Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 263 of 521.
- CVE-2024-4590 DedeCMS sys_info.php cross-site request forgery
- CVE-2024-45894 Path traversal in bluecms project:bluecms
- CVE-2024-45893 Command injection in draytek:vigor3900 firmware
- CVE-2024-45891 Command injection in draytek:vigor3900 firmware
- CVE-2024-45890 Command injection in draytek:vigor3900 firmware
- CVE-2024-4589 DedeCMS mytag_edit.php cross-site request forgery
- CVE-2024-45889 Command injection in draytek:vigor3900 firmware
- CVE-2024-45888 Command injection in draytek:vigor3900 firmware
- CVE-2024-45887 Command injection in draytek:vigor3900 firmware
- CVE-2024-45885 Command injection in draytek:vigor3900 firmware
- CVE-2024-45884 Command injection in draytek:vigor3900 firmware
- CVE-2024-45882 Command injection in draytek:vigor3900 firmware
- CVE-2024-45880 A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below.
- CVE-2024-4588 DedeCMS mytag_add.php cross-site request forgery
- CVE-2024-45879 The file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QW
- CVE-2024-45878 The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.291), in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable
- CVE-2024-45877 baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx.
- CVE-2024-45876 The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection.
- CVE-2024-45875 The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewU
- CVE-2024-45874 A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafte
- CVE-2024-45873 A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a cra
- CVE-2024-45872 Memory corruption in bandisoft:bandiview
- CVE-2024-45871 Denial of service in bandisoft:bandiview
- CVE-2024-45870 Memory corruption in bandisoft:bandiview
- CVE-2024-4587 DedeCMS tpl.php cross-site request forgery
- CVE-2024-45863 Null dereference in Facebook Thrift
- CVE-2024-45862 Cleartext Storage of Sensitive Information in Kastle Systems Access Control System
- CVE-2024-45861 Use of Hard-coded Credentials in Kastle Systems Access Control System
- CVE-2024-4586 DedeCMS shops_delivery.php cross-site request forgery
- CVE-2024-45858 Guardrails has an arbitrary code execution vulnerability
- CVE-2024-45857 Cleanlab Deserialization of Untrusted Data vulnerability
- CVE-2024-45856 MindsDB Cross-site Scripting vulnerability
- CVE-2024-45855 MindsDB Deserialization of Untrusted Data vulnerability
- CVE-2024-45854 MindsDB Deserialization of Untrusted Data vulnerability
- CVE-2024-45853 MindsDB Deserialization of Untrusted Data vulnerability
- CVE-2024-45852 MindsDB Deserialization of Untrusted Data vulnerability
- CVE-2024-45851 MindsDB Eval Injection vulnerability
- CVE-2024-45850 MindsDB Eval Injection vulnerability
- CVE-2024-4585 DedeCMS member_type.php cross-site request forgery
- CVE-2024-45849 MindsDB Eval Injection vulnerability
- CVE-2024-45848 MindsDB Eval Injection vulnerability
- CVE-2024-45847 MindsDB Eval Injection vulnerability
- CVE-2024-45846 MindsDB Eval Injection vulnerability
- CVE-2024-45844 BIG-IP monitors vulnerability
- CVE-2024-45843 Weak SSRF Filtering
- CVE-2024-45842 Path traversal in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-45841 Information disclosure in UD-LT1
- CVE-2024-4584 Faraday GM8181/GM828x command_port.ini information disclosure
- CVE-2024-45838 goTenna Pro ATAK Plugin Cleartext Transmission of Sensitive Information
- CVE-2024-45837 Hardcoded credentials in IX-BA
- CVE-2024-45836 Cross-site scripting in CS-QR10
- CVE-2024-45835 Insufficient Electron Fuses Configuration
- CVE-2024-45833 Mobile password gets saved in dictionary under conditions
- CVE-2024-45832 Ossur Mobile Logic Application Use of Hard-coded Credentials
- CVE-2024-4583 Faraday GM8181/GM828x Request information disclosure
- CVE-2024-45829 Memory corruption in Sharp Digital Full-color MFPs and Monochrome MFPs
- CVE-2024-45828 i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
- CVE-2024-45827 Command injection in Mesh Wi-Fi router RP562B
- CVE-2024-45826 ThinManager® Code Execution Vulnerability
- CVE-2024-45825 5015-U8IHFT Denial-of-Service Vulnerability via CIP Message
- CVE-2024-45824 FactoryTalk® View Site Edition Remote Code Execution Vulnerability via Lack of Input Validation
- CVE-2024-45823 FactoryTalk® Batch View™ Authentication Bypass Vulnerability via shared secrets
- CVE-2024-4582 Faraday GM8181/GM828x NTP Service os command injection
- CVE-2024-45819 libxl leaks data to PVH guests via ACPI tables
- CVE-2024-45818 Deadlock in x86 HVM standard VGA handling
- CVE-2024-45817 x86: Deadlock in vlapic_error()
- CVE-2024-45816 Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend
- CVE-2024-45815 Prototype pollution in @backstage/plugin-catalog-backend
- CVE-2024-45813 ReDoS vulnerability in multiparametric routes in find-my-way
- CVE-2024-45812 DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite
- CVE-2024-45811 server.fs.deny bypassed when using ?import&raw in vite
- CVE-2024-45810 Envoy crashes for LocalReply in http async client
- CVE-2024-4581 Cross-site scripting in Slider Revolution
- CVE-2024-45809 Jwt filter crash in the clear route cache with remote JWKs in envoy
- CVE-2024-45808 Malicious log injection via access logs in envoy
- CVE-2024-45807 oghttp2 crash on OnBeginHeadersForStream in envoy
- CVE-2024-45806 Potential manipulate `x-envoy` headers from external sources in envoy
- CVE-2024-45805 OpenCTI leaks support information due to inadequate access control
- CVE-2024-45803 Cross site scripting (XSS) Vulnerability on route /wireui/button?label=Content in wireui
- CVE-2024-45802 Squid Denial of Service
- CVE-2024-45801 Tampering by prototype polution in DOMPurify
- CVE-2024-45800 Multiple mXSS found in snappymail HTML parser
- CVE-2024-4580 Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits
- CVE-2024-45799 Javascript Injection in Vending Info/Buyers Info Module in FluxCP
- CVE-2024-45798 Multiple Poisoned Pipeline Execution (PPE) vulnerabilities
- CVE-2024-45797 LibHTP's unbounded header handling leads to denial service
- CVE-2024-45796 Suricata defrag: off by one can lead to policy bypass
- CVE-2024-45795 Suricata detect/datasets: reachable assertion with unimplemented rule option
- CVE-2024-45794 SQL Injection in CreateUser API in devtron
- CVE-2024-45793 Cross-site Scripting from in Confidant API call
- CVE-2024-45792 MantisBT vulnerable to information disclosure with user profiles
- CVE-2024-45791 Apache HertzBeat: Exposure sensitive token via http GET method with query string
- CVE-2024-45790 User Enumeration vulnerability
- CVE-2024-45789 Parameter Tampering Vulnerability
- CVE-2024-45788 No Rate Limiting Vulnerability
- CVE-2024-45787 Information Disclosure Vulnerability
- CVE-2024-45786 Improper Authorization Vulnerability
- CVE-2024-45785 Auth bypass in MUSASI
- CVE-2024-45784 Apache Airflow: Sensitive configuration values are not masked in the logs by default
- CVE-2024-45783 Grub2: fs/hfs+: refcount can be decremented twice