Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 229 of 521.
- CVE-2024-50396 QTS, QuTS hero
- CVE-2024-50395 Media Streaming add-on
- CVE-2024-50394 Helpdesk
- CVE-2024-50393 QTS, QuTS hero
- CVE-2024-50390 QHora
- CVE-2024-5039 Cross-site scripting in HUSKY – Products Filter Professional for WooCommerce
- CVE-2024-50389 QuRouter
- CVE-2024-50388 HBS 3 Hybrid Backup Sync
- CVE-2024-50387 SMB Service
- CVE-2024-50386 Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure
- CVE-2024-50385 Denial of service in X-CUBE-AZRT-H7RS
- CVE-2024-50384 Denial of service in X-CUBE-AZRT-H7RS
- CVE-2024-50383 Weak cryptography in botan project:botan
- CVE-2024-50382 Weak cryptography in botan project:botan
- CVE-2024-50381 Missing Authentication for Critical Function in Snap One OVRC cloud
- CVE-2024-50380 Authentication Bypass by Spoofing in Snap One OVRC cloud
- CVE-2024-5038 Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-50379 Apache Tomcat: RCE due to TOCTOU issue in JSP compilation
- CVE-2024-50378 Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli
- CVE-2024-50377 Hardcoded credentials in EKI-6333AC-1GPO
- CVE-2024-50376 Cross-site scripting in EKI-6333AC-1GPO
- CVE-2024-50375 Auth bypass in EKI-6333AC-1GPO
- CVE-2024-50374 Command injection in EKI-6333AC-1GPO
- CVE-2024-50373 Command injection in EKI-6333AC-1GPO
- CVE-2024-50372 Command injection in EKI-6333AC-1GPO
- CVE-2024-50371 Command injection in EKI-6333AC-1GPO
- CVE-2024-50370 Command injection in EKI-6333AC-1GPO
- CVE-2024-5037 Openshift/telemeter: iss check during jwt authentication can be bypassed
- CVE-2024-50369 Command injection in EKI-6333AC-1GPO
- CVE-2024-50368 Command injection in EKI-6333AC-1GPO
- CVE-2024-50367 Command injection in EKI-6333AC-1GPO
- CVE-2024-50366 Command injection in EKI-6333AC-1GPO
- CVE-2024-50365 Command injection in EKI-6333AC-1GPO
- CVE-2024-50364 Command injection in EKI-6333AC-1GPO
- CVE-2024-50363 Command injection in EKI-6333AC-1GPO
- CVE-2024-50362 Command injection in EKI-6333AC-1GPO
- CVE-2024-50361 Command injection in EKI-6333AC-1GPO
- CVE-2024-50360 Command injection in EKI-6333AC-1GPO
- CVE-2024-5036 Cross-site scripting in Sina Extension for Elementor
- CVE-2024-50359 Command injection in EKI-6333AC-1GPO
- CVE-2024-50358 Other in EKI-6333AC-1GPO
- CVE-2024-50357 Hardcoded credentials in FutureNet NXR-G050 series
- CVE-2024-50356 Press has a potential 2FA bypass
- CVE-2024-50355 LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints
- CVE-2024-50354 Out-of-memory during deserialization with crafted inputs
- CVE-2024-50353 ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected
- CVE-2024-50352 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php
- CVE-2024-50351 LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php
- CVE-2024-50350 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php
- CVE-2024-5035 TP-Link Archer C5400X - RFTest Unauthenticated Command Injection
- CVE-2024-50349 Git does not sanitize URLs when asking for credentials interactively
- CVE-2024-50348 InstantCMS has a Cross Site Scripting Vulnerability
- CVE-2024-50347 Laravel Reverb has Missing API Signature Verification
- CVE-2024-50346 WebFeed HTML injection vulnerabilities
- CVE-2024-50345 Open redirect via browser-sanitized URLs in symfony/http-foundation
- CVE-2024-50344 I, Librarian has a Stored XSS vulnerability in Supplemental Files
- CVE-2024-50343 Incorrect response from Validator when input ends with `\n` in symfony/validator
- CVE-2024-50342 Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client
- CVE-2024-50341 Security::login does not take into account custom user_checker in symfony/security-bundle
- CVE-2024-50340 Ability to change environment from query in symfony/runtime
- CVE-2024-5034 SULly < 4.3.1 - Plugin Reset via CSRF
- CVE-2024-50339 GLPI vulnerable to unauthenticated session hijacking
- CVE-2024-50338 Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager
- CVE-2024-50337 Chamilo: Potential unauthenticated blind SSRF via openid function
- CVE-2024-50336 matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal
- CVE-2024-50335 Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM
- CVE-2024-50334 Semicolon Path Injection on API /api;/config
- CVE-2024-50333 RCE in ModuleBuilder in SuiteCRM
- CVE-2024-50332 Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM
- CVE-2024-50331 Memory corruption in Avalanche
- CVE-2024-50330 SQL injection in Endpoint Manager
- CVE-2024-5033 SULly < 4.3.1 - Admin+ Stored XSS via CSRF
- CVE-2024-50329 Path traversal in Endpoint Manager
- CVE-2024-50328 SQL injection in Endpoint Manager
- CVE-2024-50327 SQL injection in Endpoint Manager
- CVE-2024-50326 SQL injection in Endpoint Manager
- CVE-2024-50324 Path traversal in Endpoint Manager
- CVE-2024-50323 SQL injection in Endpoint Manager
- CVE-2024-50322 Path traversal in Endpoint Manager
- CVE-2024-50321 Denial of service in Avalanche
- CVE-2024-50320 Denial of service in Avalanche
- CVE-2024-5032 SULly < 4.3.1 - Reflected XSS
- CVE-2024-50319 Denial of service in Avalanche
- CVE-2024-50318 Null dereference in Avalanche
- CVE-2024-50317 Null dereference in Avalanche
- CVE-2024-50313 Race condition in Mendix Runtime V10
- CVE-2024-50312 Graphql: information disclosure via graphql introspection in openshift
- CVE-2024-50311 Graphql: denial of service (dos) vulnerability via graphql batching
- CVE-2024-50310 Missing authorization in SIMATIC CP 1543-1 V4.0
- CVE-2024-5031 MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode
- CVE-2024-50307 Code injection in Chatwork Desktop Application (Windows)
- CVE-2024-50306 Apache Traffic Server: Server process can fail to drop privilege
- CVE-2024-50305 Apache Traffic Server: Valid Host field value can cause crashes
- CVE-2024-50304 ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
- CVE-2024-50303 resource,kexec: walk_system_ram_res_rev must retain resource flags
- CVE-2024-50302 Linux Kernel Use of Uninitialized Resource
- CVE-2024-50301 security/keys: fix slab-out-of-bounds in key_task_permission
- CVE-2024-50300 regulator: rtq2208: Fix uninitialized use of regulator_config
- CVE-2024-5030 CM Table Of Contents – WordPress TOC Plugin < 1.2.3 - Settings Reset via CSRF
- CVE-2024-50299 sctp: properly validate chunk size in sctp_sf_ootb()