Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 326 of 521.
- CVE-2024-37966 Microsoft SQL Server Native Scoring Information Disclosure Vulnerability
- CVE-2024-37965 Microsoft SQL Server Elevation of Privilege Vulnerability
- CVE-2024-37962 WordPress Fusion Page Builder plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37961 WordPress codoc plugin <= 0.9.51.12 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37960 WordPress CodePen Embedded Pens Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-3796 Cross-site Scripting vulnerability in WBSAirback
- CVE-2024-37959 WordPress Power BI Embedded for WordPress plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37958 WordPress Meks Smart Author Widget plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37957 WordPress Bradmax Player plugin <= 1.1.27 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37956 WordPress VK All in One Expansion Unit plugin <= 9.99.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37955 WordPress GutSlider – All in One Block Slider plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37954 WordPress Simple Responsive Slider plugin <= 0.2.2.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-37953 WordPress MBE eShip plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-37952 WordPress BookYourTravel theme <= 8.18.17 - Subscriber+ Privilege Escalation vulnerability
- CVE-2024-37951 WordPress Magical Posts Display plugin <= 1.2.38 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37950 WordPress Master Popups plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-3795 Cross-site Scripting vulnerability in WBSAirback
- CVE-2024-37949 WordPress Responsive Mobile theme <= 1.15.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37948 WordPress Caxton – Create Pro page layouts in Gutenberg plugin <= 1.30.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37947 WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37946 WordPress ReCaptcha Integration for WordPress plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37945 WordPress WPBITS Addons For Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37944 Cross-site scripting in WP Travel Engine
- CVE-2024-37943 WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-37942 WordPress BerqWP plugin <= 1.7.5 - Unauthenticated Non-Blind Server Side Request Forgery (SSRF) vulnerability
- CVE-2024-37941 Cross-site request forgery in Internal Link Juicer: SEO Auto Linker for WordPress
- CVE-2024-37940 Cross-site request forgery in Seraphinite Accelerator (Full, premium)
- CVE-2024-3794 Cross-site Scripting vulnerability in WBSAirback
- CVE-2024-37939 WordPress Patricia Lite theme <= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37938 WordPress SociallyViral theme <= 1.0.10 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37937 WordPress Rara Business theme <= 1.2.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37936 WordPress Tabs For WPBakery Page Builder plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37935 WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerability
- CVE-2024-37934 WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability
- CVE-2024-37933 WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated SQL Injection vulnerability
- CVE-2024-37932 WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Arbitrary File Deletion vulnerability
- CVE-2024-37931 WordPress Point theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37930 WordPress SmartMag theme < 10.1.0 - Sensitive Data Exposure via Log File vulnerability
- CVE-2024-3793 Cross-site Scripting vulnerability in WBSAirback
- CVE-2024-37929 WordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability
- CVE-2024-37928 WordPress Jobmonster theme <= 4.7.0 - Unauthenticated Arbitrary File Deletion vulnerability
- CVE-2024-37927 WordPress Jobmonster theme <= 4.7.5 - Unauthenticated Privilege Escalation vulnerability
- CVE-2024-37926 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.9 - Broken Access Control vulnerability
- CVE-2024-37925 WordPress BuddyBoss Theme theme <= 2.4.61 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37924 Information disclosure in WP2Speed Faster
- CVE-2024-37923 WordPress Cliengo – Chatbot plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37922 WordPress Premium Addons for Elementor plugin <= 4.10.34 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37921 WordPress Chained Quiz plugin <= 1.3.2.8 - Broken Access Control vulnerability
- CVE-2024-37920 WordPress ARForms Form Builder plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-3792 Cross-site Scripting vulnerability in WBSAirback
- CVE-2024-37919 WordPress Timeline Module for Beaver Builder plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37918 WordPress ConeBlog plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37917 Denial of service in pexip:pexip infinity
- CVE-2024-3791 Cross-site Scripting vulnerability in WBSAirback
- CVE-2024-37906 Admidio has Blind SQL Injection in ecard_send.php
- CVE-2024-37905 Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik
- CVE-2024-37904 Denial of service from maliciously configured Git repository in Minder
- CVE-2024-37903 Mastodon has improper authorship check on audience extension for existing posts
- CVE-2024-37902 Path thraversal in DeepJavaLibrary
- CVE-2024-37901 XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet
- CVE-2024-37900 XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader
- CVE-2024-3790 Cross-site Scripting vulnerability in WBSAirback
- CVE-2024-37899 Disabling a user account changes its author, allowing RCE from user account in XWiki
- CVE-2024-37898 XWiki Platform vulnerable to document deletion and overwrite from edit
- CVE-2024-37897 Insufficient access control for password reset in sftpgo
- CVE-2024-37896 SQL injection vulnerability in Gin-vue-admin
- CVE-2024-37895 API Key Leak in lobe-chat
- CVE-2024-37894 Squid vulnerable to heap corruption in ESI assign
- CVE-2024-37893 MFA bypass in oauth flow in Firefly III
- CVE-2024-37891 Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
- CVE-2024-37890 Denial of service when handling a request with many HTTP headers in ws
- CVE-2024-3789 Uncontrolled Resource Consumption vulnerability in WBSAirback
- CVE-2024-37889 MyFinances Allows Unauthorized Access to Other Customer Data
- CVE-2024-37888 The Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionality
- CVE-2024-37887 Nextcloud Server's events information leaked with shared calendars on recurrence exceptions
- CVE-2024-37886 Nextcloud user_oidc's ID4me does not validate signature or expiration
- CVE-2024-37885 Code injection in Nextcloud Desktop Client for macOS
- CVE-2024-37884 Nextcloud Server's users can delete old versions of read-only shared files
- CVE-2024-37883 Nextcloud Deck can access comments and attachments of deleted cards
- CVE-2024-37882 Nextcloud Server can reshare read&share only folder with more permissions
- CVE-2024-37881 Open redirect in SiteGuard WP Plugin
- CVE-2024-37880 Weak cryptography in pq-crystals:kyber
- CVE-2024-3788 Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback
- CVE-2024-37879 Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitr
- CVE-2024-37878 Cross-site scripting in twcms:twcms
- CVE-2024-37877 UERANSIM before 3.2.6 allows out-of-bounds read when a RLS packet is sent to gNodeB with malformed PDU length.
- CVE-2024-37873 SQL injection in itsourcecode:payroll management system project in php with source code
- CVE-2024-37872 SQL injection in angeljudesuarez:billing system
- CVE-2024-37871 SQL injection in emiloi:online discussion forum
- CVE-2024-37870 SQL injection in itsourcecode:learning management system
- CVE-2024-3787 Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback
- CVE-2024-37869 File upload in emiloimagtolis:online discussion forum
- CVE-2024-37868 File upload in emiloimagtolis:online discussion forum
- CVE-2024-37865 Weak cryptography in s3browser:s3 browser
- CVE-2024-37863 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process.
- CVE-2024-37862 Buffer Overflow vulnerability in Open Robotic Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local a
- CVE-2024-37861 Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process.
- CVE-2024-37860 Buffer Overflow vulnerability in Open Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker
- CVE-2024-3786 Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback
- CVE-2024-37859 Cross-site scripting in oretnom23:lost and found information system