Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 196 of 521.
- CVE-2024-54922 SQL injection in lopalopa:e-learning management system
- CVE-2024-54921 SQL injection in lopalopa:e-learning management system
- CVE-2024-54920 SQL injection in lopalopa:e-learning management system
- CVE-2024-5492 Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites
- CVE-2024-54919 Cross-site scripting in lopalopa:e-learning management system
- CVE-2024-54918 File upload in lopalopa:e-learning management system
- CVE-2024-54916 An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and esca
- CVE-2024-54910 Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function.
- CVE-2024-5491 Denial of Service
- CVE-2024-54909 A vulnerability has been identified in GoldPanKit eva-server v4.1.0.
- CVE-2024-54907 Code injection in totolink:a3002r firmware
- CVE-2024-5490 SQL Injection
- CVE-2024-5489 Wbcom Designs - Custom Font Uploader <= 2.3.4 - Missing Authorization to Font Deletion
- CVE-2024-54887 Memory corruption in tp-link:tl-wr940n firmware
- CVE-2024-54880 Business logic in seacms:seacms
- CVE-2024-5488 SEOPress < 7.9 - Unauthenticated Object Injection
- CVE-2024-54879 Business logic in seacms:seacms
- CVE-2024-5487 SQL Injection
- CVE-2024-5486 Authenticated Sensitive Information Disclosure in ClearPass Policy Manager
- CVE-2024-54855 Hardcoded credentials in fabricators:vanilla os core image
- CVE-2024-54853 A Stored Cross-Site Scripting (XSS) vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows r
- CVE-2024-54852 Other in sismics:teedy
- CVE-2024-54851 Cross-site request forgery in sismics:teedy
- CVE-2024-5485 Cross-site scripting in OttoKit: All-in-One Automation Platform
- CVE-2024-54849 Weak cryptography in cpplusworld:cp-vnr-3104 firmware
- CVE-2024-54848 Weak cryptography in cpplusworld:cp-vnr-3104 firmware
- CVE-2024-54847 Weak cryptography in cpplusworld:cp-vnr-3104 firmware
- CVE-2024-54846 Weak cryptography in cpplusworld:cp-vnr-3104 firmware
- CVE-2024-54842 SQL injection in phpgurukul:online nurse hiring system
- CVE-2024-54840 Other in Privileged Access Manager
- CVE-2024-5483 LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API
- CVE-2024-54820 XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page.
- CVE-2024-5482 SSRF in add_webpage endpoint in parisneo/lollms-webui
- CVE-2024-54819 I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/sec
- CVE-2024-54818 Missing authorization in oretnom23:computer laboratory management system
- CVE-2024-54811 SQL injection in phpgurukul:park ticketing management system
- CVE-2024-54810 SQL injection in phpgurukul:pre-school enrollment system
- CVE-2024-5481 Path traversal in Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2024-54809 Memory corruption in netgear:wnr854t firmware
- CVE-2024-54808 Memory corruption in netgear:wnr854t firmware
- CVE-2024-54807 Command injection in netgear:wnr854t firmware
- CVE-2024-54806 Command injection in netgear:wnr854t firmware
- CVE-2024-54805 Command injection in netgear:wnr854t firmware
- CVE-2024-54804 Command injection in netgear:wnr854t firmware
- CVE-2024-54803 Command injection in netgear:wnr854t firmware
- CVE-2024-54802 Memory corruption in netgear:wnr854t firmware
- CVE-2024-54795 Cross-site scripting in eng:spagobi
- CVE-2024-54794 Code injection in eng:spagobi
- CVE-2024-54792 Cross-site request forgery in eng:spagobi
- CVE-2024-54790 SQL injection in phpgurukul:pre-school enrollment system
- CVE-2024-5479 Easy Pixels by JEVNET <= 2.13 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-54780 Command injection in netgate:pfsense ce
- CVE-2024-5478 Cross-site Scripting (XSS) in SAML metadata endpoint in lunary-ai/lunary
- CVE-2024-54779 Cross-site scripting in netgate:pfsense ce
- CVE-2024-54775 Dcat-Admin Cross-Site Scripting (XSS) vulnerability
- CVE-2024-54774 Dcat Admin Cross-site Scripting (XSS) vulnerability
- CVE-2024-54772 Information disclosure in mikrotik:routeros
- CVE-2024-5477 Other in Certain HP PC Products
- CVE-2024-54767 An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information w
- CVE-2024-54764 An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.
- CVE-2024-54763 An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication.
- CVE-2024-54762 SQL injection in ruoyi:ruoyi
- CVE-2024-54761 SQL injection in bigantsoft:bigant office messenger 5
- CVE-2024-54756 A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code
- CVE-2024-54751 COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
- CVE-2024-54750 Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
- CVE-2024-5475 Responsive video embed < 0.5.1 - Contributor+ Stored XSS
- CVE-2024-54749 Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root.
- CVE-2024-54747 Hardcoded credentials in wavlink:wn531p3 firmware
- CVE-2024-54745 Hardcoded credentials in wavlink:wn701ae firmware
- CVE-2024-5474 Information disclosure in Dolby Vision Provisioning software
- CVE-2024-54731 Denial of service in CPDF
- CVE-2024-54730 Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function.
- CVE-2024-5473 Simple Photoswipe <= 0.1 - Admin+ Stored XSS
- CVE-2024-54728 Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs.
- CVE-2024-54724 PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusion.
- CVE-2024-5472 WP QuickLaTeX < 3.8.7 - Admin+ Stored XSS in Background Color field
- CVE-2024-5471 Agent takeover
- CVE-2024-5470 Improper Access Control in GitLab
- CVE-2024-5469 Uncontrolled Resource Consumption in GitLab
- CVE-2024-54687 Cross-site scripting in vtiger:vtiger crm
- CVE-2024-54683 netfilter: IDLETIMER: Fix for possible ABBA deadlock
- CVE-2024-54682 Zipbomb DoS via Missing Slack Import Validation
- CVE-2024-54681 Ossur Mobile Logic Application Command Injection
- CVE-2024-5468 Missing authorization in Pearl – Header Builder
- CVE-2024-54679 Missing authorization in cyberpanel:cyberpanel
- CVE-2024-54678 Deserialization in SIMATIC PCS neo V4.1
- CVE-2024-54677 Apache Tomcat: DoS in examples web application
- CVE-2024-54676 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode
- CVE-2024-54675 app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow.
- CVE-2024-54674 app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format.
- CVE-2024-5467 SQL Injection
- CVE-2024-54663 Path traversal in synacor:zimbra collaboration suite
- CVE-2024-54662 Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.
- CVE-2024-54661 Other in socat
- CVE-2024-54660 A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35.
- CVE-2024-5466 Remote Code Execution
- CVE-2024-54658 Denial of service in Safari
- CVE-2024-5465 Other in EMUI
- CVE-2024-5464 Missing authorization in EMUI