Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 308 of 521.
- CVE-2024-40101 Microweber Reflected Cross-site scripting (XSS) vulnerability
- CVE-2024-4010 Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request
- CVE-2024-40096 Information disclosure in rd labs llc:who
- CVE-2024-40094 GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service
- CVE-2024-40091 Missing authorization in viloliving:vilo 5 firmware
- CVE-2024-40090 Information disclosure in viloliving:vilo 5 firmware
- CVE-2024-4009 Replay Attack in KNX Secure Devices
- CVE-2024-40089 Command injection in viloliving:vilo 5 firmware
- CVE-2024-40088 Path traversal in viloliving:vilo 5 firmware
- CVE-2024-40087 Auth bypass in viloliving:vilo 5 firmware
- CVE-2024-40086 A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, un
- CVE-2024-40085 A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthentica
- CVE-2024-40084 Memory corruption in viloliving:vilo 5 firmware
- CVE-2024-40083 A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthentic
- CVE-2024-4008 FDSK Leak in KNX Secure Devices
- CVE-2024-40075 Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability.
- CVE-2024-40074 Cross-site scripting in oretnom23:online id generator system
- CVE-2024-40073 SQL injection in oretnom23:online id generator system
- CVE-2024-40072 SQL injection in oretnom23:online id generator system
- CVE-2024-40071 File upload in oretnom23:online id generator system
- CVE-2024-40070 File upload in oretnom23:online id generator system
- CVE-2024-4007 Hard coded default credential contained in install package
- CVE-2024-40069 Cross-site scripting in oretnom23:online id generator system
- CVE-2024-40068 SQL injection in oretnom23:online id generator system
- CVE-2024-40060 Denial of service in wcharczuk:go-chart
- CVE-2024-4006 Incorrect Authorization in GitLab
- CVE-2024-40051 Path traversal in ip-guard:ip-guard
- CVE-2024-4005 Social Pixel <= 2.1 - Admin+ Stored XSS
- CVE-2024-4004 Advanced Cron Manager < 2.5.7 - Admin+ Stored XSS
- CVE-2024-40039 Cross-site request forgery in idccms project:idccms
- CVE-2024-40038 Cross-site request forgery in idccms:idccms
- CVE-2024-40037 Cross-site request forgery in idccms project:idccms
- CVE-2024-40036 Cross-site request forgery in idccms:idccms
- CVE-2024-40035 Cross-site request forgery in idccms:idccms
- CVE-2024-40034 Cross-site request forgery in idccms project:idccms
- CVE-2024-4003 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-4002 Carousel, Slider, Gallery by WP Carousel < 2.6.9 - Editor+ Stored XSS
- CVE-2024-4001 Cross-site scripting in Download Manager
- CVE-2024-4000 Cross-site scripting in Pearl – Header Builder
- CVE-2024-3999 EazyDocs < 2.5.0 - Admin+ Stored XSS
- CVE-2024-3998 Cross-site scripting in Betheme
- CVE-2024-3997 Cross-site scripting in Prime Slider – Addons for Elementor
- CVE-2024-39967 Insecure permissions in Aginode GigaSwitch v5 allows attackers to access sensitive information via using the SCP command.
- CVE-2024-39963 Command injection in tenda:ax12 firmware
- CVE-2024-39962 Code injection in dlink:dir-823x firmware
- CVE-2024-3996 Post Grid, Post Carousel, & List Category Posts < 2.4.28 - Editor+ Stored XSS
- CVE-2024-39954 Apache EventMesh Runtime: SSRF
- CVE-2024-39950 Memory corruption in NVR4XXX and IPC-HX8XXX
- CVE-2024-3995 Command Injection in Helix ALM
- CVE-2024-39949 Denial of service in NVR4XXX
- CVE-2024-39948 Null dereference in NVR4XXX
- CVE-2024-39947 Denial of service in NVR4XXX
- CVE-2024-39946 Other in NVR4XXX
- CVE-2024-39945 Denial of service in NVR4XXX
- CVE-2024-39944 Denial of service in IPC-HX8XXX and NVR4XXX
- CVE-2024-39943 rejetto HFS vulnerable to OS Command Execution by remote authenticated users
- CVE-2024-3994 Cross-site scripting in Tutor LMS – eLearning and online course solution
- CVE-2024-39937 Path traversal in supos:supos
- CVE-2024-39936 Race condition in qt:qt
- CVE-2024-39935 Command injection in jc21:nginx proxy manager
- CVE-2024-39934 Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because
- CVE-2024-39933 Duplicate Advisory: Gogs allows argument injection during the tagging of a new release
- CVE-2024-39932 Gogs allows argument injection during the previewing of changes
- CVE-2024-39931 Duplicate Advisory: Gogs allows deletion of internal files
- CVE-2024-39930 Duplicate Advisory: github.com/gogs/gogs affected by CVE-2024-39930
- CVE-2024-3993 AZAN Plugin <= 0.6 - Stored XSS via CSRF
- CVE-2024-39929 Security feature bypass in exim:exim
- CVE-2024-39928 Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability
- CVE-2024-39927 Memory corruption in IM 460F/460FTL/370/370F
- CVE-2024-39926 Cross-site scripting in dani-garcia:vaultwarden
- CVE-2024-39925 Information disclosure in dani-garcia:vaultwarden
- CVE-2024-39924 Privilege escalation in dani-garcia:vaultwarden
- CVE-2024-39923 Cross-site scripting in mahara:mahara
- CVE-2024-39922 Information disclosure in LOGO! 12/24RCE
- CVE-2024-39921 Weak cryptography in IPCOM EX2 Series
- CVE-2024-39920 The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection
- CVE-2024-3992 Amen <= 3.3.1 - Admin+ Stored XSS
- CVE-2024-39919 Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png
- CVE-2024-39918 Path Traveral in @jmondi/url-to-png
- CVE-2024-39917 xrdp allows an ininite number of login attempts
- CVE-2024-39916 NFS server misconfiguration allows file access outside the exported directory
- CVE-2024-39915 Authenticated remote code execution in Thruk
- CVE-2024-39914 FOG has a command injection in /fog/management/export.php?filename=
- CVE-2024-39912 Enumeration of valid usernames in web-auth/webauthn-lib
- CVE-2024-39911 1Panel SQL injection
- CVE-2024-39910 Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
- CVE-2024-3991 Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
- CVE-2024-39909 SQL Injection in the KubeClarity REST API
- CVE-2024-39908 Denial of service in REXML
- CVE-2024-39907 a sqlinjection in 1Panel
- CVE-2024-39906 Remote code execution in Haven IndieAuthClient (GHSL-2024-093)
- CVE-2024-39905 Red-DiscordBot vulnerable to Incorrect Authorization in commands API
- CVE-2024-39904 Code Execution Vulnerability via Local File Path Traversal in Vnote
- CVE-2024-39903 Local File Inclusion in Solara
- CVE-2024-39902 Tuleap's recursive permissions to document manager folder are not properly applied
- CVE-2024-39901 OpenSearch Observability does not properly restrict access to private tenant resources
- CVE-2024-39900 OpenSearch Dashboards Reports does not properly restrict access to private tenant resources
- CVE-2024-3990 Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder
- CVE-2024-39899 PrivateBin allows shortening of URLs for other domains
- CVE-2024-39897 Cache driver GetBlob() allows read access to any blob without access control check