Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 357 of 521.
- CVE-2024-34083 STARTTLS unencrypted commands injection
- CVE-2024-34082 Grav Arbitrary File Read to Account Takeover
- CVE-2024-34081 MantisBT Cross-site Scripting vulnerability
- CVE-2024-34080 MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
- CVE-2024-3408 Authentication Bypass and RCE in man-group/dtale
- CVE-2024-34079 octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usage
- CVE-2024-34078 html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization
- CVE-2024-34077 MantisBT user account takeover in the signup/reset password process
- CVE-2024-34075 kurwov vulnerable to Denial of Service due to improper data sanitization
- CVE-2024-34074 Frappe vuilnerable to an open redirect on login page
- CVE-2024-34073 Command Injection in sagemaker-python-sdk
- CVE-2024-34072 Deserialization of Untrusted Data in sagemaker-python-sdk
- CVE-2024-34071 Open Redirect Bypass Protection
- CVE-2024-34070 Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise
- CVE-2024-3407 WP Prayer <= 2.0.9 - Arbitrary Prayer Deletion via CSRF
- CVE-2024-34069 Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution
- CVE-2024-34068 Server-side Request Forgery during remote file pull in Pterodactyl wings
- CVE-2024-34067 Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel
- CVE-2024-34066 Arbitrary File Write/Read in Pterodactyl wings
- CVE-2024-34065 @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
- CVE-2024-34064 Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
- CVE-2024-34063 Degraded secret zeroization capabilities in vodozemac
- CVE-2024-34062 tqdm CLI arguments injection attack
- CVE-2024-34061 Reflected cross site scripting in changedetection.io
- CVE-2024-34060 Arbitrary File Write in IRIS EVTX Pipeline
- CVE-2024-3406 WP Prayer <= 2.0.9 - Email Settings Update via CSRF
- CVE-2024-34058 The WebTop package for NethServer 7 and 8 allows stored XSS (for example, via the Subject field if an e-mail message).
- CVE-2024-34057 Memory corruption in siemens:sicam a8000 firmware
- CVE-2024-34055 Denial of service in cyrusimap:cyrus imap
- CVE-2024-34051 Reflected Cross-Site Scripting (XSS) in Dolibarr
- CVE-2024-34050 Denial of service in onosproject:traffic steering xapplication
- CVE-2024-3405 WP Prayer <= 2.0.9 - Settings Update via CSRF
- CVE-2024-34049 Memory corruption in onosproject:traffic steering xapplication
- CVE-2024-34048 Memory corruption in o-ran-sc:ric-plt-e2mgr
- CVE-2024-34047 Memory corruption in o-ran-sc:ric-plt-e2mgr
- CVE-2024-34046 The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->sctpParams->e2tCounters[IN_SU
- CVE-2024-34045 The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->counters[IN_INITI][MSG_COUNTE
- CVE-2024-34044 The O-RAN E2T I-Release buildPrometheusList function can have a NULL pointer dereference because peerInfo can be NULL.
- CVE-2024-34043 Denial of service in linuxfoundation:ric-app-kpimon-go
- CVE-2024-3404 Improper Access Control in gaizhenbiao/chuanhuchatgpt
- CVE-2024-34036 An issue was discovered in O-RAN Near Realtime RIC I-Release.
- CVE-2024-34035 An issue was discovered in O-RAN Near Realtime RIC H-Release.
- CVE-2024-34034 An issue was discovered in FlexRIC 2.0.0.
- CVE-2024-34033 Path Traversal vulnerability in Delta Electronics DIAEnergie
- CVE-2024-34032 SQL Injection in Delta Electronics DIAEnergie
- CVE-2024-34031 SQL Injection vulnerability in Delta Electronics DIAEnergie
- CVE-2024-34030 PCI: of_property: Return error for int_map allocation failure
- CVE-2024-3403 Local File Inclusion in imartinez/privategpt
- CVE-2024-34029 AD/LDAP Group Members Leak
- CVE-2024-34028 Privilege escalation in Intel(R) Graphics Offline Compiler for OpenCL(TM) Code software for Windows
- CVE-2024-34027 f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock
- CVE-2024-34026 Memory corruption in OpenPLC v3
- CVE-2024-34025 CyberPower PowerPanel business Use of Hard-coded Password
- CVE-2024-34024 Information disclosure in FUJITSU Business Application ID Link Manager II
- CVE-2024-34023 Memory corruption in Intel(R) Graphics Drivers
- CVE-2024-34022 Privilege escalation in Thunderbolt(TM) Share software
- CVE-2024-34021 File upload in WMC-2LX-B
- CVE-2024-34020 A stack-based buffer overflow was found in the putSDN() function of mail.c in hcode through 2.1.
- CVE-2024-3402 Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt
- CVE-2024-34019 Privilege escalation in Acronis Snap Deploy
- CVE-2024-34018 Misconfiguration in Acronis Snap Deploy
- CVE-2024-34017 Privilege escalation in Acronis Snap Deploy
- CVE-2024-34016 Privilege escalation in Acronis Cyber Protect Cloud Agent
- CVE-2024-34015 Information disclosure in Acronis Backup plugin for cPanel & WHM
- CVE-2024-34014 Path traversal in Acronis Backup extension for Plesk
- CVE-2024-34013 Command injection in Acronis True Image
- CVE-2024-34012 Privilege escalation in Acronis Cloud Manager
- CVE-2024-34011 Privilege escalation in Acronis Cyber Protect Cloud Agent
- CVE-2024-34010 Privilege escalation in Acronis Cyber Protect 16
- CVE-2024-34009 moodle: ReCAPTCHA can be bypassed on the login page
- CVE-2024-34008 moodle: CSRF risk in analytics management of models
- CVE-2024-34007 moodle: logout CSRF in admin/tool/mfa/auth.php
- CVE-2024-34006 moodle: unsanitized HTML in site log for config_log_created
- CVE-2024-34005 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backup
- CVE-2024-34004 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup
- CVE-2024-34003 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backup
- CVE-2024-34002 moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup
- CVE-2024-34001 moodle: CSRF risk in admin preset tool management of presets
- CVE-2024-34000 moodle: stored XSS in lesson overview report via user ID number
- CVE-2024-3400 Palo Alto Networks PAN-OS Command Injection
- CVE-2024-33999 moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php
- CVE-2024-33998 moodle: stored XSS via user's name on participants page when opening some options
- CVE-2024-33997 moodle: stored XSS risk when editing another user's equation in equation editor
- CVE-2024-33996 moodle: broken access control when setting calendar event type
- CVE-2024-33994 Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System
- CVE-2024-33993 Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System
- CVE-2024-33992 Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System
- CVE-2024-33991 Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System
- CVE-2024-33990 Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System
- CVE-2024-33989 Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System
- CVE-2024-33988 Cross-Site Scripting (XSS) vulnerability in Janobe products
- CVE-2024-33987 Cross-Site Scripting (XSS) vulnerability in Janobe products
- CVE-2024-33986 Cross-Site Scripting (XSS) vulnerability in Janobe products
- CVE-2024-33985 Cross-Site Scripting (XSS) vulnerability in Janobe products
- CVE-2024-33984 Cross-Site Scripting (XSS) vulnerability in Janobe products
- CVE-2024-33983 Cross-Site Scripting (XSS) vulnerability in Janobe products
- CVE-2024-33982 Cross-Site Scripting (XSS) vulnerability in Janobe products
- CVE-2024-33981 Cross-site Scripting in Janobe products
- CVE-2024-33980 Cross-site Scripting in Janobe products
- CVE-2024-33979 Cross-site Scripting in Janobe products