Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 370 of 521.
- CVE-2024-3248 Stack overflow in Xpdf 4.05 due to object loop in attachments
- CVE-2024-32479 LibreNMS's Improper Sanitization on Service template name leads to Stored XSS
- CVE-2024-32478 Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files
- CVE-2024-32477 Race condition when flushing input stream leads to permission prompt bypass
- CVE-2024-32476 Denial of Service via malicious jqPathExpressions in ignoreDifferences
- CVE-2024-32475 Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes
- CVE-2024-32474 Sentry's superuser cleartext password leaked in logs
- CVE-2024-32473 Moby IPv6 enabled on IPv4-only network interfaces
- CVE-2024-32472 excalidraw vulnerable to a Stored XSS in excalidraw's web embed component
- CVE-2024-32470 Tolgee' API keys created by server admin users bypass the permission check
- CVE-2024-3247 Stack overflow in Xpdf 4.05 due to object loop in PDF object stream
- CVE-2024-32469 Decidim has cross-site scripting (XSS) in the pagination
- CVE-2024-32468 Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator
- CVE-2024-32467 Meteraphsere vulnerable to unauthorized viewing by workspace members
- CVE-2024-32466 Tolgee's API key scopes not checked when querying translation data
- CVE-2024-32465 Git's protections for cloning untrusted repositories can be bypassed
- CVE-2024-32464 ActionText ContentAttachment can Contain Unsanitized HTML
- CVE-2024-32463 phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags
- CVE-2024-32462 Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing
- CVE-2024-32461 LibreNMS vulnerable to time-based SQL injection that leads to database extraction
- CVE-2024-32460 FreeRDP Out-Of-Bounds Read in interleaved_decompress
- CVE-2024-3246 LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-32459 FreeRDP Out-Of-Bounds Read in ncrush_decompress
- CVE-2024-32458 FreeRDP Out-Of-Bounds Read in planar_skip_plane_rle
- CVE-2024-32457 WordPress Elements Plus! plugin <= 2.16.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-32456 WordPress Envo Extra plugin <= 1.8.11 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-32455 WordPress Fatal Error Notify plugin <= 1.5.2 - Broken Access Control vulnerability
- CVE-2024-32454 WordPress Wappointment plugin <= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2024-32453 WordPress POEditor plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-32452 WordPress Shopping Cart & eCommerce Store plugin <= 5.5.19 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32451 WordPress Legal Pages plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32450 WordPress WpTravelly plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-3245 Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more
- CVE-2024-32449 WordPress RestroPress plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32448 WordPress Ads.txt Admin plugin <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32447 WordPress AWP Classifieds plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32446 WordPress Wallet System for WooCommerce plugin <= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32445 WordPress WebinarIgnition plugin <= 3.05.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32444 WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerability
- CVE-2024-32443 WordPress IP2Location Country Blocker plugin <= 2.34.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32442 WordPress Zoho Campaigns plugin <= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32441 WordPress Zoho Campaigns plugin <= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32440 WordPress Asgaros Forum plugin <= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-3244 Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more
- CVE-2024-32439 WordPress WP Client Reports plugin <= 1.0.22 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32438 WordPress SEO Booster plugin <= 3.8.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32437 WordPress eCommerce Product Catalog plugin <= 3.3.28 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32436 WordPress Gift Cards plugin <= 4.4.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32435 WordPress AffiEasy plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32434 WordPress Order Delivery Date for WooCommerce plugin <= 3.20.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32433 WordPress BEAF plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32432 WordPress Ovic Addon Toolkit plugin <= 2.6.1 - Broken Access Control vulnerability
- CVE-2024-32431 WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection
- CVE-2024-32430 WordPress ActiveCampaign plugin <= 8.1.14 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2024-3243 Missing authorization in Customer Reviews for WooCommerce
- CVE-2024-32429 WordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-32428 WordPress MWW Disclaimer Buttons plugin <= 3.0.2 - Stored Cross Site Scripting (XSS) vulnerability
- CVE-2024-3242 Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2024-32418 Code injection in flusity:flusity
- CVE-2024-3241 Ultimate Blocks < 3.1.7 - Contributor+ Stored XSS
- CVE-2024-32409 Cross-site scripting in sem-cms:semcms
- CVE-2024-32407 Code injection in inducer:relate
- CVE-2024-32406 Code injection in inducer:relate
- CVE-2024-32405 Cross-site scripting in inducer:relate
- CVE-2024-32404 Code injection in inducer:relate
- CVE-2024-3240 ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-32399 Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via
- CVE-2024-32394 An issue in ruijie.com/cn RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S_07150910 and RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S
- CVE-2024-32392 Cross-site scripting in cmsimple:cmsimple
- CVE-2024-32391 Cross-site scripting in maccms:maccms
- CVE-2024-3239 PostX < 4.0.2 - Contributor+ Stored XSS
- CVE-2024-32389 Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensiti
- CVE-2024-32388 Misconfiguration in kerlink:keros
- CVE-2024-32387 An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via th
- CVE-2024-32386 Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sen
- CVE-2024-32385 An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via a
- CVE-2024-32384 Weak cryptography in kerlink:keros
- CVE-2024-3238 WordPress Menu Plugin — Superfly Responsive Menu <= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion
- CVE-2024-32371 Privilege escalation in hsclabs:mailinspector
- CVE-2024-32370 Information disclosure in hsclabs:mailinspector
- CVE-2024-3237 ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
- CVE-2024-32369 SQL injection in hsclabs:mailinspector
- CVE-2024-32368 Insecure Permission vulnerability in Agasta Sanketlife 2.0 Pocket 12-Lead ECG Monitor FW Version 3.0 allows a local attacker to cause a deni
- CVE-2024-3236 Easy Notify Lite < 1.1.33 - Contributor+ Stored XSS
- CVE-2024-32359 An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtai
- CVE-2024-32358 Code injection in jpress:jpress
- CVE-2024-32355 Command injection in totolink:x5000r firmware
- CVE-2024-32354 Command injection in totolink:x5000r firmware
- CVE-2024-32353 Command injection in totolink:x5000r firmware
- CVE-2024-32352 Command injection in totolink:x5000r firmware
- CVE-2024-32351 Command injection in totolink:x5000r firmware
- CVE-2024-32350 Command injection in totolink:x5000r firmware
- CVE-2024-3235 Essential Grid <= 3.1.1 - Unauthenticated Private Post Disclosure
- CVE-2024-32349 Command injection in totolink:x5000r firmware
- CVE-2024-32345 Cross-site scripting in cmsimple:cmsimple
- CVE-2024-32344 Cross-site scripting in cmsimple:cmsimple
- CVE-2024-32343 Cross-site scripting in boidcms:boidcms
- CVE-2024-32342 Cross-site scripting in boidcms:boidcms
- CVE-2024-32341 Cross-site scripting in wondercms:wondercms
- CVE-2024-32340 Cross-site scripting in wondercms:wondercms