Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 245 of 521.
- CVE-2024-48461 Cross Site Scripting vulnerability in TeslaLogger Admin Panel before v.1.59.6 allows a remote attacker to execute arbitrary code via the New Journey field.
- CVE-2024-48460 Eugeny Tabby Sends Password Despite Host Key Verification Failure
- CVE-2024-4846 Auth bypass in Server
- CVE-2024-48459 A command execution vulnerability exists in the AX2 Pro home router produced by Shenzhen Tenda Technology Co., Ltd.
- CVE-2024-48457 An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0
- CVE-2024-48456 An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0
- CVE-2024-48455 An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0
- CVE-2024-48454 File upload in oretnom23:purchase order management system
- CVE-2024-48453 An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function
- CVE-2024-48450 An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML file into chat group.
- CVE-2024-4845 Icegram Express <= 5.7.22 - Authenticated (Subscriber+) SQL Injection Vulnerability via options[list_id]
- CVE-2024-48448 An arbitrary file upload vulnerability in Huly Platform v0.6.295 allows attackers to execute arbitrary code via uploading a crafted HTML fil
- CVE-2024-48445 An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters.
- CVE-2024-48442 Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows a
- CVE-2024-48441 Wuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injection
- CVE-2024-48440 Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command
- CVE-2024-4844 Hardcoded credentials in ePolicy Orchestrator
- CVE-2024-4843 Missing authorization in ePolicy Orchestrator
- CVE-2024-48428 Information disclosure in olivegroup:olivevle
- CVE-2024-48427 SQL injection in oretnom23:packers and movers management system
- CVE-2024-48426 Memory corruption in assimp:assimp
- CVE-2024-48425 Null dereference in assimp:assimp
- CVE-2024-48424 Memory corruption in assimp:assimp
- CVE-2024-48423 Use after free in assimp:assimp
- CVE-2024-48420 Memory corruption in edimax:br-6476ac firmware
- CVE-2024-48419 Command injection in edimax:br-6476ac firmware
- CVE-2024-48418 Command injection in edimax:br-6476ac firmware
- CVE-2024-48417 Cross-site scripting in edimax:br-6476ac firmware
- CVE-2024-48416 Memory corruption in edimax:br-6476ac firmware
- CVE-2024-48415 Cross-site scripting in razormist:loan management system
- CVE-2024-48411 SQL injection in mayurik:online tours \& travels management system
- CVE-2024-48410 Cross Site Scripting vulnerability in Camtrace v.9.16.2.1 allows a remote attacker to execute arbitrary code via the login.php.
- CVE-2024-4841 Path Traversal in parisneo/lollms-webui
- CVE-2024-48406 Buffer Overflow vulnerability in SunBK201 umicat through v.0.3.2 and fixed in v.0.3.3 allows an attacker to execute arbitrary code via the p
- CVE-2024-4840 Rhosp-director: cleartext passwords exposed in logs
- CVE-2024-48396 AIML Chatbot 1.0 (fixed in 2.0) is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-48394 A Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the driver of the NDD Print solution, which could allow an unpr
- CVE-2024-48392 Cross-site scripting in orangescrum:orangescrum
- CVE-2024-4839 CSRF in Servers Configurations in parisneo/lollms-webui
- CVE-2024-4838 ConvertPlus <= 3.5.26 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-4837 Trust Boundary Violation Vulnerability
- CVE-2024-48360 Server-side request forgery in qualitor:qualitor
- CVE-2024-4836 LFI in sites managed by Edito CMS
- CVE-2024-48359 Code injection in qualitor:qualitor
- CVE-2024-48357 SQL injection in lylme:lylme spage
- CVE-2024-48356 SQL injection in lylme:lylme spage
- CVE-2024-48353 Hardcoded credentials in yealink:yealink meeting server
- CVE-2024-48352 Information disclosure in yealink:yealink meeting server
- CVE-2024-4835 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2024-48346 xtreme1 <= v0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the /api/data/upload path.
- CVE-2024-48343 SQL injection in esafenet:cdg
- CVE-2024-48341 Cross-site request forgery in geeeeeeeek:dingfanzu
- CVE-2024-48336 The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, wh
- CVE-2024-48325 SQL injection in portabilis:i-educar
- CVE-2024-48322 UsersController.php in Run.codes 1.5.2 and older has a reset password race condition vulnerability.
- CVE-2024-48312 WebLaudos v20.8 (118) was discovered to contain a cross-site scripting (XSS) vulnerability via the login page.
- CVE-2024-48311 Cross-site request forgery in piwigo:piwigo
- CVE-2024-48310 AutoLib Software Systems OPAC v20.10 was discovered to have multiple API keys exposed within the source code.
- CVE-2024-48307 JeecgBoot SQL Injection vulnerability
- CVE-2024-48294 A NULL pointer dereference in the component libPdfCore.dll of Wondershare PDF Reader v1.0.9.2544 allows attackers to cause a Denial of Servi
- CVE-2024-48293 Incorrect access control in QuickHeal Antivirus Pro 24.1.0.182 and earlier allows authenticated attackers with low-level privileges to arbit
- CVE-2024-48292 An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attacke
- CVE-2024-48291 Cross-site request forgery in timgreen:dingfanzu cms
- CVE-2024-48290 An issue in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) v
- CVE-2024-48289 An issue in the Bluetooth Low Energy implementation of Cypress Bluetooth SDK v3.66 allows attackers to cause a Denial of Service (DoS) via s
- CVE-2024-48288 Command injection in tp-link:tl-ipc42c firmware
- CVE-2024-48286 Command injection in linksys:e3000 firmware
- CVE-2024-48284 Cross-site scripting in phpgurukul:user registration \& login and user management system
- CVE-2024-48283 SQL injection in phpgurukul:user registration \& login and user management system
- CVE-2024-48282 SQL injection in phpgurukul:user registration \& login and user management system
- CVE-2024-48280 SQL injection in phpgurukul:user registration \& login and user management system
- CVE-2024-48279 Cross-site scripting in phpgurukul:user registration \& login and user management system
- CVE-2024-48278 Cross-site request forgery in phpgurukul:user registration \& login and user management system
- CVE-2024-48272 Hardcoded credentials in dlink:dsl-6740c firmware
- CVE-2024-48271 Hardcoded credentials in dlink:dsl-6740c firmware
- CVE-2024-48270 Information disclosure in misstt123:oasys
- CVE-2024-4826 SQL injection vulnerability in Simple PHP Shopping Cart
- CVE-2024-48259 SQL injection in magicbug:cloudlog
- CVE-2024-48257 SQL injection in wavelog:wavelog
- CVE-2024-48255 SQL injection in magicbug:cloudlog
- CVE-2024-48253 SQL injection in magicbug:cloudlog
- CVE-2024-48251 SQL injection in wavelog:wavelog
- CVE-2024-4825 Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo
- CVE-2024-48249 SQL injection in wavelog:wavelog
- CVE-2024-48248 NAKIVO Backup and Replication Absolute Path Traversal
- CVE-2024-48246 Cross-site scripting in janobe:vehicle management system
- CVE-2024-48245 SQL injection in janobe:vehicle management system
- CVE-2024-48241 Memory corruption in radare:radare2
- CVE-2024-4824 SQL Injection in School ERP Pro+Responsive by AROX SOLUTION
- CVE-2024-48239 Cross-site scripting in wtcms project:wtcms
- CVE-2024-48238 SQL injection in wtcms project:wtcms
- CVE-2024-48237 Missing authorization in wtcms project:wtcms
- CVE-2024-48236 Code injection in ofcms project:ofcms
- CVE-2024-48235 Code injection in ofcms project:ofcms
- CVE-2024-48234 An issue was discovered in mipjz 5.0.5.
- CVE-2024-48233 Cross-site scripting in mipjz project:mipjz
- CVE-2024-48232 Server-side request forgery in mipjz project:mipjz
- CVE-2024-48231 SQL injection in funadmin
- CVE-2024-48230 SQL injection in funadmin
- CVE-2024-4823 Cross-site Scripting in School ERP Pro+Responsive by AROX SOLUTION