Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 351 of 521.
- CVE-2024-34783 SQL injection in EPM
- CVE-2024-34782 SQL injection in EPM
- CVE-2024-34781 SQL injection in EPM
- CVE-2024-34780 SQL injection in EPM
- CVE-2024-3478 Herd Effects < 5.2.7 - Effect Deletion via CSRF
- CVE-2024-34779 SQL injection in EPM
- CVE-2024-34777 dma-mapping: benchmark: fix node id validation
- CVE-2024-34776 Memory corruption in Intel(R) SGX SDK software
- CVE-2024-34773 Memory corruption in Solid Edge
- CVE-2024-34772 Memory corruption in Solid Edge
- CVE-2024-34771 Memory corruption in Solid Edge
- CVE-2024-34770 WordPress Popup Maker WP plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-3477 Popup Box < 2.2.7 - Popup Deletion via CSRF
- CVE-2024-34769 WordPress Elegant Blocks – Amazing Gutenberg Blocks plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-34768 WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerability
- CVE-2024-34767 WordPress ShopLentor plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-34766 WordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-34765 WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-34763 Missing authorization in Builder for WooCommerce reviews shortcodes – ReviewShort
- CVE-2024-34762 Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability
- CVE-2024-34761 Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability
- CVE-2024-34760 WordPress Magazine Blocks plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-3476 Side Menu Lite < 4.2.1 - Menu Deletion via CSRF
- CVE-2024-34759 WordPress Picture Gallery plugin <= 1.5.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-34758 WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control vulnerability
- CVE-2024-34757 WordPress Borderless plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-34756 WordPress Integration for HubSpot and Contact Form 7 plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-34755 Cross-site request forgery in Integration for Contact Form 7 and Salesforce
- CVE-2024-34754 WordPress Contact Form Widget plugin <= 1.3.9 - Sensitive Data Exposure vulnerability
- CVE-2024-34753 WordPress Radio Player plugin <= 2.0.73 - Broken Access Control vulnerability
- CVE-2024-34752 WordPress Landing Page Builder <= 1.5.1.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-34751 WordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerability
- CVE-2024-34750 Apache Tomcat: HTTP/2 excess header handling DoS
- CVE-2024-3475 Sticky Buttons < 3.2.4 - Button Deletion via CSRF
- CVE-2024-34749 Cross-site scripting in Phormer
- CVE-2024-34748 Use after free in Android
- CVE-2024-34747 Use after free in Android
- CVE-2024-34743 Business logic in Android
- CVE-2024-34742 Business logic in Android
- CVE-2024-34741 Security feature bypass in Android
- CVE-2024-34740 Integer overflow in Android
- CVE-2024-3474 Wow Skype Buttons < 4.0.4 - Button Deletion via CSRF
- CVE-2024-34739 Privilege escalation in Android
- CVE-2024-34738 Privilege escalation in Android
- CVE-2024-34737 Business logic in Android
- CVE-2024-34736 Privilege escalation in Android
- CVE-2024-34734 Misconfiguration in Android
- CVE-2024-34733 Integer overflow in Android
- CVE-2024-34732 Race condition in Android
- CVE-2024-34731 Race condition in Android
- CVE-2024-34730 Security feature bypass in Android
- CVE-2024-3473 Header Footer Code Manager Pro <= 1.0.16 - Reflected Cross-Site Scripting via message
- CVE-2024-34729 Business logic in Android
- CVE-2024-34727 Memory corruption in Android
- CVE-2024-34726 Privilege escalation in Android
- CVE-2024-34725 Race condition in Android
- CVE-2024-34724 Race condition in Android
- CVE-2024-34723 Business logic in Android
- CVE-2024-34722 Auth bypass in Android
- CVE-2024-34721 Information disclosure in Android
- CVE-2024-34720 Privilege escalation in Android
- CVE-2024-3472 Modal Window < 5.3.10 - Modal Deletion via CSRF
- CVE-2024-34719 Null dereference in Android
- CVE-2024-34717 Anonymous PrestaShop customer can download other customers' invoices
- CVE-2024-34716 PrestaShop vulnerable to XSS via customer contact form in FO, through file upload
- CVE-2024-34715 Partial Password Exposure Vulnerability in Fides Webserver Logs
- CVE-2024-34714 Hoppscotch Extension responds to calls made by origins not in the domain list
- CVE-2024-34713 sshproxy vulnerable to SSH option injection
- CVE-2024-34712 Oceanic allows unsanitized user input to lead to path traversal in URLs
- CVE-2024-34711 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
- CVE-2024-34710 Wiki.js Stored XSS through Client Side Template Injection
- CVE-2024-3471 Button Generator < 3.0 - Button Deletion via CSRF
- CVE-2024-34709 Directus Lacks Session Tokens Invalidation
- CVE-2024-34708 Directus allows redacted data extraction on the API through "alias"
- CVE-2024-34707 Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages
- CVE-2024-34706 @valtimo/components exposes access token to form.io
- CVE-2024-34704 era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization
- CVE-2024-34703 Botan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve Parameters
- CVE-2024-34702 Botan has a Denial of Service Due to Excessive Name Constraints
- CVE-2024-34701 CreateWiki vulnerable to impersonation of wiki requester
- CVE-2024-3470 Repository administrator can bypass organization's ruleset using deploy keys
- CVE-2024-34699 GZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names.
- CVE-2024-34698 Prototype Pollution in getQueryParam Function (URL Query Parser)
- CVE-2024-34697 Freescout vulnerable to Stored HTML Injection in Editing Received Emails
- CVE-2024-34696 GeoServer's Server Status shows sensitive environmental variables and Java properties
- CVE-2024-34695 WOWS Karma vulnerable to a post submission bounce/timing attack
- CVE-2024-34694 LNbits improperly handles potential network and payment failures when using Eclair backend
- CVE-2024-34693 Apache Superset: Server arbitrary file read
- CVE-2024-34692 [CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now
- CVE-2024-34691 Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files)
- CVE-2024-34690 Missing Authorization check in SAP Student Life Cycle Management (SLcM)
- CVE-2024-3469 GP Premium <= 2.4.0 - Reflected Cross-Site Scripting
- CVE-2024-34689 [CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services)
- CVE-2024-34688 Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository)
- CVE-2024-34687 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform
- CVE-2024-34686 Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
- CVE-2024-34685 [CVE-2024-34685] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor
- CVE-2024-34684 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling)
- CVE-2024-34683 Unrestricted file upload in SAP Document Builder (HTTP service)
- CVE-2024-34682 Missing authorization in Samsung Mobile Devices