Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 400 of 521.
- CVE-2024-28228 Auth bypass in YouTrack
- CVE-2024-28226 Fs has an improper input validation vulnerability
- CVE-2024-28224 Ollama DNS rebinding vulnerability
- CVE-2024-28222 Path traversal in veritas:netbackup
- CVE-2024-2822 DedeCMS vote_edit.php cross-site request forgery
- CVE-2024-28219 Pillow buffer overflow vulnerability
- CVE-2024-28216 Missing authorization in nGrinder
- CVE-2024-28215 Missing authorization in nGrinder
- CVE-2024-28214 Denial of service in nGrinder
- CVE-2024-28213 nGrinder vulnerable to unsafe Java objects deserialization
- CVE-2024-28212 Deserialization in nGrinder
- CVE-2024-28211 Deserialization in nGrinder
- CVE-2024-2821 DedeCMS friendlink_edit.php cross-site request forgery
- CVE-2024-28200 N-central Authentication Bypass
- CVE-2024-2820 DedeCMS baidunews.php cross-site request forgery
- CVE-2024-28199 Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex
- CVE-2024-28198 XML external entity (XXE) injection in OpenOLAT
- CVE-2024-28197 Account Takeover via Session Fixation in Zitadel [Bypassing MFA]
- CVE-2024-28196 Clickjacking in your_spotify
- CVE-2024-28195 Cross-Site Request Forgery (CSRF) vulnerability in API and login in your_spotify
- CVE-2024-28194 Authentication Bypass Because of Hardcoded JWT Secret in your_spotify
- CVE-2024-28193 Disclosure of Spotify API Access Tokens to Guest Users Using Public Tokens in your_spotify
- CVE-2024-28192 NoSQL Injection Leading to Authentication Bypass in your_spotify
- CVE-2024-28191 Contao may have unencoded insert tags in the frontend
- CVE-2024-28190 Contao core bundle vulnerable to cross site scripting in the file manager
- CVE-2024-2819 File Permission Vulnerability in Hitachi Ops Center Common Services
- CVE-2024-28189 Judge0 vulnerable to Sandbox Escape Patch Bypass via chown running on Symbolic Link
- CVE-2024-28188 jupyter-scheduler's endpoint is missing authentication
- CVE-2024-28187 OS Command Injection Vulnerability in SOY CMS
- CVE-2024-28186 SMTP Mail Credentials Disclosed in Error Log in freescout
- CVE-2024-28185 Judge0 vulnerable to Sandbox Escape via Symbolic Link
- CVE-2024-28184 WeasyPrint allows the attachment of arbitrary files and URLs to a PDF
- CVE-2024-28183 Anti Rollback bypass with physical access and TOCTOU attack
- CVE-2024-28182 Reading unbounded number of HTTP/2 CONTINUATION frames to cause excessive CPU usage
- CVE-2024-28181 Arbitrary method invocation turbo_boost-commands
- CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
- CVE-2024-2818 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2024-28179 Jupyter Server Proxy's Websocket Proxying does not require authentication
- CVE-2024-28176 jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
- CVE-2024-28175 Cross-site scripting on application summary component in argo-cd
- CVE-2024-28174 Missing authorization in TeamCity
- CVE-2024-28173 Information disclosure in TeamCity
- CVE-2024-28172 Privilege escalation in Intel(R) Trace Analyzer and Collector software
- CVE-2024-28171 Delta Electronics DIAEnergie Path traversal
- CVE-2024-28170 Missing authorization in Intel(R) RAID Web Console
- CVE-2024-2817 Tenda AC15 SysToolRestoreSet fromSysToolRestoreSet cross-site request forgery
- CVE-2024-28169 Information disclosure in BigDL software maintained by Intel(R)
- CVE-2024-28168 Apache XML Graphics FOP: XML External Entity (XXE) Processing
- CVE-2024-28167 Missing Authorization check in SAP Group Reporting Data Collection (Enter Package Data)
- CVE-2024-28166 Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform
- CVE-2024-28165 Cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform
- CVE-2024-28164 Information Disclosure vulnerability in SAP NetWeaver AS Java (Guided Procedures)
- CVE-2024-28163 Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages)
- CVE-2024-28162 Jenkins Delphix Plugin has improper SSL/TLS certificate validation
- CVE-2024-28161 Jenkins Delphix Plugin has SSL/TLS certificate validation disabled by default
- CVE-2024-28160 Jenkins iceScrum Plugin vulnerable to stored Cross-site Scripting
- CVE-2024-2816 Tenda AC15 SysToolReboot fromSysToolReboot cross-site request forgery
- CVE-2024-28159 Jenkins Subversion Partial Release Manager Plugin missing permission check
- CVE-2024-28158 Jenkins Subversion Partial Release Manager Plugin vulnerable to Cross-Site Request Forgery
- CVE-2024-28157 Jenkins GitBucket Plugin vulnerable to stored Cross-site Scripting
- CVE-2024-28156 Jenkins Build Monitor View Plugin vulnerable to stored Cross-site Scripting
- CVE-2024-28155 Jenkins AppSpider Plugin missing permission checks
- CVE-2024-28154 Jenkins MQ Notifier Plugin exposes sensitive information in build logs
- CVE-2024-28153 Jenkins OWASP Dependency-Check Plugin has stored XSS vulnerability
- CVE-2024-28152 Jenkins Bitbucket Branch Source Plugin has incorrect trust policy behavior for pull requests
- CVE-2024-28151 Jenkins HTML Publisher Plugin Path traversal vulnerability
- CVE-2024-28150 Jenkins HTML Publisher Plugin Stored XSS vulnerability
- CVE-2024-2815 Tenda AC15 Cookie execCommand R7WebsSecurityHandler stack-based overflow
- CVE-2024-28149 Jenkins HTML Publisher Plugin does not properly sanitize input
- CVE-2024-28148 Apache Superset: Incorrect datasource authorization on explore REST API
- CVE-2024-28147 Unrestricted Upload of Files in edu-sharing
- CVE-2024-28146 Hardcoded credentials
- CVE-2024-28145 Unauthenticated SQL Injection
- CVE-2024-28144 Broken Access Control
- CVE-2024-28143 Insecure Password Change Function
- CVE-2024-28142 Stored cross site scripting
- CVE-2024-28141 Cross-Site Request-Forgery
- CVE-2024-28140 Violation of Least Privilege Principle
- CVE-2024-2814 Tenda AC15 DhcpListClient fromDhcpListClient stack-based overflow
- CVE-2024-28139 Privilege escalation through sudo misconfiguration
- CVE-2024-28138 OS Command Injection
- CVE-2024-28137 PHOENIX CONTACT: privilege escalation due to a TOCTOU vulnerability in the CHARX Series
- CVE-2024-28136 PHOENIX CONTACT: command injection gains root privileges using the OCPP remote service
- CVE-2024-28135 PHOENIX CONTACT: command injection vulnerability in the API of the CHARX Series
- CVE-2024-28134 PHOENIX CONTACT: MitM attack gains privileges of the current logged in user in CHARX Series
- CVE-2024-28133 PHOENIX CONTACT: Privilege escalation in CHARX Series
- CVE-2024-28132 BIG-IP NEXT CNF vulnerability
- CVE-2024-28131 Code injection in EasyRange
- CVE-2024-28130 Memory corruption in DCMTK
- CVE-2024-2813 Tenda AC15 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow
- CVE-2024-28128 FitNesse Cross-site Scripting vulnerability
- CVE-2024-28127 Privilege escalation in Intel(R) Processors
- CVE-2024-28126 Cross-site scripting in 0ch BBS Script
- CVE-2024-28125 FitNesse allows execution of arbitrary OS commands
- CVE-2024-28123 Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters
- CVE-2024-28122 JWX vulnerable to a denial of service attack using compressed JWE message
- CVE-2024-28121 Reflex arbitrary method call in stimulus_reflex
- CVE-2024-28120 API key leak in codeium-chrome
- CVE-2024-2812 Tenda AC15 WriteFacMac formWriteFacMac os command injection
- CVE-2024-28119 Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler