Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 362 of 521.
- CVE-2024-33493 Memory corruption in Solid Edge
- CVE-2024-33492 Memory corruption in Solid Edge
- CVE-2024-33491 Memory corruption in Solid Edge
- CVE-2024-33490 Memory corruption in Solid Edge
- CVE-2024-3349 SourceCodester Aplaya Beach Resort Online Reservation System login.php sql injection
- CVE-2024-33489 Memory corruption in Solid Edge
- CVE-2024-33485 SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain s
- CVE-2024-3348 SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection
- CVE-2024-33471 An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request.
- CVE-2024-33470 An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passback attack.
- CVE-2024-3347 SourceCodester Airline Ticket Reservation System activate_jet_details_form_handler.php sql injection
- CVE-2024-33469 An issue in Team Amaze Amaze File Manager v.3.8.5 and fixed in v.3.10 allows a local attacker to execute arbitrary code via the onCreate met
- CVE-2024-33465 Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component.
- CVE-2024-3346 Byzoro Smart S80 webmailattach.php os command injection
- CVE-2024-33454 Memory corruption in espressif:esp-idf
- CVE-2024-33453 Memory corruption in espressif:esp-idf
- CVE-2024-33452 Other in openresty:lua-nginx-module
- CVE-2024-33450 SQL Injection in Finereport v.8.0 allows a remote attacker to obtain sensitive information
- CVE-2024-3345 ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode
- CVE-2024-33449 An SSRF issue in the PDFMyURL service allows a remote attacker to obtain sensitive information and execute arbitrary code via a POST request
- CVE-2024-33445 Code injection in hisiphp:hisiphp
- CVE-2024-33444 SQL injection in onethink:onethink
- CVE-2024-33443 Code injection in onethink:onethink
- CVE-2024-33442 Code injection in flusity:flusity
- CVE-2024-3344 Cross-site scripting in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- CVE-2024-33439 An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters.
- CVE-2024-33438 File upload in cubecart:cubecart
- CVE-2024-33437 Information disclosure in mikegualtieri:css exfil protection
- CVE-2024-33436 Information disclosure in mikegualtieri:css exfil protection
- CVE-2024-33435 Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co.
- CVE-2024-33434 tiagorlampert CHAOS vulnerable to arbitrary code execution
- CVE-2024-33433 Cross-site scripting in totolink:x2000r firmware
- CVE-2024-33431 Denial of service in stsaz:phiola
- CVE-2024-33430 Memory corruption in stsaz:phiola
- CVE-2024-3343 Cross-site scripting in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- CVE-2024-33429 Memory corruption in stsaz:phiola
- CVE-2024-33428 Memory corruption in stsaz:phiola
- CVE-2024-33424 Cross-site scripting in cmsimple:cmsimple
- CVE-2024-33423 Cross-site scripting in cmsimple:cmsimple
- CVE-2024-3342 Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection
- CVE-2024-33411 SQL injection in campcodes:complete web-based school management system
- CVE-2024-33410 SQL injection in campcodes:complete web-based school management system
- CVE-2024-3341 Cross-site scripting in Shortcodes and extra features for Phlox theme
- CVE-2024-33409 SQL injection in campcodes:complete web-based school management system
- CVE-2024-33408 SQL injection in campcodes:complete web-based school management system
- CVE-2024-33407 SQL injection in campcodes:complete web-based school management system
- CVE-2024-33406 SQL injection in campcodes:complete web-based school management system
- CVE-2024-33405 SQL injection in campcodes:complete web-based school management system
- CVE-2024-33404 SQL injection in campcodes:complete web-based school management system
- CVE-2024-33403 SQL injection in campcodes:complete web-based school management system
- CVE-2024-33402 SQL injection in campcodes:complete web-based school management system
- CVE-2024-33401 Cross-site scripting in dedecms:dedecms
- CVE-2024-3340 Cross-site scripting in Colibri Page Builder
- CVE-2024-33398 piraeus-operator allows attacker to impersonate service account
- CVE-2024-33396 karmada vulnerable to arbitrary code execution via a crafted command
- CVE-2024-33394 kubevirt allows a local attacker to execute arbitrary code via a crafted command
- CVE-2024-33393 An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.
- CVE-2024-33383 Path traversal in xxyopen:novel-plus
- CVE-2024-33382 Denial of service in open5gs:open5gs
- CVE-2024-3338 Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2024-33377 Other in lb-link:bl-w1210m firmware
- CVE-2024-33375 Information disclosure in lb-link:bl-w1210m firmware
- CVE-2024-33374 Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal without authentication.
- CVE-2024-33373 Security feature bypass in lb-link:bl-w1210m firmware
- CVE-2024-33371 Cross-site scripting in dedecms:dedecms
- CVE-2024-3337 Cross-site scripting in Colibri Page Builder
- CVE-2024-33369 Path traversal in plasmoapp:rpshare
- CVE-2024-33368 Command injection in plasmoapp:rpshare
- CVE-2024-33365 Memory corruption in tenda:ac10 firmware
- CVE-2024-33350 Path traversal in taogogo:taocms
- CVE-2024-33345 Null dereference in dlink:dir-823g firmware
- CVE-2024-33344 Command injection in dlink:dir-822\+ firmware
- CVE-2024-33343 Command injection in dlink:dir-822\+ firmware
- CVE-2024-33342 Command injection in dlink:dir-822\+ firmware
- CVE-2024-3334 USB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.0
- CVE-2024-33338 Cross-site scripting in jizhicms:jizhicms
- CVE-2024-33335 SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file.
- CVE-2024-33332 Information disclosure in bladex:springblade
- CVE-2024-3333 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-33329 A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other sensitive information.
- CVE-2024-33328 A cross-site scripting (XSS) vulnerability in the component main.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web
- CVE-2024-33327 A cross-site scripting (XSS) vulnerability in the component UrlAccessibilityEvaluation.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to
- CVE-2024-33326 A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to e
- CVE-2024-3332 bt: host/smp: DoS caused by null pointer dereference
- CVE-2024-3331 Spotfire: NTLM token leakage
- CVE-2024-33309 An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information vi
- CVE-2024-33308 An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to escalate privileges via the Eme
- CVE-2024-33307 Cross-site scripting in sourcecodester:laboratory management system
- CVE-2024-33306 Cross-site scripting in sourcecodester:laboratory management system
- CVE-2024-33305 Cross-site scripting in sourcecodester:laboratory management system
- CVE-2024-33304 Cross-site scripting in oretnom23:product show room site
- CVE-2024-33303 Cross-site scripting in oretnom23:product show room site
- CVE-2024-33302 Cross-site scripting in oretnom23:product show room site
- CVE-2024-33300 Cross-site scripting in typora:typora
- CVE-2024-3330 Spotfire Remote Code Execution Vulnerability
- CVE-2024-33299 Microweber Cross-site Scripting vulnerability
- CVE-2024-33298 Microweber Cross-site Scripting vulnerability
- CVE-2024-33297 Microweber Cross-site Scripting vulnerability
- CVE-2024-33294 An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable
- CVE-2024-33292 SQL Injection vulnerability in Realisation MGSD v.1.0 allows a remote attacker to obtain sensitive information via the id parameter.