Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 401 of 521.
- CVE-2024-28118 Grav vulnerable to Server Side Template Injection (SSTI)
- CVE-2024-28117 Grav vulnerable to Server Side Template Injection (SSTI)
- CVE-2024-28116 Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass
- CVE-2024-28115 Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled
- CVE-2024-28114 Remote Code Execution using Server Side Template Injection in Peering Manager
- CVE-2024-28113 Open redirection using the return_url parameter in Peering Manager
- CVE-2024-28112 Cross site scripting on router page in Peering Manager
- CVE-2024-28111 CSV Injection in exported history CSV files
- CVE-2024-28110 Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials
- CVE-2024-2811 Tenda AC15 WifiWpsStart formWifiWpsStart stack-based overflow
- CVE-2024-28109 Potential XSLT injection vulnerability when using policy files
- CVE-2024-28108 phpMyFAQ Stored HTML Injection at contentLink
- CVE-2024-28107 phpMyFAQ SQL injections at insertentry & saveentry
- CVE-2024-28106 phpMyFAQ Stored XSS at FAQ News Content
- CVE-2024-28105 phpMyFAQ's File Upload Bypass at Category Image Leads to RCE
- CVE-2024-28103 Action Pack is missing security headers on non-HTML responses
- CVE-2024-28102 JWCrypto vulnerable to JWT bomb Attack in `deserialize` function
- CVE-2024-28101 Apollo Router's Compressed Payloads do not respect HTTP Payload Limits
- CVE-2024-28100 Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw
- CVE-2024-2810 Tenda AC15 WifiWpsOOB formWifiWpsOOB stack-based overflow
- CVE-2024-28099 Other in VT STUDIO
- CVE-2024-28098 Apache Pulsar: Improper Authorization For Topic-Level Policy Management
- CVE-2024-28097 Stored Cross-site Scripting in Calendar functionality in Schoolbox
- CVE-2024-28096 Stored Cross-site Scripting in Class functionality in Schoolbox
- CVE-2024-28095 Stored Cross-site Scripting in News functionality in Schoolbox
- CVE-2024-28094 Blind SQL Injection in Chat functionality in Schoolbox
- CVE-2024-28093 The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level account.
- CVE-2024-28092 UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks vi
- CVE-2024-28091 Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stor
- CVE-2024-28090 Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stor
- CVE-2024-2809 Tenda AC15 SetFirewallCfg formSetFirewallCfg stack-based overflow
- CVE-2024-28089 Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel
- CVE-2024-28088 LangChain directory traversal vulnerability
- CVE-2024-28087 Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability
- CVE-2024-28085 Other in debian:debian linux
- CVE-2024-28084 Memory corruption in fedoraproject:fedora
- CVE-2024-2808 Tenda AC15 QuickIndex formQuickIndex stack-based overflow
- CVE-2024-28077 Denial of service in gl-inet:a1300 firmware
- CVE-2024-28076 SolarWinds Platform Arbitrary Open Redirection Vulnerability
- CVE-2024-28075 SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution
- CVE-2024-28074 SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability
- CVE-2024-28073 SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability
- CVE-2024-28072 Arbitrary File Overwrite Vulnerability
- CVE-2024-28070 Cross-site scripting in mitel:micontact center business
- CVE-2024-2807 Tenda AC15 expandDlnaFile formExpandDlnaFile stack-based overflow
- CVE-2024-28069 Misconfiguration in mitel:micontact center business
- CVE-2024-28068 Null dereference in samsung:exynos 1080 firmware
- CVE-2024-28067 Security feature bypass in samsung:exynos modem 5300 firmware
- CVE-2024-28066 Hardcoded credentials in mitel:6905 firmware
- CVE-2024-28065 In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash.
- CVE-2024-28064 Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated fil
- CVE-2024-28063 Cross-site scripting in totemo:totemomail
- CVE-2024-28061 An issue was discovered in Apiris Kafeo 6.4.4.
- CVE-2024-28060 An issue was discovered in Apiris Kafeo 6.4.4.
- CVE-2024-2806 Tenda AC15 addWifiMacFilter stack-based overflow
- CVE-2024-28058 In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an active session, an i
- CVE-2024-28056 AWS Amplify CLI has incorrect trust policy management
- CVE-2024-28054 Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some ma
- CVE-2024-28053 Resource Exhaustion via the Invitation Feature
- CVE-2024-28052 Other in WBR-6012
- CVE-2024-28051 Memory corruption in Intel(R) VPL software
- CVE-2024-28050 Missing authorization in Intel(R) Arc(TM) & Iris(R) Xe Graphics software
- CVE-2024-2805 Tenda AC15 SetSpeedWan formSetSpeedWan stack-based overflow
- CVE-2024-28049 Denial of service in Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products
- CVE-2024-28048 Command injection in ffBull
- CVE-2024-28047 Information disclosure in Intel(R) Processors
- CVE-2024-28046 Privilege escalation in Intel(R) GPA software
- CVE-2024-28045 Delta Electronics DIAEnergie Cross-site scripting
- CVE-2024-28044 Liteos-A has an integer overflow vulnerability
- CVE-2024-28042 SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component
- CVE-2024-28041 Command injection in HGW BL1500HM
- CVE-2024-28040 Delta Electronics DIAEnergie SQL injection
- CVE-2024-2804 Network Summary <= 2.0.11 - Unauthenticated SQL Injection
- CVE-2024-28039 XML external entity in FitNesse
- CVE-2024-28038 Memory corruption in Multiple MFPs (multifunction printers)
- CVE-2024-28036 Denial of service in Intel(R) Arc™ GPU
- CVE-2024-28034 Cross-site scripting in Mini Thread
- CVE-2024-28033 Command injection in WebProxy
- CVE-2024-28030 Null dereference in Intel(R) VPL software
- CVE-2024-2803 ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
- CVE-2024-28029 Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie
- CVE-2024-28028 Other in Intel(R) Neural Compressor software
- CVE-2024-28027 Command injection in MC LR Router
- CVE-2024-28026 Command injection in MC LR Router
- CVE-2024-28025 Command injection in MC LR Router
- CVE-2024-28024 Information disclosure in FOXMAN-UN
- CVE-2024-28023 Information disclosure in FOXMAN-UN
- CVE-2024-28022 Auth bypass in FOXMAN-UN
- CVE-2024-28021 Security feature bypass in FOXMAN-UN
- CVE-2024-28020 Auth bypass in FOXMAN-UN
- CVE-2024-28016 Missing authorization in CR2500P
- CVE-2024-28015 Command injection in CR2500P
- CVE-2024-28014 Memory corruption in CR2500P
- CVE-2024-28013 Weak cryptography in CR2500P
- CVE-2024-28012 Auth bypass in CR2500P
- CVE-2024-28011 Command injection in CR2500P
- CVE-2024-28010 Hardcoded credentials in CR2500P
- CVE-2024-2801 Shopkeeper Extender <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-28009 Auth bypass in CR2500P
- CVE-2024-28008 Command injection in CR2500P