Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 314 of 521.
- CVE-2024-39386 ZDI-CAN-24057: Adobe Bridge AVI FIle Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-39385 Premiere Pro | Use After Free (CWE-416)
- CVE-2024-39384 Premiere Pro | Out-of-bounds Write (CWE-787)
- CVE-2024-39383 PoC sample of unknown vulnerability detected by EXPMON system
- CVE-2024-39382 After Effects | Out-of-bounds Read (CWE-125)
- CVE-2024-39381 After Effects | Out-of-bounds Write (CWE-787)
- CVE-2024-39380 After Effects | Heap-based Buffer Overflow (CWE-122)
- CVE-2024-3938 Cross-site scripting in dotCMS core
- CVE-2024-39379 Acrobat for Edge | Out-of-bounds Read (CWE-125)
- CVE-2024-39378 Audition | Out-of-bounds Write (CWE-787)
- CVE-2024-39377 Media Encoder | Out-of-bounds Write (CWE-787)
- CVE-2024-39376 Improper Access Control In TELSAT MarKoni FM Transmitter
- CVE-2024-39375 Use of Client-Side Authentication in TELSAT marKoni FM Transmitter
- CVE-2024-39374 Use of Hard-coded Credentials in TELSAT marKoni FM Transmitter
- CVE-2024-39373 Improper Neutralization of Special Elements used in a Command in TELSAT marKoni FM Transmitter
- CVE-2024-39372 Privilege escalation in Intel(R) XTU software for Windows
- CVE-2024-39371 io_uring: check for non-NULL file pointer in io_file_can_poll()
- CVE-2024-39370 Memory corruption in Wavlink AC3000
- CVE-2024-3937 Playlist for Youtube <= 1.32 - Editor+ Stored XSS
- CVE-2024-39368 SQL injection in Intel(R) Neural Compressor software
- CVE-2024-39367 Command injection in Wavlink AC3000
- CVE-2024-39365 Privilege escalation in Intel(R) oneAPI DPC++/C++ Compiler software for Windows
- CVE-2024-39364 Advantech ADAM-5630 Missing Authentication for Critical Function
- CVE-2024-39363 Cross-site scripting in Wavlink AC3000
- CVE-2024-39361 Creating posts with user-defined IDs permitted in CreatePost API
- CVE-2024-39360 Command injection in Wavlink AC3000
- CVE-2024-3936 The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization
- CVE-2024-39359 Memory corruption in Wavlink AC3000
- CVE-2024-39358 Memory corruption in Wavlink AC3000
- CVE-2024-39357 Memory corruption in Wavlink AC3000
- CVE-2024-39356 Null dereference in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows
- CVE-2024-39355 Denial of service in Intel(R) Processors
- CVE-2024-39354 Delta Electronics DIAScreen Stack-based Buffer Overflow
- CVE-2024-39353 RemoteClusterFrame payloads are audit logged in full
- CVE-2024-39352 Security feature bypass in Camera Firmware
- CVE-2024-39351 Command injection in Camera Firmware
- CVE-2024-39350 Auth bypass in Camera Firmware
- CVE-2024-3935 Eclipse Mosquito: Double free vulnerability
- CVE-2024-39349 Memory corruption in Camera Firmware
- CVE-2024-39348 Security feature bypass in Synology Router Manager (SRM)
- CVE-2024-39347 Misconfiguration in Synology Router Manager (SRM)
- CVE-2024-39345 Hardcoded credentials in adtran:sdg smartos
- CVE-2024-39344 An issue was discovered in the Docusign API package 8.142.14 for Salesforce.
- CVE-2024-39343 Denial of service in samsung:exynos 1280 firmware
- CVE-2024-39342 Entrust Instant Financial Issuance (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library (i.e.
- CVE-2024-39341 Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier l
- CVE-2024-39340 The authentication system of Securepoint UTM mishandles OTP keys.
- CVE-2024-3934 Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download
- CVE-2024-39339 A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota cars.
- CVE-2024-39338 Server-Side Request Forgery in axios
- CVE-2024-39337 Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass.
- CVE-2024-39335 Information disclosure in mahara:mahara
- CVE-2024-39334 MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data.
- CVE-2024-39332 Path traversal in webswing:webswing
- CVE-2024-39331 Code injection in gnu:emacs
- CVE-2024-39330 Django Path Traversal vulnerability
- CVE-2024-3933 Eclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a buffer
- CVE-2024-39329 Django vulnerable to user enumeration attack
- CVE-2024-39328 Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0.
- CVE-2024-39327 Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way.
- CVE-2024-39326 SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill
- CVE-2024-39325 aimeos/ai-controller-frontend doesn't reset payment status in basket
- CVE-2024-39324 aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services
- CVE-2024-39323 aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account
- CVE-2024-39322 aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records
- CVE-2024-39321 Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes
- CVE-2024-39320 Discourse allows iframe injection though default site setting
- CVE-2024-3932 Totara LMS User Selector cross-site request forgery
- CVE-2024-39319 aimeos/ai-controller-frontend has IDOR vulnerability in account profile page
- CVE-2024-39318 Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget
- CVE-2024-39317 Wagtail regular expression denial-of-service via search query parsing
- CVE-2024-39316 Rack ReDoS Vulnerability in HTTP Accept Headers Parsing
- CVE-2024-39315 Pomerium exposed OAuth2 access and ID tokens in user info endpoint response
- CVE-2024-39314 toy-blog administrative token leaked through the command line parameter
- CVE-2024-39313 toy-blog Improper Input Validation vulnerability
- CVE-2024-39312 Botan has an Authorization Error due to Name Constraint Decoding Bug
- CVE-2024-39311 Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction
- CVE-2024-39310 WordPress Basil Theme Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability
- CVE-2024-3931 Totara LMS User Selector check.php cross site scripting
- CVE-2024-39309 ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
- CVE-2024-39308 RailsAdmin Cross-site Scripting vulnerability in the list view
- CVE-2024-39307 Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita
- CVE-2024-39305 Envoy Proxy use after free when route hash policy is configured with cookie attributes
- CVE-2024-39304 ChurchCRM SQL Injection Vulnerability
- CVE-2024-39303 Weblate vulnerabler to improper sanitization of project backups
- CVE-2024-39302 Some bbb-record-core files installed with wrong file permission
- CVE-2024-39301 net/9p: fix uninit-value in p9_client_rpc()
- CVE-2024-39300 Auth bypass in WAB-I1750-PS
- CVE-2024-3930 XML External Entity in Akana
- CVE-2024-39299 Memory corruption in Wavlink AC3000
- CVE-2024-39298 mm/memory-failure: fix handling of dissolved but not taken off from buddy pages
- CVE-2024-39296 bonding: fix oops during rmmod
- CVE-2024-39294 Memory corruption in Wavlink AC3000
- CVE-2024-39293 Revert "xsk: Support redirect to any socket bound to the same umem"
- CVE-2024-39292 um: Add winch to winch_handlers before registering winch IRQ
- CVE-2024-39291 drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode()
- CVE-2024-39290 Information disclosure in IX-BA
- CVE-2024-3929 Cross-site scripting in Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor)
- CVE-2024-39289 Unsafe use of eval() method in rosparam tool
- CVE-2024-39288 Memory corruption in Wavlink AC3000