Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 212 of 521.
- CVE-2024-52791 Denial of service through memory exhaustion in Matrix Media Repo
- CVE-2024-5279 Qiwen Netdisk File Rename cross site scripting
- CVE-2024-52789 Hardcoded credentials in tenda:w30e firmware
- CVE-2024-52788 Hardcoded credentials in tenda:w9 firmware
- CVE-2024-52787 libre-chat Path Traversal vulnerability
- CVE-2024-52786 An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL.
- CVE-2024-52783 Insecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code via
- CVE-2024-52782 Code injection in dcnetworks:dcme-320-l firmware
- CVE-2024-52781 Code injection in dcnetworks:dcme-320-l firmware
- CVE-2024-52780 Code injection in dcnetworks:dcme-320-l firmware
- CVE-2024-5278 Unrestricted File Upload leading to RCE in gaizhenbiao/chuanhuchatgpt
- CVE-2024-52779 Code injection in dcnetworks:dcme-320-l firmware
- CVE-2024-52778 Code injection in dcnetworks:dcme-320-l firmware
- CVE-2024-52777 Code injection in dcnetworks:dcme-320-l firmware
- CVE-2024-52771 Path traversal in dedebiz:dedebiz
- CVE-2024-52770 File upload in dedebiz:dedebiz
- CVE-2024-5277 Weak Password Recovery Mechanism in lunary-ai/lunary
- CVE-2024-52769 File upload in dedebiz:dedebiz
- CVE-2024-52765 Code injection in h3c:gr-1800ax firmware
- CVE-2024-52763 Cross-site scripting in ganglia:ganglia-web
- CVE-2024-52762 Cross-site scripting in ganglia:ganglia-web
- CVE-2024-5276 SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)
- CVE-2024-52759 Memory corruption in dlink:di-8003 firmware
- CVE-2024-52757 Memory corruption in dlink:di-8003 firmware
- CVE-2024-52755 Memory corruption in dlink:di-8003 firmware
- CVE-2024-52754 Memory corruption in dlink:di-8003 firmware
- CVE-2024-5275 Hardcoded credentials in FileCatalyst Direct
- CVE-2024-5274 Google Chromium V8 Type Confusion
- CVE-2024-52739 Command injection in dlink:di-8400 firmware
- CVE-2024-52732 Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused.
- CVE-2024-5273 Jenkins Report Info Plugin Path Traversal vulnerability
- CVE-2024-52726 Path traversal in crmeb:crmeb
- CVE-2024-52725 SQL injection in sem-cms:semcms
- CVE-2024-52724 SQL injection in zzcms:zzcms
- CVE-2024-52723 Command injection in totolink:x6000r firmware
- CVE-2024-5272 Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated"
- CVE-2024-52714 Memory corruption in tenda:ac6 firmware
- CVE-2024-52711 Memory corruption in dlink:di-8100 firmware
- CVE-2024-5271 Fuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion')
- CVE-2024-52702 Cross-site scripting in mybb:mybb
- CVE-2024-52701 Cross-site scripting in piwigo:piwigo
- CVE-2024-5270 SAML to email switch possible when email signin is disabled
- CVE-2024-5269 Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Execution Vulnerability
- CVE-2024-52680 Cross-site scripting in eyoucms:eyoucms
- CVE-2024-5268 Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability
- CVE-2024-52677 File upload in hkcms:hkcms
- CVE-2024-52676 Cross-site scripting in emiloimagtolis:online discussion forum
- CVE-2024-52675 SQL injection in oretnom23:sentiment based movie rating system
- CVE-2024-5267 Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-5266 Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes
- CVE-2024-5265 Cross-site scripting in WPBakery Page Builder
- CVE-2024-5264 Network Key Transfer with AES KHT vulnerability in Luna EFT
- CVE-2024-5263 Cross-site scripting in ElementsKit Pro
- CVE-2024-5262 ProjectDiscovery Interactsh - Files or Directories Accessible to External Parties
- CVE-2024-52616 Avahi: avahi wide-area dns predictable transaction ids
- CVE-2024-52615 Avahi: avahi wide-area dns uses constant source port
- CVE-2024-52614 Hardcoded credentials in Kura Sushi Official App Produced by EPARK
- CVE-2024-52613 Memory corruption in justdan96:tsmuxer
- CVE-2024-52612 SolarWinds Platform Reflected Cross-Site Scripting Vulnerability
- CVE-2024-52611 SolarWinds Platform Information Disclosure Vulnerability
- CVE-2024-5261 TLS certificate are not properly verified when utilizing LibreOfficeKit
- CVE-2024-52606 SolarWinds Platform Server-Side Request Forgery Vulnerability
- CVE-2024-52602 Server-Side Request Forgery (SSRF) on redirects and federation in Matrix Media Repo
- CVE-2024-52601 iTop portal Insecure Direct Object Reference vulnerability
- CVE-2024-52600 Statamic CMS has Path Traversal in Asset Upload
- CVE-2024-5260 Cross-site scripting in Sina Extension for Elementor
- CVE-2024-52599 Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin
- CVE-2024-52598 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview
- CVE-2024-52597 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render
- CVE-2024-52596 SimpleSAMLphp xml-common XXE vulnerability
- CVE-2024-52595 HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through
- CVE-2024-52594 Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib
- CVE-2024-52593 Missing validation allows spoofed "origin" links in Misskey
- CVE-2024-52592 Missing validation allows spoofed poll updates in Misskey
- CVE-2024-52591 Missing validation allows spoofed profiles and notes in Misskey
- CVE-2024-52590 Missing validation allows spoofed profiles in Misskey
- CVE-2024-5259 Cross-site scripting in MultiVendorX – WooCommerce Multivendor Marketplace Solutions
- CVE-2024-52589 Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse
- CVE-2024-52588 Strapi allows Server-Side Request Forgery in Webhook function
- CVE-2024-52587 Harden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts`
- CVE-2024-52586 eLabFTW MFA bypass
- CVE-2024-52585 Autolab has HTML Injection Vulnerability
- CVE-2024-52584 Autolab has vulnerable submission endpoints
- CVE-2024-52583 WesHacks code includes links to Leostop tracking spyware infested files
- CVE-2024-52582 cachi2 allows traceback prints locals
- CVE-2024-52581 Litestar allows unbounded resource consumption (DoS vulnerability)
- CVE-2024-5258 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2024-52579 Server-Side Request Forgery vulnerability in various APIs in Misskey
- CVE-2024-52577 Apache Ignite: Possible RCE when deserializing incoming messages by the server node
- CVE-2024-52574 Memory corruption in Teamcenter Visualization V14.2
- CVE-2024-52573 Memory corruption in Teamcenter Visualization V14.2
- CVE-2024-52572 Memory corruption in Teamcenter Visualization V14.2
- CVE-2024-52571 Memory corruption in Teamcenter Visualization V14.2
- CVE-2024-52570 Memory corruption in Teamcenter Visualization V14.2
- CVE-2024-5257 Improper Access Control in GitLab
- CVE-2024-52569 Memory corruption in Teamcenter Visualization V14.2
- CVE-2024-52568 Use after free in Teamcenter Visualization V14.2
- CVE-2024-52567 Memory corruption in Teamcenter Visualization V14.2
- CVE-2024-52566 Memory corruption in Teamcenter Visualization V14.2
- CVE-2024-52565 Memory corruption in Teamcenter Visualization V14.2