Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 393 of 521.
- CVE-2024-29220 Cross-site scripting in Ninja Forms
- CVE-2024-2922 Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags
- CVE-2024-29219 Memory corruption in KV REPLAY VIEWER
- CVE-2024-29218 Memory corruption in KV REPLAY VIEWER
- CVE-2024-29217 Apache Answer: XSS vulnerability when changing personal website
- CVE-2024-29216 Missing authorization in cg6kwin2k.sys
- CVE-2024-29215 Slash commands run in channel without channel membership via playbook task commands
- CVE-2024-29214 Privilege escalation in Intel(R) Processors
- CVE-2024-29213 Privilege escalation in DSM
- CVE-2024-29212 Deserialization in Service Provider Console
- CVE-2024-29211 Race condition in Secure Access Client
- CVE-2024-29210 Privilege escalation in PasswordIQ (PIQ) Client
- CVE-2024-2921 Missing authorization in Server
- CVE-2024-29209 Code injection in PasswordIQ (PIQ) Client
- CVE-2024-29208 Auth bypass in Update UniFi Connect Display
- CVE-2024-29207 Security feature bypass in UniFi Connect Application
- CVE-2024-29206 Missing authorization in UniFi Access G2 Reader Pro
- CVE-2024-29205 Denial of service in Connect Secure
- CVE-2024-29204 Memory corruption in Avalanche
- CVE-2024-29203 TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
- CVE-2024-29202 JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery
- CVE-2024-29201 JumpServer's insecure Ansible playbook validation leads to RCE in Celery
- CVE-2024-29200 API returns timesheet entries a user should not be authorized to view
- CVE-2024-2920 WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files
- CVE-2024-29199 Unauthenticated views may expose information to anonymous users
- CVE-2024-29198 GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
- CVE-2024-29197 Pimcore Preview Documents are not restricted to logged in users anymore
- CVE-2024-29196 phpMyFAQ Path Traversal in Attachments
- CVE-2024-29195 Azure C SDK Integer Wraparound Vulnerability
- CVE-2024-29194 OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation
- CVE-2024-29193 GHSL-2023-207 gotortc DOM-based Cross-site Scripting vulnerability
- CVE-2024-29192 GHSL-2023-206 gotortc Cross-Site Request Forgery vulnerability
- CVE-2024-29191 GHSL-2023-205 gotortc DOM-based Cross-site Scripting vulnerability
- CVE-2024-29190 MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)
- CVE-2024-2919 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-29189 ansys-geometry-core OS Command Injection vulnerability
- CVE-2024-29188 Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
- CVE-2024-29187 WiX based installers are vulnerable to binary hijack when run as SYSTEM
- CVE-2024-29186 Slow String Operations via MultiPart Requests in Event-Driven Functions
- CVE-2024-29185 FreeScout OS Command Injection vulnerability
- CVE-2024-29184 FreeScout Stored XSS to Privilege Escalation After CSP Bypass
- CVE-2024-29183 OpenRASP vulnerable to a reflected Cross-Site Scripting (XSS) attack in /login
- CVE-2024-29182 Collabora Online Stored Cross-Site-Scripting vulnerability via tooltip
- CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel
- CVE-2024-29180 webpack-dev-middleware Path Traversal vulnerability
- CVE-2024-2918 Other in Server
- CVE-2024-29179 phpMyFAQ Stored Cross-site Scripting at File Attachments
- CVE-2024-29178 Apache StreamPark: FreeMarker SSTI RCE Vulnerability
- CVE-2024-29177 Information disclosure in PowerProtect DD
- CVE-2024-29176 Memory corruption in PowerProtect DD
- CVE-2024-29175 Weak cryptography in PowerProtect DD
- CVE-2024-29174 SQL injection in PowerProtect DD
- CVE-2024-29173 Server-side request forgery in PowerProtect DD
- CVE-2024-29172 Denial of service in Dell BSAFE SSL-J
- CVE-2024-29171 Security feature bypass in Dell BSAFE SSL-J
- CVE-2024-29170 Hardcoded credentials in PowerScale OneFS
- CVE-2024-2917 Campcodes House Rental Management System index.php file inclusion
- CVE-2024-29169 SQL injection in Secure Connect Gateway-Appliance
- CVE-2024-29168 SQL injection in Secure Connect Gateway-Appliance
- CVE-2024-29167 Command injection in SVR-116
- CVE-2024-29166 Memory corruption in hdfgroup:hdf5
- CVE-2024-29165 Memory corruption in hdfgroup:hdf5
- CVE-2024-29164 Memory corruption in hdfgroup:hdf5
- CVE-2024-29163 Memory corruption in hdfgroup:hdf5
- CVE-2024-29162 Memory corruption in hdfgroup:hdf5
- CVE-2024-29161 Memory corruption in hdfgroup:hdf5
- CVE-2024-29160 Memory corruption in hdfgroup:hdf5
- CVE-2024-2916 Campcodes House Rental Management System ajax.php sql injection
- CVE-2024-29159 Memory corruption in hdfgroup:hdf5
- CVE-2024-29158 Memory corruption in hdfgroup:hdf5
- CVE-2024-29157 Memory corruption in hdfgroup:hdf5
- CVE-2024-29156 Information leakage in YAQL
- CVE-2024-29155 Denial of service on Microchip RN4870 devices
- CVE-2024-29154 Cross-site scripting in danielmiessler:fabric
- CVE-2024-29153 Denial of service in samsung:exynos 1080 firmware
- CVE-2024-29152 Information disclosure in samsung:exynos 1080 firmware
- CVE-2024-29151 Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI.
- CVE-2024-29150 An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728.
- CVE-2024-2915 Privilege escalation in Server
- CVE-2024-29149 An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728.
- CVE-2024-29146 Information disclosure in Multiple MFPs (multifunction printers)
- CVE-2024-29143 WordPress Passwordless Login plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-29142 WordPress Better Search plugin <= 3.3.0 - Stored Cross Site Scripting (XSS) vulnerability
- CVE-2024-29141 WordPress PDF Embedder plugin <= 4.6.4 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-29140 WordPress MJM Clinic plugin <= 1.1.22 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-2914 TarSlip Vulnerability in deepjavalibrary/djl
- CVE-2024-29139 WordPress MyCurator Content Curation plugin <= 3.76 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-29138 WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-29137 WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-29136 WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability
- CVE-2024-29135 WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability
- CVE-2024-29134 WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-29133 Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree
- CVE-2024-29131 Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()
- CVE-2024-29130 WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-2913 Race Condition Vulnerability in mintplex-labs/anything-llm
- CVE-2024-29129 WordPress OxyExtras plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-29128 WordPress POST SMTP Mailer plugin <= 2.8.6 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-29127 WordPress Advanced Access Manager plugin <= 6.9.20 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-29126 WordPress Specific Content For Mobile plugin <= 0.1.9.5 - Cross Site Scripting (XSS) vulnerability