Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 338 of 521.
- CVE-2024-36432 An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4.
- CVE-2024-3643 Newsletter Popup <= 1.2 - List Deletion via CSRF
- CVE-2024-36428 SQL injection in orangehrm:orangehrm
- CVE-2024-36427 The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to
- CVE-2024-36426 In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session.
- CVE-2024-36424 Null dereference in k7computing:k7 ultimate security
- CVE-2024-36423 GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id
- CVE-2024-36422 GHSL-2023-245: Flowise xss in api/v1/chatflows/id
- CVE-2024-36421 GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts
- CVE-2024-36420 GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file
- CVE-2024-3642 Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF
- CVE-2024-36419 SuiteCRM-Core Host Header Injection in /legacy
- CVE-2024-36418 SuiteCRM authenticated RCE using connectors
- CVE-2024-36417 SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame
- CVE-2024-36416 SuiteCRM v4 API Excessive log data DOS
- CVE-2024-36415 File upload in SuiteCRM
- CVE-2024-36414 SuiteCRM authenticated Server-Side Request Forgery
- CVE-2024-36413 SuiteCRM authenticated Reflected Cross-Site Scripting
- CVE-2024-36412 SuiteCRM unauthenticated SQL Injection
- CVE-2024-36411 SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controller
- CVE-2024-36410 SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller
- CVE-2024-3641 Newsletter Popup <= 1.2 - Unauthenticated Stored XSS
- CVE-2024-36409 SuiteCRM authenticated SQL Injection in TreeData entrypoint
- CVE-2024-36408 SuiteCRM authenticated SQL Injection in Alerts
- CVE-2024-36407 SuiteCRM unauthenticated user password reset on php7
- CVE-2024-36406 SuiteCRM vulnerable to open redirects
- CVE-2024-36405 Information disclosure in liboqs
- CVE-2024-36404 GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
- CVE-2024-36403 Denial of service/high operating costs through unauthenticated downloads in Matrix Media Repo
- CVE-2024-36402 Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo
- CVE-2024-36401 OSGeo GeoServer GeoTools Eval Injection
- CVE-2024-36400 nano-id is unable to generate the correct character set
- CVE-2024-3640 Rockwell Automation FactoryTalk® Remote Access™ has Unquoted Executables
- CVE-2024-36399 Kanboard affected by Project Takeover via IDOR in ProjectPermissionController
- CVE-2024-36398 Privilege escalation in SINEC NMS
- CVE-2024-36397 Vantiva - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2024-36396 Verint - CWE-434: Unrestricted Upload of File with Dangerous Type
- CVE-2024-36395 Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- CVE-2024-36394 SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CVE-2024-36393 SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CVE-2024-36392 MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CVE-2024-36391 MileSight DeviceHub - CWE-320: Key Management Errors
- CVE-2024-36390 MileSight DeviceHub - CWE-20 Improper Input Validation
- CVE-2024-3639 Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid
- CVE-2024-36389 MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values
- CVE-2024-36388 MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function
- CVE-2024-36387 Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2
- CVE-2024-36384 Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages.
- CVE-2024-36383 Denial of service in logpoint:saml authentication
- CVE-2024-3638 Cross-site scripting in Livemesh Addons by Elementor
- CVE-2024-36378 Denial of service in TeamCity
- CVE-2024-36377 Missing authorization in TeamCity
- CVE-2024-36376 Missing authorization in TeamCity
- CVE-2024-36375 Information disclosure in TeamCity
- CVE-2024-36374 Cross-site scripting in TeamCity
- CVE-2024-36373 Cross-site scripting in TeamCity
- CVE-2024-36372 Cross-site scripting in TeamCity
- CVE-2024-36371 Cross-site scripting in TeamCity
- CVE-2024-36370 Cross-site scripting in TeamCity
- CVE-2024-3637 Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Admin+ Stored XSS
- CVE-2024-36369 Cross-site scripting in TeamCity
- CVE-2024-36368 Cross-site scripting in TeamCity
- CVE-2024-36367 Cross-site scripting in TeamCity
- CVE-2024-36366 Cross-site scripting in TeamCity
- CVE-2024-36365 Auth bypass in TeamCity
- CVE-2024-36364 Missing authorization in TeamCity
- CVE-2024-36363 Cross-site scripting in TeamCity
- CVE-2024-36362 Path traversal in TeamCity
- CVE-2024-36361 Pug allows JavaScript code execution if an application accepts untrusted input
- CVE-2024-36360 Command injection in awkblog
- CVE-2024-3636 Pinpoint Booking System < 2.9.9.4.8 - Admin+ Stored XSS
- CVE-2024-36359 Cross-site scripting in Trend Micro InterScan Web Security Virtual Appliance
- CVE-2024-36358 Privilege escalation in Trend Micro Deep Security Agent
- CVE-2024-36357 Information disclosure in AMD EPYC™ 7003 Series Processors
- CVE-2024-36355 Memory corruption in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
- CVE-2024-36354 Security feature bypass in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
- CVE-2024-36353 Information disclosure in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
- CVE-2024-36352 Memory corruption in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics
- CVE-2024-36350 Information disclosure in AMD EPYC™ 7003 Series Processors
- CVE-2024-3635 The Post Grid < 7.5.0 - Editor+ Stored XSS via Grid Creation
- CVE-2024-36349 Information disclosure in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
- CVE-2024-36348 Information disclosure in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
- CVE-2024-36347 Security feature bypass in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
- CVE-2024-36346 Other in AMD Instinct™ MI300A
- CVE-2024-36345 Memory corruption in AMD EPYC™ 4004
- CVE-2024-36343 Memory corruption in AMD EPYC™ 4004
- CVE-2024-36342 Memory corruption in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics
- CVE-2024-36340 Other in AMD μProf
- CVE-2024-3634 month name translation benaceur < 2.3.8 - Admin+ Stored XSS
- CVE-2024-36339 Privilege escalation in AMD Optimizing CPU Libraries (AOCL)
- CVE-2024-36337 Integer overflow in AMD Ryzen™ AI Software
- CVE-2024-36336 Integer overflow in AMD Ryzen™ AI Software
- CVE-2024-36334 Security feature bypass in AMD Radeon™ RX 7000 Series Graphics Products
- CVE-2024-36333 Privilege escalation in AMD Cleanup Utility
- CVE-2024-36332 Memory corruption in AMD Radeon™ PRO V710
- CVE-2024-36331 Other in AMD EPYC™ 9004 Series Processors
- CVE-2024-3633 WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG
- CVE-2024-36328 Integer overflow in AMD Ryzen™ AI Software
- CVE-2024-36326 Missing authorization in AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics
- CVE-2024-36324 Memory corruption in AMD Radeon™ PRO V520