Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 268 of 521.
- CVE-2024-45320 Memory corruption in DocuPrint CM225fw
- CVE-2024-4532 Business Card <= 1.0.0 - Arbitrary Card Deletion via CSRF
- CVE-2024-45319 Auth bypass in SMA100
- CVE-2024-45318 Memory corruption in SMA100
- CVE-2024-45317 Server-side request forgery in SMA1000
- CVE-2024-45316 Privilege escalation in Connect Tunnel
- CVE-2024-45315 Path traversal in Connect Tunnel
- CVE-2024-45314 Flask-AppBuilder login form allows browser to cache sensitive fields
- CVE-2024-45313 Insecure default setting for Server Pro installed via Overleaf toolkit
- CVE-2024-45312 Arbitrary language parameter can passed to `aspell` executable via spelling requests in overleaf
- CVE-2024-45311 Denial of service in quinn-proto when using `Endpoint::retry()`
- CVE-2024-45310 runc can be confused to create empty files/directories on the host
- CVE-2024-4531 Business Card <= 1.0.0 - Card Edit via CSRF
- CVE-2024-45309 OneDev vulnerable to arbitrary file reading for unauthenticated user
- CVE-2024-45308 MySQL & free URL mode allows to hide existing notes in hedgedoc
- CVE-2024-45307 SudoBot missing authorization check in `-config` command
- CVE-2024-45306 heap-buffer-overflow in Vim
- CVE-2024-45305 gix-path uses local config across repos when it is the highest scope
- CVE-2024-45304 Business logic in cairo-contracts
- CVE-2024-45303 Discourse Calendar plugin event names susceptible to XSS
- CVE-2024-45302 CRLF Injection in RestSharp's `RestRequest.AddHeader` method
- CVE-2024-45301 ZDI-CAN-24744: Mintty Path Conversion Improper Input Validation Information Disclosure Vulnerability
- CVE-2024-45300 Bypassing promo code limitations with race conditions
- CVE-2024-4530 Business Card <= 1.0.0 - Category Edit via CSRF
- CVE-2024-45299 alf.io's preloaded data as json is not escaped correctly
- CVE-2024-45298 Disabled user can bypass lockout by requesting password reset in wiki.js
- CVE-2024-45297 Prevent topic list filtering by hidden tags for unauthorized users in Discourse
- CVE-2024-45296 path-to-regexp outputs backtracking regular expressions
- CVE-2024-45294 `org.hl7.fhir.core` XXE vulnerability in XSLT transforms
- CVE-2024-45293 XML External Entity Reference (XXE) in PHPSpreadsheet's XLSX reader
- CVE-2024-45292 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via JavaScript hyperlinks
- CVE-2024-45291 Path traversal and Server-Side Request Forgery in HTML writer when embedding images is enabled in PHPSpreadsheet
- CVE-2024-45290 Path traversal and Server-Side Request Forgery when opening XLSX files in PHPSpreadsheet
- CVE-2024-4529 Business Card <= 1.0.0 - Category Deletion via CSRF
- CVE-2024-45289 Unbounded allocation in ctl(4) CAM Target Layer
- CVE-2024-45288 Multiple vulnerabilities in libnv
- CVE-2024-45287 Multiple vulnerabilities in libnv
- CVE-2024-45286 Missing Authorization check in SAP Production and Revenue Accounting (Tobin interface)
- CVE-2024-45285 Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2024-45284 Missing authorization check in SAP Student Life Cycle Management (SLcM)
- CVE-2024-45283 Information disclosure vulnerability in SAP NetWeaver AS for Java (Destination Service)
- CVE-2024-45282 HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements)
- CVE-2024-45281 DLL hijacking vulnerability in SAP BusinessObjects Business Intelligence Platform
- CVE-2024-45280 Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)
- CVE-2024-4528 SourceCodester Prison Management System user-record.php cross site scripting
- CVE-2024-45279 Cross-site scripting in SAP NetWeaver Application Server for ABAP (CRM Blueprint Application Builder Panel)
- CVE-2024-45278 Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice
- CVE-2024-45277 Prototype Pollution vulnerability in SAP HANA Client
- CVE-2024-45276 MB connect line/Helmholz: tmp directory exposed via webservice
- CVE-2024-45275 MB connect line/Helmholz: Hardcoded user accounts with hard-coded passwords
- CVE-2024-45274 MB connect line/Helmholz: Remote code execution via confnet service
- CVE-2024-45273 MB connect line/Helmholz: Weak encryption of configuration file
- CVE-2024-45272 MB connect line/Helmholz: Generation of weak passwords vulnerability
- CVE-2024-45271 MB connect line/Helmholz: Remote code execution due to improper input validation
- CVE-2024-45270 Cross-site request forgery in Carousel Slider
- CVE-2024-4527 Campcodes Complete Web-Based School Management System student_payment_details2.php cross site scripting
- CVE-2024-45269 Cross-site request forgery in Carousel Slider
- CVE-2024-45265 SQL injection in skyss:arfa-cms
- CVE-2024-45264 Cross-site request forgery in skyss:arfa-cms
- CVE-2024-45263 File upload in gl-inet:a1300 firmware
- CVE-2024-45262 Path traversal in gl-inet:a1300 firmware
- CVE-2024-45261 Auth bypass in gl-inet:a1300 firmware
- CVE-2024-45260 Missing authorization in gl-inet:a1300 firmware
- CVE-2024-4526 Campcodes Complete Web-Based School Management System student_payment_details3.php cross site scripting
- CVE-2024-45259 Path traversal in gl-inet:a1300 firmware
- CVE-2024-45258 req may send an unintended request when a malformed URL is provided
- CVE-2024-45257 A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on th
- CVE-2024-45256 An arbitrary file write issue in the exfiltration endpoint in BYOB (Build Your Own Botnet) 2.0 allows attackers to overwrite SQLite database
- CVE-2024-45254 VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2024-45253 Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CVE-2024-45252 Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CVE-2024-45251 Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CVE-2024-45250 ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-4525 Campcodes Complete Web-Based School Management System student_payment_details4.php cross site scripting
- CVE-2024-45249 Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CVE-2024-45248 Multi-DNC – CWE-35: Path Traversal: '.../...//'
- CVE-2024-45247 Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- CVE-2024-45246 Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element
- CVE-2024-45245 Diebold Nixdorf – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-45244 Hyperledger Fabric does not verify request has a timestamp within the expected time window
- CVE-2024-45242 EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utility.
- CVE-2024-45241 A traversal vulnerability in GeneralDocs.aspx in CentralSquare CryWolf (False Alarm Management) through 2024-08-09 allows unauthenticated at
- CVE-2024-45240 The TikTok (aka com.zhiliaoapp.musically) application before 34.5.5 for Android allows the takeover of Lynxview JavaScript interfaces via de
- CVE-2024-4524 Campcodes Complete Web-Based School Management System student_payment_invoice.php cross site scripting
- CVE-2024-45239 Null dereference in nicmx:fort-validator
- CVE-2024-45238 Null dereference in nicmx:fort validator
- CVE-2024-45237 Memory corruption in nicmx:fort-validator
- CVE-2024-45236 Denial of service in nicmx:fort-validator
- CVE-2024-45235 Null dereference in nicmx:fort validator
- CVE-2024-45234 Denial of service in nicmx:fort-validator
- CVE-2024-45233 Powermail TYPO3 extension Broken Access Control in the OutputController
- CVE-2024-45232 "powermail" (powermail) Insecure Direct Object Reference (IDOR)
- CVE-2024-45231 Django allows enumeration of user e-mail addresses
- CVE-2024-45230 Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters
- CVE-2024-4523 Campcodes Complete Web-Based School Management System teacher_attendance_history1.php cross site scripting
- CVE-2024-45229 Missing authorization in Director
- CVE-2024-4522 Campcodes Complete Web-Based School Management System teacher_salary_details.php cross site scripting
- CVE-2024-45219 Apache CloudStack: Uploaded and registered templates and volumes can be used to abuse KVM-based infrastructure
- CVE-2024-45217 Apache Solr: ConfigSets created during a backup restore command are trusted implicitly
- CVE-2024-45216 Apache Solr: Authentication bypass possible using a fake URL Path ending