Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 283 of 521.
- CVE-2024-43420 Information disclosure in Intel Atom(R) processors
- CVE-2024-4342 Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-43418 GLPI has multiple reflected XSS
- CVE-2024-43417 Reflected XSS in Software form
- CVE-2024-43416 GLPI vulnerable to enumeration of users' email addresses by unauthenticated user
- CVE-2024-43415 Decidim-Awesome: SQL injection in AdminAccountability
- CVE-2024-43414 Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries
- CVE-2024-43413 Xibo CMS XSS vulnerability using DataSet HTML columns
- CVE-2024-43412 Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS
- CVE-2024-43411 CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover
- CVE-2024-43410 Russh has an OOM Denial of Service due to allocation of untrusted amount
- CVE-2024-4341 IDOR in ExtremePacs's Extreme XDS
- CVE-2024-43409 Ghost's improper authentication allows access to member information and actions
- CVE-2024-43408 Discourse Placeholder Forms has a XSS stopped by CSP
- CVE-2024-43407 Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability
- CVE-2024-43406 LF Edge eKuiper has a SQL Injection in sqlKvStore
- CVE-2024-43405 Nuclei Template Signature Verification Bypass
- CVE-2024-43404 Remote Code Execution Vulnerability in MEGABOT
- CVE-2024-43403 Kanister has a potential risk which can be leveraged to make a cluster-level privilege escalation
- CVE-2024-43402 Rust OS Command Injection/Argument Injection vulnerability
- CVE-2024-43401 In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
- CVE-2024-43400 XWiki Platform allows XSS through XClass name in string properties
- CVE-2024-4340 Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.
- CVE-2024-43399 Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files
- CVE-2024-43398 REXML denial of service vulnerability
- CVE-2024-43397 Potential unauthorized access issue in apollo-portal
- CVE-2024-43396 Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)
- CVE-2024-43395 CraftOS-PC 2's improperly sanitizied paths cause filesystem escape (Windows)
- CVE-2024-43394 Apache HTTP Server: SSRF on Windows due to UNC paths
- CVE-2024-43393 Phoenix Contact: Configuration changes of the firewall services can lead to DoS in MGUARD devices
- CVE-2024-43392 Phoenix Contact: Firewall reconfiguration through the FW_environment variables in MGUARD devices
- CVE-2024-43391 Phoenix Contact: Firewall reconfiguration through the FW_PORTFORWARDING.SRC_IP in MGUARD devices
- CVE-2024-43390 Phoenix Contact: Firewall reconfiguration due to improper input validation in MGUARD devices
- CVE-2024-4339 Cross-site scripting in Prime Slider – Addons for Elementor
- CVE-2024-43389 Phoenix Contact: OSPF reconfiguration due to improper input validation in MGUARD devices
- CVE-2024-43388 Phoenix Contact: SNMP reconfiguration due to improper input validation in MGUARD devices
- CVE-2024-43387 Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devices
- CVE-2024-43386 Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.
- CVE-2024-43385 Phoenix Contact: OS command execution through PROXY_HTTP_PORT in mGuard devices
- CVE-2024-43384 Phoenix Contact: Improper removal of sensitive information in MGUARD products
- CVE-2024-43383 Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator
- CVE-2024-43382 Snowflake JDBC Security Advisory
- CVE-2024-43381 reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoning
- CVE-2024-43380 fugit parse and parse_nat stall on lengthy input
- CVE-2024-43379 TruffleHog has a Blind SSRF in some Detectors
- CVE-2024-43378 calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systems
- CVE-2024-43377 Umbraco CMS Improper Access Control vulnerability
- CVE-2024-43376 Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information
- CVE-2024-43374 Vim heap-use-after-free in src/arglist.c:207
- CVE-2024-43373 webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle
- CVE-2024-43371 Potential access to sensitive URLs via CKAN extensions (SSRF)
- CVE-2024-43370 gettext.js vulnerable to cross-site scripting (XSS)
- CVE-2024-4337 Múltiple vulnerabilities on Adive Framework
- CVE-2024-43369 Persistent Cross-site Scripting in Ibexa RichText Field Type
- CVE-2024-43368 Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste
- CVE-2024-43367 Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects
- CVE-2024-43366 zkvyper ignored loop range bounds
- CVE-2024-43365 Stored Cross-site Scripting (XSS) when creating external links in Cacti
- CVE-2024-43364 Stored Cross-site Scripting (XSS) when creating external links in Cacti
- CVE-2024-43363 Remote code execution via Log Poisoning in Cacti
- CVE-2024-43362 Stored Cross-site Scripting (XSS) when creating external links in Cacti
- CVE-2024-43360 ZoneMinder Time-based SQL Injection
- CVE-2024-4336 Múltiple vulnerabilities on Adive Framework
- CVE-2024-43359 XSS vulnerabilities in montagereview
- CVE-2024-43358 XSS vulnerability in filter view
- CVE-2024-43357 JavaScript specification issue may lead to type confusion and pointer dereference in implementations
- CVE-2024-43356 WordPress oik plugin <= 4.12.0 - Arbitrary File Deletion vulnerability
- CVE-2024-43355 WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability
- CVE-2024-43354 WordPress myCred plugin <= 2.7.2 - PHP Object Injection vulnerability
- CVE-2024-43353 WordPress myCred plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43352 WordPress GivingPress Lite theme <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43351 WordPress Bravada theme <= 1.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43350 WordPress Propovoice CRM plugin <= 1.7.6.4 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2024-4335 Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-43349 WordPress All Bootstrap Blocks plugin <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43348 WordPress Purity Of Soul theme <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-43347 WordPress Button contact VR plugin <= 4.7.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43346 WordPress Modal Window – create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43345 WordPress Landing Page Builder plugin <= 1.5.2.0 - Local File Inclusion vulnerability
- CVE-2024-43344 Cross-site scripting in Icegram
- CVE-2024-43343 WordPress Order Tracking – WordPress Status Tracking Plugin plugin < 3.3.13 - Broken Access Control vulnerability
- CVE-2024-43342 Cross-site scripting in Ultimate Store Kit Elementor Addons
- CVE-2024-43341 WordPress Hello Agency theme <= 1.0.5 - Broken Access Control vulnerability
- CVE-2024-43340 WordPress AFI – The Easiest Integration Plugin plugin <= 1.89.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-4334 Cross-site scripting in Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder
- CVE-2024-43339 WordPress WordPress Webinar Plugin – WebinarPress plugin <= 1.33.20 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-43338 WordPress Crowdsignal Polls & Ratings plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-43337 WordPress Brave plugin <= 0.7.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-43336 Cross-site request forgery in WP User Manager
- CVE-2024-43335 WordPress Responsive Blocks – WordPress Gutenberg Blocks plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43334 WordPress Zilom theme < 1.4.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43333 WordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.2.1 - Privilege Escalation vulnerability
- CVE-2024-43332 WordPress Photo Engine plugin <= 6.4.0 - Broken Access Control vulnerability
- CVE-2024-43331 WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability
- CVE-2024-43330 WordPress PowerPack for Beaver Builder plugin < 2.37.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-4333 Cross-site scripting in Sina Extension for Elementor
- CVE-2024-43329 WordPress Allegiant theme <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43328 WordPress EmbedPress plugin <= 4.0.9 - Local File Inclusion vulnerability
- CVE-2024-43327 WordPress Invite Anyone plugin <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-43326 WordPress Plugin Notes Plus plugin <= 1.2.7 - Arbitrary Content Deletion vulnerability