Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 399 of 521.
- CVE-2024-2842 Easy Appointments <= 3.11.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-28418 File upload in webedition:webedition cms
- CVE-2024-28417 Cross-site scripting in webedition:webedition cms
- CVE-2024-2841 Cross-site scripting in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- CVE-2024-28405 Auth bypass in sem-cms:semcms
- CVE-2024-28404 Cross-site scripting in totolink:x2000r firmware
- CVE-2024-28403 Cross-site scripting in totolink:x2000r firmware
- CVE-2024-28402 Cross-site scripting in totolink:x2000r firmware
- CVE-2024-28401 Cross-site scripting in totolink:x2000r firmware
- CVE-2024-2840 Enhanced Media Library <= 2.8.9 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2024-28397 js2py allows remote code execution
- CVE-2024-28396 Code injection in myprestamodules:orders \(csv\, excel\) export pro
- CVE-2024-28395 SQL injection in best-kit:bestkit popup
- CVE-2024-28394 An issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to execute arbitrary code via the Sales Reports,
- CVE-2024-28393 SQL injection in scalapay:scalapay
- CVE-2024-28392 SQL injection in prestashop:abandoned cart reminder pro
- CVE-2024-28391 SQL injection in fmemodules:b2b quick order form
- CVE-2024-28390 Missing authorization in advancedplugins:ultimateimagetool
- CVE-2024-2839 Colibri Page Builder <= 1.0.263 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-28389 SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensit
- CVE-2024-28388 SQL injection in sunnytoo:product comments
- CVE-2024-28387 Information disclosure in axonaut:axonaut
- CVE-2024-28386 Code injection in home-made:fastmag sync
- CVE-2024-28383 Memory corruption in tenda:ax12 firmware
- CVE-2024-2838 WPC Composite Products for WooCommerce <= 7.2.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-2837 WP Chat App < 3.6.4 - Admin+ Stored XSS
- CVE-2024-2836 Super Socializer < 7.13.64 - Editor+ Stored XSS
- CVE-2024-28354 Command injection in trendnet:tew-827dru firmware
- CVE-2024-28353 Command injection in trendnet:tew-827dru firmware
- CVE-2024-2835 OpenText ArcSight Enterprise Security Manager and ArcSight Platform Stored XSS
- CVE-2024-28345 Missing authorization in sipwise:next generation communication platform
- CVE-2024-28344 Open redirect in sipwise:next generation communication platform
- CVE-2024-28340 Information disclosure in netgear:cbk40 firmware
- CVE-2024-2834 OpenText ArcSight Management Center and ArcSight Platform Stored XSS
- CVE-2024-28339 Information disclosure in netgear:cbk40 firmware
- CVE-2024-28338 Auth bypass in totolink:a8000ru firmware
- CVE-2024-28335 Lektor does not sanitize database path traversal
- CVE-2024-2833 Jobs for WordPress <= 2.7.5 - Reflected Cross-Site Scripting via job-search
- CVE-2024-28328 CSV Injection vulnerability in the Asus RT-N12+ router allows administrator users to inject arbitrary commands or formulas in the client nam
- CVE-2024-28327 Asus RT-N12+ B1 router stores user passwords in plaintext, which could allow local attackers to obtain unauthorized access and modify router settings.
- CVE-2024-28326 Incorrect Access Control in ASUS RT-N12+ B1 and RT-N12 D1 routers allows local attackers to obtain root terminal access via the the UART interface.
- CVE-2024-28325 Asus RT-N12+ B1 router stores credentials in cleartext, which could allow local attackers to obtain unauthorized access and modify router settings.
- CVE-2024-28323 SQL injection in phpgurukul:user registration \& login and user management system
- CVE-2024-28322 SQL injection in puneethreddyhc:event management
- CVE-2024-28320 Missing authorization in mayurik:hospital management system
- CVE-2024-2832 Campcodes Online Shopping System offersmail.php cross site scripting
- CVE-2024-28319 Memory corruption in gpac:gpac
- CVE-2024-28318 Memory corruption in gpac:gpac
- CVE-2024-2831 Calendar <= 1.3.14 - Authenticated (Contributor+) SQL Injection via Shortcode
- CVE-2024-28303 Open Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/index.php.
- CVE-2024-2830 Cross-site scripting in Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI
- CVE-2024-28298 SQL injection in e-bmsoft:bmplanning
- CVE-2024-28297 SQL injection vulnerability in AzureSoft MyHorus 4.3.5 allows authenticated users to execute arbitrary SQL commands via unspecified vectors.
- CVE-2024-28294 SQL injection in limbas:limbas
- CVE-2024-2829 Inefficient Regular Expression Complexity in GitLab
- CVE-2024-28288 Auth bypass in ruijie:rg-nbr700gw firmware
- CVE-2024-28287 A DOM-based open redirection in the returnUrl parameter of INSTINCT UI Web Client 6.5.0 allows attackers to redirect users to malicious sites via a crafted URL.
- CVE-2024-28286 Null dereference in mz-automation:libiec61850
- CVE-2024-28285 A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows an attacker to co-re
- CVE-2024-28283 Memory corruption in linksys:e1000 firmware
- CVE-2024-2828 lakernote EasyAdmin IndexController.java thumbnail server-side request forgery
- CVE-2024-28279 SQL injection in carmelo:computer book store
- CVE-2024-28277 Cross-site scripting in remyandrade:school task manager
- CVE-2024-28276 Cross-site scripting in rems:school task manager
- CVE-2024-28275 Puwell Cloud Tech Co, Ltd 360Eyes Pro v3.9.5.16(3090516) was discovered to transmit sensitive information in cleartext.
- CVE-2024-28270 An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword.
- CVE-2024-2827 lakernote EasyAdmin saveReportFile server-side request forgery
- CVE-2024-28269 ReCrystallize Server 5.10.0.0 allows administrators to upload files to the server.
- CVE-2024-28265 Path traversal in ibos:ibos
- CVE-2024-2826 lakernote EasyAdmin saveReportFile xml external entity reference
- CVE-2024-28255 Authentication Bypass in OpenMetadata
- CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata
- CVE-2024-28253 SpEL Injection in `PUT /api/v1/policies` in OpenMetadata
- CVE-2024-28252 CoreWCF NetFraming based services can leave connections open when they should be closed
- CVE-2024-28251 Cross-site websocket hijacking in Querybook
- CVE-2024-28250 Cilium has possible unencrypted traffic between nodes when using WireGuard and L7 policies
- CVE-2024-2825 lakernote EasyAdmin saveReportFile path traversal
- CVE-2024-28249 Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies
- CVE-2024-28248 Cilium intermittent HTTP policy bypass
- CVE-2024-28247 Pihole Authenticated Arbitrary File Read with root privileges
- CVE-2024-28246 KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols
- CVE-2024-28245 KaTeX's \includegraphics does not escape filename
- CVE-2024-28244 KaTeX's maxExpand bypassed by Unicode sub/superscripts
- CVE-2024-28243 KaTeX's maxExpand bypassed by \edef
- CVE-2024-28242 Disclosure of the existence of secret categories with custom backgrounds in Discourse
- CVE-2024-28241 GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder
- CVE-2024-28240 GLPI-Agent's MSI package installation permits local users to change Agent configuration
- CVE-2024-2824 Matthias-Wandel jhead exif.c PrintFormatNumber heap-based overflow
- CVE-2024-28239 URL Redirection to Untrusted Site in OAuth2/OpenID in directus
- CVE-2024-28238 Session Token in URL in directus
- CVE-2024-28237 OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings
- CVE-2024-28236 Insecure Variable Substitution in Vela
- CVE-2024-28235 Contao possible cookie sharing with external domains while checking protected pages for broken links
- CVE-2024-28234 Contao has insufficient BBCode sanitizer
- CVE-2024-28233 XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
- CVE-2024-28232 Username Enumeration in CasaOS via bypass of CVE-2024-24766
- CVE-2024-28231 Manipulated DATA Submessage causes a heap-buffer-overflow error
- CVE-2024-28230 Missing authorization in YouTrack
- CVE-2024-2823 DedeCMS mda_main.php cross-site request forgery
- CVE-2024-28229 Missing authorization in YouTrack