Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 206 of 521.
- CVE-2024-5355 anji-plus AJ-Report IGroovyHandler command injection
- CVE-2024-53544 NovaCHRON Zeitsysteme GmbH & Co.
- CVE-2024-53543 NovaCHRON Zeitsysteme GmbH & Co.
- CVE-2024-53542 Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co.
- CVE-2024-5354 anji-plus AJ-Report detailByCode information disclosure
- CVE-2024-53537 Path traversal in openpanel:openpanel
- CVE-2024-5353 anji-plus AJ-Report ZIP File decompress path traversal
- CVE-2024-53526 Composio Command Execution vulnerability
- CVE-2024-53523 JSFinder commit d70ab9bc5221e016c08cffaf0d9ac79646c90645 is vulnerable to Directory Traversal in the find_by_file function.
- CVE-2024-53522 Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components.
- CVE-2024-5352 anji-plus AJ-Report validationRules deserialization
- CVE-2024-5351 anji-plus AJ-Report Javascript getValueFromJs deserialization
- CVE-2024-53507 SQL injection in b3log:siyuan
- CVE-2024-53506 SQL injection in b3log:siyuan
- CVE-2024-53505 SQL injection in b3log:siyuan
- CVE-2024-53504 SQL injection in b3log:siyuan
- CVE-2024-53502 SQL injection in sem-cms:semcms
- CVE-2024-5350 anji-plus AJ-Report pageList sql injection
- CVE-2024-53499 SQL injection in jeewms:jeewms
- CVE-2024-53496 Auth bypass in winterchens:my-site
- CVE-2024-53495 Auth bypass in winterchens:my-site
- CVE-2024-53494 Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication.
- CVE-2024-53490 Favorites-web 1.3.0 favorites-web has a directory traversal vulnerability in SecurityFilter.java.
- CVE-2024-5349 LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-53484 Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key.
- CVE-2024-53481 Cross-site scripting in phpgurukul:beauty parlour management system
- CVE-2024-53480 SQL injection in phpgurukul:beauty parlour management system
- CVE-2024-5348 Elements For Elementor <= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes
- CVE-2024-53477 Deserialization in jflyfox:jfinal cms
- CVE-2024-53476 A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory rest
- CVE-2024-53473 Missing authorization in wegia:wegia
- CVE-2024-53472 Cross-site request forgery in wegia:wegia
- CVE-2024-53471 Cross-site scripting in wegia:wegia
- CVE-2024-53470 Cross-site scripting in wegia:wegia
- CVE-2024-5347 Cross-site scripting in Happy Addons for Elementor
- CVE-2024-5346 Cross-site scripting in Flatsome
- CVE-2024-53459 Cross-site scripting in sysax:multi server
- CVE-2024-53458 Denial of service in sysax:multi server
- CVE-2024-53457 LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section
- CVE-2024-53450 Missing authorization in infiniflow:ragflow
- CVE-2024-5345 Responsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusion
- CVE-2024-53442 whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component.
- CVE-2024-53441 Bit flip attack vulnerability in cookie-encrypter
- CVE-2024-5344 The Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget
- CVE-2024-53438 SQL injection in churchcrm:churchcrm
- CVE-2024-53432 While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out_of_range exception in PCLPointCloud2::at.
- CVE-2024-5343 Cross-site request forgery in Robo Gallery – Photo & Image Slider
- CVE-2024-53429 Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash.
- CVE-2024-53427 Memory corruption in jq
- CVE-2024-53426 A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function.
- CVE-2024-53425 Memory corruption in assimp:assimp
- CVE-2024-53423 Denial of service in opennetworking:onos
- CVE-2024-5342 Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-53412 NietThijmen ShoppingCart: Command injection in the connect function
- CVE-2024-5341 Cross-site scripting in The Plus Addons for Elementor Page Builder Pro
- CVE-2024-53408 AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability.
- CVE-2024-53407 Code injection in phiewer:phiewer
- CVE-2024-53406 Auth bypass in espressif:esp-idf
- CVE-2024-5340 Ruijie RG-UAC sub_commit.php os command injection
- CVE-2024-5339 Ruijie RG-UAC online_check.php os command injection
- CVE-2024-53388 mavo DOM Clobbering vulnerability
- CVE-2024-53387 Cross-site scripting in umeditor project:umeditor
- CVE-2024-53386 Stage.js DOM Clobbering vulnerabilty
- CVE-2024-53384 tsup DOM Clobbering vulnerability
- CVE-2024-53382 PrismJS DOM Clobbering vulnerability
- CVE-2024-5338 Ruijie RG-UAC online.php os command injection
- CVE-2024-53379 Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12
- CVE-2024-53376 Command injection in cyberpanel:cyberpanel
- CVE-2024-53375 An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series.
- CVE-2024-5337 Ruijie RG-UAC user_commit.php os command injection
- CVE-2024-53365 Cross-site scripting in phpgurukul:vehicle parking management system
- CVE-2024-53364 SQL injection in phpgurukul:vehicle parking management system
- CVE-2024-5336 Ruijie RG-UAC vlan_add_commit.php addVlan os command injection
- CVE-2024-53359 Information disclosure in zalo:zalo
- CVE-2024-53357 SQL injection in easyvirt:co2scope
- CVE-2024-53356 Hardcoded credentials in easyvirt:co2scope
- CVE-2024-53355 Missing authorization in easyvirt:co2scope
- CVE-2024-53354 SQL injection in easyvirt:co2scope
- CVE-2024-53351 PipeCD Vulnerable to Privilege Escalation
- CVE-2024-53350 Privilege escalation in kubeslice:kubeslice
- CVE-2024-5335 Deserialization in Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor
- CVE-2024-53349 Misconfiguration in linuxfoundation:kuadrant
- CVE-2024-53348 Missing authorization in loxilb:loxilb
- CVE-2024-53345 An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code
- CVE-2024-5334 Local File Read in stitionai/devika
- CVE-2024-53335 Memory corruption in totolink:a810r firmware
- CVE-2024-53334 Memory corruption in totolink:a810r firmware
- CVE-2024-53333 Command injection in totolink:ex200 firmware
- CVE-2024-5333 The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure
- CVE-2024-53326 LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code execution.
- CVE-2024-53320 Qualisys C++ SDK commit a32a21a was discovered to contain multiple stack buffer overflows via the GetCurrentFrame, SaveCapture, and LoadProject functions.
- CVE-2024-5332 Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget
- CVE-2024-53319 A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause Denial of Service (Do
- CVE-2024-53311 A Stack buffer overflow in the arguments parameter in Immunity Inc.
- CVE-2024-53310 A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 whe
- CVE-2024-5331 Breakdance <= 1.7.2 - Missing Authorization
- CVE-2024-53309 A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string
- CVE-2024-53307 Cross-site scripting in evisions:maps
- CVE-2024-53305 Whoogle allows attackers to execute arbitrary code via supplying a crafted search query
- CVE-2024-53304 An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary co