Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 256 of 521.
- CVE-2024-47049 czim/file-handling vulnerable to SSRF and directory traversal
- CVE-2024-47048 Cross-site scripting in rocket.chat:rocket.chat
- CVE-2024-47047 powermail TYPO3 extension has Insecure Direct Object Reference
- CVE-2024-47046 Memory corruption in Simcenter Femap V2306
- CVE-2024-47045 Privilege escalation in The installer of e-Tax software(common program)
- CVE-2024-47044 Missing authorization in Hikari Denwa router PR-400MI
- CVE-2024-47043 Ruijie Reyee OS Insecure Storage of Sensitive Information
- CVE-2024-47041 Memory corruption in Android
- CVE-2024-47040 Use After Free in the android.hardware.radio.sap.ISap/slot2 service
- CVE-2024-4704 Contact Form 7 < 5.9.5 - Unauthenticated Open Redirect
- CVE-2024-47039 OOB Read in the android.hardware.boot.IBootControl/default service
- CVE-2024-47038 Memory corruption in Android
- CVE-2024-47035 Memory corruption in Android
- CVE-2024-47034 Memory corruption in Android
- CVE-2024-47033 Use after free in Android
- CVE-2024-47032 Memory corruption in Android
- CVE-2024-47031 Privilege escalation in Android
- CVE-2024-47030 Information disclosure in Android
- CVE-2024-4703 Cross-site scripting in One Page Express Companion
- CVE-2024-47029 Memory corruption in Android
- CVE-2024-47028 Integer overflow in Android
- CVE-2024-47027 Memory corruption in Android
- CVE-2024-47026 Memory corruption in Android
- CVE-2024-47025 Information disclosure in Android
- CVE-2024-47024 Integer overflow in Android
- CVE-2024-47023 Business logic in Android
- CVE-2024-47022 Information disclosure in Android
- CVE-2024-47021 Memory corruption in Android
- CVE-2024-47020 Information disclosure in Android
- CVE-2024-4702 Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget
- CVE-2024-47019 Memory corruption in Android
- CVE-2024-47018 Memory corruption in Android
- CVE-2024-47017 Use after free in Android
- CVE-2024-47016 Misconfiguration in Android
- CVE-2024-47015 Memory corruption in Android
- CVE-2024-47014 Privilege escalation in Android
- CVE-2024-47013 Memory corruption in Android
- CVE-2024-47012 Memory corruption in Android
- CVE-2024-47011 Path traversal in Avalanche
- CVE-2024-47010 Auth bypass in Avalanche
- CVE-2024-4701 Path Traversal vulnerability via File Uploads in Genie
- CVE-2024-47009 Auth bypass in Avalanche
- CVE-2024-47008 Server-side request forgery in Avalanche
- CVE-2024-47007 Null dereference in Avalanche
- CVE-2024-47006 Privilege escalation in Intel(R) RealSense D400 Series
- CVE-2024-47005 Missing authorization in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-47003 DoS via non-string message using permalink embed
- CVE-2024-47002 Cross-site scripting in Observium
- CVE-2024-47001 Command injection in AHD04T-A
- CVE-2024-47000 Service Users Deactivation not Working in Zitadel
- CVE-2024-4700 WP Table Builder – WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-46999 User Grant Deactivation not Working in Zitadel
- CVE-2024-46998 baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature
- CVE-2024-46997 DataEase's H2 datasource has a remote command execution risk
- CVE-2024-46996 baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature
- CVE-2024-46995 baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request
- CVE-2024-46994 baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature
- CVE-2024-46993 Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath
- CVE-2024-46992 Electron ASAR Integrity bypass by just modifying the content
- CVE-2024-46990 SSRF Loopback IP filter bypass in directus
- CVE-2024-4699 D-Link DAR-8000-10 importhtml.php deserialization
- CVE-2024-46989 Multiple caveats on resources of the same type can result in no permission when permission is expected
- CVE-2024-46988 Tuleap does not properly check permissions for email notifications in trackers
- CVE-2024-46987 Arbitrary path traversal in Camaleon CMS
- CVE-2024-46986 Arbitrary file write leading to RCE in Camaleon CMS
- CVE-2024-46985 DataEase has an XXE vulnerability
- CVE-2024-46984 Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack
- CVE-2024-46983 Remote Command Execution(RCE) Vulnerbility in sofa-hessian
- CVE-2024-46982 Cache Poisoning in next.js
- CVE-2024-46981 Redis' Lua library commands may lead to remote code execution
- CVE-2024-46980 Tuleap vulnerable to XSS in the HTML mail content of the cross reference field
- CVE-2024-4698 Testimonial Carousel For Elementor <= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-46979 Data leak of notification filters of users in XWiki Platform
- CVE-2024-46978 Missing checks for notification filter preferences editions in XWiki Platform
- CVE-2024-46977 OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)
- CVE-2024-46976 Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend
- CVE-2024-46975 GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mapping
- CVE-2024-46974 GPU DDK - Arbitrary write of read-only dmabuf
- CVE-2024-46973 Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement
- CVE-2024-46972 GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence
- CVE-2024-46971 GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems
- CVE-2024-46970 Cross-site scripting in IntelliJ IDEA
- CVE-2024-4697 Cross-site scripting in Cowidgets – Elementor Addons
- CVE-2024-46966 The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbit
- CVE-2024-46965 The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execut
- CVE-2024-46964 The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaSc
- CVE-2024-46963 The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attac
- CVE-2024-46962 The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary
- CVE-2024-46961 The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to ex
- CVE-2024-46960 The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execut
- CVE-2024-4696 Command injection in Service Bridge
- CVE-2024-46959 runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account.
- CVE-2024-46958 Misconfiguration in nextcloud:desktop
- CVE-2024-46957 Mellium allows Authentication Bypass by Spoofing
- CVE-2024-46956 Memory corruption in artifex:ghostscript
- CVE-2024-46955 Memory corruption in artifex:ghostscript
- CVE-2024-46954 Path traversal in artifex:ghostscript
- CVE-2024-46953 Integer overflow in artifex:ghostscript
- CVE-2024-46952 Memory corruption in artifex:ghostscript
- CVE-2024-46951 Memory corruption in artifex:ghostscript