Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 341 of 521.
- CVE-2024-36116 Path traversal in Reposilite javadoc file expansion
- CVE-2024-36115 Stored Cross site scripting in Reposilite artifacts
- CVE-2024-36114 Decompressors can crash the JVM and leak memory content in Aircompressor
- CVE-2024-36113 Discourse missing authorization checks for suspending admins/moderators
- CVE-2024-36112 Nautobot dynamic-group-members doesn't enforce permission restrictions on member objects
- CVE-2024-36111 KubePi's JWT token validation has a defect
- CVE-2024-36110 Cross-site scripting in ansibleguy-webui
- CVE-2024-3611 Cross-site scripting in Toolbar Extras for Elementor & More – WordPress Admin Bar Enhanced
- CVE-2024-36109 Cross-site Scripting with Markdown rendering in CoCalc
- CVE-2024-36108 Multiple Broken Function-Level Authorization vulnerabilities in casgate
- CVE-2024-36107 Information disclosure in minio
- CVE-2024-36106 Argo CD allows authenticated users to enumerate clusters by name
- CVE-2024-36105 dbt allows Binding to an Unrestricted IP Address via socketsocket
- CVE-2024-36104 Apache OFBiz: Path traversal leading to a RCE
- CVE-2024-36103 Command injection in WRC-X5400GS-B
- CVE-2024-3610 WP Child Theme Generator <= 1.1.1 - Missing Authorization to Unauthenticated Child Theme Creation/Activation
- CVE-2024-3609 ReviewX – Multi-criteria Rating & Reviews for WooCommerce <= 1.6.27 - Missing Authorization
- CVE-2024-36082 SQL injection in Music Store - WordPress eCommerce
- CVE-2024-36081 Westermo EDW-100 devices through 2024-05-03 allow an unauthenticated user to download a configuration file containing a cleartext password.
- CVE-2024-36080 Westermo EDW-100 devices through 2024-05-03 have a hidden root user account with a hardcoded password that cannot be changed.
- CVE-2024-3608 Product Designer <= 1.0.33 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
- CVE-2024-36079 An issue was discovered in Vaultize 21.07.27.
- CVE-2024-36078 Misconfiguration in zammad:zammad
- CVE-2024-36077 Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation.
- CVE-2024-36076 Cross-site request forgery in syslifters:sysreptor
- CVE-2024-36075 The CoSoSys Endpoint Protector through 5.9.3 and Unify agent through 7.0.6 is susceptible to an arbitrary code execution vulnerability due t
- CVE-2024-36074 Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the Endpoi
- CVE-2024-36073 Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the shadow
- CVE-2024-36072 Netwrix CoSoSys Endpoint Protector through 5.9.3 and CoSoSys Unify through 7.0.6 contain a remote code execution vulnerability in the loggin
- CVE-2024-36071 Privilege escalation in samsung:magician
- CVE-2024-36070 tine before 2023.11.8, when an LDAP backend is used, allows anonymous remote attackers to obtain sensitive authentication information via se
- CVE-2024-3607 PropertyHive <= 2.0.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
- CVE-2024-36068 Missing authorization in rubrik:cloud data management
- CVE-2024-36066 Weak cryptography in keyfactor:ejbca
- CVE-2024-36064 The NLL com.nll.cb (aka ACR Phone) application through 0.330-playStore-NoAccessibility-arm8 for Android allows any installed application (wi
- CVE-2024-36063 The Goodwy com.goodwy.dialer (aka Right Dialer) application through 5.1.0 for Android enables any application (with no permissions) to place
- CVE-2024-36062 The com.callassistant.android (aka AI Call Assistant & Screener) application 1.174 for Android enables any installed application (with no pe
- CVE-2024-36061 Command injection in engeniustech:ews356-fit firmware
- CVE-2024-36060 EnGenius EnStation5-AC A8J-ENS500AC 1.0.0 devices allow blind OS command injection via shell metacharacters in the Ping and Speed Test parameters.
- CVE-2024-3606 ProfileGrid – User Profiles, Memberships, Groups and Communities <= 5.8.3 - Missing Authorization
- CVE-2024-36059 Directory Traversal vulnerability in Kalkitech ASE ASE61850 IEDSmart upto and including version 2.3.5 allows attackers to read/write arbitra
- CVE-2024-36058 The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the PO
- CVE-2024-36057 Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution.
- CVE-2024-36056 Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory via IOCTL 0x9c40649
- CVE-2024-36055 Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily map physical memory with read/write acc
- CVE-2024-36054 Hw64.sys in Marvin Test HW.exe before 5.0.5.0 allows unprivileged user-mode processes to arbitrarily read kernel memory (and consequently ga
- CVE-2024-36053 In the mintupload package through 4.2.0 for Linux Mint, service-name mishandling leads to command injection via shell metacharacters in chec
- CVE-2024-36052 Other in rarlab:winrar
- CVE-2024-36050 Nix through 2.22.1 mishandles certain usage of hash caches, which makes it easier for attackers to replace current source code with attacker
- CVE-2024-3605 WP Hotel Booking <= 2.1.0 - Unauthenticated SQL Injection
- CVE-2024-36049 Aptos Wisal payroll accounting before 7.1.6 uses hardcoded credentials in the Windows client to fetch the complete list of usernames and pas
- CVE-2024-36048 Weak cryptography in fedoraproject:fedora
- CVE-2024-36047 Other in infoblox:nios
- CVE-2024-36046 Privilege escalation in infoblox:nios
- CVE-2024-36043 question_image.ts in SurveyJS Form Library before 1.10.4 allows contentMode=youtube XSS via the imageLink property.
- CVE-2024-36042 Silverpeas authentication bypass
- CVE-2024-36041 Auth bypass in kde:plasma-workspace
- CVE-2024-3604 OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) SQL Injection
- CVE-2024-36039 PyMySQL SQL Injection vulnerability
- CVE-2024-36038 Stored XSS
- CVE-2024-36037 Insufficient Access Control Vulnerability
- CVE-2024-36036 Insufficient Access Control Vulnerability
- CVE-2024-36035 SQL Injection
- CVE-2024-36034 SQL Injection
- CVE-2024-36033 Bluetooth: qca: fix info leak when fetching board id
- CVE-2024-36032 Bluetooth: qca: fix info leak when fetching fw build id
- CVE-2024-36031 keys: Fix overwrite of key expiration on instantiation
- CVE-2024-36030 octeontx2-af: fix the double free in rvu_npc_freemem()
- CVE-2024-3603 OSM – OpenStreetMap <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-36029 mmc: sdhci-msm: pervent access to suspended controller
- CVE-2024-36028 mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio()
- CVE-2024-36027 btrfs: zoned: do not flag ZEROOUT on non-dirty extent buffer
- CVE-2024-36026 drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11
- CVE-2024-36025 scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
- CVE-2024-36024 drm/amd/display: Disable idle reallow as part of command/gpint execution
- CVE-2024-36023 Julia Lawall reported this null pointer dereference, this should fix it.
- CVE-2024-36021 net: hns3: fix kernel crash when devlink reload during pf initialization
- CVE-2024-36020 i40e: fix vf may be used uninitialized in this function warning
- CVE-2024-3602 Missing authorization in Promolayer – Popup Builder & Abandonment Preventer
- CVE-2024-36019 regmap: maple: Fix cache corruption in regcache_maple_drop()
- CVE-2024-36018 nouveau/uvmm: fix addr/range calcs for remap operations
- CVE-2024-36017 rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
- CVE-2024-36016 tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
- CVE-2024-36015 ppdev: Add an error check in register_device
- CVE-2024-36014 drm/arm/malidp: fix a possible null pointer dereference
- CVE-2024-36013 Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
- CVE-2024-36012 Bluetooth: msft: fix slab-use-after-free in msft_do_close()
- CVE-2024-36011 Bluetooth: HCI: Fix potential null-ptr-deref
- CVE-2024-36010 igb: Fix string truncation warnings in igb_set_fw_version
- CVE-2024-3601 Poll Maker – Best WordPress Poll Plugin <= 5.1.8 - Missing Authorization to Unauthenticated Email Enumeration
- CVE-2024-36009 ax25: Fix netdev refcount issue
- CVE-2024-36008 ipv4: check for NULL idev in ip_route_use_hint()
- CVE-2024-36007 mlxsw: spectrum_acl_tcam: Fix warning during rehash
- CVE-2024-36006 mlxsw: spectrum_acl_tcam: Fix incorrect list API usage
- CVE-2024-36005 netfilter: nf_tables: honor table dormant flag from netdev release event path
- CVE-2024-36004 i40e: Do not use WQ_MEM_RECLAIM flag for workqueue
- CVE-2024-36003 ice: fix LAG and VF lock dependency in ice_reset_vf()
- CVE-2024-36002 dpll: fix dpll_pin_on_pin_register() for multiple parent pins
- CVE-2024-36001 netfs: Fix the pre-flush when appending to a file in writethrough mode
- CVE-2024-36000 mm/hugetlb: fix missing hugetlb_lock for resv uncharge