Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 316 of 521.
- CVE-2024-39069 An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking attack.
- CVE-2024-39063 Cross-site request forgery in limesurvey:limesurvey
- CVE-2024-3906 Tenda AC500 QuickIndex formQuickIndex stack-based overflow
- CVE-2024-3905 Tenda AC500 execCommand R7WebsSecurityHandler stack-based overflow
- CVE-2024-3904 Misconfiguration in MELIPC Series MI5122-VW
- CVE-2024-39037 SQL injection in airc:mynet
- CVE-2024-39036 Path traversal in seacms:seacms
- CVE-2024-39033 In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stolen.
- CVE-2024-39031 Silverpeas Core Cross-site Scripting vulnerability
- CVE-2024-3903 Add Custom CSS and JS <= 1.20 - Stored XSS via CSRF
- CVE-2024-39028 Command injection in seacms:seacms
- CVE-2024-39027 SQL injection in seacms:seacms
- CVE-2024-39025 Letta (previously MemGPT) incorrect access control vulnerability
- CVE-2024-39024 In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.
- CVE-2024-39023 Cross-site request forgery in idccms:idccms
- CVE-2024-39022 Cross-site request forgery in idccms:idccms
- CVE-2024-39021 Cross-site request forgery in idccms:idccms
- CVE-2024-39020 Cross-site request forgery in idccms:idccms
- CVE-2024-39019 Cross-site request forgery in idccms:idccms
- CVE-2024-39018 @cat5th/key-serializer Prototype Pollution vulnerability
- CVE-2024-39017 agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents.
- CVE-2024-39016 che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign.
- CVE-2024-39015 cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request.
- CVE-2024-39014 ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set.
- CVE-2024-39013 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend.
- CVE-2024-39012 Code injection in ais:strategyen
- CVE-2024-39011 Code injection in chargeover:chargeover\/redoc
- CVE-2024-39010 Code injection in chasemoskal:snapstate
- CVE-2024-3901 Genesis Blocks <= 3.1.3 - Contributor+ Stored XSS
- CVE-2024-39008 robinweser fast-loops vulnerable to prototype pollution
- CVE-2024-39003 Code injection in amoyjs:common
- CVE-2024-39002 Code injection in richardrodger:jsonic
- CVE-2024-39001 ag-grid packages vulnerable to Prototype Pollution
- CVE-2024-39000 Code injection in swiperjs:swiper
- CVE-2024-3900 Out-of-bounds stack array write in Xpdf 4.05 due to missing zero check
- CVE-2024-38999 jrburke requirejs vulnerable to prototype pollution
- CVE-2024-38997 adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults
- CVE-2024-38996 Prototype pollution in ag-grid-community via the _.mergeDeep function
- CVE-2024-38994 @amoy/common v was discovered to contain a prototype pollution via the function extend
- CVE-2024-38993 Code injection in richardrodger:jsonic
- CVE-2024-38992 frappejs was discovered to contain a prototype pollution via the function registerView
- CVE-2024-38991 akbr patch-into was discovered to contain a prototype pollution via the function patchInto
- CVE-2024-38990 Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep.
- CVE-2024-3899 Envira Gallery < 1.8.15 - Author+ Stored XSS
- CVE-2024-38989 Prototype pollution in izatop bunt
- CVE-2024-38988 @alizeait/unflatto Prototype Pollution
- CVE-2024-38987 @aofl/cli-lib Prototype Pollution vulnerability
- CVE-2024-38986 @75lb/deep-merge Prototype Pollution vulnerability
- CVE-2024-38985 depath and cool-path vulnerable to Prototype Pollution via `set()` Method
- CVE-2024-38984 Code injection in lukebond:json-override
- CVE-2024-38983 Code injection in alykoshin:mini-deep-assign
- CVE-2024-38972 Cross-site scripting in netbox:netbox
- CVE-2024-38971 Cross-site scripting in vaethink:vaethink
- CVE-2024-38970 Information disclosure in vaethink:vaethink
- CVE-2024-3897 Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure
- CVE-2024-38963 Cross-site scripting in nopcommerce:nopcommerce
- CVE-2024-3896 Cross-site scripting in Robo Gallery – Photo & Image Slider
- CVE-2024-38959 Cross-site scripting in creativeitem:academy lms
- CVE-2024-38953 Cross-site scripting in phpok:phpok
- CVE-2024-38952 Memory corruption in dronecode:px4 drone autopilot
- CVE-2024-38951 Memory corruption in dronecode:px4 drone autopilot
- CVE-2024-38950 Memory corruption in struktur:libde265
- CVE-2024-3895 WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- CVE-2024-38949 Memory corruption in struktur:libde265
- CVE-2024-38944 An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateFo
- CVE-2024-3894 Cross-site scripting in Robo Gallery – Photo & Image Slider
- CVE-2024-3893 Missing authorization in Classified Listing – AI-Powered Classified ads & Business Directory Plugin
- CVE-2024-38927 Use after free in openrobotics:robot operating system
- CVE-2024-38926 Use after free in openrobotics:robot operating system
- CVE-2024-38925 Use after free in openrobotics:robot operating system
- CVE-2024-38924 Use after free in openrobotics:robot operating system
- CVE-2024-38923 Use after free in openrobotics:robot operating system
- CVE-2024-38922 Memory corruption in openrobotics:robot operating system
- CVE-2024-38921 Use after free in openrobotics:robot operating system
- CVE-2024-38920 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process.
- CVE-2024-3892 Local code execution vulnerability in Telerik UI for WinForms
- CVE-2024-38910 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a use-after-free in the nav2_amcl process.
- CVE-2024-3891 Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags
- CVE-2024-38909 Studio 42 elFinder vulnerable to Incorrect Access Control
- CVE-2024-38903 Command injection in h3c:magic r230 firmware
- CVE-2024-38902 Hardcoded credentials in h3c:magic r230 firmware
- CVE-2024-3890 Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget
- CVE-2024-38897 Information disclosure in wavlink:wn551k1 firmware
- CVE-2024-38896 Command injection in wavlink:wn551k1 firmware
- CVE-2024-38895 Information disclosure in wavlink:wn551k1 firmware
- CVE-2024-38894 Command injection in wavlink:wn551k1 firmware
- CVE-2024-38892 Information disclosure in wavlink:wn551k1 firmware
- CVE-2024-38891 Information disclosure in horizoncloud:caterease
- CVE-2024-38890 Auth bypass in horizoncloud:caterease
- CVE-2024-3889 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2024-38889 SQL injection in horizoncloud:caterease
- CVE-2024-38888 Auth bypass in horizoncloud:caterease
- CVE-2024-38887 Command injection in horizoncloud:caterease
- CVE-2024-38886 Other in horizoncloud:caterease
- CVE-2024-38885 Hardcoded credentials in horizoncloud:caterease
- CVE-2024-38884 Auth bypass in horizoncloud:caterease
- CVE-2024-38883 Weak cryptography in horizoncloud:caterease
- CVE-2024-38882 Command injection in horizoncloud:caterease
- CVE-2024-38881 Weak cryptography in horizoncloud:caterease
- CVE-2024-3888 tagDiv Composer <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode