Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 307 of 521.
- CVE-2024-40465 Beego privilege escalation vulnerability
- CVE-2024-40464 Beego privilege escalation vulnerability
- CVE-2024-40462 Privilege escalation in ocuco:innovation
- CVE-2024-40461 Privilege escalation in ocuco:innovation
- CVE-2024-40460 Privilege escalation in ocuco:innovation
- CVE-2024-4046 Other in EMUI
- CVE-2024-40459 Privilege escalation in ocuco:innovation
- CVE-2024-40458 Privilege escalation in ocuco:innovation
- CVE-2024-40457 No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file.
- CVE-2024-40456 SQL injection in thinksaas:thinksaas
- CVE-2024-40455 Cross-site request forgery in thinksaas:thinksaas
- CVE-2024-40453 squirrelly Code Injection vulnerability
- CVE-2024-4045 Cross-site scripting in Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation
- CVE-2024-40446 Code injection in ctan:mimetex
- CVE-2024-40445 Path traversal in ctan:mimetex
- CVE-2024-40443 SQL injection in oretnom23:computer laboratory management system
- CVE-2024-40442 An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to ann
- CVE-2024-40441 An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to ann
- CVE-2024-4044 Deserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudio
- CVE-2024-40433 Privilege escalation in tencent:wechat
- CVE-2024-40432 A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_C
- CVE-2024-40431 A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUG
- CVE-2024-4043 WP Ultimate Post Grid <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode
- CVE-2024-40427 Memory corruption in dronecode:px4 drone autopilot
- CVE-2024-40425 File upload in sparkshop:sparkshop
- CVE-2024-40422 Path traversal in stitionai:devika
- CVE-2024-4042 Cross-site scripting in Post Grid
- CVE-2024-40417 Memory corruption in tenda:ax1806 firmware
- CVE-2024-40416 Memory corruption in tenda:ax1806 firmware
- CVE-2024-40415 Memory corruption in tenda:ax1806 firmware
- CVE-2024-40414 Memory corruption in tenda:ax1806 firmware
- CVE-2024-40412 Memory corruption in tenda:ax12 firmware
- CVE-2024-40410 Hardcoded credentials in cybelesoft:thinfinity workspace
- CVE-2024-4041 Yoast SEO <= 22.5 - Reflected Cross-Site Scripting
- CVE-2024-40408 Missing authorization in cybelesoft:thinfinity workspace
- CVE-2024-40407 Information disclosure in cybelesoft:thinfinity workspace
- CVE-2024-40405 Auth bypass in cybelesoft:thinfinity workspace
- CVE-2024-40404 Missing authorization in cybelesoft:thinfinity workspace
- CVE-2024-40402 SQL injection in nikhil-bhalerao:simple library management system
- CVE-2024-40400 Automad arbitrary file upload vulnerability
- CVE-2024-4040 CrushFTP VFS Sandbox Escape
- CVE-2024-40395 Missing authorization in ptc:thingworx
- CVE-2024-40394 File upload in oretnom23:simple library management system
- CVE-2024-40393 SQL injection in angeljudesuarez:online clinic management system
- CVE-2024-40392 SQL injection in fkgeo:pharmacy\/medical store point of sale system
- CVE-2024-4039 Orders Tracking for WooCommerce <= 1.2.10 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-4038 Code injection in Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro
- CVE-2024-4037 WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-4036 Sydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-4035 Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.21 - Authenticated (Author+) Cross-Site Scripting
- CVE-2024-40348 Path traversal in bazarr:bazarr
- CVE-2024-40347 Cross-site scripting in hyland:alfresco content services
- CVE-2024-4034 Virtue <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author
- CVE-2024-40336 Cross-site scripting in idccms:idccms
- CVE-2024-40334 Cross-site request forgery in idccms:idccms
- CVE-2024-40333 Cross-site request forgery in idccms:idccms
- CVE-2024-40332 Cross-site request forgery in idccms:idccms
- CVE-2024-40331 Cross-site request forgery in idccms:idccms
- CVE-2024-4033 All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image
- CVE-2024-40329 Cross-site request forgery in idccms:idccms
- CVE-2024-40328 Cross-site request forgery in idccms:idccms
- CVE-2024-40324 Other in datex-soft:e-staff
- CVE-2024-40322 SQL injection in jfinalcms project:jfinalcms
- CVE-2024-4032 Incorrect IPv4 and IPv6 private ranges
- CVE-2024-40318 File upload in webkul:qloapps
- CVE-2024-40317 Cross-site scripting in airc:mynet
- CVE-2024-4031 MEVO WEBCAM APP Windows Unquoted Service Path Vulnerability
- CVE-2024-4030 tempfile.mkdtemp() may be readable and writeable by all users on Windows
- CVE-2024-4029 Wildfly: no timeout for eap management interface may lead to denial of service (dos)
- CVE-2024-4028 Keycloak-core: stored xss in keycloak when creating a items in admin console
- CVE-2024-4027 Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks
- CVE-2024-4026 Cross-Site Scripting in the Holded application
- CVE-2024-4025 Inefficient Regular Expression Complexity in GitLab
- CVE-2024-40240 Auth bypass in homeserve:homeserve
- CVE-2024-4024 Authentication Bypass by Assumed-Immutable Data in GitLab
- CVE-2024-40239 Auth bypass in hitbytes:life
- CVE-2024-4023 Stored XSS in flatpressblog/flatpress
- CVE-2024-4022 Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Version Data version.js information disclosure
- CVE-2024-4021 Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Configuration Setting ndmComponents.js information disclosure
- CVE-2024-4020 Tenda FH1206 addressNat fromAddressNat buffer overflow
- CVE-2024-4019 Byzoro Smart S80 Management Platform importhtml.php deserialization
- CVE-2024-4018 Privilege Escalation in U-Series Appliance
- CVE-2024-4017 Privilege Escalation in U-Series Appliance
- CVE-2024-4014 hCaptcha for WordPress <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode
- CVE-2024-40137 Dolibarr ERP CRM vulnerable to remote code execution (RCE)
- CVE-2024-40130 Memory corruption in open5gs:open5gs
- CVE-2024-4013 Failure to update BT Mesh Replay Protection List
- CVE-2024-40129 Memory corruption in open5gs:open5gs
- CVE-2024-40125 File upload in closed-loop:cless server
- CVE-2024-40124 Cross-site scripting in pydio:pydio
- CVE-2024-40120 SeaweedFS Vulnerable to SQL Injection
- CVE-2024-40119 Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2024-40117 Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via c
- CVE-2024-40116 An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html,
- CVE-2024-40114 Cross-site scripting in sitecom:wlx-2006 firmware
- CVE-2024-40113 Hardcoded credentials in sitecom:wlx-2006 firmware
- CVE-2024-40112 Path traversal in sitecom:wlx-2006 firmware
- CVE-2024-40111 Cross-site scripting in automad:automad
- CVE-2024-40110 Command injection in nikhil-bhalerao:poultry farm management system
- CVE-2024-4011 Improper Access Control in GitLab