Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 267 of 521.
- CVE-2024-45436 Ollama can extract members of a ZIP archive outside of the parent directory
- CVE-2024-45435 Code injection in chartist:chartist
- CVE-2024-45434 Use after free in opensynergy:blue sdk
- CVE-2024-45433 Security feature bypass in opensynergy:blue sdk
- CVE-2024-45432 Other in opensynergy:blue sdk
- CVE-2024-45431 Other in opensynergy:blue sdk
- CVE-2024-4543 Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery
- CVE-2024-45429 Cross-site scripting in Advanced Custom Fields
- CVE-2024-45426 Zoom Workplace Apps - Incorrect Ownership Assignment
- CVE-2024-45425 Zoom Workplace Apps - Incorrect User Management
- CVE-2024-45424 Zoom Workplace Apps - Business Logic Error
- CVE-2024-45422 Zoom Apps - Improper Input Validation
- CVE-2024-45421 Zoom Apps - Buffer Overflow
- CVE-2024-45420 Zoom Apps - Uncontrolled Resource Consumption
- CVE-2024-45419 Zoom Apps - Improper Input Validation
- CVE-2024-45418 Zoom Apps for macOS - Symbolic Link Following
- CVE-2024-45417 Zoom Apps for macOS - Uncontrolled Resource Consumption
- CVE-2024-45416 The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function.
- CVE-2024-45415 The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function.
- CVE-2024-45414 The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function.
- CVE-2024-45413 The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function.
- CVE-2024-45412 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack
- CVE-2024-45411 Twig has a possible sandbox bypass
- CVE-2024-45410 HTTP client can remove the X-Forwarded headers in Traefik
- CVE-2024-4541 Custom Product List Table <= 3.0.0 - Cross-Site Request Forgery
- CVE-2024-45409 The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector
- CVE-2024-45408 eLabFTW contains a direct and indirect information disclosure
- CVE-2024-45407 Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client
- CVE-2024-45406 Craft CMS stored XSS in breadcrumb list and title fields
- CVE-2024-45405 gix-path improperly resolves configuration path reported by Git
- CVE-2024-45404 OpenCTI's lack of Rate Limit lead to OTP brute forcing
- CVE-2024-45403 H2O assertion failure when HTTP/3 requests are cancelled
- CVE-2024-45402 Picotls double free
- CVE-2024-45401 stripe-cli Path Traversal vulnerability
- CVE-2024-45400 CKEditor Open Link plugin vulnerable to Cross-site Scripting
- CVE-2024-4540 Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie
- CVE-2024-45399 Indico has a Cross-Site-Scripting during account creation
- CVE-2024-45398 Remote command execution through file upload in contao/core-bundle
- CVE-2024-45397 H2O alllows bypassing address-based access control with 0-RTT
- CVE-2024-45396 Quicly assertion failures
- CVE-2024-45395 Unbounded loop over untrusted input can lead to endless data attack
- CVE-2024-45394 Secret encryption vulnerable to brute-force attacks
- CVE-2024-45393 Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries
- CVE-2024-45392 SuiteCRM has wrong deletion permission checks on API delete call
- CVE-2024-45391 Tina search token leak via lock file in TinaCMS
- CVE-2024-45390 @blakeembrey/template vulnerable to code injection when attacker controls template input
- CVE-2024-4539 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2024-45389 Pagefind DOM clobbering could escalate to Cross-site Scripting (XSS)
- CVE-2024-45388 Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`)
- CVE-2024-45387 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments
- CVE-2024-45386 Auth bypass in SIMATIC PCS neo V4.0
- CVE-2024-45385 Cross-site scripting in Industrial Edge Management OS (IEM-OS)
- CVE-2024-45384 druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability
- CVE-2024-45383 Denial of service in HDAudBus.sys
- CVE-2024-45382 Liteos_a has an Out-of-bounds Write vulnerability
- CVE-2024-4538 IDOR vulnerability in Janto Ticketing Software
- CVE-2024-45374 goTenna Pro ATAK Plugin Weak Password Requirements
- CVE-2024-45373 Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Improper Privilege Management
- CVE-2024-45372 Cross-site request forgery in MZK-DP300N
- CVE-2024-45371 Missing authorization in Intel(R) Arc™ & Iris(R) Xe graphics software
- CVE-2024-45370 Auth bypass in Easy Config System
- CVE-2024-4537 IDOR vulnerability in Janto Ticketing Software
- CVE-2024-45369 mySCADA myPRO Improper Authentication
- CVE-2024-45368 AutomationDirect DirectLogic H2-DM1E Session Fixation
- CVE-2024-45367 Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication
- CVE-2024-45366 Cross-site scripting in Welcart e-Commerce
- CVE-2024-45361 Mi Connect Service APP protocol flaws lead to leaking sensitive user information
- CVE-2024-4536 Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability
- CVE-2024-45356 Xiaomi phone framework has unauthorized access vulnerability
- CVE-2024-45355 Xiaomi phone framework has unauthorized access vulnerability
- CVE-2024-45354 xiaomi shop application Webview has code execution vulnerability
- CVE-2024-45353 quick App has intent redriction vulnerability
- CVE-2024-45352 Xiaomi smarthome application Webview has code execution vulnerability
- CVE-2024-45351 Game center application has code execution Vulnerability
- CVE-2024-4535 KKProgressbar2 Free <= 1.1.4.2 - Progress Bar Deletion via CSRF
- CVE-2024-45348 Xiaomi Router AX9000 has a post-authorization command injection vulnerability
- CVE-2024-45347 Mi Connect Service APP protocol flaws lead to unauthorized access
- CVE-2024-45346 GetApps application has code execution vulnerability
- CVE-2024-45341 Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509
- CVE-2024-45340 GOAUTH credential leak in cmd/go
- CVE-2024-4534 KKProgressbar2 Free <= 1.1.4.2 - Stored XSS via CSRF
- CVE-2024-45339 Vulnerability when creating log files in github.com/golang/glog
- CVE-2024-45338 Non-linear parsing of case-insensitive content in golang.org/x/net/html
- CVE-2024-45337 Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto
- CVE-2024-45336 Sensitive headers incorrectly sent after cross-domain redirect in net/http
- CVE-2024-45335 Security feature bypass in Trend Micro Antivirus One
- CVE-2024-45334 Missing authorization in Trend Micro Antivirus One
- CVE-2024-45333 Missing authorization in Intel(R) Data Center GPU Flex Series for Windows driver
- CVE-2024-45332 Information disclosure in Intel(R) Processors
- CVE-2024-45331 Privilege escalation in FortiAnalyzer
- CVE-2024-45330 Memory corruption in FortiAnalyzer
- CVE-2024-4533 KKProgressbar2 Free <= 1.1.4.2 - Admin+ SQL Injection
- CVE-2024-45329 Missing authorization in FortiPortal
- CVE-2024-45328 Privilege escalation in FortiSandbox
- CVE-2024-45327 Auth bypass in FortiSOAR
- CVE-2024-45326 Missing authorization in FortiDeceptor
- CVE-2024-45325 Command injection in FortiDDoS-F
- CVE-2024-45324 Memory corruption in FortiOS
- CVE-2024-45323 Missing authorization in FortiEDR Manager
- CVE-2024-45321 Supply chain in app\:\