Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 257 of 521.
- CVE-2024-4695 Move Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- CVE-2024-46948 Missing authorization in northern.tech:mender
- CVE-2024-46947 Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF.
- CVE-2024-46946 LangChain Experimental Eval Injection vulnerability
- CVE-2024-46943 OpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability
- CVE-2024-46942 OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries
- CVE-2024-46941 SystemUI component protection settings vulnerability
- CVE-2024-46939 Game Extension Engine Path Traversal Vulnerability
- CVE-2024-46938 Information disclosure in sitecore:experience commerce
- CVE-2024-46937 Missing authorization in mfasoft:secure authentication server
- CVE-2024-46936 Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message forgery / impersonation issue.
- CVE-2024-46935 Denial of service in rocket chat message parser
- CVE-2024-46934 Cross-site scripting in rocket.chat:rocket.chat
- CVE-2024-46933 An issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF_C4E 101.05.0014.
- CVE-2024-4693 Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash
- CVE-2024-46923 Null dereference in samsung:exynos 1480 firmware
- CVE-2024-46922 Null dereference in samsung:exynos 1480 firmware
- CVE-2024-46921 Denial of service in samsung:exynos 1080 firmware
- CVE-2024-46920 Memory corruption in samsung:exynos 1080 firmware
- CVE-2024-4692 Multiple missing permission checks
- CVE-2024-46919 Memory corruption in samsung:exynos 1080 firmware
- CVE-2024-46918 Missing authorization in misp-project:misp
- CVE-2024-46917 Security feature bypass in dieboldnixdorf:vynamic security suite
- CVE-2024-46916 Race condition in dieboldnixdorf:vynamic security suite
- CVE-2024-46911 Apache Roller: Weakness in CSRF protection allows privilege escalation
- CVE-2024-46910 Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user
- CVE-2024-46909 WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability
- CVE-2024-46908 WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability
- CVE-2024-46907 WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability
- CVE-2024-46906 WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability
- CVE-2024-46905 WhatsUp Gold GetOrderByClause SQL Injection Privilege Escalation Vulnerability
- CVE-2024-46903 Information disclosure in Trend Micro Deep Discovery Inspector
- CVE-2024-46902 Information disclosure in Trend Micro Deep Discovery Inspector
- CVE-2024-46901 Apache Subversion: mod_dav_svn denial-of-service via control characters in paths
- CVE-2024-4690 Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools
- CVE-2024-46899 Information disclosure in Hitachi Ops Center Analyzer viewpoint OVF
- CVE-2024-46898 Path traversal in SHIRASAGI
- CVE-2024-46897 Missing authorization in Exment
- CVE-2024-46896 drm/amdgpu: don't access invalid sched
- CVE-2024-46895 Privilege escalation in Intel(R) Arc™ & Iris(R) Xe graphics software
- CVE-2024-46894 Missing authorization in SINEC INS
- CVE-2024-46892 Auth bypass in SINEC INS
- CVE-2024-46891 Denial of service in SINEC INS
- CVE-2024-46890 Command injection in SINEC INS
- CVE-2024-4689 WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-46889 Hardcoded credentials in SINEC INS
- CVE-2024-46888 Path traversal in SINEC INS
- CVE-2024-46887 Auth bypass in SIMATIC Drive Controller CPU 1504D TF
- CVE-2024-46886 Open redirect in SIMATIC Drive Controller CPU 1504D TF
- CVE-2024-46881 Misconfiguration in Enterprise
- CVE-2024-4688 Campcodes Complete Web-Based School Management System conversation_history_admin.php cross site scripting
- CVE-2024-46879 Cross-site scripting in tiki:tiki
- CVE-2024-46878 Cross-site scripting in tiki:tiki
- CVE-2024-46874 Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges
- CVE-2024-46873 Misconfiguration in PocketWifi 809SH
- CVE-2024-46872 Client-Side Path Traversal Leading to CSRF in Playbooks
- CVE-2024-46871 drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
- CVE-2024-46870 drm/amd/display: Disable DMCUB timeout for DCN35
- CVE-2024-4687 Campcodes Complete Web-Based School Management System create_events.php cross site scripting
- CVE-2024-46869 Bluetooth: btintel_pcie: Allocate memory for driver private data
- CVE-2024-46868 firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire()
- CVE-2024-46867 drm/xe/client: fix deadlock in show_meminfo()
- CVE-2024-46866 drm/xe/client: add missing bo locking in show_meminfo()
- CVE-2024-46865 fou: fix initialization of grc
- CVE-2024-46864 x86/hyperv: fix kexec crash due to VP assist page corruption
- CVE-2024-46863 ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item
- CVE-2024-46862 ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item
- CVE-2024-46861 usbnet: ipheth: do not stop RX on failing RX callback
- CVE-2024-46860 wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change
- CVE-2024-4686 Campcodes Complete Web-Based School Management System emarks_range_grade_update_form.php cross site scripting
- CVE-2024-46859 platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses
- CVE-2024-46858 mptcp: pm: Fix uaf in __timer_delete_sync
- CVE-2024-46857 net/mlx5: Fix bridge mode operations when there are no VFs
- CVE-2024-46856 net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices
- CVE-2024-46855 netfilter: nft_socket: fix sk refcount leaks
- CVE-2024-46854 net: dpaa: Pad packets to ETH_ZLEN
- CVE-2024-46853 spi: nxp-fspi: fix the KASAN report out-of-bounds bug
- CVE-2024-46852 dma-buf: heaps: Fix off-by-one in CMA heap fault handler
- CVE-2024-46851 drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct()
- CVE-2024-46850 drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct()
- CVE-2024-4685 Campcodes Complete Web-Based School Management System exam_timetable.php cross site scripting
- CVE-2024-46849 ASoC: meson: axg-card: fix 'use-after-free'
- CVE-2024-46848 perf/x86/intel: Limit the period on Haswell
- CVE-2024-46847 mm: vmalloc: ensure vmap_block is initialised before adding to queue
- CVE-2024-46846 spi: rockchip: Resolve unbalanced runtime PM / system PM handling
- CVE-2024-46845 tracing/timerlat: Only clear timer if a kthread exists
- CVE-2024-46844 um: line: always fill *error_out in setup_one_line()
- CVE-2024-46843 scsi: ufs: core: Remove SCSI host only if added
- CVE-2024-46842 scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info
- CVE-2024-46841 btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
- CVE-2024-46840 btrfs: clean up our handling of refs == 0 in snapshot delete
- CVE-2024-4684 Campcodes Complete Web-Based School Management System exam_timetable_grade_wise.php cross site scripting
- CVE-2024-46838 userfaultfd: don't BUG_ON() if khugepaged yanks our page table
- CVE-2024-46837 drm/panthor: Restrict high priorities on group_create
- CVE-2024-46836 usb: gadget: aspeed_udc: validate endpoint index for ast udc
- CVE-2024-46835 drm/amdgpu: Fix smatch static checker warning
- CVE-2024-46834 ethtool: fail closed if we can't get max channel used in indirection tables
- CVE-2024-46833 net: hns3: void array out of bound when loop tnl_num
- CVE-2024-46832 MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
- CVE-2024-46831 net: microchip: vcap: Fix use-after-free error in kunit test