Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 355 of 521.
- CVE-2024-34367 WordPress Popup Box plugin <= 4.1.2 - CSRF to XSS vulnerability
- CVE-2024-34366 WordPress AltText.ai plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-34365 Apache Karaf Cave: Cave SSRF and arbitrary file access
- CVE-2024-34364 Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response
- CVE-2024-34363 Envoy can crash due to uncaught nlohmann JSON exception
- CVE-2024-34362 Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream
- CVE-2024-34361 Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE)
- CVE-2024-34360 Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATX
- CVE-2024-3436 SourceCodester Prison Management System Avatar edit-photo.php unrestricted upload
- CVE-2024-34359 llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata
- CVE-2024-34358 TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController
- CVE-2024-34357 TYPO3 vulnerable to Cross-Site Scripting in ShowImageController
- CVE-2024-34356 TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
- CVE-2024-34355 TYPO3 vulnerable to an HTML Injection in the History Module
- CVE-2024-34354 CMSaasStarter: JWT Token Not Verified on Server Session
- CVE-2024-34353 matrix-sdk-crypto contains a log exposure of private key of the server-side key backup
- CVE-2024-34352 Arbitrary file write vulnerability in 1Panel
- CVE-2024-34351 Next.js Server-Side Request Forgery in Server Actions
- CVE-2024-34350 Next.js Vulnerable to HTTP Request Smuggling
- CVE-2024-3435 Path Traversal in parisneo/lollms-webui
- CVE-2024-34349 Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel
- CVE-2024-34347 @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE
- CVE-2024-34346 Deno contains a permission escalation via open of privileged files with missing `--deny` flag
- CVE-2024-34345 @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
- CVE-2024-34344 Remote code execution via the browser when running the test locally in nuxt
- CVE-2024-34343 Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt
- CVE-2024-34342 react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF
- CVE-2024-34341 The Trix Editor Contains an Arbitrary Code Execution Vulnerability
- CVE-2024-34340 Authentication Bypass when using using older password hashes
- CVE-2024-3434 CP Plus Wi-Fi Camera User Management improper authorization
- CVE-2024-34338 Command injection in tenda:o3 firmware
- CVE-2024-34336 Information disclosure in ordat:ordat.erp
- CVE-2024-34335 Cross-site scripting in ordat:ordat.erp
- CVE-2024-34334 SQL injection in ordat:ordat.erp
- CVE-2024-34332 An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a crafted buffer sent t
- CVE-2024-34331 A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted m
- CVE-2024-3433 PuneethReddyHC Event Management register.php cross site scripting
- CVE-2024-34329 Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated
- CVE-2024-34328 An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL.
- CVE-2024-34327 SQL injection in sielox:anyware
- CVE-2024-34326 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/M
- CVE-2024-34324 An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character
- CVE-2024-34323 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.
- CVE-2024-34321 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes p
- CVE-2024-34320 ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
- CVE-2024-3432 PuneethReddyHC Event Management register.php sql injection
- CVE-2024-34319 A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the applic
- CVE-2024-34315 Path traversal in cmseasy:cmseasy
- CVE-2024-34314 Path traversal in cmseasy:cmseasy
- CVE-2024-34313 An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint.
- CVE-2024-34312 Cross-site scripting in moodle:virtual programming lab
- CVE-2024-34310 Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter.
- CVE-2024-3431 EyouCMS Backend deserialization
- CVE-2024-34308 Memory corruption in totolink:lr350 firmware
- CVE-2024-3430 QKSMS Backup File androidmanifest.xml backup
- CVE-2024-3429 Path Traversal in parisneo/lollms
- CVE-2024-3428 SourceCodester Online Courseware edit.php cross site scripting
- CVE-2024-34274 OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data.
- CVE-2024-34273 njwt Prototype Pollution vulnerability
- CVE-2024-3427 SourceCodester Online Courseware addq.php cross site scripting
- CVE-2024-34268 EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth connections.
- CVE-2024-3426 SourceCodester Online Courseware editt.php cross site scripting
- CVE-2024-34257 Command injection in totolink:ex1800t firmware
- CVE-2024-34256 SQL injection in ofcms project:ofcms
- CVE-2024-34255 Cross-site scripting in jizhicms:jizhicms
- CVE-2024-34252 pywasm3 contains a global buffer overflow which leads to segmentation fault
- CVE-2024-34251 Memory corruption in bytecodealliance:webassembly micro runtime
- CVE-2024-34250 Memory corruption in bytecodealliance:webassembly micro runtime
- CVE-2024-3425 SourceCodester Online Courseware activateall.php sql injection
- CVE-2024-34249 pywasm3 contains a heap buffer overflow which leads to segmentation fault
- CVE-2024-34246 Memory corruption in wasm3 project:wasm3
- CVE-2024-34245 Path traversal in dedecms:dedecms
- CVE-2024-34244 Memory corruption in libmodbus:libmodbus
- CVE-2024-34243 Konga is vulnerable to Cross Site Scripting (XSS) attacks
- CVE-2024-34241 Cross-site scripting in rocketsoft:rocket lms
- CVE-2024-34240 Cross-site scripting in qdocs:smart school
- CVE-2024-3424 SourceCodester Online Courseware listscore.php sql injection
- CVE-2024-34235 Denial of service in open5gs:open5gs
- CVE-2024-34231 Cross-site scripting in sourcecodester:laboratory management system
- CVE-2024-34230 Cross-site scripting in sourcecodester:laboratory management system
- CVE-2024-3423 SourceCodester Online Courseware activateteach.php sql injection
- CVE-2024-34226 SQL injection in oretnom23:visitor management system
- CVE-2024-34225 Cross-site scripting in oretnom23:computer laboratory management system
- CVE-2024-34224 Cross-site scripting in oretnom23:computer laboratory management system
- CVE-2024-34223 Missing authorization in oretnom23:human resource management system
- CVE-2024-34222 SQL injection in oretnom23:human resource management system
- CVE-2024-34221 Privilege escalation in oretnom23:human resource management system
- CVE-2024-34220 SQL injection in oretnom23:human resource management system
- CVE-2024-3422 SourceCodester Online Courseware activatestud.php sql injection
- CVE-2024-34219 Hardcoded credentials in totolink:cp450 firmware
- CVE-2024-34218 Command injection in totolink:cp450 firmware
- CVE-2024-34217 Memory corruption in totolink:cp450 firmware
- CVE-2024-34215 Memory corruption in totolink:cp450 firmware
- CVE-2024-34213 Memory corruption in totolink:cp450 firmware
- CVE-2024-34212 Memory corruption in totolink:cp450 firmware
- CVE-2024-34211 Hardcoded credentials in totolink:cp450 firmware
- CVE-2024-34210 Command injection in totolink:cp450 firmware
- CVE-2024-3421 SourceCodester Online Courseware deactivatestud.php sql injection
- CVE-2024-34209 Memory corruption in totolink:cp450 firmware
- CVE-2024-34207 Memory corruption in totolink:cp450 firmware