Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 298 of 521.
- CVE-2024-41674 CKAN may leak Solr credentials via error message in package_search action
- CVE-2024-41673 Decidim has a cross-site scripting vulnerability in the version control page
- CVE-2024-41672 DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled
- CVE-2024-41671 twisted.web has disordered HTTP pipeline response
- CVE-2024-41670 PayPal Official Module for PrestaShop has Improperly Implemented Security Check for Standard
- CVE-2024-4167 Tenda 4G300 sub_422AA4 stack-based overflow
- CVE-2024-41668 cBioPortal Proxy Endpoint Vulnerabliity
- CVE-2024-41667 OpenAM FreeMarker template injection
- CVE-2024-41666 The Argo CD web terminal session does not handle the revocation of user permissions properly.
- CVE-2024-41665 Ampache Stored Cross-site Scripting Vulnerability
- CVE-2024-41664 Blind SSRF via Canarytoken Webhook
- CVE-2024-41663 Canarytoken "Cloned Website" Vulnerable to Stored Cross-Site Scripting
- CVE-2024-41662 VNote vulnerable to Markdown XSS, which leads to RCE
- CVE-2024-41660 slpd-lite unauthenticated memory corruption
- CVE-2024-4166 Tenda 4G300 sub_41E858 stack-based overflow
- CVE-2024-41659 GHSL-2024-034: memos CORS Misconfiguration in server.go
- CVE-2024-41658 GHSL-2024-036: Reflected XSS in QrCodePage.js
- CVE-2024-41657 GHSL-2024-035: Casdoor CORS misconfiguration
- CVE-2024-41656 Sentry vulnerable to stored Cross-Site Scripting (XSS)
- CVE-2024-41655 TF2 Item Format Regular Expression Denial of Service vulnerability
- CVE-2024-41651 Code injection in prestashop:prestashop
- CVE-2024-41650 Misconfiguration in openrobotics:robot operating system
- CVE-2024-4165 Tenda G3 modifyDhcpRule stack-based overflow
- CVE-2024-41649 Privilege escalation in openrobotics:robot operating system
- CVE-2024-41648 Misconfiguration in openrobotics:robot operating system
- CVE-2024-41647 Misconfiguration in openrobotics:robot operating system
- CVE-2024-41646 Misconfiguration in openrobotics:robot operating system
- CVE-2024-41645 Misconfiguration in openrobotics:robot operating system
- CVE-2024-41644 Misconfiguration in openrobotics:robot operating system
- CVE-2024-41643 An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component.
- CVE-2024-41640 Cross Site Scripting (XSS) vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter.
- CVE-2024-4164 Tenda G3 ModifyPppAuthWhiteMac formModifyPppAuthWhiteMac stack-based overflow
- CVE-2024-41637 RaspAP allows an attacker to escalate privileges
- CVE-2024-41631 Buffer Overflow vulnerability in host-host NEUQ_board v.1.0 allows a remote attacker to cause a denial of service via the password.h component.
- CVE-2024-41630 Memory corruption in tenda:ac18 firmware
- CVE-2024-4163 Privilege Escalation on Skylab IIoT Gateway (IGX)
- CVE-2024-41629 Information disclosure in ti:fusion digital power designer
- CVE-2024-41628 Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9
- CVE-2024-41624 Incorrect access control in Himalaya Xiaoya nano smart speaker rom_version 1.6.96 allows a remote attacker to have an unspecified impact.
- CVE-2024-41623 Code injection in d3dsecurity:d8801 firmware
- CVE-2024-41622 Command injection in dlink:dir-846w firmware
- CVE-2024-4162 KW Watcher Vulnerability ALlows Malicious Read Access to Memory
- CVE-2024-41618 Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the `transaction_delete_group` function.
- CVE-2024-41617 Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control.
- CVE-2024-41616 Hardcoded credentials in dlink:dir-300 firmware
- CVE-2024-41614 Cross-site scripting in symphony-cms:symphony cms
- CVE-2024-41613 Cross-site scripting in symphony-cms:symphony cms
- CVE-2024-41611 Hardcoded credentials in dlink:dir-860l firmware
- CVE-2024-41610 Hardcoded credentials in dlink:dir-820lw firmware
- CVE-2024-4161 Syslog traffic sent in clear-text
- CVE-2024-41605 In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an update file with a Trojan
- CVE-2024-41603 Cross-site request forgery in denkgroot:spina
- CVE-2024-41602 Cross-site request forgery in denkgroot:spina
- CVE-2024-41601 Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login meth
- CVE-2024-41600 Missing authorization in talelin:lin-cms-spring-boot
- CVE-2024-4160 Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode
- CVE-2024-41599 Cross-site scripting in ruoyi:ruoyi
- CVE-2024-41597 ProcessWire Cross Site Request Forgery vulnerability
- CVE-2024-41596 Memory corruption in draytek:vigor1000b firmware
- CVE-2024-41595 Memory corruption in draytek:vigor3910 firmware
- CVE-2024-41594 Weak cryptography in draytek:vigor1000b firmware
- CVE-2024-41593 Memory corruption in draytek:vigor1000b firmware
- CVE-2024-41592 Memory corruption in draytek:vigor1000b firmware
- CVE-2024-41591 Cross-site scripting in draytek:vigor1000b firmware
- CVE-2024-41590 Memory corruption in draytek:vigor1000b firmware
- CVE-2024-4159 Protection mechanisms
- CVE-2024-41589 Weak cryptography in draytek:vigor3910 firmware
- CVE-2024-41588 Memory corruption in draytek:vigor1000b firmware
- CVE-2024-41587 Cross-site scripting in draytek:vigor1000b firmware
- CVE-2024-41586 Memory corruption in draytek:vigor3910 firmware
- CVE-2024-41585 Command injection in draytek:vigor3910 firmware
- CVE-2024-41584 Cross-site scripting in draytek:vigor3910 firmware
- CVE-2024-41583 Cross-site scripting in draytek:vigor3910 firmware
- CVE-2024-4158 Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-41579 DTStack Taier 1.4.0 allows remote attackers to specify the jobName parameter in the console listNames function to cause a SQL injection vuln
- CVE-2024-41577 An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uplo
- CVE-2024-41572 Cross-site scripting in lang-learn-guy:learning with texts
- CVE-2024-41570 Server-side request forgery in havocframework:havoc
- CVE-2024-4157 Deserialization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- CVE-2024-41565 Business logic in mezz:justenoughitems
- CVE-2024-41564 Business logic in emilyploszaj:emi
- CVE-2024-4156 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-41551 SQL injection in campcodes:supplier management system
- CVE-2024-41550 SQL injection in campcodes:supplier management system
- CVE-2024-4154 Incorrect Synchronization in lunary-ai/lunary
- CVE-2024-41519 Cross-site scripting in mecodia:feripro
- CVE-2024-41518 Missing authorization in mecodia:feripro
- CVE-2024-41517 Missing authorization in mecodia:feripro
- CVE-2024-41516 Cross-site scripting in 4pace:cadclick
- CVE-2024-41515 Cross-site scripting in 4pace:cadclick
- CVE-2024-41514 Cross-site scripting in 4pace:cadclick
- CVE-2024-41513 Cross-site scripting in 4pace:cadclick
- CVE-2024-41512 SQL injection in 4pace:cadclick
- CVE-2024-41511 Path traversal in 4pace:cadclick
- CVE-2024-4151 Improper Access Control in lunary-ai/lunary
- CVE-2024-41505 Cross-site scripting in jetimob:imobiliaria
- CVE-2024-41504 Cross-site scripting in jetimob:imobiliaria
- CVE-2024-41503 Cross-site scripting in jetimob:imobiliaria
- CVE-2024-41502 Cross-site scripting in jetimob:imobiliaria
- CVE-2024-4150 Simple Basic Contact Form <= 20221201 - Reflected Cross-Site Scripting