Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 251 of 521.
- CVE-2024-47598 GHSL-2024-246: GStreamer has an OOB-read in qtdemux_merge_sample_table
- CVE-2024-47597 GHSL-2024-245: GStreamer has an OOB-read in qtdemux_parse_samples
- CVE-2024-47596 GHSL-2024-244: GStreamer has an OOB-read in FOURCC_SMI_ parsing
- CVE-2024-47595 Local Privilege Escalation in SAP Host Agent
- CVE-2024-47594 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (KMC)
- CVE-2024-47593 Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2024-47592 Information Disclosure Vulnerability in SAP NetWeaver Application Server Java (Logon Application)
- CVE-2024-47590 Cross-Site Scripting (XSS) vulnerability in SAP Web Dispatcher
- CVE-2024-4759 Mime Types Extended <= 0.11 - Author+ Stored XSS via SVG Upload
- CVE-2024-47588 Information Disclosure vulnerability in SAP NetWeaver Java (Software Update Manager)
- CVE-2024-47587 Missing authorization check in SAP Cash Management (Cash Operations)
- CVE-2024-47586 NULL Pointer Dereference vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2024-47585 Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2024-47582 XML Entity Expansion Vulnerability in SAP NetWeaver AS JAVA
- CVE-2024-47581 Missing Authorization check in SAP HCM (Approve Timesheets version 4)
- CVE-2024-47580 Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
- CVE-2024-4758 Muslim Prayer Time BD <= 2.4 - Settings Reset via CSRF
- CVE-2024-47579 Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
- CVE-2024-47578 Multiple vulnerabilities in SAP NetWeaver AS for JAVA(Adobe Document Services)
- CVE-2024-47577 Information Disclosure vulnerability in SAP Commerce Cloud
- CVE-2024-47576 DLL Hijacking vulnerability in SAP Product Lifecycle Costing
- CVE-2024-47575 Fortinet FortiManager Missing Authentication
- CVE-2024-47574 Auth bypass in FortiClientWindows
- CVE-2024-47573 Security feature bypass in FortiNDR
- CVE-2024-47572 Code injection in FortiSOAR
- CVE-2024-47571 Use after free in FortiManager
- CVE-2024-47570 Information disclosure in FortiOS
- CVE-2024-4757 Logo Manager For Enamad <= 0.7.0 - Stored XSS via CSRF
- CVE-2024-47569 Information disclosure in FortiMail
- CVE-2024-47566 Path traversal in FortiRecorder
- CVE-2024-47565 Other in SINEC Security Monitor
- CVE-2024-47563 Path traversal in SINEC Security Monitor
- CVE-2024-47562 Command injection in SINEC Security Monitor
- CVE-2024-47561 Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)
- CVE-2024-47560 Missing authorization in RevoWorks Cloud Client
- CVE-2024-4756 WP Backpack <= 2.1 - Admin+ Stored XSS
- CVE-2024-47559 Authenticated RCE via Path Traversal
- CVE-2024-47558 Authenticated RCE via Path Traversal
- CVE-2024-47557 Pre-Auth RCE via Path Traversal
- CVE-2024-47556 Pre-Auth RCE via Path Traversal
- CVE-2024-47555 Missing Authentication - User & System Configuration
- CVE-2024-47554 Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
- CVE-2024-47553 Command injection in SINEC Security Monitor
- CVE-2024-47552 Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server
- CVE-2024-47550 Misconfiguration in Endurance Gaming Mode software installers
- CVE-2024-4755 Google CSE <= 1.0.7 - Admin+ Stored XSS
- CVE-2024-47549 Cross-site scripting in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-47547 Ruijie Reyee OS Weak Password Recovery Mechanism for Forgotten Password
- CVE-2024-47546 GHSL-2024-243: GStreamer has an integer underflow in extract_cc_from_data leading to OOB-read
- CVE-2024-47545 GHSL-2024-242: GStreamer has an integer underflow in FOURCC_strf parsing leading to OOB-read
- CVE-2024-47544 GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling
- CVE-2024-47543 GHSL-2024-236: GStreamer has an OOB-read in qtdemux_parse_container
- CVE-2024-47542 GHSL-2024-235: GStreamer ID3v2 parser out-of-bounds read and NULL-pointer dereference
- CVE-2024-47541 GHSL-2024-228: GStreamer has an out-of-bounds write in SSA subtitle parser
- CVE-2024-47540 GHSL-2024-197: GStreamer uses uninitialized stack memory in Matroska/WebM demuxer
- CVE-2024-4754 Stored XSS in Next4Biz's BPM
- CVE-2024-47539 GHSL-2024-195: GStreamer has an OOB-write in convert_to_s334_1a
- CVE-2024-47538 GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet
- CVE-2024-47537 GHSL-2024-094: GStreamer has an OOB-write in isomp4/qtdemux.c
- CVE-2024-47536 starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
- CVE-2024-47535 Denial of Service attack on windows app using Netty
- CVE-2024-47534 Incorrect delegation lookups can make go-tuf download the wrong artifact
- CVE-2024-47533 Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changes
- CVE-2024-47532 RestrictedPython information leakage via `AttributeError.obj` and the `string` module
- CVE-2024-47531 Scout contains insufficient output escaping of attachment names
- CVE-2024-47530 Scout contains an Open Redirect on Login via `next`
- CVE-2024-4753 WP Secure Maintenance < 1.7 - Admin+ Stored XSS
- CVE-2024-47529 OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)
- CVE-2024-47528 LibreNMS Contains a Stored XSS via File Upload
- CVE-2024-47527 LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device-dependencies.inc.php
- CVE-2024-47526 LibreNMS has a Self-XSS ('Cross-site Scripting') in librenms/includes/html/modal/alert_template.inc.php
- CVE-2024-47525 Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-alert-rules.php
- CVE-2024-47524 LibreNMS has Stored Cross-site Scripting vulnerability in "Device Group" Name
- CVE-2024-47523 LibreNMS has Stored Cross-site Scripting vulnerability in "Alert Transports" feature
- CVE-2024-47522 Suricata ja4: invalid alpn leads to panic
- CVE-2024-47520 A user with advanced report application access rights can perform actions for which they are not authorized
- CVE-2024-4752 EventON < 2.2.15 - Admin+ Stored Cross-Site Scripting via event subtitle
- CVE-2024-47519 Backup uploads to ETM subject to man-in-the-middle interception
- CVE-2024-47518 Specially constructed queries targeting ETM could discover active remote access sessions
- CVE-2024-47517 Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access
- CVE-2024-47516 Pagure: argument injection in pagurerepo.log()
- CVE-2024-47515 Pagure: generate_archive() follows symbolic links in temporary clones
- CVE-2024-4751 WP Prayer II <= 2.4.7 - Settings Update via CSRF
- CVE-2024-47509 Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #3
- CVE-2024-47508 Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #2
- CVE-2024-47507 Other in Junos OS
- CVE-2024-47506 Junos OS: SRX Series: A large amount of traffic being processed by ATP Cloud can lead to a PFE crash
- CVE-2024-47505 Junos OS Evolved: Specific low privileged CLI commands and SNMP GET requests can trigger a resource leak #1
- CVE-2024-47504 Junos OS: SRX5000 Series: Receipt of a specific malformed packet will cause a flowd crash
- CVE-2024-47503 Junos OS: SRX4600 and SRX5000 Series: Sequence of specific PIM packets causes a flowd crash
- CVE-2024-47502 Junos OS Evolved: TCP session state is not always cleared on the Routing Engine leading to DoS
- CVE-2024-47501 Null dereference in Junos OS
- CVE-2024-4750 BuddyBoss Platform < 2.6.0 - Insecure Direct Object Reference on Like Comment
- CVE-2024-47499 Junos OS and Junos OS Evolved: In a BMP scenario receipt of a malformed AS PATH attribute can cause an RPD crash
- CVE-2024-47498 Junos OS Evolved: QFX5000 Series: Configured MAC learning and move limits are not in effect
- CVE-2024-47497 Junos OS: SRX Series, QFX Series, MX Series and EX Series: Receiving specific HTTPS traffic causes resource exhaustion
- CVE-2024-47496 Junos OS: MX Series: The PFE will crash on running specific command
- CVE-2024-47495 Auth bypass in Junos OS Evolved
- CVE-2024-47494 Junos OS: Due to a race condition AgentD process causes a memory corruption and FPC reset
- CVE-2024-47493 Junos OS: MX Series: Trio-based FPCs: Continuous physical Interface flaps causes local FPC to crash