Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 255 of 521.
- CVE-2024-47153 Information disclosure in Magic OS
- CVE-2024-47151 File upload in Magic OS
- CVE-2024-47150 Information disclosure in Magic OS
- CVE-2024-4715 Campcodes Complete Web-Based School Management System update_grade.php cross site scripting
- CVE-2024-47149 Privilege escalation in Magic OS
- CVE-2024-47148 Privilege escalation in Magic OS
- CVE-2024-47146 Ruijie Reyee OS Resource Leak
- CVE-2024-47145 Unauthorized access on archived channels via file links
- CVE-2024-47143 dma-debug: fix a possible deadlock on radix_lock
- CVE-2024-47142 Information disclosure in IXG-2C7
- CVE-2024-47141 pinmux: Use sequential access to access desc->pinmux data
- CVE-2024-47140 Cross-site scripting in Observium
- CVE-2024-4714 Campcodes Complete Web-Based School Management System update_subject.php cross site scripting
- CVE-2024-47139 F5 BIG-IQ Vulnerability
- CVE-2024-47138 mySCADA myPRO Missing Authentication for Critical Function
- CVE-2024-47137 Liteos_a has an out-of-bounds Write vulnerability
- CVE-2024-47136 Memory corruption in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software)
- CVE-2024-47135 Memory corruption in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software)
- CVE-2024-47134 Memory corruption in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software)
- CVE-2024-47133 Command injection in UD-LT1
- CVE-2024-47131 Delta Electronics DIAScreen Stack-based Buffer Overflow
- CVE-2024-47130 Missing Authentication for Critical Function in goTenna Pro
- CVE-2024-4713 Campcodes Complete Web-Based School Management System all_teacher.php cross site scripting
- CVE-2024-47129 Observable Response Discrepancy in goTenna Pro
- CVE-2024-47128 Insertion of Sensitive Information Into Sent Data in goTenna Pro
- CVE-2024-47127 Weak Authentication in goTenna Pro
- CVE-2024-47126 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro
- CVE-2024-47125 Improper Restriction of Communication Channel to Intended Endpoints in goTenna Pro
- CVE-2024-47124 Cleartext Transmission of Sensitive Information in goTenna Pro
- CVE-2024-47123 Missing Support for Integrity Check in goTenna Pro
- CVE-2024-47122 Insecure Storage of Sensitive Information in goTenna Pro
- CVE-2024-47121 Weak Passwords Requirements in goTenna Pro
- CVE-2024-47120 IBM Security Verify Information Queue code execution
- CVE-2024-4712 Arbitrary File Creation in PaperCut NG/MF Web Print Image Handler
- CVE-2024-47119 IBM Storage Defender - Resiliency Service improper certificate validation
- CVE-2024-47118 Memory corruption in Db2
- CVE-2024-47117 IBM Carbon Design System cross-site scripting
- CVE-2024-47116 IBM Sterling B2B Integrator cross-site scripting
- CVE-2024-47115 IBM AIX command execution
- CVE-2024-47113 IBM ICP - Voice Gateway XML injection
- CVE-2024-4711 WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting
- CVE-2024-47109 IBM Sterling File Gateway information disclosure
- CVE-2024-47107 IBM QRadar SIEM cross-site scripting
- CVE-2024-47106 IBM Jazz for Service Management information disclosure
- CVE-2024-47104 IBM i incorrect privilege assignment
- CVE-2024-47103 IBM Sterling B2B Integrator cross-site scripting
- CVE-2024-47102 IBM AIX denial of service
- CVE-2024-47100 Cross-site request forgery in SIMATIC S7-1200 CPU 1211C AC/DC/Rly
- CVE-2024-4710 Uber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- CVE-2024-47097 Reflected Cross-Site Scripting in Follet School Solutions Destiny
- CVE-2024-47096 Reflected Cross-Site Scripting in Follet School Solutions Destiny
- CVE-2024-47095 Reflected Cross-Site Scripting in Follet School Solutions Destiny
- CVE-2024-47094 Logging of sitesecret to automations log
- CVE-2024-47093 Fix various XSS issues and potential RCE
- CVE-2024-47092 Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api
- CVE-2024-47091 Privilege escalation via mk_mysql agent plugin on Windows
- CVE-2024-47090 XSS via WYSIWYG editor
- CVE-2024-4709 Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2024-47089 Unauthorized Transaction Manipulation Vulnerability
- CVE-2024-47088 User Enumeration vulnerability
- CVE-2024-47087 Information Disclosure Vulnerability
- CVE-2024-47086 OTP Bypass Vulnerability
- CVE-2024-47085 Parameter Manipulation Vulnerability
- CVE-2024-47084 CORS origin validation is not performed when the request has a cookie in Gradio
- CVE-2024-47083 Power Platform Terraform Provider has Improper Masking of Secrets in Logs
- CVE-2024-47082 Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2024-47081 Requests vulnerable to .netrc credentials leak via malicious URLs
- CVE-2024-47080 matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver
- CVE-2024-4708 mySCADA myPRO Use of Hard-coded Password
- CVE-2024-47079 Unauthorized usage of remote hardware module because of missing channel verification
- CVE-2024-47078 Meshtastic firmware Authentication/Authorization Bypass via MQTT
- CVE-2024-47077 authentik cross-provider token validation problems
- CVE-2024-47076 libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server
- CVE-2024-47075 DOM Clobbering gadgets found in layui that lead to Cross-site Scripting
- CVE-2024-47074 Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
- CVE-2024-47073 Dataease arbitrary interface access vulnerability
- CVE-2024-47072 XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream
- CVE-2024-47071 OSS Endpoint Manager allows unauthorized access to read system files
- CVE-2024-47070 authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header
- CVE-2024-4707 Cross-site scripting in Materialis Companion
- CVE-2024-47069 Oveleon Cookiebar reflected Cross-site Scripting vulnerability
- CVE-2024-47068 DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
- CVE-2024-47067 Alist Contains a Reflected Cross-Site Scripting Vulnerability
- CVE-2024-47066 Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
- CVE-2024-47065 Traceroute_APP responses are not rate-limited.
- CVE-2024-47064 Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints
- CVE-2024-47063 Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint
- CVE-2024-47062 Multiple SQL Injections and ORM Leak in navidrome
- CVE-2024-47061 Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs
- CVE-2024-47060 Unauthorized Access After Organization or Project Deactivation in Zitadel
- CVE-2024-4706 Cross-site scripting in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
- CVE-2024-47059 Users enumeration - weak password login
- CVE-2024-47058 Cross-site Scripting (XSS) - stored (edit form HTML field)
- CVE-2024-47057 User name enumeration possible due to response time difference on password reset form
- CVE-2024-47056 Mautic does not shield .env files from web traffic
- CVE-2024-47055 Segment cloning doesn't have a proper permission check
- CVE-2024-47053 Improper Authorization in Reporting API
- CVE-2024-47051 Remote Code Execution & File Deletion in Asset Uploads
- CVE-2024-47050 XSS in contact/company tracking (no authentication)
- CVE-2024-4705 Testimonials Widget <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode