Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 376 of 521.
- CVE-2024-3152 Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm
- CVE-2024-31510 Weak cryptography in openquantumsafe:liboqs
- CVE-2024-3151 Bdtask Multi-Store Inventory Management System Stock Movement Page cross-site request forgery
- CVE-2024-31507 SQL injection in tamparongj03:online graduate tracer system
- CVE-2024-31506 SQL injection in tamparongj03:online graduate tracer system
- CVE-2024-31504 Memory corruption in embedded-solutions:freemodbus
- CVE-2024-31503 Dolibarr vulnerable to Cross-Site Request Forgery
- CVE-2024-31502 An issue in Insurance Management System v.1.0.0 and before allows a remote attacker to escalate privileges via a crafted POST request to /admin/core/new_staff.
- CVE-2024-3150 Privilege Escalation in mintplex-labs/anything-llm
- CVE-2024-31498 Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windo
- CVE-2024-31497 Weak cryptography in fedoraproject:fedora
- CVE-2024-31496 Memory corruption in FortiAnalyzer
- CVE-2024-31495 SQL injection in FortiPortal
- CVE-2024-31493 Information disclosure in FortiSOAR
- CVE-2024-31492 Code injection in FortiClientMac
- CVE-2024-31491 Security feature bypass in FortiSandbox
- CVE-2024-31490 Information disclosure in FortiSandbox
- CVE-2024-3149 SSRF in mintplex-labs/anything-llm
- CVE-2024-31489 Security feature bypass in FortiClientEMS
- CVE-2024-31488 Cross-site scripting in FortiNAC
- CVE-2024-31487 Path traversal in FortiSandbox
- CVE-2024-31486 Information disclosure in OPUPI0 AMQP/MQTT
- CVE-2024-31485 Command injection in CPCI85 Central Processing/Communication
- CVE-2024-31484 Memory corruption in CPC80 Central Processing/Communication
- CVE-2024-31483 Information disclosure in AOS-8 Instant and AOS-10 AP
- CVE-2024-31482 Denial of service in AOS-8 Instant and AOS-10 AP
- CVE-2024-31481 Denial of service in AOS-8 Instant and AOS-10 AP
- CVE-2024-31480 Command injection in AOS-8 Instant and AOS-10 AP
- CVE-2024-3148 DedeCMS makehtml_archives_action.php sql injection
- CVE-2024-31479 Denial of service in AOS-8 Instant and AOS-10 AP
- CVE-2024-31478 Denial of service in AOS-8 Instant and AOS-10 AP
- CVE-2024-31477 Command injection in AOS-8 Instant and AOS-10 AP
- CVE-2024-31476 Command injection in AOS-8 Instant and AOS-10 AP
- CVE-2024-31475 Other in AOS-8 Instant and AOS-10 AP
- CVE-2024-31474 Path traversal in AOS-8 Instant and AOS-10 AP
- CVE-2024-31473 Command injection in AOS-8 Instant and AOS-10 AP
- CVE-2024-31472 Command injection in AOS-8 Instant and AOS-10 AP
- CVE-2024-31471 Command injection in AOS-8 Instant and AOS-10 AP
- CVE-2024-31470 Memory corruption in AOS-8 Instant and AOS-10 AP
- CVE-2024-3147 DedeCMS makehtml_map.php cross-site request forgery
- CVE-2024-31469 Memory corruption in AOS-8 Instant and AOS-10 AP
- CVE-2024-31468 Memory corruption in AOS-8 Instant and AOS-10 AP
- CVE-2024-31467 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
- CVE-2024-31466 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
- CVE-2024-31465 XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet
- CVE-2024-31464 XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted
- CVE-2024-31463 Ironic-image allows unauthenticated local access to Ironic API
- CVE-2024-31462 Limited file write in Stable-diffusion-webui - GHSL-2024-010
- CVE-2024-31461 Plane Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2024-31460 Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database
- CVE-2024-3146 DedeCMS makehtml_rss_action.php cross-site request forgery
- CVE-2024-31459 Cacti RCE vulnerability by file include in lib/plugin.php
- CVE-2024-31458 Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database
- CVE-2024-31457 gin-vue-admin background arbitrary code coverage vulnerability
- CVE-2024-31456 GLPI contains an authenticated SQL injection
- CVE-2024-31455 Minder GetRepositoryByName data leak
- CVE-2024-31454 PsiTransfer file integrity violation vulnerability
- CVE-2024-31453 PsiTransfer vulnerable to violation of the integrity of file distribution
- CVE-2024-31452 OpenFGA Authorization Bypass
- CVE-2024-31451 Limited file write in routes.py (GHSL-2023-250)
- CVE-2024-31450 Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)
- CVE-2024-3145 DedeCMS makehtml_js_action.php cross-site request forgery
- CVE-2024-31449 Lua library commands may lead to stack overflow and RCE in Redis
- CVE-2024-31448 Cross-site Scripting vulnerability in link CSV import in Combodo iTop
- CVE-2024-31447 Shopware has Improper Session Handling in store-api
- CVE-2024-31446 OpenComputers Denial of Service using xpcall
- CVE-2024-31445 SQL Injection vulnerability in automation_get_new_graphs_sql
- CVE-2024-31444 Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database
- CVE-2024-31443 Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database
- CVE-2024-31442 Redon-Hub has incorrect permissions on all admin related commands
- CVE-2024-31441 Arbitrary File Reading in DataEase
- CVE-2024-3144 DedeCMS makehtml_spec.php cross-site request forgery
- CVE-2024-31435 WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.6 - Broken Access Control vulnerability
- CVE-2024-31434 WordPress Newsletter plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31433 WordPress The Events Calendar plugin <= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31432 WordPress Restrict Content plugin <= 3.2.8 - Broken Access Control vulnerability
- CVE-2024-31431 WordPress Product Input Fields for WooCommerce plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31430 Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR and WOLF WordPress plugins
- CVE-2024-3143 DedeCMS member_rank.php cross-site request forgery
- CVE-2024-31429 WordPress Sarada Lite theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31428 WordPress The Conference theme <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31427 WordPress Marker.io plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31426 WordPress Inline Related Posts plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31425 WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31424 WordPress Login with Phone Number plugin <= 1.6.93 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31423 WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.5 - Broken Access Control vulnerability
- CVE-2024-31422 WordPress Favicon by RealFaviconGenerator plugin <= 1.3.29 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-31421 WordPress Popup by Supsystic plugin <= 1.10.27 - Broken Access Control vulnerability
- CVE-2024-31420 Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes
- CVE-2024-3142 Clavister E10/E80 Setting cross-site request forgery
- CVE-2024-31419 Cnv: information disclosure through the usage of vm-dump-metrics
- CVE-2024-31416 Integer overflow in Foreseer
- CVE-2024-31415 Weak cryptography in Foreseer
- CVE-2024-31414 Cross-site scripting in Foreseer
- CVE-2024-31413 Memory corruption in CX-One CX-One CXONE-AL[][]D-V4
- CVE-2024-31412 Memory corruption in CX-Programmer
- CVE-2024-31411 Apache StreamPipes: Potential remote code execution (RCE) via file upload
- CVE-2024-31410 CyberPower PowerPanel business Use of Hard-coded Cryptographic Key
- CVE-2024-3141 Clavister E10/E80 Misc Settings Page MiscSettings cross site scripting
- CVE-2024-31409 CyberPower PowerPanel business Incorrect Authorization