Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 332 of 521.
- CVE-2024-37229 WordPress Blogmentor – Blog Layouts for Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37228 WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability
- CVE-2024-37227 WordPress Newsletters plugin <= 4.9.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-37226 WordPress Kanban Boards for WordPress plugin <= 2.5.21 - Broken Access Control vulnerability
- CVE-2024-37225 WordPress Zoho Marketing Automation plugin <= 1.2.7 - SQL Injection vulnerability
- CVE-2024-37224 WordPress SP Project & Document Manager plugin <= 4.71 - Directory Traversal vulnerability
- CVE-2024-37223 WordPress Restaurant Reservations plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37222 WordPress Master Slider plugin <= 3.10.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-37221 WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37220 WordPress Optinly plugin <= 1.0.18 - Broken Access Control vulnerability
- CVE-2024-3722 Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification
- CVE-2024-37219 WordPress Page Builder Sandwich plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37218 WordPress Page Builder Sandwich <= 5.1.0 - Broken Access Control vulnerability
- CVE-2024-37217 WordPress Empty Cart Button for WooCommerce plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37216 WordPress Sketchfab Embed plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-37215 Cross-site scripting in Transition Slider – Responsive Image Slider and Gallery
- CVE-2024-37214 WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control to XSS vulnerability
- CVE-2024-37213 WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.4.6 - CSRF to XSS vulnerability
- CVE-2024-37212 WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - CSRF to PHP Object Injection vulnerability
- CVE-2024-37211 Cross-site scripting in Ali2Woo Lite
- CVE-2024-37210 WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control vulnerability
- CVE-2024-3721 TBK DVR-4104/DVR-4216 os command injection
- CVE-2024-37209 WordPress User Rights Access Manager plugin <= 1.1.2 - Broken Access Control vulnerability
- CVE-2024-37208 WordPress WP Scraper plugin <= 5.7 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2024-37207 WordPress Demo Awesome plugin <= 1.0.2 - Broken Access Control vulnerability
- CVE-2024-37206 WordPress Demo Awesome plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-37205 WordPress affiliate-toolkit plugin <= 3.4.4 - Sensitive Data Exposure via Log File vulnerability
- CVE-2024-37204 WordPress PropertyHive plugin <= 2.0.9 - Broken Access Control vulnerability
- CVE-2024-37203 WordPress Laybuy Payment Extension for WooCommerce plugin <= 5.3.9 - Broken Access Control vulnerability
- CVE-2024-37202 Missing authorization in Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter
- CVE-2024-37201 WordPress Woocommerce Customers Order History plugin <= 5.2.2 - Broken Access Control vulnerability
- CVE-2024-3720 Tianwell Fire Intelligent Command Platform API Interface page sql injection
- CVE-2024-37199 WordPress Enfold theme <= 5.6.9 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-37198 WordPress Digital Newspaper theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-3719 Campcodes House Rental Management System ajax.php sql injection
- CVE-2024-37187 Advantech ADAM-5550 Weak Encoding for Password
- CVE-2024-37186 Command injection in Wavlink AC3000
- CVE-2024-37185 Arkcompiler Ets Runtime has an out-of-bounds write vulnerability
- CVE-2024-37184 Memory corruption in Wavlink AC3000
- CVE-2024-37183 Westermo L210-F2G Lynx Cleartext Transmission of Sensitive Information
- CVE-2024-37182 Lack of permissions prompting when opening external URLs
- CVE-2024-37181 Race condition in Intel(R) Neural Compressor software
- CVE-2024-37180 [CVE-2024-37180] Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2024-3718 Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2024-37179 Insecure File Operations vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
- CVE-2024-37178 Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
- CVE-2024-37177 Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation
- CVE-2024-37176 Missing Authorization check in SAP BW/4HANA Transformation and DTP
- CVE-2024-37175 [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
- CVE-2024-37174 [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
- CVE-2024-37173 [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI)
- CVE-2024-37172 [CVE-2024-37172] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)
- CVE-2024-37171 [CVE-2024-37171] Server-Side Request Forgery (SSRF) in SAP Transportation Management (Collaboration Portal)
- CVE-2024-3717 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure
- CVE-2024-37169 @jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper
- CVE-2024-37168 @grpc/grpc-js can allocate memory for incoming messages well above configured limits
- CVE-2024-37167 Tuleap has improper permissions of the backlog items
- CVE-2024-37166 ghtml Cross-Site Scripting (XSS) vulnerability
- CVE-2024-37165 Discourse has an XSS via Onebox system
- CVE-2024-37164 CVAT SSRF via custom cloud storage endpoints
- CVE-2024-37163 SkyScrape Secure API Requests
- CVE-2024-37162 zsa Generates Error Messages Containing Sensitive Information
- CVE-2024-37161 MeterSphere front-end editor stores XSS vulnerability
- CVE-2024-37160 Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata
- CVE-2024-3716 Foreman-installer: candlepin database password being leaked to local users via the process list
- CVE-2024-37159 Evmos is missing create validator check
- CVE-2024-37158 Evmos is missing precompile checks
- CVE-2024-37157 Discourse vulnerable to Server-Side Request Forgery via FastImage
- CVE-2024-37156 TokenController formName not sanitized in hidden input
- CVE-2024-37155 OpenCTI May Bypass Introspection Restriction
- CVE-2024-37154 Evmos allows unvested token delegations
- CVE-2024-37153 Evmos's contract balance not updating correctly after interchain transaction
- CVE-2024-37152 Unauthenticated Access to sensitive settings in Argo CD
- CVE-2024-37151 Suricata defrag: IP ID reuse can lead to policy bypass
- CVE-2024-37150 Private npm registry support used scope auth token for downloading tarballs
- CVE-2024-3715 Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-37149 GLPI allows remote code execution through the plugin loader
- CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts
- CVE-2024-37147 GLPI allows Authenticated File Upload to Restricted Tickets
- CVE-2024-37146 GHSL-2023-248: Flowise xss in /api/v1/credentials/id
- CVE-2024-37145 GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id
- CVE-2024-37144 Information disclosure in Dell Data Lakehouse
- CVE-2024-37143 Path traversal in Dell Data Lakehouse
- CVE-2024-37142 Privilege escalation in Dell Peripheral Manager
- CVE-2024-37141 Open redirect in PowerProtect DD
- CVE-2024-37140 Command injection in PowerProtect DD
- CVE-2024-3714 GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-37139 Denial of service in PowerProtect DD
- CVE-2024-37138 Path traversal in PowerProtect DD
- CVE-2024-37137 Weak cryptography in CloudLink
- CVE-2024-37136 Information disclosure in Path to Power
- CVE-2024-37135 Information disclosure in Data Manager Appliance Software (DMAS)
- CVE-2024-37134 Privilege escalation in PowerScale OneFS
- CVE-2024-37133 Privilege escalation in PowerScale OneFS
- CVE-2024-37132 Privilege escalation in PowerScale OneFS
- CVE-2024-37131 Misconfiguration in Secure Connect Gateway (SCG) Policy Manager
- CVE-2024-37130 Privilege escalation in Dell OpenManage Server Administrator
- CVE-2024-37129 Path traversal in Dell Inventory Collector
- CVE-2024-37127 Privilege escalation in Dell Peripheral Manager
- CVE-2024-37126 Privilege escalation in PowerScale OneFS