Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 373 of 521.
- CVE-2024-32022 Kohya_ss is vulnerable to a command injection in basic_caption_gui.py (GHSL-2024-019)
- CVE-2024-32021 Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory
- CVE-2024-32020 Other in git
- CVE-2024-3202 codelyfe Stupid Simple CMS Login Page excessive authentication
- CVE-2024-32019 ndsudo: local privilege escalation via untrusted search path
- CVE-2024-32018 Ineffective size check due to assert() and buffer overflow in RIOT
- CVE-2024-32017 Buffer overflows in RIOT
- CVE-2024-32014 Privilege escalation in Spectrum Power 4
- CVE-2024-32011 Command injection in Spectrum Power 4
- CVE-2024-32010 Information disclosure in Spectrum Power 4
- CVE-2024-3201 WP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-32009 Privilege escalation in Spectrum Power 4
- CVE-2024-32008 Privilege escalation in Spectrum Power 4
- CVE-2024-32007 Apache CXF Denial of Service vulnerability in JOSE
- CVE-2024-32006 Auth bypass in SINEMA Remote Connect Client
- CVE-2024-32005 Local File Inclusion in NiceGUI leaflet component
- CVE-2024-32004 Git vulnerable to Remote Code Execution while cloning special-crafted local repositories
- CVE-2024-32003 Dusk plugin may allow unfettered user authentication in misconfigured installs
- CVE-2024-32002 Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
- CVE-2024-32001 SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used
- CVE-2024-32000 Truncated content of messages can be leaked from matrix-appservice-irc
- CVE-2024-3200 wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection
- CVE-2024-31999 @fastify/secure-session: Reuse of destroyed secure session cookie
- CVE-2024-31998 CSRF security issue on CSV import in Combodo iTop
- CVE-2024-31997 XWiki Platform remote code execution from account through UIExtension parameters
- CVE-2024-31996 XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution
- CVE-2024-31995 zcap has incomplete expiration checks in capability chains.
- CVE-2024-31994 Mealie vulnerable to a DoS in recipe image importer (GHSL-2023-228)
- CVE-2024-31993 Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227)
- CVE-2024-31992 Mealie contains a DoS vulnerability in recipe importer
- CVE-2024-31991 Mealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225)
- CVE-2024-31990 Argo CD' API server does not enforce project sourceNamespaces
- CVE-2024-3199 The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- CVE-2024-31989 ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache
- CVE-2024-31988 XWiki Platform CSRF remote code execution through the realtime HTML Converter API
- CVE-2024-31987 XWiki Platform remote code execution from account via custom skins support
- CVE-2024-31986 XWiki Platform CSRF remote code execution through scheduler job's document reference
- CVE-2024-31985 XWiki Platform CSRF in the job scheduler
- CVE-2024-31984 XWiki Platform: Remote code execution through space title and Solr space facet
- CVE-2024-31983 XWiki Platform: Remote code execution from edit in multilingual wikis via translations
- CVE-2024-31982 XWiki Platform: Remote code execution as guest via DatabaseSearch
- CVE-2024-31981 XWiki Platform: Privilege escalation (PR) from user registration through PDFClass
- CVE-2024-31980 Memory corruption in Parasolid V35.1
- CVE-2024-3198 WP Font Awesome Share Icons <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-31979 Apache StreamPipes: Possibility of SSRF in pipeline element installation process
- CVE-2024-31978 Path traversal in SINEC NMS
- CVE-2024-31977 Command injection in adtran:834-5 firmware
- CVE-2024-31976 Command injection in engeniustech:ews356-fir firmware
- CVE-2024-31975 Cross-site scripting in engeniustech:ews356-fit firmware
- CVE-2024-31974 The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute
- CVE-2024-31973 Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'Ne
- CVE-2024-31972 EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execu
- CVE-2024-31971 Cross-site scripting in adtran:netvanta 3120 firmware
- CVE-2024-31970 Hardcoded credentials in adtran:sdg smartos
- CVE-2024-3197 The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes
- CVE-2024-31967 A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
- CVE-2024-31966 A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
- CVE-2024-31965 A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
- CVE-2024-31964 A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
- CVE-2024-31963 A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen
- CVE-2024-31961 A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands vi
- CVE-2024-31960 Use after free in samsung:exynos 1480 firmware
- CVE-2024-3196 MailCleaner SOAP Service dumpConfiguration os command injection
- CVE-2024-31959 Memory corruption in samsung:exynos 1480 firmware
- CVE-2024-31958 Memory corruption in samsung:exynos 1480 firmware
- CVE-2024-31957 Denial of service in samsung:exynos 2200 firmware
- CVE-2024-31956 Memory corruption in samsung:exynos 1480 firmware
- CVE-2024-31955 An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware.
- CVE-2024-31954 An issue was discovered in the installer in Samsung Portable SSD for T5 1.6.10 on Windows.
- CVE-2024-31953 Privilege escalation in samsung:magician
- CVE-2024-31952 Privilege escalation in samsung:magician
- CVE-2024-31951 Memory corruption in frrouting:frrouting
- CVE-2024-31950 Memory corruption in frrouting:frrouting
- CVE-2024-3195 MailCleaner Admin Endpoints path traversal
- CVE-2024-31949 Denial of service in frrouting:frrouting
- CVE-2024-31948 Denial of service in frrouting:frrouting
- CVE-2024-31947 Path traversal in stonefly:storage concentrator
- CVE-2024-31946 An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.41, 3.10.0 through 3.11.29, 4.0 through 4.3.24, and 4.4.0 through 4.7.4.
- CVE-2024-31944 WordPress WooCommerce UPS Shipping plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31943 WordPress USPS Shipping for WooCommerce plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31942 WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31941 WordPress CP Media Player plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31940 Cross-site request forgery in Extra Product Options Builder for WooCommerce
- CVE-2024-3194 MailCleaner Log File Endpoint cross site scripting
- CVE-2024-31939 WordPress Import any XML or CSV File to WordPress plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31938 WordPress NewsXpress theme <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31937 WordPress TWIPLA (Visitor Analytics IO) plugin <= 1.2.0 - Cross-Site Scripting (XSS) vulnerability
- CVE-2024-31936 WordPress UsersWP plugin < 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31935 WordPress Simple Post Notes plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31934 WordPress Link Whisper Free plugin <= 0.6.9 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31933 WordPress Page Builder: Live Composer plugin <= 1.5.35 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31932 WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31931 WordPress Save as Image plugin by Pdfcrowd plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-31930 WordPress Save as PDF by Pdfcrowd plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-3193 MailCleaner Admin Endpoints os command injection
- CVE-2024-31929 WordPress Intagrate Lite plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-31928 WordPress Top Bar plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-31927 WordPress WP Login and Logout Redirect plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-31926 WordPress Advanced Cron Manager – debug & control plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-31925 WordPress F4 Improvements plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerability