Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 248 of 521.
- CVE-2024-47895 GPU DDK - OOB read into fwlog due to unchecked block count
- CVE-2024-47894 GPU DDK - Out of bounds read into fwlog due to unchecked loop bounds
- CVE-2024-47893 GPU DDK - OOB read and write of the shared KMD/FW memory heap (VZ/TEE setups)
- CVE-2024-47892 GPU DDK - UAF of kernel memory in PMRUnlockPhysAddressesOSMem for on-demand non-4KB PMRs in system memory (UMA)
- CVE-2024-47891 Use after free in Graphics DDK
- CVE-2024-4789 Cost Calculator Builder Pro <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery
- CVE-2024-47889 Action Mailer has possible ReDoS vulnerability in block_format
- CVE-2024-47888 Action Text has possible ReDoS vulnerability in plain_text_for_blockquote_node
- CVE-2024-47887 Action Controller has possible ReDoS vulnerability in HTTP Token authentication
- CVE-2024-47886 Chamilo: Post-Auth Remote Code Execution
- CVE-2024-47885 astro's client-side router has DOM Clobbering Gadget that leads to XSS
- CVE-2024-47884 Insecure Temporary File in `foxmarks`
- CVE-2024-47883 Butterfly has path/URL confusion in resource handling leading to multiple weaknesses
- CVE-2024-47882 OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project
- CVE-2024-47881 OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE)
- CVE-2024-47880 OpenRefine has a reflected cross-site scripting vulnerability from POST request in ExportRowsCommand
- CVE-2024-4788 Boostify Header Footer Builder for Elementor <= 1.3.5 - Missing Authorization to Page/Post Creation
- CVE-2024-47879 OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF)
- CVE-2024-47878 Reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt)
- CVE-2024-47877 Extract has insufficient checks allowing attacker to create symlinks outside the extraction directory.
- CVE-2024-47876 Sakai: Kernel users created with type roleview can login as a normal user
- CVE-2024-47875 DOMPurify nesting-based mXSS
- CVE-2024-47874 Starlette Denial of service (DoS) via multipart/form-data
- CVE-2024-47873 PhpSpreadsheet XmlScanner bypass leads to XXE
- CVE-2024-47872 Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files
- CVE-2024-47871 Insecure communication between the FRP client and server in Gradio
- CVE-2024-47870 Race condition in update_root_in_config may redirect user traffic in Gradio
- CVE-2024-4787 Cost Calculator Builder PRO <= 3.1.75 - Unauthenticated Arbitrary Email Sending
- CVE-2024-47869 Non-constant-time comparison when comparing hashes in Gradio
- CVE-2024-47868 Several components’ post-process steps may allow arbitrary file leaks in Gradio
- CVE-2024-47867 Lack of integrity check on the downloaded FRP client in Gradio
- CVE-2024-47866 RGW DoS attack with empty HTTP header in S3 object copy
- CVE-2024-47865 Missing authorization in Rakuten Turbo 5G
- CVE-2024-47864 Memory corruption in Wi-Fi STATION SH-52B
- CVE-2024-47863 An issue was discovered in Centreon Web 24.10.x before 24.10.0, 24.04.x before 24.04.8, 23.10.x before 23.10.18, 23.04.x before 23.04.23, an
- CVE-2024-4786 Security feature bypass in Tab K10
- CVE-2024-47857 SSH Communication Security PrivX versions between 18.0-36.0 implement insufficient validation on public key signatures when using native SSH
- CVE-2024-47856 Privilege escalation in rsa:authentication agent for windows
- CVE-2024-47855 JSON-lib mishandles an unbalanced comment string
- CVE-2024-47854 Cross-site scripting in veritas:data insight
- CVE-2024-47853 Privilege escalation in mahara:mahara
- CVE-2024-47850 CUPS cups-browsed before 2.5b1 will send an HTTP POST request to an arbitrary destination and port in response to a single IPP UDP packet re
- CVE-2024-4785 BT: Missing Check in LL_CONNECTION_UPDATE_IND Packet Leads to Division by Zero
- CVE-2024-47849 Backticks can allow the usage of not-allowed SQL functions
- CVE-2024-47848 User can review/unreview articles while blocked
- CVE-2024-47847 Various XSSes found in Cargo
- CVE-2024-47846 Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection
- CVE-2024-47845 CSS sanitizer used incorrectly, and is easily bypassed
- CVE-2024-47841 Path traversal when loading stylesheets
- CVE-2024-47840 Stored XSS through sidebar in Apex skin
- CVE-2024-4784 Authentication Bypass by Primary Weakness in GitLab
- CVE-2024-47836 Admidio vulnerable to HTML Injection In The Messages Section
- CVE-2024-47835 GHSL-2024-263: Gstreamer NULL-pointer dereference in LRC subtitle parser
- CVE-2024-47834 GHSL-2024-280: Gstreamer Use-After-Free read in Matroska CodecPrivate
- CVE-2024-47833 Session Cookie without Secure and HTTPOnly flags in taipy
- CVE-2024-47832 XML Signature Bypass via differential XML parsing in ssoready
- CVE-2024-47831 Next.js image optimization has Denial of Service condition
- CVE-2024-47830 Plane allows server side request forgery via /_next/image endpoint
- CVE-2024-4783 jQuery T(-) Countdown Widget <= 2.3.25 - Authenticated (Contributor+) Stored Cross-Site Scripting via tminus Shortcode
- CVE-2024-47829 pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
- CVE-2024-47828 Cross-Site Request Forgery in ampache
- CVE-2024-47827 Argo Workflows Controller: Denial of Service via malicious daemon Workflows
- CVE-2024-47826 eLabFTW vulnerable to HTML Injection in extended search error message
- CVE-2024-47825 CIDR deny policies may not take effect when a more narrow CIDR allow is present
- CVE-2024-47824 Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a room
- CVE-2024-47823 Livewire Remote Code Execution (RCE) on File Uploads
- CVE-2024-47822 Directus inserts access token from query string into logs
- CVE-2024-47821 pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API
- CVE-2024-47820 MarkUs vulnerable to Path Traversal
- CVE-2024-4782 Denial of service in Printers
- CVE-2024-47819 Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary section
- CVE-2024-47818 Logged-in users with any role can delete arbitrary files in @saltcorn/server
- CVE-2024-47817 Unvalidated paragraph widget values can be used for Cross-site Scripting in lara-zeus
- CVE-2024-47816 Users can impersonate import requesters if their actor IDs coincide in ImportDump
- CVE-2024-47815 Cross-site Scripting in IncidentReporting
- CVE-2024-47814 use-after-free when closing buffers in Vim
- CVE-2024-47813 Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violations
- CVE-2024-47812 Cross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDump
- CVE-2024-47810 Use after free in Foxit Reader
- CVE-2024-4781 Denial of service in Printers
- CVE-2024-47809 dlm: fix possible lkb_resource null dereference
- CVE-2024-47808 Missing authorization in SINEC NMS
- CVE-2024-47807 Jenkins OpenId Connect Authentication Plugin lacks issuer claim validation
- CVE-2024-47806 Jenkins OpenId Connect Authentication Plugin lacks audience claim validation
- CVE-2024-47805 Jenkins Credentials plugin reveals encrypted values of credentials to users with Extended Read permission
- CVE-2024-47804 Jenkins item creation restriction bypass vulnerability
- CVE-2024-47803 Jenkins exposes multi-line secrets through error messages
- CVE-2024-47801 Cross-site scripting in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-47800 Privilege escalation in Intel(R) Graphics Driver software
- CVE-2024-4780 Cross-site scripting in Image Hover Effects – Elementor Addon
- CVE-2024-47799 Information disclosure in Mesh Wi-Fi router RP562B
- CVE-2024-47797 Liteos_a has an out-of-bounds Write vulnerability
- CVE-2024-47796 Memory corruption in DCMTK
- CVE-2024-47795 Privilege escalation in Intel(R) oneAPI DPC++/C++ Compiler software
- CVE-2024-47794 bpf: Prevent tailcall infinite loop caused by freplace
- CVE-2024-47793 Cross-site scripting in Exment
- CVE-2024-47791 Ruijie Reyee OS Improper Neutralization of Wildcards or Matching Symbols
- CVE-2024-47790 Missing Authorization Vulnerability
- CVE-2024-4779 Unlimited Elements for Elementor <= 1.5.107 - Authenticated (Contributor+) SQL Injection via data[post_ids][0]
- CVE-2024-47789 Credential Leakage Vulnerability