Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 337 of 521.
- CVE-2024-36535 Misconfiguration in layer5:meshery
- CVE-2024-36534 Insecure permissions in hwameistor v0.14.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
- CVE-2024-36533 Volcano has insecure permissions
- CVE-2024-36532 Insecure permissions in kruise v1.6.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
- CVE-2024-36531 Code injection in nukeviet:egovernment
- CVE-2024-3653 Undertow: learningpushhandler can lead to remote memory dos attacks
- CVE-2024-36528 nukeviet Deserialization of Untrusted Data vulnerability
- CVE-2024-36527 puppeteer-renderer v.3.2.0 and before is vulnerable to Directory Traversal.
- CVE-2024-36526 Hardcoded credentials in zkteco:zkbio cvsecurity
- CVE-2024-36523 Auth bypass in wvp-pro:gb28181
- CVE-2024-36522 Apache Wicket: Remote code execution via XSLT injection
- CVE-2024-3652 IKEv1 default AH/ESP responder can cause libreswan to abort and restart
- CVE-2024-36518 SQL Injection
- CVE-2024-36517 SQL Injection
- CVE-2024-36516 SQL Injection
- CVE-2024-36515 SQL Injection
- CVE-2024-36514 SQL Injection
- CVE-2024-36513 Privilege escalation in FortiClientWindows
- CVE-2024-36512 Path traversal in FortiAnalyzer
- CVE-2024-36511 Security feature bypass in FortiADC
- CVE-2024-36510 Information disclosure in FortiClientEMS
- CVE-2024-3651 Denial of Service via Quadratic Complexity in kjd/idna
- CVE-2024-36509 Information disclosure in FortiWeb
- CVE-2024-36508 Path traversal in FortiAnalyzer
- CVE-2024-36507 Other in FortiClientWindows
- CVE-2024-36506 Security feature bypass in FortiClientEMS
- CVE-2024-36505 Security feature bypass in FortiOS
- CVE-2024-36504 Memory corruption in FortiOS
- CVE-2024-36503 Memory corruption in EMUI
- CVE-2024-36502 Memory corruption in EMUI
- CVE-2024-36501 Memory corruption in EMUI
- CVE-2024-36500 Privilege escalation in EMUI
- CVE-2024-3650 Cross-site scripting in ElementsKit Elementor addons and Templates Library
- CVE-2024-36499 Missing authorization in EMUI
- CVE-2024-36498 Stored cross site scripting
- CVE-2024-36497 Unhashed Storage of Password
- CVE-2024-36496 Hardcoded Credentials
- CVE-2024-36495 Read/Write Permissions for Everyone on Configuration File
- CVE-2024-36494 Reflected Cross Site Scripting
- CVE-2024-36493 Memory corruption in Wavlink AC3000
- CVE-2024-36492 Existing local user overwritten by malicious remote
- CVE-2024-36491 Command injection in FutureNet NXR-120/C
- CVE-2024-3649 Contact Form by WPForms – Drag & Drop Form Builder for WordPress <= 1.8.7.2 - Unauthenticated Price Manipulation
- CVE-2024-36489 tls: fix missing memory barrier in tls_init
- CVE-2024-36488 Privilege escalation in Intel(R) DSA
- CVE-2024-36486 Privilege escalation in Parallels Desktop for Mac
- CVE-2024-36485 SQL Injection
- CVE-2024-36484 net: relax socket state check at accept time.
- CVE-2024-36482 Privilege escalation in Intel(R) CIP software
- CVE-2024-36481 tracing/probes: fix error check in parse_btf_field()
- CVE-2024-36480 Hardcoded credentials in Ricoh Streamline NX PC Client
- CVE-2024-3648 Cross-site scripting in ShareThis Share Buttons
- CVE-2024-36479 fpga: bridge: add owner module and take its refcount
- CVE-2024-36478 null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
- CVE-2024-36477 tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
- CVE-2024-36476 RDMA/rtrs: Ensure 'ib_sge list' is accessible
- CVE-2024-36475 Command injection in FutureNet NXR-120/C
- CVE-2024-36474 Integer overflow in G Structured File Library (libgsf)
- CVE-2024-36473 Other in Trend Micro VPN Proxy One Pro
- CVE-2024-36472 In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided b
- CVE-2024-36471 Apache Allura: sensitive information exposure via DNS rebinding
- CVE-2024-36470 Auth bypass in TeamCity
- CVE-2024-3647 Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'arrow_style'
- CVE-2024-36469 User enumeration via timing attack in Zabbix web interface
- CVE-2024-36468 Stack buffer overflow in zbx_snmp_cache_handle_engineid
- CVE-2024-36467 Authentication privilege escalation via user groups due to missing authorization checks
- CVE-2024-36466 Unauthenticated Zabbix frontend takeover when SSO is being used
- CVE-2024-36465 SQL injection in Zabbix API
- CVE-2024-36464 Media Types: Office365, SMTP passwords are unencrypted and visible in plaintext when exported
- CVE-2024-36463 Code injection in Zabbix
- CVE-2024-36462 Allocation of resources without limits or throttling (uncontrolled resource consumption)
- CVE-2024-36461 Direct access to memory pointers within the JS engine for modification
- CVE-2024-36460 Front-end audit log shows passwords in plaintext
- CVE-2024-3646 Command injection in Enterprise Server
- CVE-2024-36459 Cross-Site Scripting Vulnerability in Symantec SiteMinder Web Agent
- CVE-2024-36458 Symantec Privileged Access Manager Privilege Escalation vulnerability
- CVE-2024-36457 Symantec Privileged Access Manager Authentication Bypass vulnerability
- CVE-2024-36456 Symantec Privileged Access Manager Remote Command Execution vulnerability
- CVE-2024-36455 Symantec Privileged Access Manager Remote Command Execution vulnerability
- CVE-2024-36454 Denial of service in IPCOM EX2 Series (V01L0x Series)
- CVE-2024-36453 Cross-site scripting in Usermin
- CVE-2024-36452 Cross-site request forgery in Webmin
- CVE-2024-36451 Missing authorization in Webmin
- CVE-2024-36450 Cross-site scripting in Webmin
- CVE-2024-3645 Cross-site scripting in Essential Addons for Elementor Pro
- CVE-2024-36448 Apache IoTDB Workbench: SSRF Vulnerability (EOL)
- CVE-2024-36446 Auth bypass in mitel:mivoice mx-one
- CVE-2024-36445 Swissphone DiCal-RED 4009 devices allow a remote attacker to gain a root shell via TELNET without authentication.
- CVE-2024-36444 cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an unauthenticated attacker to gain access to device logs.
- CVE-2024-36443 Swissphone DiCal-RED 4009 devices allow a remote attacker to gain read access to almost the whole file system via anonymous FTP.
- CVE-2024-36442 cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system.
- CVE-2024-36441 Swissphone DiCal-RED 4009 devices allow an unauthenticated attacker use a port-2101 TCP connection to gain access to operation messages that
- CVE-2024-36440 An issue was discovered on Swissphone DiCal-RED 4009 devices.
- CVE-2024-3644 Newsletter Popup <= 1.2 - Admin+ Stored XSS
- CVE-2024-36439 Swissphone DiCal-RED 4009 devices allow a remote attacker to gain access to the administrative web interface via the device password's hash
- CVE-2024-36438 eLinkSmart Hidden Smart Cabinet Lock 2024-05-22 has Incorrect Access Control and fails to perform an authorization check which can lead to c
- CVE-2024-36437 The com.enflick.android.TextNow (aka TextNow: Call + Text Unlimited) application 24.17.0.2 for Android enables any installed application (wi
- CVE-2024-36435 An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules).
- CVE-2024-36434 An SMM callout vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4.
- CVE-2024-36433 An arbitrary memory write vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4.