Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 322 of 521.
- CVE-2024-3838 Other in Chrome
- CVE-2024-38379 Apache Allura: Stored authenticated XSS
- CVE-2024-38375 @fastly/js-compute use-after-free in some host call implementations
- CVE-2024-38374 Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java
- CVE-2024-38373 FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser
- CVE-2024-38372 Undici vulnerable to data leak when using response.arrayBuffer()
- CVE-2024-38371 Insufficient access control for OAuth2 Device Code flow in authentik
- CVE-2024-38370 GLPI allows API document download without rights
- CVE-2024-3837 Use after free in Chrome
- CVE-2024-38369 XWiki programming rights may be inherited by inclusion
- CVE-2024-38368 Trunk's 'Claim your pod' could be used to obtain un-used pods
- CVE-2024-38367 CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking
- CVE-2024-38366 CoacoaPods trunk RCE in email verification system rfc-822
- CVE-2024-38365 btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality
- CVE-2024-38364 DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document
- CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte
- CVE-2024-38361 Permissions processing error in spacedb
- CVE-2024-38360 Denial of service via Watched Words in Discourse
- CVE-2024-38359 Lightning Network Daemon Onion Bomb
- CVE-2024-38358 Symlink bypasses filesystem sandbox in wasmer
- CVE-2024-38357 TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements
- CVE-2024-38356 TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option
- CVE-2024-38355 Unhandled 'error' event in socket.io
- CVE-2024-38354 Cross-site Scripting in Hackmd.io Notes lead by HTML Injection
- CVE-2024-38353 CodiMD - Missing Image Access Controls and Unauthorized Image Access
- CVE-2024-38351 Password auth and OAuth2 unverified email linking
- CVE-2024-38348 SQL injection in health care hospital management system project:health care hospital management system
- CVE-2024-38347 SQL injection in health care hospital management system project:health care hospital management system
- CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution
- CVE-2024-38345 Cross-site request forgery in Sola Testimonials
- CVE-2024-38344 Cross-site request forgery in WP Tweet Walls
- CVE-2024-38341 IBM Sterling Secure Proxy information disclosure
- CVE-2024-3834 Use after free in Chrome
- CVE-2024-38337 IBM Sterling Secure Proxy improper input validation
- CVE-2024-38335 IBM Security QRadar Network Threat Analytics denial of service
- CVE-2024-38330 IBM i privilege escalation
- CVE-2024-3833 Memory corruption in Chrome
- CVE-2024-38329 IBM Storage Protect for Virtual Environments: Data Protection for VMware security bypass
- CVE-2024-38327 IBM Analytics Content Hub information disclosure
- CVE-2024-38325 IBM Storage Defender information disclosure
- CVE-2024-38324 IBM Storage Defender improper certificate validation
- CVE-2024-38322 IBM Storage Defender information disclosure
- CVE-2024-38321 IBM Business Automation Workflow information disclosure
- CVE-2024-38320 IBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosure
- CVE-2024-3832 Memory corruption in Chrome
- CVE-2024-38319 IBM Security SOAR code execution
- CVE-2024-38318 IBM Aspera Shares HTML injection
- CVE-2024-38317 IBM Aspera Shares Cross-Site Scripting
- CVE-2024-38316 IBM Aspera Shares Denial of Service
- CVE-2024-38315 IBM Aspera Shares session fixation
- CVE-2024-38314 IBM Maximo Application Suite - Monitor Component information disclosure
- CVE-2024-38313 Other in Firefox for iOS
- CVE-2024-38312 Information disclosure in Firefox for iOS
- CVE-2024-38311 Apache Traffic Server: Request smuggling via pipelining after a chunked message body
- CVE-2024-38310 Privilege escalation in Intel(R) Graphics Driver software installers
- CVE-2024-3831 Cross-site scripting in Enter Addons – Ultimate Template Builder for Elementor
- CVE-2024-38309 Memory corruption in TELLUS
- CVE-2024-38308 Advantech ADAM-5550 Cross-site Scripting
- CVE-2024-38307 Denial of service in Intel(R) AMT and Intel(R) Standard Manageability
- CVE-2024-38306 btrfs: protect folio::private when attaching extent buffer folios
- CVE-2024-38305 Privilege escalation in SupportAssist for Home PCs
- CVE-2024-38304 Memory corruption in PowerEdge Platform
- CVE-2024-38303 Information disclosure in PowerEdge Platform
- CVE-2024-38302 Information disclosure in Dell Data Lakehouse
- CVE-2024-38301 Missing authorization in Alienware Command Center (AWCC)
- CVE-2024-38296 Information disclosure in Edge Gateway 5200
- CVE-2024-38295 Code injection in alcasar:alcasar
- CVE-2024-38294 Code injection in alcasar:alcasar
- CVE-2024-38293 Cross-site request forgery in alcasar:alcasar
- CVE-2024-38292 Path traversal in extremenetworks:xiq-se
- CVE-2024-38291 Information disclosure in extremenetworks:xiq-se
- CVE-2024-38290 Information disclosure in extremenetworks:xiq-se
- CVE-2024-3829 Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrant
- CVE-2024-38289 SQL injection in rhubcom:turbomeeting
- CVE-2024-38288 Command injection in rhubcom:turbomeeting
- CVE-2024-38287 Business logic in rhubcom:turbomeeting
- CVE-2024-38286 Apache Tomcat: Denial of Service
- CVE-2024-38285 Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
- CVE-2024-38284 Authentication Bypass by Capture-replay in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
- CVE-2024-38283 Missing Encryption of Sensitive Data in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
- CVE-2024-38282 Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
- CVE-2024-38281 Use of Hard-coded Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
- CVE-2024-38280 Cleartext Storage in a File or on Disk in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
- CVE-2024-3828 Spectra Pro <= 1.1.5 - Authenticated (Author+) Privilege Escalation
- CVE-2024-38279 Auth bypass in Vigilant Fixed LPR Coms Box (BCAV1F2-C600)
- CVE-2024-38278 Misconfiguration in RUGGEDCOM RMC8388 V5.X
- CVE-2024-38277 moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys
- CVE-2024-38276 moodle: CSRF risks due to misuse of confirm_sesskey
- CVE-2024-38275 moodle: HTTP authorization header is preserved between "emulated redirects"
- CVE-2024-38274 moodle: stored XSS via calendar's event title when deleting the event
- CVE-2024-38273 moodle: BigBlueButton web service leaks meeting joining information to users who should not have access
- CVE-2024-38272 Auth Bypass in Quick Share
- CVE-2024-38271 Denial of Service in Quick Share
- CVE-2024-38270 Weak cryptography in GS1900-10HP firmware
- CVE-2024-3827 Spectra Pro <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs
- CVE-2024-38269 Memory corruption in VMG8825-T50K firmware
- CVE-2024-38268 Memory corruption in VMG8825-T50K firmware
- CVE-2024-38267 Memory corruption in VMG8825-T50K firmware
- CVE-2024-38266 Memory corruption in VMG8825-T50K firmware
- CVE-2024-38265 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability