Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 242 of 521.
- CVE-2024-48981 Memory corruption in arm:mbed
- CVE-2024-4898 Missing authorization in InstaWP Connect – 1-click WP Staging & Migration
- CVE-2024-48974 Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates
- CVE-2024-48973 Debug port on Life2000 Ventilator serial interface is enabled by default
- CVE-2024-48971 Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator
- CVE-2024-48970 Life2000 Ventilator microcontroller lacks memory protection
- CVE-2024-4897 Remote Code Execution in parisneo/lollms-webui
- CVE-2024-48967 Life2000 ventilator and Service PC lack sufficient audit logging capabilities
- CVE-2024-48966 Life2000 service tools for test and calibration do not support user authentication
- CVE-2024-48964 OS Command Injection in Snyk gradle plugin
- CVE-2024-48963 OS Command Injection in Snyk php plugin
- CVE-2024-48962 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)
- CVE-2024-4896 WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
- CVE-2024-48958 Memory corruption in libarchive:libarchive
- CVE-2024-48957 Memory corruption in libarchive:libarchive
- CVE-2024-48956 Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a
- CVE-2024-48955 Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the
- CVE-2024-48954 Command injection in logpoint:siem
- CVE-2024-48953 Missing authorization in logpoint:siem
- CVE-2024-48952 Hardcoded credentials in logpoint:soar
- CVE-2024-48951 Server-side request forgery in logpoint:siem
- CVE-2024-48950 Auth bypass in logpoint:siem
- CVE-2024-4895 Cross-site scripting in wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin
- CVE-2024-48949 Elliptic's verify function omits uniqueness validation
- CVE-2024-48948 Valid ECDSA signatures erroneously rejected in Elliptic
- CVE-2024-48944 Apache Kylin: SSRF vulnerability in the diagnosis api
- CVE-2024-48942 Auth bypass in syracom:secure login
- CVE-2024-48941 Security feature bypass in syracom:secure login
- CVE-2024-4894 ITPison OMICARD EDM - Server-Side Request Forgery
- CVE-2024-48939 Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with
- CVE-2024-48938 Denial of service in znuny:znuny
- CVE-2024-48937 Cross-site scripting in znuny:znuny
- CVE-2024-48936 Missing authorization in schedmd:slurm
- CVE-2024-48933 Cross-site scripting in lemonldap-ng:lemonldap\
- CVE-2024-48932 ZimaOS Unauthenticated API Discloses Usernames
- CVE-2024-48931 ZimaOS Arbitrary File Read via Parameter Manipulation
- CVE-2024-48930 secp256k1-node vulnerable to private key extraction over ECDH
- CVE-2024-4893 DigiWin EasyFlow .NET - SQL Injection
- CVE-2024-48929 Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out
- CVE-2024-48928 Piwigo's secret key can be brute forced
- CVE-2024-48927 Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice
- CVE-2024-48926 Umbraco CMS logout page displayed before session expiration
- CVE-2024-48925 Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API
- CVE-2024-48924 MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow
- CVE-2024-48921 Kyverno's PolicyException objects can be created in any namespace by default
- CVE-2024-48920 PutongOJ: unprivileged users can escalate privileges by constructing requests
- CVE-2024-4892 BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-48919 RCE via Prompt Injection Into Cursor's Terminal Cmd-K
- CVE-2024-48918 Lack of Input Validation in RDS Light - Potential for Injection Attacks and Memory Tampering
- CVE-2024-48917 XXE in PHPSpreadsheet's XLSX reader
- CVE-2024-48916 Ceph is vulnerable to authentication bypass through RadosGW
- CVE-2024-48915 Agent Dart missing certificate verification checks
- CVE-2024-48914 Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy
- CVE-2024-48913 Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.
- CVE-2024-48912 GLPI vulnerable to authenticated insecure account deletion
- CVE-2024-48911 OpenCanary Executes Commands From Potentially Writable Config File
- CVE-2024-48910 DOMPurify vulnerable to tampering by prototype polution
- CVE-2024-4891 Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
- CVE-2024-48909 SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not
- CVE-2024-48908 lychee-action vulnerable to arbitrary code injection in composite action
- CVE-2024-48907 Server-side request forgery in sematell:replyone
- CVE-2024-48906 Cross-site scripting in sematell:replyone
- CVE-2024-48905 Missing authorization in sematell:replyone
- CVE-2024-48904 Command injection in Trend Micro Cloud Edge
- CVE-2024-48903 Privilege escalation in Trend Micro Deep Security Agent
- CVE-2024-48902 Missing authorization in YouTrack
- CVE-2024-48901 Moodle: idor when fetching report schedules
- CVE-2024-48900 Moodle: idor when accessing list of badge recipients
- CVE-2024-4890 Blind SQL Injection in berriai/litellm
- CVE-2024-48899 Moodle: idor when accessing list of course badges
- CVE-2024-48898 Moodle: some users can delete audiences of other reports
- CVE-2024-48897 Moodle: idor in edit/delete rss feed
- CVE-2024-48896 Moodle: users' names returned in messaging error message
- CVE-2024-48895 Command injection in Rakuten Turbo 5G
- CVE-2024-48894 Information disclosure in DIRIS Digiware M-70
- CVE-2024-48893 Cross-site scripting in FortiSOAR
- CVE-2024-48892 Path traversal in FortiSOAR
- CVE-2024-48891 Command injection in FortiSOAR on-premise
- CVE-2024-48890 Command injection in FortiSOAR
- CVE-2024-4889 Code Injection in berriai/litellm
- CVE-2024-48889 Command injection in FortiManager
- CVE-2024-48887 Auth bypass in FortiSwitch
- CVE-2024-48886 Auth bypass in FortiOS
- CVE-2024-48885 Path traversal in FortiRecorder
- CVE-2024-48884 Path traversal in FortiManager
- CVE-2024-48883 Information disclosure in samsung:exynos 1080 firmware
- CVE-2024-48882 Denial of service in DIRIS Digiware M-70
- CVE-2024-48881 bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
- CVE-2024-4888 Arbitrary File Deletion in BerriAI/litellm
- CVE-2024-48878 SQL Injection
- CVE-2024-48877 Memory corruption in xls2csv
- CVE-2024-48876 stackdepot: fix stack_depot_save_flags() in NMI context
- CVE-2024-48875 btrfs: don't take dev_replace rwsem on task already holding it
- CVE-2024-48874 Ruijie Reyee OS Server-Side Request Forgery
- CVE-2024-48873 wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
- CVE-2024-48872 Bypass of "Max failed attempts" restriction via race condition
- CVE-2024-48871 Planet Technology Planet WGS-804HPT Stack-based Buffer Overflow
- CVE-2024-48870 Cross-site scripting in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-4887 Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-48869 Privilege escalation in Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trust Domain Extensions (Intel(R) TDX) or Intel(R) Software Guard Extensions (Intel(R) SGX)