Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 336 of 521.
- CVE-2024-36730 Denial of service in oneflow:oneflow
- CVE-2024-3673 Web Directory Free < 1.7.3 - Unauthenticated LFI
- CVE-2024-36729 Memory corruption in trendnet:tew-827dru firmware
- CVE-2024-36728 Memory corruption in trendnet:tew-827dru firmware
- CVE-2024-3672 BA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-3671 Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-36702 Memory corruption in mz-automation:libiec61850
- CVE-2024-3670 Cross-site scripting in Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps)
- CVE-2024-36697 A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrar
- CVE-2024-36694 openCart Server-Side Template Injection (SSTI) vulnerability
- CVE-2024-36691 Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users
- CVE-2024-3669 Web Directory Free < 1.7.2 - Reflected XSS
- CVE-2024-36684 SQL injection in prestashop:pk customlinks
- CVE-2024-36683 SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers t
- CVE-2024-36682 In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while S
- CVE-2024-36681 SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitiv
- CVE-2024-36680 In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection.
- CVE-2024-3668 PowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation
- CVE-2024-36679 In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection.
- CVE-2024-36678 SQL injection in promokit:pk themesettings
- CVE-2024-36677 In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to e
- CVE-2024-36676 BookStack Incorrect Access Control vulnerability
- CVE-2024-36675 Server-side request forgery in lylme:lylme spage
- CVE-2024-36674 Cross-site scripting in lylme:lylme spage
- CVE-2024-36673 SQL injection in pharmacy\/medical store point of sale system project:pharmacy\/medical store point of sale system
- CVE-2024-36671 nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c.
- CVE-2024-36670 Cross-site request forgery in idccms:idccms
- CVE-2024-3667 Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL
- CVE-2024-36669 Cross-site request forgery in idccms project:idccms
- CVE-2024-36668 Cross-site request forgery in idccms project:idccms
- CVE-2024-36667 Cross-site request forgery in idccms project:idccms
- CVE-2024-3666 Cross-site scripting in Opal Estate Pro – Property Management and Submission
- CVE-2024-36656 Cross-site scripting in minthcm:minthcm
- CVE-2024-36650 Memory corruption in totolink:a3100r firmware
- CVE-2024-3665 Cross-site scripting in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
- CVE-2024-36647 Cross-site scripting in churchcrm:churchcrm
- CVE-2024-3664 Missing authorization in Quick Featured Images
- CVE-2024-3663 WP Scraper <= 5.7 - Missing Authorization to Arbitrary Page/Post Creation
- CVE-2024-36626 Null dereference in prestashop:prestashop
- CVE-2024-36625 Cross-site scripting in zulip:zulip
- CVE-2024-36624 Cross-site scripting in zulip:zulip
- CVE-2024-36623 Moby Race Condition vulnerability
- CVE-2024-36622 Command injection in raspap:raspap-webgui
- CVE-2024-36621 Moby Race Condition vulnerability
- CVE-2024-36620 NULL Pointer Dereference on moby image history
- CVE-2024-3662 Missing authorization in WPZOOM Social Feed Widget & Block
- CVE-2024-36619 Integer overflow in ffmpeg:ffmpeg
- CVE-2024-36618 Integer overflow in ffmpeg:ffmpeg
- CVE-2024-36617 Integer overflow in ffmpeg:ffmpeg
- CVE-2024-36616 Integer overflow in ffmpeg:ffmpeg
- CVE-2024-36615 Race condition in ffmpeg:ffmpeg
- CVE-2024-36613 Integer overflow in ffmpeg:ffmpeg
- CVE-2024-36612 Denial of service in zulip:zulip server
- CVE-2024-36611 In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle case
- CVE-2024-3661 DHCP routing options can manipulate interface-based VPN traffic
- CVE-2024-36604 Command injection in tenda:o3 firmware
- CVE-2024-36600 Memory corruption in gnu:libcdio
- CVE-2024-3660 Arbitrary code injection vulnerability in Keras framework < 2.13
- CVE-2024-36599 Cross-site scripting in aegon:life insurance management system
- CVE-2024-36598 An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file.
- CVE-2024-36597 SQL injection in projectworlds:life insurance management system
- CVE-2024-3659 Command injection in KAON AR2140 routers
- CVE-2024-36589 An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd81
- CVE-2024-36588 An issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbi
- CVE-2024-36587 Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting
- CVE-2024-36586 AdGuardHome privilege escalation vulnerability
- CVE-2024-36583 A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.
- CVE-2024-36582 object-deep-assign Prototype Pollution
- CVE-2024-36581 Badger Database Prototype Pollution
- CVE-2024-36580 @cdr0/sg Prototype Pollution
- CVE-2024-36578 @akbr/update Prototype Pollution
- CVE-2024-36577 Object Resolver Prototype Pollution
- CVE-2024-36575 A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.
- CVE-2024-36574 flatten-json Prototype Pollution
- CVE-2024-36573 obx Prototype Pollution
- CVE-2024-36572 Code injection in allpro:formmanager data handler
- CVE-2024-3657 389-ds-base: potential denial of service via specially crafted kerberos as-req request
- CVE-2024-36569 Code injection in mayurik:gas agency management system
- CVE-2024-36568 SQL injection in mayurik:gas agency management system
- CVE-2024-3656 Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities
- CVE-2024-36558 Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Informatio
- CVE-2024-36557 The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call
- CVE-2024-36556 Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1.
- CVE-2024-36555 Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch
- CVE-2024-36554 Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0
- CVE-2024-36553 Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack.
- CVE-2024-36550 Cross-site request forgery in idccms:idccms
- CVE-2024-3655 Mali GPU Kernel Driver allows improper GPU memory processing operations
- CVE-2024-36549 Cross-site request forgery in idccms:idccms
- CVE-2024-36548 Cross-site request forgery in idccms:idccms
- CVE-2024-36547 Cross-site request forgery in idccms:idccms
- CVE-2024-36543 STRIMZI incorrect access control
- CVE-2024-36542 Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
- CVE-2024-36541 Misconfiguration in kube-logging:logging-operator
- CVE-2024-36540 Misconfiguration in external-secrets:external secrets operator
- CVE-2024-3654 Cross-Site Scripting Vulnerability in Teixo by Teimas Global
- CVE-2024-36539 Misconfiguration in projectcontour:contour
- CVE-2024-36538 Misconfiguration in chaos-mesh:chaos mesh
- CVE-2024-36537 Misconfiguration in cert-manager:cert-manager
- CVE-2024-36536 fabedge has insecure permissions