Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 386 of 521.
- CVE-2024-30242 WordPress Contact Form to Any API plugin <= 1.1.8 - Auth. SQL Injection vulnerability
- CVE-2024-30241 SQL injection in ProfileGrid
- CVE-2024-30240 WordPress Calendarista plugin <= 15.5.7 - SQL Injection vulnerability
- CVE-2024-3024 appneta tcpreplay get.c get_layer4_v6 heap-based overflow
- CVE-2024-30239 WordPress Zoho Campaigns plugin <= 2.0.6 - SQL Injection vulnerability
- CVE-2024-30238 WordPress Photos and Files Contest Gallery plugin <= 21.3.2 - SQL Injection vulnerability
- CVE-2024-30237 WordPress Slider by Supsystic plugin <= 1.8.10 - SQL Injection vulnerability
- CVE-2024-30236 WordPress Contest Gallery plugin <= 21.3.4 - SQL Injection vulnerability
- CVE-2024-30235 WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Broken Access Control vulnerability
- CVE-2024-30234 WordPress WholesaleX plugin <= 1.3.1 - Broken Access Control vulnerability
- CVE-2024-30233 WordPress WholesaleX plugin <= 1.3.1 - Sensitive Data Exposure on User Export vulnerability
- CVE-2024-30232 WordPress Exclusive Addons for Elementor plugin <= 2.6.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30231 WordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerability
- CVE-2024-30230 WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerability
- CVE-2024-3023 AnnounceKit <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-30229 WordPress Give plugin <= 3.4.2 - PHP Object Injection vulnerability
- CVE-2024-30228 WordPress Hercules Core plugin <= 6.4 - Auth. PHP Object Injection vulnerability
- CVE-2024-30227 WordPress Geo Controller plugin <= 8.6.4 - PHP Object Injection vulnerability
- CVE-2024-30226 WordPress BetterDocs plugin <= 3.3.3 - Unauthenticated PHP Object Injection vulnerability
- CVE-2024-30225 WordPress WP Migrate plugin <= 2.6.10 - Unauthenticated PHP Object Injection vulnerability
- CVE-2024-30224 WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated PHP Object Injection vulnerability
- CVE-2024-30223 WordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerability
- CVE-2024-30222 WordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerability
- CVE-2024-30221 WordPress Sunshine Photo Cart plugin <= 3.1.1 - PHP Object Injection vulnerability
- CVE-2024-30220 Command injection in MZK-MF300HP2
- CVE-2024-3022 File upload in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
- CVE-2024-30219 Other in MZK-MF300HP2
- CVE-2024-30218 Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2024-30217 Missing Authorization check in SAP S/4 HANA (Cash Management)
- CVE-2024-30216 Missing Authorization check in SAP S/4 HANA (Cash Management)
- CVE-2024-30215 Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
- CVE-2024-30214 Cross-Site Scripting (XSS) vulnerability in SAP Business Connector
- CVE-2024-30213 StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, l
- CVE-2024-30212 Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command
- CVE-2024-30211 Privilege escalation in Intel(R) ME driver pack installer engines
- CVE-2024-30210 IOSIX IO-1020 Micro ELD Use of Default Credentials
- CVE-2024-3021 Mhr Post Ticker <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-30209 Weak cryptography in SIMATIC RTLS Locating Manager
- CVE-2024-30208 Missing authorization in SIMATIC RTLS Locating Manager
- CVE-2024-30207 Hardcoded credentials in SIMATIC RTLS Locating Manager
- CVE-2024-30206 Security feature bypass in SIMATIC RTLS Locating Manager
- CVE-2024-30205 Security feature bypass in debian:debian linux
- CVE-2024-30204 Misconfiguration in debian:debian linux
- CVE-2024-30203 Security feature bypass in debian:debian linux
- CVE-2024-30202 Code injection in gnu:emacs
- CVE-2024-30201 WordPress WP Smart Import plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-30200 WordPress BEAR plugin <= 1.1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-3020 Deserialization in Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel
- CVE-2024-30199 WordPress WP-Lister Lite for Amazon plugin <= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-30198 WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-30197 WordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30196 WordPress Easy Social Share Buttons plugin <= 9.4 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-30195 WordPress New RoyalSlider plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-30194 WordPress Sunshine Photo Cart plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-30193 WordPress Church Admin plugin <= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerability
- CVE-2024-30192 WordPress Pinterest Plugin <= 1.8.2 - Cross Site Scripting (XSS)
- CVE-2024-30191 Auth bypass in SCALANCE W1748-1 M12
- CVE-2024-30190 Auth bypass in SCALANCE W1748-1 M12
- CVE-2024-3019 Pcp: exposure of the redis server backend allows remote command execution via pmproxy
- CVE-2024-30189 Auth bypass in SCALANCE W721-1 RJ45
- CVE-2024-30188 Apache DolphinScheduler: Resource File Read And Write Vulnerability
- CVE-2024-30187 Business logic in anope:anope
- CVE-2024-30186 WordPress Prime Slider plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30185 WordPress Element Pack Elementor Addons plugin <= 5.5.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30184 WordPress Popup Builder plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30183 WordPress WPBakery Page Builder Addons by Livemesh plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30182 WordPress HT Mega – Absolute Addons For Elementor plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30181 WordPress Locatoraid Store Locator plugin <= 3.9.30 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30180 WordPress Easy Social Feed plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-3018 Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword
- CVE-2024-30179 WordPress Bold Page Builder plugin <= 4.7.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30178 WordPress Simply Static plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30177 WordPress Exclusive Addons for Elementor plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-30176 Information disclosure in logpoint:siem
- CVE-2024-30172 Bouncy Castle crafted signature and public key can be used to trigger an infinite loop
- CVE-2024-30171 Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack")
- CVE-2024-30170 Denial of service in ssh:privx
- CVE-2024-3017 Denial of service in multi-protocol gateway - Zigbee + Thread
- CVE-2024-30167 /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a P
- CVE-2024-30166 Memory corruption in trustedfirmware:mbed tls
- CVE-2024-30165 Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands w
- CVE-2024-30164 Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions.
- CVE-2024-30163 SQL injection in invisioncommunity:invisioncommunity
- CVE-2024-30162 Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\a
- CVE-2024-30161 Use after free in qt:qt
- CVE-2024-30160 Cross-site scripting in mitel:micollab
- CVE-2024-3016 Missing authorization in ITK-12D-1(BK)TEL
- CVE-2024-30159 Cross-site scripting in mitel:micollab
- CVE-2024-30158 SQL injection in mitel:micollab
- CVE-2024-30157 SQL injection in mitel:micollab
- CVE-2024-30156 Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhausti
- CVE-2024-30155 HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability
- CVE-2024-30154 HCL SX is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability
- CVE-2024-30152 HCL SX is affected by usage of a weak cryptographic algorithm
- CVE-2024-30151 HCL BigFix Service Management (SM) is susceptible to Broken Access Control Vulnerability
- CVE-2024-30150 An unauthenticated privilege escalation vulnerability affects HCL MyCloud
- CVE-2024-3015 SourceCodester Simple Subscription Website manage_plan.php sql injection
- CVE-2024-30149 HCL AppScan Source is affected by an expired TLS/SSL certificate
- CVE-2024-30148 HCL Leap is affected by improper access control
- CVE-2024-30147 HCL Leap is affected by a cross-site scripting (XSS) vulnerability