Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 348 of 521.
- CVE-2024-35263 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
- CVE-2024-35261 Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
- CVE-2024-35260 Microsoft Dataverse Remote Code Execution Vulnerability
- CVE-2024-3526 Campcodes Online Event Management System index.php cross site scripting
- CVE-2024-35256 SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
- CVE-2024-35255 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
- CVE-2024-35254 Azure Monitor Agent Elevation of Privilege Vulnerability
- CVE-2024-35253 Microsoft Azure File Sync Elevation of Privilege Vulnerability
- CVE-2024-35252 Azure Storage Movement Client Library Denial of Service Vulnerability
- CVE-2024-35250 Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability
- CVE-2024-3525 Campcodes Online Event Management System index.php cross site scripting
- CVE-2024-35249 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
- CVE-2024-35248 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
- CVE-2024-35247 fpga: region: add owner module and take its refcount
- CVE-2024-35246 Westermo L210-F2G Lynx Improper Control of Interaction Frequency
- CVE-2024-35245 Privilege escalation in Intel(R) PROSet/Wireless WiFi software for Windows
- CVE-2024-35244 Hardcoded credentials in Multiple MFPs (multifunction printers)
- CVE-2024-35242 Composer vulnerable to command injection via malicious git/hg branch names
- CVE-2024-35241 Composer vulnerable to command injection via malicious git branch name
- CVE-2024-35240 Stored Cross-site Scripting on Print Functionality in Umbraco Commerce
- CVE-2024-3524 Campcodes Online Event Management System process.php cross site scripting
- CVE-2024-35239 Stored Cross-site Scripting on Components of Umbraco Forms
- CVE-2024-35238 Denial of service of Minder Server from maliciously crafted GitHub attestations
- CVE-2024-35237 MIT IdentiBot User-Kerberos Mapping Publicly Available
- CVE-2024-35236 Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks
- CVE-2024-35235 Cupsd Listen arbitrary chmod 0140777
- CVE-2024-35234 Discourse vulnerable to stored-dom XSS via Facebook Oneboxes
- CVE-2024-35232 github.com/huandu/facebook may expose access_token in error message
- CVE-2024-35231 rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter
- CVE-2024-35230 Welcome and About GeoServer pages communicate version and revision information
- CVE-2024-3523 Campcodes Online Event Management System index.php sql injection
- CVE-2024-35229 ZKsync Era evaluation order of Yul function arguments
- CVE-2024-35228 Improper Handling of Insufficient Permissions in Wagtail
- CVE-2024-35227 Discourse vulnerable to DoS through Onebox
- CVE-2024-35226 PHP Code Injection by malicious attribute in extends-tag in Smarty
- CVE-2024-35225 Jupyter Server Proxy has a reflected XSS issue in host parameter
- CVE-2024-35224 Stored Cross-Site Scripting (XSS) in OpenProject
- CVE-2024-35223 Dapr API Token Exposure
- CVE-2024-35222 iFrames Bypass Origin Checks for Tauri API Access Control
- CVE-2024-35221 Denial of service when publishing a package on rubygems.org
- CVE-2024-35220 @fastify/session reuses destroyed session cookie
- CVE-2024-3522 Campcodes Online Event Management System process.php sql injection
- CVE-2024-35219 OpenAPI Generator Online - Arbitrary File Read/Delete
- CVE-2024-35218 Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane
- CVE-2024-35215 Null dereference in QNX Software Development Platform (SDP)
- CVE-2024-35214 Vulnerability in CylanceOPTICS Windows Installer Package Impacts CylanceOPTICS for Windows
- CVE-2024-35213 Vulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP)
- CVE-2024-35212 Other in SINEC Traffic Analyzer
- CVE-2024-35211 Misconfiguration in SINEC Traffic Analyzer
- CVE-2024-35210 Misconfiguration in SINEC Traffic Analyzer
- CVE-2024-3521 Byzoro Smart S80 Management Platform userattestation.php unrestricted upload
- CVE-2024-35209 Other in SINEC Traffic Analyzer
- CVE-2024-35208 Information disclosure in SINEC Traffic Analyzer
- CVE-2024-35207 Cross-site request forgery in SINEC Traffic Analyzer
- CVE-2024-35206 Auth bypass in SINEC Traffic Analyzer
- CVE-2024-35205 The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them t
- CVE-2024-35204 Veritas System Recovery before 23.3_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks.
- CVE-2024-35203 Cross-site scripting in mahara:mahara
- CVE-2024-35202 Denial of service in bitcoin:bitcoin core
- CVE-2024-35201 Misconfiguration in Intel(R) SDP Tool for Windows software
- CVE-2024-35200 NGINX HTTP/3 QUIC vulnerability
- CVE-2024-3520 Country State City Dropdown CF7 <= 2.7.1 - Missing Authorization
- CVE-2024-35199 TorchServe gRPC Port Exposure
- CVE-2024-35198 TorchServe bypass allowed_urls configuration
- CVE-2024-35197 gix refs and paths with reserved Windows device names access the devices
- CVE-2024-35196 Slack integration leaks sensitive information in logs in Sentry
- CVE-2024-35195 Requests `Session` object does not verify requests after making first request with verify=False
- CVE-2024-35194 Stacklok Minder vulnerable to denial of service from maliciously crafted templates
- CVE-2024-35192 Trivy possibly leaks registry credential when scanning images from malicious registries
- CVE-2024-35191 verbb/formie Server-Side Template Injection for variable-enabled settings
- CVE-2024-35190 Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests
- CVE-2024-3519 Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang
- CVE-2024-35189 Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides
- CVE-2024-35187 Stalwart Mail Server has privilege escalation by design
- CVE-2024-35186 gix traversal outside working tree enables arbitrary code execution
- CVE-2024-35185 Denial of service of Minder Server with attacker-controlled REST endpoint
- CVE-2024-35184 paperless-ngx's remote user auth via header works even when disabling it for API
- CVE-2024-35183 wolfictl leaks GitHub tokens to remote non-GitHub git servers
- CVE-2024-35182 GHSL-2024-014 Meshery SQL Injection vulnerability
- CVE-2024-35181 GHSL-2024-013 Meshery SQL Injection vulnerability
- CVE-2024-35180 OMERO.web JSONP callback vulnerability
- CVE-2024-3518 Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode
- CVE-2024-35179 Unprivileged Stalwart Mail Server user can read files as root
- CVE-2024-35178 Jupyter server on Windows discloses Windows user password hash
- CVE-2024-35177 Improper Access Control in wazuh-agent
- CVE-2024-35176 REXML contains a denial of service vulnerability
- CVE-2024-35175 sshpiper's Enabling of Proxy Protocol without proper feature flagging allows faking source address
- CVE-2024-35174 WordPress Flo Forms plugin <= 1.0.42 - Broken Access Control vulnerability
- CVE-2024-35172 WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2024-35171 WordPress Academy LMS plugin <= 1.9.25 - Sensitive Data Exposure vulnerability
- CVE-2024-35170 WordPress Sticky banner plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-3517 Cross-site scripting in Shortcodes and extra features for Phlox theme
- CVE-2024-35169 WordPress All Bootstrap Blocks plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-35168 WordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerability
- CVE-2024-35167 Cross-site scripting in Envo's Elementor Templates & Widgets for WooCommerce
- CVE-2024-35166 Information disclosure in Filebird
- CVE-2024-35165 WordPress Gutenify plugin <= 1.4.0 - Sensitive Data Exposure via API vulnerability
- CVE-2024-35164 Apache Guacamole: Improper input validation of console codes
- CVE-2024-35162 Path traversal in Download Plugins and Themes from Dashboard
- CVE-2024-35161 Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling