Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 244 of 521.
- CVE-2024-48730 The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authenticati
- CVE-2024-4873 Replace Image <= 1.1.10 - Insecure Direct Object Reference
- CVE-2024-48729 An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacke
- CVE-2024-4872 Code injection in MicroSCADA Pro SYS600
- CVE-2024-48714 Memory corruption in tp-link:tl-wdr7660 firmware
- CVE-2024-48713 Memory corruption in tp-link:tl-wdr7660 firmware
- CVE-2024-48712 Memory corruption in tp-link:tl-wdr7660 firmware
- CVE-2024-48710 Memory corruption in tp-link:tl-wdr7660 firmware
- CVE-2024-4871 Foreman: host ssh key not being checked in remote execution
- CVE-2024-48709 Cross-site scripting in codeastro:membership management system
- CVE-2024-48708 Cross-site scripting in o-dyn:collabtive
- CVE-2024-48707 Cross-site scripting in o-dyn:collabtive
- CVE-2024-48706 Cross-site scripting in o-dyn:collabtive
- CVE-2024-48705 Command injection in wavlink:wl-wn531p3 firmware
- CVE-2024-48704 Cross-site scripting in phpgurukul:medical card generation system
- CVE-2024-48703 Cross-site scripting in anujk305:medical card generation system
- CVE-2024-48702 Cross-site scripting in phpgurukul:old age home management system
- CVE-2024-48700 Code injection in kliqqi:kliqqi cms
- CVE-2024-4870 Frontend Registration – Contact Form 7 <= 5.1 - Authenticated (Editor+) Privilege Escalation
- CVE-2024-48694 File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arb
- CVE-2024-4869 Cross-site scripting in Cookie Banner for GDPR / CCPA – WPLP Cookie Consent
- CVE-2024-4868 Cross-site scripting in Extensions for Elementor
- CVE-2024-4867 Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval
- CVE-2024-48662 Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a craf
- CVE-2024-4866 Cross-site scripting in UltraAddons for Elementor
- CVE-2024-48659 Command injection in dcnetworks:dcme-320-l firmware
- CVE-2024-48657 SQL injection in princelycesar:hospital management system
- CVE-2024-48656 Cross-site scripting in angeljudesuarez:student management system
- CVE-2024-48655 Code injection in totaljs:total.js
- CVE-2024-48654 Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.php component.
- CVE-2024-48652 camaleon_cms affected by cross site scripting
- CVE-2024-48651 In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplement
- CVE-2024-4865 Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter
- CVE-2024-48648 Cross-site scripting in sage:sage frp 1000
- CVE-2024-48647 Path traversal in sage:sage frp 1000
- CVE-2024-48646 File upload in sage:sage frp 1000
- CVE-2024-48645 In Minecraft mod "Command Block IDE" up to and including version 0.4.9, a missing authorization (CWE-862) allows any user to modify "functio
- CVE-2024-48644 Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote
- CVE-2024-48638 Command injection in dlink:dir-878 firmware
- CVE-2024-48637 Command injection in dlink:dir-878 firmware
- CVE-2024-48636 Command injection in dlink:dir-878 firmware
- CVE-2024-48635 Command injection in dlink:dir-878 firmware
- CVE-2024-48634 Command injection in dlink:dir-878 firmware
- CVE-2024-48633 Command injection in dlink:dir-878 firmware
- CVE-2024-48632 Command injection in dlink:dir-878 firmware
- CVE-2024-48631 Command injection in dlink:dir-878 firmware
- CVE-2024-48630 Command injection in dlink:dir-878 firmware
- CVE-2024-4863 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-48629 Command injection in dlink:dir-878 firmware
- CVE-2024-48624 Cross-site scripting in domainmod:domainmod
- CVE-2024-48623 Cross-site scripting in domainmod:domainmod
- CVE-2024-48622 Cross-site scripting in domainmod:domainmod
- CVE-2024-4862 Cross-site scripting in WPBITS Addons For Elementor Page Builder
- CVE-2024-48615 Null dereference in libarchive:libarchive
- CVE-2024-48605 Other in helakuru:helakuru
- CVE-2024-4860 Cross-site scripting in rebelcode:rss aggregator
- CVE-2024-48597 SQL injection in angeljudesuarez:online clinic management system
- CVE-2024-48594 File upload in fast5:prison management system
- CVE-2024-48591 Cross-site scripting in inflectra:spirateam
- CVE-2024-48590 Server-side request forgery in inflectra:spirateam
- CVE-2024-4859 Cross-site scripting in solidus
- CVE-2024-48589 Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter
- CVE-2024-48581 File upload in mayurik:best courier management system
- CVE-2024-48580 SQL injection in mayurik:best courier management system
- CVE-2024-4858 Testimonial Carousel For Elementor <= 10.2.0 - Missing Authorization to Limited Setting Update
- CVE-2024-48579 SQL injection in mayurik:best house rental management system
- CVE-2024-48573 SQL injection in aquila-cms:aquilacms
- CVE-2024-48572 Information disclosure in aquila-cms:aquilacms
- CVE-2024-48570 SQL injection in phpgurukul:client management system
- CVE-2024-4857 FS Product Inquiry <= 1.1.1 - Unauthenticated Stored XSS
- CVE-2024-48569 Proactive Risk Manager version 9.1.1.0 is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in the add/edit form fields, at th
- CVE-2024-4856 FS Product Inquiry <= 1.1.1 - Reflected XSS
- CVE-2024-4855 Use After Free in editcap
- CVE-2024-48548 The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices.
- CVE-2024-48547 Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive info
- CVE-2024-48546 Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information
- CVE-2024-48545 Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information
- CVE-2024-48544 Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive in
- CVE-2024-48542 Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sen
- CVE-2024-48541 Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive informat
- CVE-2024-48540 Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file.
- CVE-2024-4854 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
- CVE-2024-48539 Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism.
- CVE-2024-48538 Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information b
- CVE-2024-48536 Missing authorization in esoftplanner:esoft planner
- CVE-2024-48535 Cross-site scripting in esoftplanner:esoft planner
- CVE-2024-48534 Cross-site scripting in esoftplanner:esoft planner
- CVE-2024-48533 Information disclosure in esoftplanner:esoft planner
- CVE-2024-48531 Cross-site scripting in esoftplanner:esoft planner
- CVE-2024-48530 Denial of service in esoftplanner:esoft planner
- CVE-2024-4853 Mismatched Memory Management Routines in editcap
- CVE-2024-48519 Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial
- CVE-2024-48514 Remote code execution in php-heic-to-jpg
- CVE-2024-48510 DotNetZip Directory Traversal vulnerability
- CVE-2024-4851 SSRF Vulnerability in stangirard/quivr
- CVE-2024-48509 SQL injection in lang-learn-guy:learning with texts
- CVE-2024-4849 WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter
- CVE-2024-4847 SQL injection in Alt Text AI – Automatically generate image alt text for SEO and accessibility
- CVE-2024-48465 The MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameter
- CVE-2024-48463 Open redirect in usebruno:bruno