Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 215 of 521.
- CVE-2024-52376 WordPress Boat Rental Plugin for WordPress plugin <= 1.0.1 - Arbitrary File Upload vulnerability
- CVE-2024-52375 WordPress Datasets Manager by Arttia Creative plugin <= 1.5 - Arbitrary File Upload vulnerability
- CVE-2024-52374 WordPress Do That Task plugin <= 1.5.5 - Arbitrary File Upload vulnerability
- CVE-2024-52373 WordPress Devexhub Gallery plugin <= 2.0.1 - Arbitrary File Upload vulnerability
- CVE-2024-52372 WordPress Easy CSV Importer plugin <= 7.0.0 - Arbitrary File Upload vulnerability
- CVE-2024-52371 WordPress Global Gateway e4 plugin <= 2.0 - Arbitrary File Deletion vulnerability
- CVE-2024-52370 File upload in Hive Support
- CVE-2024-5237 Campcodes Complete Web-Based School Management System timetable_grade_wise.php sql injection
- CVE-2024-52369 WordPress KBucket plugin <= 4.2.2 - Arbitrary File Upload vulnerability
- CVE-2024-52367 IBM Concert Software information disclosure
- CVE-2024-52366 IBM Concert Software information disclosure
- CVE-2024-52365 IBM Cloud Pak for Business Automation cross-site scripting
- CVE-2024-52364 IBM Cloud Pak for Business Automation cross-site scripting
- CVE-2024-52363 IBM InfoSphere Information Server directory traversal
- CVE-2024-52362 IBM App Connect Enterprise Certified Container denial of service
- CVE-2024-52361 IBM Storage Defender - Resiliency Service information disclosure
- CVE-2024-52360 IBM Concert Software SQL injection
- CVE-2024-5236 Campcodes Complete Web-Based School Management System teacher_salary_invoice1.php sql injection
- CVE-2024-52359 IBM Concert Software improper access controls
- CVE-2024-52358 WordPress Responsive Addons for Elementor plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52357 WordPress LIQUID BLOCKS plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52356 WordPress The Pack Elementor addons plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52355 WordPress OSM – OpenStreetMap plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52354 WordPress Web Stories Widgets For Elementor plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52353 WordPress Christian Science Bible Lesson Subjects plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52352 WordPress Postcasa Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52351 WordPress BU Slideshow plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52350 WordPress CRM 2go plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-5235 Campcodes Complete Web-Based School Management System teacher_salary_invoice.php sql injection
- CVE-2024-52349 WordPress Awesome Tool Tip plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52348 WordPress AA Audio Player plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52347 Cross-site scripting in Website remote Install vor Gravity, WPForms, Formidable, Ninja, Caldera
- CVE-2024-52346 WordPress SimpleGMaps plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52345 WordPress ra_qrcode plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52344 WordPress Provide Forex Signals plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52343 WordPress OS Pricing Tables plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52342 WordPress OS BXSlider plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52341 WordPress OS Our Team plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52340 WordPress Photographer Connections plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-5234 Campcodes Complete Web-Based School Management System teacher_salary_history1.php sql injection
- CVE-2024-52339 WordPress Mage Front End Forms plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-52338 Apache Arrow R package: Arbitrary code execution when loading a malicious data file
- CVE-2024-52337 Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method
- CVE-2024-52336 Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root
- CVE-2024-52335 SQL injection in syngo.plaza VB30E
- CVE-2024-52334 Weak cryptography in syngo.plaza VB30E
- CVE-2024-52333 Memory corruption in DCMTK
- CVE-2024-52332 igb: Fix potential invalid memory access in igb_init_module()
- CVE-2024-52331 ECOVACS lawnmowers and vacuums deterministic firmware encryption key
- CVE-2024-52330 ECOVACS lawnmowers and vacuums do not properly validate TLS certificates
- CVE-2024-5233 Campcodes Complete Web-Based School Management System teacher_salary_details3.php sql injection
- CVE-2024-52329 ECOVACS HOME mobile app plugins do not properly validate TLS certificates
- CVE-2024-52328 ECOVACS lawnmowers and vacuums insecurely store audio warning files
- CVE-2024-52327 ECOVACS lawnmower and vacuum cloud service live video PIN bypass
- CVE-2024-52325 ECOVACS robot lawnmowers and vacuums command injection
- CVE-2024-52324 Ruijie Reyee OS Use of Inherently Dangerous Function
- CVE-2024-52323 Sensitive Data Exposure
- CVE-2024-52322 WebService::Xero 0.11 for Perl uses insecure rand() function for cryptographic functions
- CVE-2024-52321 Auth bypass in PocketWifi 809SH
- CVE-2024-52320 Planet Technology Planet WGS-804HPT Command Injection
- CVE-2024-5232 Campcodes Complete Web-Based School Management System teacher_salary_details2.php sql injection
- CVE-2024-52319 mm: use aligned address in clear_gigantic_page()
- CVE-2024-52318 Apache Tomcat: Incorrect JSP tag recycling leads to XSS
- CVE-2024-52317 Apache Tomcat: Request/response mix-up with HTTP/2
- CVE-2024-52316 Apache Tomcat: Authentication bypass when using Jakarta Authentication API
- CVE-2024-52314 data.all admin user may access potentially sensitive data stored by producers via logs
- CVE-2024-52313 data.all authenticated users can obtain incorrect object level authorizations
- CVE-2024-52312 data.all authenticated users can perform restricted operations against DataSets and Environments
- CVE-2024-52311 data.all does not invalidate authentication token upon user logout
- CVE-2024-5231 Campcodes Complete Web-Based School Management System teacher_salary_details.php sql injection
- CVE-2024-52309 SFTPGo allows administrators to restrict command execution from the EventManager
- CVE-2024-52308 Connecting to a malicious Codespaces via GH CLI could allow command execution on the user's computer
- CVE-2024-52307 authentik allows a timing attack due to missing constant time comparison for metrics view
- CVE-2024-52306 FileManager Deserialization of Untrusted Data
- CVE-2024-52305 UnoPim Stored XSS : Cookie hijacking through Create User function
- CVE-2024-52304 aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensions
- CVE-2024-52303 aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed method
- CVE-2024-52302 common-user-management Unrestricted File Upload Leading to Remote Code Execution (RCE)
- CVE-2024-52301 Laravel allows environment manipulation via query string
- CVE-2024-52300 macro-pdfviewer has a XSS through the width parameter
- CVE-2024-5230 EnvaySoft FleetCart information disclosure
- CVE-2024-52299 The PDF viewer macro allows accessing any attachment without access right checks
- CVE-2024-52298 macro-pdfviewer's preview in WYSIWYG editor allows accessing any PDF document as the last author
- CVE-2024-52297 Tolgee's configuration all configuration properties leaked in public configuration DTO
- CVE-2024-52296 libosdp has a null pointer deref in osdp_reply_name
- CVE-2024-52295 DataEase has a forged JWT token vulnerability
- CVE-2024-52294 khoj has an IDOR in subscription management that allows unauthorized subscription modifications
- CVE-2024-52293 Craft has a Potential Remote Code Execution via missing path normalization & Twig SSTI
- CVE-2024-52292 Craft Allows Attackers to Read Arbitrary System Files
- CVE-2024-52291 Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
- CVE-2024-52290 Stored XSS in Configuration Key Functionality
- CVE-2024-5229 Cross-site scripting in Primary Addon for Elementor
- CVE-2024-52289 authentik has an insecure default configuration for OAuth2 Redirect URIs
- CVE-2024-52288 RMAC revert to the beginning of the session in libosdp
- CVE-2024-52287 authentik performs insufficient validation of OAuth scopes
- CVE-2024-52286 Self Cross Site Scripting (XSS) In Merge Functionality in Stirling-PDF
- CVE-2024-52285 Missing authorization in SiPass integrated AC5102 (ACC-G2)
- CVE-2024-52284 Rancher Fleet Helm Values are stored inside BundleDeployment in plain text
- CVE-2024-52283 Cross-site scripting in hackweek
- CVE-2024-52282 Rancher Helm Applications may have sensitive values leaked