Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 402 of 521.
- CVE-2024-28007 Auth bypass in CR2500P
- CVE-2024-28006 Auth bypass in CR2500P
- CVE-2024-28005 Code injection in CR2500P
- CVE-2024-28004 WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerability
- CVE-2024-28003 WordPress Max Mega Menu plugin <= 3.3 - Broken Access Control vulnerability
- CVE-2024-28002 WordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-28001 WordPress Favicon Rotator plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-28000 WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability
- CVE-2024-2800 Uncontrolled Resource Consumption in GitLab
- CVE-2024-27999 WordPress Preview E-mails for WooCommerce plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-27998 WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-27997 WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27996 WordPress Survey Maker plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27995 WordPress ARMember plugin <= 4.0.23 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27994 WordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27993 WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27992 WordPress Link Whisper Free plugin <= 0.6.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-27991 WordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27990 WordPress The Moneytizer plugin <= 9.5.20 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-2799 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2024-27989 Cross-site scripting in WP Responsive Tabs horizontal vertical and accordion Tabs
- CVE-2024-27988 WordPress WEN Responsive Columns plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27987 WordPress Give plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-27986 WordPress Livemesh Addons for Elementor Plugin <= 8.3.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-27985 WordPress PropertyHive plugin <= 2.0.9 - PHP Object Injection vulnerability
- CVE-2024-27984 Path traversal in Avalanche
- CVE-2024-27983 Race condition in Node
- CVE-2024-27982 Other in Node
- CVE-2024-27981 Command injection in UniFi Network Application
- CVE-2024-27980 Command injection in Node
- CVE-2024-2798 Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
- CVE-2024-27978 Null dereference in Avalanche
- CVE-2024-27977 Path traversal in Avalanche
- CVE-2024-27976 Path traversal in Avalanche
- CVE-2024-27975 Use after free in Avalanche
- CVE-2024-27974 Cross-site request forgery in ApeosPort-IV C2270
- CVE-2024-27972 WordPress WP Fusion Lite plugin <= 3.41.24 - Remote Code Execution (RCE) vulnerability
- CVE-2024-27971 WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability
- CVE-2024-27970 WordPress WP SendFox plugin <= 1.3.0 - Broken Access Control vulnerability
- CVE-2024-2797 MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization
- CVE-2024-27969 WordPress Free Downloads WooCommerce plugin <= 3.5.8.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27968 WordPress Super Page Cache for Cloudflare plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability
- CVE-2024-27967 WordPress DSGVO All in one for WP plugin <= 4.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-27966 WordPress Quiz And Survey Master plugin <= 8.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27965 WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27964 WordPress Zippy plugin <= 1.6.9 - Arbitrary File Upload vulnerability
- CVE-2024-27963 WordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27962 WordPress wp-mpdf plugin <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-27961 WordPress AntiSpam for Contact Form 7 plugin <= 0.6.0 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-27960 WordPress Email Subscription Popup plugin <= 1.2.20 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-2796 SSRF in Akana API Platform
- CVE-2024-27959 WordPress APIExperts Square for WooCommerce plugin <= 4.2.9 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27958 WordPress Visualizer plugin <= 3.10.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-27957 WordPress Pie Register plugin <= 3.8.3.1 - Unauthenticated Arbitrary File Upload vulnerability
- CVE-2024-27956 WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability
- CVE-2024-27955 WordPress Automatic plugin <= 3.92.0 - CSRF to Privilege Escalation vulnerability
- CVE-2024-27954 WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability
- CVE-2024-27953 WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.8 is vulnerable to Broken Access Control
- CVE-2024-27952 WordPress Advanced Sermons plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-27951 WordPress Multiple Page Generator Plugin <= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability
- CVE-2024-27950 WordPress Sirv plugin <= 7.2.0 - Broken Access Control vulnerability
- CVE-2024-2795 SEO SIMPLE PACK <= 3.2.1 - Information Exposure
- CVE-2024-27949 WordPress Sirv plugin <= 7.2.0 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2024-27948 WordPress Atahualpa Theme <= 3.7.24 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2024-27947 Information disclosure in RUGGEDCOM CROSSBOW
- CVE-2024-27946 Path traversal in RUGGEDCOM CROSSBOW
- CVE-2024-27945 File upload in RUGGEDCOM CROSSBOW
- CVE-2024-27944 File upload in RUGGEDCOM CROSSBOW
- CVE-2024-27943 File upload in RUGGEDCOM CROSSBOW
- CVE-2024-27942 Missing authorization in RUGGEDCOM CROSSBOW
- CVE-2024-27941 SQL injection in RUGGEDCOM CROSSBOW
- CVE-2024-27940 SQL injection in RUGGEDCOM CROSSBOW
- CVE-2024-2794 Gutenberg Block Editor Toolkit – EditorsKit <= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-27939 File upload in RUGGEDCOM CROSSBOW
- CVE-2024-27938 SMTP Smuggling in Postal
- CVE-2024-27937 glpi Users emails enumeration
- CVE-2024-27936 Deno interactive permission prompt spoofing via improper ANSI stripping
- CVE-2024-27935 Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination
- CVE-2024-27934 *const c_void / ExternalPointer unsoundness leading to use-after-free
- CVE-2024-27933 Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass
- CVE-2024-27932 Deno's improper suffix match testing for DENO_AUTH_TOKENS
- CVE-2024-27931 Insufficient permission checking in `Deno.makeTemp*` APIs
- CVE-2024-27930 Sensitive fields access through dropdowns in GLPI
- CVE-2024-2793 Cross-site scripting in Atarim – Visual Feedback, Review & AI Collaboration
- CVE-2024-27929 Use After Free in SixLabors.ImageSharp
- CVE-2024-27928 Vantage6: 2FA can be circumvented with hacked email access
- CVE-2024-27927 RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4
- CVE-2024-27926 RSSHub Cross-site Scripting vulnerability caused by internal media proxy
- CVE-2024-27923 Remote Code Execution by uploading a phar file using frontmatter
- CVE-2024-27922 HTTP Handling Vulnerability in the Bare server
- CVE-2024-27921 Grav File Upload Path Traversal vulnerability
- CVE-2024-27920 Unsigned code template execution through workflows in projectdiscovery/nuclei
- CVE-2024-2792 Cross-site scripting in Addon Elements for Elementor (formerly Elementor Addon Elements)
- CVE-2024-27919 HTTP/2: memory exhaustion due to CONTINUATION frame flood
- CVE-2024-27918 Coder's OIDC authentication allows email with partially matching domain to register
- CVE-2024-27917 Shopware's session is persistent in Cache for 404 pages
- CVE-2024-27916 `GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user
- CVE-2024-27915 Sulu grants access to pages regardless of role permissions
- CVE-2024-27914 Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI
- CVE-2024-27913 Denial of service in frrouting:frrouting