Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 315 of 521.
- CVE-2024-39287 Dorsett Controls InfoScan Exposure of Sensitive Information To An Unauthorized Actor
- CVE-2024-39286 Misconfiguration in Intel(R) 800 Series Ethernet Driver
- CVE-2024-39285 Missing authorization in Intel(R) Server M20NTP Family
- CVE-2024-39284 Privilege escalation in Intel(R) Advisor software
- CVE-2024-39283 Privilege escalation in Intel(R) TDX module software
- CVE-2024-39282 net: wwan: t7xx: Fix FSM command timeout issue
- CVE-2024-39281 Unbounded allocation in ctl(4) CAM Target Layer
- CVE-2024-39280 Command injection in Wavlink AC3000
- CVE-2024-3928 Dromara open-capacity-platform auth-server heapdump information disclosure
- CVE-2024-39279 Missing authorization in Intel(R) processors
- CVE-2024-39278 Hughes Network Systems Insufficiently Protected Credentials
- CVE-2024-39277 dma-mapping: benchmark: handle NUMA_NO_NODE correctly
- CVE-2024-39276 ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find()
- CVE-2024-39275 Advantech ADAM-5630 Use of Persistent Cookies Containing Sensitive Information
- CVE-2024-39274 Malicious remote can add users to arbitrary teams and channels
- CVE-2024-39273 Missing authorization in Wavlink AC3000
- CVE-2024-39272 Cross-site scripting in ClearML
- CVE-2024-39271 Information disclosure in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software
- CVE-2024-3927 Security feature bypass in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-3926 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-39251 An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive
- CVE-2024-39250 SQL injection in efrotech:timetrax
- CVE-2024-3925 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-39249 Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function.
- CVE-2024-39248 Cross-site scripting in fikeulous:simpcms
- CVE-2024-39243 Code injection in skycaiji:skycaiji
- CVE-2024-39242 Cross-site scripting in skycaiji:skycaiji
- CVE-2024-39241 Cross-site scripting in skycaiji:skycaiji
- CVE-2024-3924 Code Injection in huggingface/text-generation-inference
- CVE-2024-39236 Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py
- CVE-2024-3923 Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-39229 Security feature bypass in gl-inet:a1300 firmware
- CVE-2024-39228 Command injection in gl-inet:a1300 firmware
- CVE-2024-39227 Code injection in gl-inet:a1300 firmware
- CVE-2024-39226 Command injection in gl-inet:a1300 firmware
- CVE-2024-39225 Auth bypass in gl-inet:a1300 firmware
- CVE-2024-39223 Missing key verification in gost
- CVE-2024-39220 BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-
- CVE-2024-3922 Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection
- CVE-2024-39219 An issue in Aginode GigaSwitch V5 before version 7.06G allows authenticated attackers with Administrator privileges to upload an earlier fir
- CVE-2024-39211 Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_emai
- CVE-2024-39210 Path traversal in mayurik:best house rental management system
- CVE-2024-3921 Gianism <= 5.1.0 - Admin+ Stored XSS
- CVE-2024-39209 luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter.
- CVE-2024-39208 luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.
- CVE-2024-39207 lua-shmem v1.0-1 was discovered to contain a buffer overflow via the shmem_write function.
- CVE-2024-39206 An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due
- CVE-2024-39205 pyload-ng vulnerable to RCE with js2py sandbox escape
- CVE-2024-39203 Cross-site scripting in zblogcn:z-blogphp
- CVE-2024-39202 Command injection in dlink:dir-823x ax3000 firmware
- CVE-2024-3920 Flattr <= 1.2.2 - Admin+ Stored XSS
- CVE-2024-3919 OpenPGP Form Encryption for WordPress < 1.5.1 - Contributor+ Stored XSS
- CVE-2024-39182 An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an
- CVE-2024-39181 Memory corruption in szlbt:lbt-t300-t400 firmware
- CVE-2024-3918 Pet Manager <= 1.4 - Contributor+ Stored XSS
- CVE-2024-39178 MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uuid.
- CVE-2024-39174 Cross-site scripting in yzmcms:yzmcms
- CVE-2024-39173 calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculator.js.
- CVE-2024-39171 Path traversal in phpvibe:phpvibe
- CVE-2024-3917 Pet Manager <= 1.4 - Reflected XSS
- CVE-2024-39165 QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload
- CVE-2024-39163 pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints
- CVE-2024-39162 pyspider Cross-site Scripting vulnerability
- CVE-2024-3916 Swift Framework <= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
- CVE-2024-39158 Cross-site request forgery in idccms:idccms
- CVE-2024-39157 Cross-site request forgery in idccms:idccms
- CVE-2024-39156 Cross-site request forgery in idccms:idccms
- CVE-2024-39155 Cross-site request forgery in idccms:idccms
- CVE-2024-39154 Cross-site request forgery in idccms:idccms
- CVE-2024-39153 Cross-site request forgery in idccms:idccms
- CVE-2024-39150 Path traversal in b3log:vditor
- CVE-2024-3915 Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update
- CVE-2024-39148 Command injection in kerlink:keros
- CVE-2024-39143 Cross-site scripting in coderberg:residencecms
- CVE-2024-3914 Use after free in Chrome
- CVE-2024-39134 Memory corruption in gdraheim:zziplib
- CVE-2024-39133 Memory corruption in zziplib project:zziplib
- CVE-2024-39132 A NULL Pointer Dereference vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function VerifyComma
- CVE-2024-39130 A NULL Pointer Dereference discovered in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function DumpOneStream(
- CVE-2024-3913 Phoenix Contact: Start sequence allows attack during the boot process
- CVE-2024-39129 Heap Buffer Overflow vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function PushTSBuf() at /src/PayloadBuf.cpp.
- CVE-2024-39126 Roundup Cross-site Scripting Vulnerability
- CVE-2024-39125 Roundup Cross-site Scripting Vulnerability
- CVE-2024-39124 Roundup Cross-site Scripting Vulnerability
- CVE-2024-39123 Calibre-Web Cross Site Scripting (XSS)
- CVE-2024-3912 ASUS Router - Upload arbitrary firmware
- CVE-2024-39119 Cross-site request forgery in idccms:idccms
- CVE-2024-39118 Memory corruption in mommyheather:advanced backups
- CVE-2024-3911 Welotec: Clickjacking Vulnerability in WebUI
- CVE-2024-3910 Tenda AC500 DhcpListClient fromDhcpListClient stack-based overflow
- CVE-2024-39097 Open redirect in sir:gnuboard
- CVE-2024-39094 Cross-site scripting in friendica:friendica
- CVE-2024-39091 Command injection in annke:crater 2 firmware
- CVE-2024-39090 Cross-site request forgery in phpgurukul:online shopping portal
- CVE-2024-3909 Tenda AC500 execCommand formexeCommand stack-based overflow
- CVE-2024-39081 Security feature bypass in jktyre:smart tyre car \& bike
- CVE-2024-3908 Tenda AC500 WriteFacMac formWriteFacMac command injection
- CVE-2024-39072 SQL injection in amttgroup:hibos
- CVE-2024-39071 Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php.
- CVE-2024-3907 Tenda AC500 setcfm formSetCfm stack-based overflow