Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 222 of 521.
- CVE-2024-51506 Cross-site scripting in tiki:tiki
- CVE-2024-51505 An issue was discovered in Atos Eviden IDRA before 2.7.1.
- CVE-2024-51504 Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server
- CVE-2024-51503 Command injection in Trend Micro Deep Security
- CVE-2024-51502 Panic Vulnerability in loona-hpack
- CVE-2024-51501 CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
- CVE-2024-51500 Denial of service in firmware
- CVE-2024-5150 Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check
- CVE-2024-51499 MarkUs Arbitrary File Write leading up to remote code execution (student accounts)
- CVE-2024-51498 [@imput/cobalt-web] Cross-site Scripting when downloading picker image from malicious instance
- CVE-2024-51497 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php
- CVE-2024-51496 LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php
- CVE-2024-51495 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php
- CVE-2024-51494 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php
- CVE-2024-51493 API key access in settings without reauthentication in OctoPrint
- CVE-2024-51492 Zusam vulnerable to stored XSS, allowing token theft via crafted SVG
- CVE-2024-51491 Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go
- CVE-2024-51490 Stored Cross-Site Scripting in Ampache
- CVE-2024-5149 BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness
- CVE-2024-51489 Insufficient Message Token Validation in Ampache
- CVE-2024-51488 Insufficient Validation in Delete Message in Ampache
- CVE-2024-51487 Insufficient Validation in Catalog (Activation/Deactivation) in Ampache
- CVE-2024-51486 Stored Cross-Site Scripting in Ampache
- CVE-2024-51485 Insufficient Validation in Plugins (Activation/Deactivation) in Ampache
- CVE-2024-51484 Insufficient Validation in Controllers (Activation/Deactivation) in Ampache
- CVE-2024-51483 changedetection.io Path Traversal vulnerability
- CVE-2024-51482 Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64
- CVE-2024-51481 Nix allows macOS sandbox escape via built-in builders
- CVE-2024-51480 RedisTimeSeries Integer Overflow Remote Code Execution Vulnerability
- CVE-2024-5148 Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate
- CVE-2024-51479 Authorization bypass in Next.js
- CVE-2024-51478 Use of a Broken or Risky Cryptographic Algorithm in YesWiki
- CVE-2024-51477 IBM InfoSphere Information Server information disclosure
- CVE-2024-51476 IBM Concert Software information disclosure
- CVE-2024-51475 IBM Content Navigator HTML injection
- CVE-2024-51473 IBM Db2 for Linux, UNIX and Windows denial of service
- CVE-2024-51472 IBM DevOps Deploy / IBM UrbanCode Deploy HTML injection
- CVE-2024-51471 IBM MQ Appliance denial of service
- CVE-2024-51470 IBM MQ denial of service
- CVE-2024-5147 WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion
- CVE-2024-51466 IBM Cognos Analytics expression language injection
- CVE-2024-51465 IBM App Connect Enterprise Certified Container command execution
- CVE-2024-51464 IBM i authentication bypass
- CVE-2024-51463 IBM i server-side request forgery
- CVE-2024-51462 IBM QRadar WinCollect Agent data manipulation
- CVE-2024-51461 IBM QRadar WinCollect Agent denial of service
- CVE-2024-51460 IBM InfoSphere Information Server information disclosure
- CVE-2024-51459 IBM InfoSphere Server Information command execution
- CVE-2024-51457 IBM Robotic Process Automation for Cloud Pak cross-site scripting
- CVE-2024-51456 IBM Robotic Process Automation information disclosure
- CVE-2024-51454 Other in Engineering Workflow Management
- CVE-2024-51453 IBM Sterling Secure Proxy directory traversal
- CVE-2024-51451 Multiple Vulnerabilities in IBM Concert Software
- CVE-2024-51450 IBM Security Verify Directory Command Execution
- CVE-2024-5145 SourceCodester Vehicle Management System HTTP POST Request newdriver.php unrestricted upload
- CVE-2024-51448 IBM Robotic Process Automation privilege escalation
- CVE-2024-51447 Information disclosure in Polarion V2310
- CVE-2024-51446 Cross-site scripting in Polarion V2310
- CVE-2024-51445 XML external entity in Polarion V2310
- CVE-2024-51444 SQL injection in Polarion V2310
- CVE-2024-51442 Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna
- CVE-2024-51440 An issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component.
- CVE-2024-51434 Froala WYSIWYG editor allows cross-site scripting (XSS)
- CVE-2024-51432 Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI C
- CVE-2024-51431 Hardcoded credentials in lb-link:bl-wr1300h firmware
- CVE-2024-51430 Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary
- CVE-2024-5143 Missing authorization in Certain HP LaserJet Pro Printers
- CVE-2024-51428 Denial of service in espressif:esp-idf
- CVE-2024-51427 An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact
- CVE-2024-51426 An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact
- CVE-2024-51425 An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact.
- CVE-2024-51424 An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact
- CVE-2024-51423 Cross-site scripting in infor:global human resources
- CVE-2024-5142 XSS in Hubshare's social module
- CVE-2024-51419 Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a
- CVE-2024-51417 Property reflection in System.Linq.Dynamic.Core
- CVE-2024-5141 Cross-site scripting in Rotating Tweets (Twitter widget and shortcode)
- CVE-2024-51409 Memory corruption in tenda:o3 firmware
- CVE-2024-51408 Server-side request forgery in appsmith:appsmith
- CVE-2024-51407 Other in projectfloodlight:floodlight
- CVE-2024-51406 Security feature bypass in projectfloodlight:open sdn controller
- CVE-2024-51399 Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtai
- CVE-2024-51398 Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthoriz
- CVE-2024-51395 Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a d
- CVE-2024-51394 Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a d
- CVE-2024-51392 An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component
- CVE-2024-5139 Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
- CVE-2024-51382 Cross-site request forgery in jatos:jatos
- CVE-2024-51381 Cross-site request forgery in jatos:jatos
- CVE-2024-51380 Cross-site scripting in jatos:jatos
- CVE-2024-5138 CVE-2024-5138: snapd snapctl auth bypass
- CVE-2024-51379 Cross-site scripting in jatos:jatos
- CVE-2024-51378 CyberPanel Incorrect Default Permissions
- CVE-2024-51377 Cross-site scripting in ladybirdweb:faveo helpdesk
- CVE-2024-51376 Directory Traversal vulnerability in yeqifu carRental v.1.0 allows a remote attacker to obtain sensitive information via the file/downloadFi
- CVE-2024-5137 PHPGurukul Directory Management System Searchbar admin-profile.php cross site scripting
- CVE-2024-51367 An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitr
- CVE-2024-51366 An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploa
- CVE-2024-51364 An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file.
- CVE-2024-51363 Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code.