Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 193 of 521.
- CVE-2024-55657 SiYuan has an arbitrary file read via /api/template/render
- CVE-2024-55656 RedisBloom Integer Overflow Remote Code Execution Vulnerability
- CVE-2024-55655 sigstore-python has insufficient validation of integration timestamp during verification
- CVE-2024-55653 pwndoc's UnhandledPromiseRejection on audits causes Denial of Service (DoS)
- CVE-2024-55652 PwnDoc Server-Side Template Injection vulnerability - Sandbox Escape to RCE using custom filters
- CVE-2024-55651 i-Educar Stored Cross-Site Scripting vulnerability
- CVE-2024-5565 Prompt Injection in "ask" API with visualization leads to RCE
- CVE-2024-55642 block: Prevent potential deadlocks in zone write plug error recovery
- CVE-2024-55641 xfs: unlock inodes when erroring out of xfs_trans_alloc_dir
- CVE-2024-5564 Libndp: buffer overflow in route information length field
- CVE-2024-55639 net: renesas: rswitch: avoid use-after-put for a device tree node
- CVE-2024-55638 Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-008
- CVE-2024-55637 Drupal core - Moderately critical - Gadget chain - SA-CORE-2024-007
- CVE-2024-55636 Drupal core - Less critical - Gadget chain - SA-CORE-2024-006
- CVE-2024-55635 Drupal core - Critical - Cross Site Scripting - SA-CORE-2024-005
- CVE-2024-55634 Drupal core - Moderately critical - Access bypass - SA-CORE-2024-004
- CVE-2024-55633 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
- CVE-2024-55632 Privilege escalation in Trend Micro Apex One
- CVE-2024-55631 Privilege escalation in Trend Micro Apex One
- CVE-2024-55630 DOM Clobbering leads to temporary DOS in the note viewer in Joplin
- CVE-2024-5563 Incomplete reCaptcha Implementation in Authentication Flows in WSO2 Identity Server Allows Brute Force Attacks
- CVE-2024-55629 Suricata generic detection bypass using TCP urgent support
- CVE-2024-55628 Suricata oversized resource names utilizing DNS name compression can lead to resource starvation
- CVE-2024-55627 Suricata segfault on StreamingBufferSlideToOffsetWithRegions
- CVE-2024-55626 Suricata oversized bpf file can lead to buffer overflow
- CVE-2024-5561 Popup Maker < 1.19.1 - Admin+ Stored XSS
- CVE-2024-55605 Suricata allows stack overflow in transforms
- CVE-2024-55604 Appsmith's Broken Access Control Allows Viewer Role User to Query Datasources
- CVE-2024-55603 Insufficient session invalidation in Kanboard
- CVE-2024-55602 PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal
- CVE-2024-55601 Hugo does not escape some attributes in internal templates
- CVE-2024-5560 Memory corruption in Sage 1410
- CVE-2024-55599 Security feature bypass in FortiOS
- CVE-2024-55597 Path traversal in FortiWeb
- CVE-2024-55594 Code injection in FortiWeb
- CVE-2024-55593 SQL injection in FortiWeb
- CVE-2024-55592 Missing authorization in FortiSIEM
- CVE-2024-55591 Fortinet FortiOS and FortiProxy Authentication Bypass
- CVE-2024-55590 Command injection in FortiIsolator
- CVE-2024-5559 Weak cryptography in PowerLogic P5
- CVE-2024-55587 python-libarchive directory traversal
- CVE-2024-55586 Nette Database through 3.2.4 allows SQL injection in certain situations involving an untrusted filter that is directly passed to the where method.
- CVE-2024-55585 Missing authorization in moPS
- CVE-2024-55582 Oxide before 6 has unencrypted Control Plane datastores.
- CVE-2024-55581 Security feature bypass in adacore:ada web server
- CVE-2024-55580 An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR.
- CVE-2024-5558 Race condition in SpaceLogic AS-B
- CVE-2024-55579 An issue was discovered in Qlik Sense Enterprise for Windows before November 2024 IR.
- CVE-2024-55578 Information disclosure in zammad:zammad
- CVE-2024-55577 Memory corruption in Linux Ratfor
- CVE-2024-55573 SQL injection in centreon:centreon web
- CVE-2024-55570 /api/user/users in the web GUI for the Cubro EXA48200 network packet broker (build 20231025055018) fixed in V5.0R14.5P4-V3.3R1 allows remote
- CVE-2024-5557 Information disclosure in SpaceLogic AS-B
- CVE-2024-55569 Memory corruption in samsung:exynos 1080 firmware
- CVE-2024-55568 Null dereference in samsung:exynos 1080 firmware
- CVE-2024-55567 Memory corruption in insyde:insydeh2o
- CVE-2024-55566 ColPack 1.0.10 through 9a7293a has a predictable temporary file (located under /tmp with a name derived from an unseeded RNG).
- CVE-2024-55565 Predictable results in nanoid generation when given non-integer values
- CVE-2024-55564 The POSIX::2008 package before 0.24 for Perl has a potential _execve50c env buffer overflow.
- CVE-2024-55563 Denial of service in bitcoin:bitcoin core
- CVE-2024-55560 MailCleaner before 28d913e has default values of ssh_host_dsa_key, ssh_host_rsa_key, and ssh_host_ed25519_key that persist after installation.
- CVE-2024-5556 SQL Injection
- CVE-2024-55557 ui/pref/ProxyPrefView.java in weasis-core in Weasis 4.5.1 has a hardcoded key for symmetric encryption of proxy credentials.
- CVE-2024-55556 A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on th
- CVE-2024-55555 Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APP_KEY.
- CVE-2024-55554 Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet.
- CVE-2024-55553 In FRRouting (FRR) before 10.3 from 6.0 onward, all routes are re-validated if the total size of an update received via RTR exceeds the inte
- CVE-2024-55551 Code injection in JDBC driver
- CVE-2024-55550 Mitel MiCollab Path Traversal
- CVE-2024-5555 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-55549 Use after free in libxslt
- CVE-2024-55548 Denial of Service
- CVE-2024-55547 Remote Command Execution via SNMP
- CVE-2024-55546 Stored Cross-Site Scripting
- CVE-2024-55545 Reflected Cross-Site Scripting
- CVE-2024-55544 Authenticated Command Injection
- CVE-2024-55543 Privilege escalation in Acronis Cyber Protect 16
- CVE-2024-55542 Privilege escalation in Acronis Cyber Protect 16
- CVE-2024-55541 Cross-site scripting in Acronis Cyber Protect 16
- CVE-2024-55540 Privilege escalation in Acronis Cyber Protect 16
- CVE-2024-5554 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-55539 Weak cryptography in Acronis Cyber Protect 16
- CVE-2024-55538 Missing authorization in Acronis True Image
- CVE-2024-55532 Apache Ranger: Improper Neutralization of Formula Elements in a CSV File
- CVE-2024-5553 Premium Addons for Elementor <= 4.10.33 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- CVE-2024-55529 Code injection in zblogcn:z-blogphp
- CVE-2024-5552 ReDoS in kubeflow/kubeflow
- CVE-2024-55517 An issue was discovered in the Interllect Core Search in Polaris FT Intellect Core Banking 9.5.
- CVE-2024-55516 File upload in raisecom:msg1200 firmware
- CVE-2024-55515 File upload in raisecom:msg1200 firmware
- CVE-2024-55514 File upload in raisecom:msg1200 firmware
- CVE-2024-55513 File upload in raisecom:msg1200 firmware
- CVE-2024-55511 A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially
- CVE-2024-5551 WP STAGING PRO - Backup Duplicator & Migration <= 5.6.0 - Cross-Site Request Forgery to Limited Local File Inclusion
- CVE-2024-55509 SQL injection in codeastro:complaint management system
- CVE-2024-55507 Privilege escalation in codeastro:complaint management system
- CVE-2024-55506 Missing authorization in codeastro:complaint management system
- CVE-2024-55505 Code injection in codeastro:complaint management system
- CVE-2024-55504 An issue in RAR Extractor - Unarchiver Free and Pro v.6.4.0 allows local attackers to inject arbitrary code potentially leading to remote co
- CVE-2024-55503 Code injection in termius:termius