Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 392 of 521.
- CVE-2024-29471 Cross-site scripting in zhyd:oneblog
- CVE-2024-29470 Cross-site scripting in zhyd:oneblog
- CVE-2024-2947 Cockpit: command injection when deleting a sosreport with a crafted name
- CVE-2024-29469 Cross-site scripting in zhyd:oneblog
- CVE-2024-29466 Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component.
- CVE-2024-29461 Denial of service in projectfloodlight:open sdn controller
- CVE-2024-29460 Path traversal in dronecode:px4 drone autopilot
- CVE-2024-2946 Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
- CVE-2024-2945 Campcodes Online Examination System updateExaminee.php sql injection
- CVE-2024-2944 Campcodes Online Examination System deleteCourseExe.php sql injection
- CVE-2024-29435 Command injection in alldata:alldata
- CVE-2024-29434 Path traversal in alldata:alldata
- CVE-2024-29433 Deserialization in alldata:alldata
- CVE-2024-29432 SQL injection in alldata:alldata
- CVE-2024-2943 Campcodes Online Examination System deleteExamExe.php sql injection
- CVE-2024-29421 xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary code.
- CVE-2024-2942 Campcodes Online Examination System deleteQuestionExe.php sql injection
- CVE-2024-29419 Cross-site scripting in totolink:x2000r firmware
- CVE-2024-29417 Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function.
- CVE-2024-29415 ip SSRF improper categorization in isPublic
- CVE-2024-29413 Cross Site Scripting vulnerability in Webasyst v.2.9.9 allows a remote attacker to run arbitrary code via the Instant messenger field in the
- CVE-2024-2941 Campcodes Online Examination System loginExe.php sql injection
- CVE-2024-29409 nest allows a remote attacker to execute arbitrary code via the Content-Type header
- CVE-2024-29404 An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker to execute arbitrary code via the export pa
- CVE-2024-29402 cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity.
- CVE-2024-29401 Auth bypass in mindskip:xzs-mysql
- CVE-2024-29400 Information disclosure in ruoyi:ruoyi
- CVE-2024-2940 Campcodes Online Examination System updateCourse.php cross site scripting
- CVE-2024-29399 Code injection in gnu:savane
- CVE-2024-29392 Silverpeas Core vulnerable to Cross Site Scripting
- CVE-2024-29390 SQL injection in anujk305:daily expenses management system
- CVE-2024-2939 Campcodes Online Examination System updateExaminee.php cross site scripting
- CVE-2024-29387 File upload in projeqtor:projeqtor
- CVE-2024-29386 SQL injection in projeqtor:projeqtor
- CVE-2024-29385 Command injection in dlink:dir-845l firmware
- CVE-2024-29384 Information disclosure in mikegualtieri:css exfil protection
- CVE-2024-2938 Campcodes Online Examination System updateCourse.php sql injection
- CVE-2024-29376 Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book
- CVE-2024-29375 CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to t
- CVE-2024-29374 Cross site scripting in moodle
- CVE-2024-29371 jose4j is vulnerable to DoS via compressed JWE content
- CVE-2024-29370 Duplicate Advisory: python-jose denial of service via compressed JWE content
- CVE-2024-2937 Mali GPU Kernel Driver allows improper GPU memory processing operations
- CVE-2024-29368 File upload in mozilo:mozilocms
- CVE-2024-29366 Command injection in dlink:dir-845l firmware
- CVE-2024-2936 Sydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id
- CVE-2024-2935 SourceCodester Todo List in Kanban Board Add ToDo cross site scripting
- CVE-2024-2934 SourceCodester Todo List in Kanban Board delete-todo.php sql injection
- CVE-2024-29338 Cross-Site Request Forgery in Anchor CMS
- CVE-2024-2933 Cross-site scripting in Page Builder Gutenberg Blocks – CoBlocks
- CVE-2024-29320 SQL injection in wallosapp:wallos
- CVE-2024-2932 SourceCodester Online Chatting System update_room.php sql injection
- CVE-2024-29319 Server-side request forgery in personal-management-system:personal management system
- CVE-2024-29318 Cross-site scripting in personal-management-system:personal management system
- CVE-2024-29316 Incorrect Access Control in NodeBB
- CVE-2024-2931 WPFront User Role Editor <= 3.2.1.11184 - Limited Information Exposure
- CVE-2024-29309 An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service.
- CVE-2024-29303 SQL injection in mayurik:php task management system
- CVE-2024-29302 SQL injection in mayurik:php task management system
- CVE-2024-29301 SQL injection in mayurik:php task management system
- CVE-2024-2930 SourceCodester Music Gallery Site unrestricted upload
- CVE-2024-29296 Portainer CE allows username enumeration through authentication response timing
- CVE-2024-29292 Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to exe
- CVE-2024-29291 An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log.
- CVE-2024-2929 Rockwell Automation Arena Simulation Vulnerable To Memory Corruption
- CVE-2024-2928 Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow
- CVE-2024-29278 funboot v1.1 is vulnerable to Cross Site Scripting (XSS) via the title field in "create a message ."
- CVE-2024-29276 An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDes
- CVE-2024-29275 SQL injection in seacms:seacms
- CVE-2024-29273 Cross-site scripting in dzzoffice:dzzoffice
- CVE-2024-29272 VvvebJs Arbitrary File Upload vulnerability
- CVE-2024-29271 VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability
- CVE-2024-2927 code-projects Mobile Shop Login Page Details.php sql injection
- CVE-2024-29269 Command injection in telesquare:tlr-2005ksh firmware
- CVE-2024-2926 Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets
- CVE-2024-2925 Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder
- CVE-2024-29244 Memory corruption in szlbt:lbt-t300-mini1 firmware
- CVE-2024-29243 Memory corruption in szlbt:lbt-t300-mini1 firmware
- CVE-2024-29241 Missing authorization in Surveillance Station
- CVE-2024-29240 Missing authorization in Surveillance Station
- CVE-2024-2924 Creative Addons for Elementor <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-29239 SQL injection in Surveillance Station
- CVE-2024-29238 SQL injection in Surveillance Station
- CVE-2024-29237 SQL injection in Surveillance Station
- CVE-2024-29236 SQL injection in Surveillance Station
- CVE-2024-29235 SQL injection in Surveillance Station
- CVE-2024-29234 SQL injection in Surveillance Station
- CVE-2024-29233 SQL injection in Surveillance Station
- CVE-2024-29232 SQL injection in Surveillance Station
- CVE-2024-29231 Other in Surveillance Station
- CVE-2024-29230 SQL injection in Surveillance Station
- CVE-2024-2923 Cross-site scripting in Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library )
- CVE-2024-29229 Missing authorization in Surveillance Station
- CVE-2024-29228 Missing authorization in Surveillance Station
- CVE-2024-29227 SQL injection in Surveillance Station
- CVE-2024-29225 Information disclosure in WMC-2LX-B
- CVE-2024-29224 Command injection in GoCast
- CVE-2024-29223 Privilege escalation in Intel(R) QuickAssist Technology software
- CVE-2024-29222 Memory corruption in Intel(R) Graphics Driver software
- CVE-2024-29221 Invite ID available to team admins even without the "Add Members" permission