Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 194 of 521.
- CVE-2024-55500 Avenwu Whistle Cross-Site Request Forgery (CSRF)
- CVE-2024-5550 Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3
- CVE-2024-55496 SQL injection in 1000projects:bookstore management system
- CVE-2024-55494 A PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attack
- CVE-2024-55492 Cross-site scripting in magicwinmail:winmail server
- CVE-2024-5549 Data leak through CORS misconfiguration in stitionai/devika
- CVE-2024-55488 Cross-site scripting in umbraco:umbraco cms
- CVE-2024-5548 Directory Traversal in stitionai/devika
- CVE-2024-55471 Oqtane Framework Insecure Direct Object Reference vulnerability
- CVE-2024-55470 Oqtane Framework Incorrect Access Control vulnerability
- CVE-2024-5547 Directory Traversal in stitionai/devika
- CVE-2024-55466 File upload in thingsboard:thingsboard
- CVE-2024-55461 Command injection in seacms:seacms
- CVE-2024-55460 A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allow
- CVE-2024-5546 SQL Injection
- CVE-2024-55459 keras Path Traversal vulnerability
- CVE-2024-55457 MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService.
- CVE-2024-55456 Memory corruption in sammycage:lunasvg
- CVE-2024-55452 Open redirect in ujcms:ujcms
- CVE-2024-55451 Cross-site scripting in ujcms:ujcms
- CVE-2024-5545 Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization
- CVE-2024-5544 Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting
- CVE-2024-5543 Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection
- CVE-2024-5542 Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
- CVE-2024-55417 DevDojo Voyager Arbitrary File Write
- CVE-2024-55416 DevDojo Voyager vulnerable to reflected Cross-site Scripting
- CVE-2024-55415 DevDojo Voyager vulnerable to path traversal
- CVE-2024-55414 A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping phys
- CVE-2024-55413 A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write ar
- CVE-2024-55412 A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbi
- CVE-2024-55411 An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via su
- CVE-2024-5541 Ibtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update
- CVE-2024-55408 Missing authorization in ASCI
- CVE-2024-55407 An issue in the DeviceloControl function of ITE Tech.
- CVE-2024-55402 Missing authorization in 4cstrategies:exonaut
- CVE-2024-55401 Path traversal in 4cstrategies:exonaut
- CVE-2024-5540 ALC WebCTRL Carrier i-Vu Reflected Cross-Site Scripting
- CVE-2024-55399 Server-side request forgery in 4cstrategies:exonaut
- CVE-2024-55398 Misconfiguration in 4cstrategies:exonaut
- CVE-2024-5539 ALC WebCTRL Carrier i-Vu Access Control Bypass
- CVE-2024-55374 Information disclosure in vanderbilt:redcap
- CVE-2024-55372 File upload in wallosapp:wallos
- CVE-2024-55371 File upload in wallosapp:wallos
- CVE-2024-5536 GamiPress – Link <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-55354 Security feature bypass in Lucee Server
- CVE-2024-5535 SSL_select_next_proto buffer overread
- CVE-2024-55342 Piranha CMS Cross-site Scripting vulnerability
- CVE-2024-55341 Piranha CMS Cross-site Scripting vulnerability
- CVE-2024-5533 Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-5532 A stored XSS vulnerability has been discovered on OpenText™ Operations Agent (OA).
- CVE-2024-5531 Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget
- CVE-2024-5530 Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
- CVE-2024-5529 WP QuickLaTeX < 3.8.8 - Admin+ Stored XSS
- CVE-2024-5528 Incomplete Comparison with Missing Factors in GitLab
- CVE-2024-55279 Cross-site scripting in uguu:uguu
- CVE-2024-55272 An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function.
- CVE-2024-55271 Cross-site request forgery in phpgurukul:gym management system
- CVE-2024-55270 SQL injection in phpgurukul:student management system
- CVE-2024-5527 SQL Injection
- CVE-2024-55268 Cross-site scripting in phpgurukul:covid 19 testing management system
- CVE-2024-5526 Server-side request forgery in OnCall
- CVE-2024-5525 Improper privilege management vulnerability in Astrotalks
- CVE-2024-55241 An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component.
- CVE-2024-5524 Information exposure vulnerability in Astrotalks
- CVE-2024-55239 Cross-site scripting in portabilis:i-educar
- CVE-2024-55238 OpenMetadata SQL Injection
- CVE-2024-55232 Missing authorization in phpgurukul:online notes sharing management system
- CVE-2024-55231 Missing authorization in phpgurukul:online notes sharing management system
- CVE-2024-5523 SQL injection vulnerability in Astrotalks
- CVE-2024-55228 Dolibarr Cross-site Scripting vulnerability
- CVE-2024-55227 Dolibarr Cross-site Scripting vulnerability
- CVE-2024-55226 Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability
- CVE-2024-55225 Vaultwarden vulnerable to user impersonation
- CVE-2024-55224 Vaultwarden HTML injection vulnerability
- CVE-2024-5522 HTML5 Video Player < 2.5.27 - Unauthenticated SQLi
- CVE-2024-55218 Cross-site scripting in icewarp:icewarp
- CVE-2024-55215 Privilege escalation in jrohy:trojan
- CVE-2024-55214 Path traversal in dhtmlx:file explorer
- CVE-2024-55213 Path traversal in dhtmlx:file explorer
- CVE-2024-55212 DNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo_xBlog/Resource_Service.aspx.
- CVE-2024-55211 Auth bypass in think:tk-rt-wr135g firmware
- CVE-2024-55210 Auth bypass in totvs:framework \(linha protheus\)
- CVE-2024-5521 Cross-Site Scripting stored in Alkacon OpenCMS
- CVE-2024-5520 Cross-Site Scripting stored in Alkacon OpenCMS
- CVE-2024-55199 Cross-site scripting in celk:celk saude
- CVE-2024-55198 Information disclosure in celk:celk saude
- CVE-2024-55196 GoPhish sends cleartext passwords
- CVE-2024-55195 An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the progra
- CVE-2024-55194 Memory corruption in openimageio:openimageio
- CVE-2024-55193 Null dereference in openimageio:openimageio
- CVE-2024-55192 Memory corruption in openimageio:openimageio
- CVE-2024-5519 ItsourceCode Learning Management System Project In PHP login.php sql injection
- CVE-2024-55186 Oqtane Framework Insecure Direct Object Reference vulnerability
- CVE-2024-5518 itsourcecode Online Discussion Forum change_profile_picture.php unrestricted upload
- CVE-2024-5517 itsourcecode Online Blood Bank Management System changepwd.php sql injection
- CVE-2024-55160 SQL injection in g-fast:gfast
- CVE-2024-5516 itsourcecode Online Blood Bank Management System massage.php sql injection
- CVE-2024-55159 GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list.
- CVE-2024-55156 An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sen
- CVE-2024-5515 SourceCodester Stock Management System createBrand.php sql injection