Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 295 of 521.
- CVE-2024-41987 Cross-Site Request Forgery (CSRF) vulnerability in TEM Opera Plus FM Family Transmitter
- CVE-2024-41986 Weak cryptography in SOA Audit
- CVE-2024-41985 Auth bypass in SOA Audit
- CVE-2024-41984 Information disclosure in SOA Audit
- CVE-2024-41983 Information disclosure in SOA Audit
- CVE-2024-41982 Information disclosure in SOA Audit
- CVE-2024-41981 Memory corruption in Simcenter Femap V2306
- CVE-2024-41980 Information disclosure in SOA Audit
- CVE-2024-4198 Mattermost fails to fully validate role changes
- CVE-2024-41979 Missing authorization in SOA Audit
- CVE-2024-41978 Information disclosure in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2024-41977 Privilege escalation in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2024-41976 Code injection in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2024-41975 CODESYS (Edge) Gateway for Windows insecure default
- CVE-2024-41974 WAGO: BACNet Service Property Modification Due to Permission Misconfiguration in Multiple Devices
- CVE-2024-41973 WAGO: Remote Arbitrary File Write with Root Privileges in multiple Devices
- CVE-2024-41972 WAGO: Arbitrary File Overwrite Leading to Privileged File Read in Multiple Devices
- CVE-2024-41971 WAGO: Arbitrary File Overwrite in Multiple Devices
- CVE-2024-41970 WAGO: Unauthorized Diagnostic Data Exposure in Multiple Devices
- CVE-2024-4197 Avaya IP Office One-X Portal File Upload Vulnerability
- CVE-2024-41969 WAGO: CODESYS V3 Configuration Authentication Bypass in Multiple Devices
- CVE-2024-41968 WAGO: Docker Settings Manipulation in Multiple Devices
- CVE-2024-41967 WAGO: Boot Mode Manipulation in Multiple Devices
- CVE-2024-41965 Vim < v9.1.0648 has a double-free in dialog_changed()
- CVE-2024-41964 Insufficient permission checks in the language settings in Kirby CMS
- CVE-2024-41962 Bostr Improper Authorization
- CVE-2024-41961 Elektra vulnerable to remote code execution in universal search
- CVE-2024-41960 Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized
- CVE-2024-4196 Avaya IP Office Web Control RCE Vulnerability
- CVE-2024-41959 Cross-site Scripting (XSS) via API Logs in mailcow: dockerized
- CVE-2024-41958 Two-Factor Authentication (2FA) Bypass in mailcow: dockerized
- CVE-2024-41957 Vim double free in src/alloc.c:616
- CVE-2024-41956 Soft Serve allows arbitrary code execution by crafting git-lfs requests
- CVE-2024-41955 Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect
- CVE-2024-41954 FOG Weak file permissions
- CVE-2024-41953 Zitadel improperly sanitizes HTML in emails and Console UI
- CVE-2024-41952 Zitadel has an "Ignoring unknown usernames" vulnerability
- CVE-2024-41951 PheonixAppAPI has visible Encoding Maps
- CVE-2024-41950 Insecure Jinja2 templates rendered in Haystack Components can lead to RCE
- CVE-2024-4195 Mattermost allows team admins to promote guests to team admins
- CVE-2024-41949 biscuit-rust vulnerable to public key confusion in third party block
- CVE-2024-41948 biscuit-java vulnerable to public key confusion in third party block
- CVE-2024-41947 XWiki Platform XSS through conflict resolution
- CVE-2024-41946 REXML DoS vulnerability
- CVE-2024-41945 The fuels-ts typescript SDK has no awareness of to-be-spent transactions
- CVE-2024-41944 Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report
- CVE-2024-41943 I, Librarian Stored XSS vulnerability in Item Summary
- CVE-2024-41942 JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
- CVE-2024-41941 Missing authorization in SINEC NMS
- CVE-2024-41940 Command injection in SINEC NMS
- CVE-2024-4194 Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-41939 Missing authorization in SINEC NMS
- CVE-2024-41938 Path traversal in SINEC NMS
- CVE-2024-41937 Apache Airflow: Stored XSS Vulnerability on provider link
- CVE-2024-41936 Vonets WiFi Bridges Path Traversal
- CVE-2024-41935 f2fs: fix to shrink read extent node in batches
- CVE-2024-41934 Missing authorization in Intel(R) GPA software
- CVE-2024-41932 sched: fix warning in sched_setaffinity
- CVE-2024-41931 goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data
- CVE-2024-41930 Cross-site scripting in MF Teacher Performance Management System
- CVE-2024-4193 Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-41929 Auth bypass in AHD04T-A
- CVE-2024-41928 bhyve(8) privileged guest escape via TPM device passthrough
- CVE-2024-41927 Information disclosure in FC6A Series MICROSmart All-in-One CPU module
- CVE-2024-41926 Malicious remote can claim that a user was synced from another remote
- CVE-2024-41925 Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion
- CVE-2024-41924 Security feature bypass in EC-CUBE 4 series
- CVE-2024-41922 Path traversal in Anka Build
- CVE-2024-41921 Unsafe use of eval() method in rostopic echo tool
- CVE-2024-4192 Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 DOPSoft
- CVE-2024-41918 Open redirect in 'Rakuten Ichiba App' for Android
- CVE-2024-41917 Race condition in Intel(R) Battery Life Diagnostic Tool software
- CVE-2024-41916 Authenticated Sensitive Information Disclosure in ClearPass Policy Manager
- CVE-2024-41915 Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface
- CVE-2024-41914 Cross-site scripting in HPE Aruba Networking EdgeConnect SD-WAN Orchestrator
- CVE-2024-41913 Clariti Manager – Arbitrary File Upload
- CVE-2024-41912 Missing authorization in Poly Clariti Manager
- CVE-2024-41911 Cross-site scripting in Poly Clariti Manager
- CVE-2024-41910 Cross-site scripting in Poly Clariti Manager
- CVE-2024-41909 Apache MINA SSHD: integrity check bypass
- CVE-2024-41908 Memory corruption in NX
- CVE-2024-41907 Misconfiguration in SINEC Traffic Analyzer
- CVE-2024-41906 Information disclosure in SINEC Traffic Analyzer
- CVE-2024-41905 Missing authorization in SINEC Traffic Analyzer
- CVE-2024-41904 Auth bypass in SINEC Traffic Analyzer
- CVE-2024-41903 Misconfiguration in SINEC Traffic Analyzer
- CVE-2024-41902 Memory corruption in JT2Go
- CVE-2024-4190 OpenText ArcSight Logger Stored XSS
- CVE-2024-41890 Apache Answer: The link to reset the user's password will remain valid after sending a new link
- CVE-2024-4189 Multiple XXE sinks in Run LoadRunner script step in OpenText Application Automation Tools
- CVE-2024-41889 Code injection in PiTool
- CVE-2024-41888 Apache Answer: The link for resetting user password is not Single-Use
- CVE-2024-41887 Arbitrary File Overwrite
- CVE-2024-41886 Improper Input Validation
- CVE-2024-41885 Hardcoding sensitive information
- CVE-2024-41884 Null Pointer Dereference
- CVE-2024-41883 Null Pointer Dereference
- CVE-2024-41882 Stack based buffer overflow
- CVE-2024-41881 Memory corruption in SDoP
- CVE-2024-41880 In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and private routes.