Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 421 of 521.
- CVE-2024-25729 Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access.
- CVE-2024-25728 Information disclosure in expressvpn:expressvpn
- CVE-2024-25724 Memory corruption in rti:connext professional
- CVE-2024-25723 ZenML Server Remote Privilege Escalation Vulnerability
- CVE-2024-25722 SQL injection in qanything:qanything
- CVE-2024-2572 SourceCodester Employee Task Management System task-details.php redirect
- CVE-2024-25718 Samly access control vulnerability
- CVE-2024-25715 Open redirect in glewlwyd sso server project:glewlwyd sso server
- CVE-2024-25714 Weak cryptography in debian:debian linux
- CVE-2024-25713 yyjson has a Double Free vulnerability
- CVE-2024-25712 Cross-site scripting in http-swagger project:http-swagger
- CVE-2024-25711 diffoscope Path Traversal vulnerability
- CVE-2024-25710 Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file
- CVE-2024-2571 SourceCodester Employee Task Management System manage-admin.php redirect
- CVE-2024-25709 Self-XSS style in move item dialog
- CVE-2024-25708 Persistent XSS when creating new application using Web App Builder
- CVE-2024-25707 BUG-000160241 - Reflected XSS in Portal for ArcGIS
- CVE-2024-25706 HTMLi at createFolder Content Injection
- CVE-2024-25705 Cross site scripting issue in embed widget
- CVE-2024-25702 BUG-000160599 - Stored XSS in Portal for ArcGIS Web App Builder
- CVE-2024-25701 BUG-000160765 - Stored XSS in ArcGIS Experience Builder
- CVE-2024-25700 Persistent XSS in URL added to a shared map
- CVE-2024-2570 SourceCodester Employee Task Management System edit-task.php redirect
- CVE-2024-25699 Portal for ArcGIS has an invalid authentication vulnerability
- CVE-2024-25698 Reflected XSS in Portal for ArcGIS
- CVE-2024-25697 Stored XSS in Portal for ArcGIS
- CVE-2024-25696 Stored XSS in Portal for ArcGIS
- CVE-2024-25695 concatenated errors resulting in cross site scripting and frame injection issues.
- CVE-2024-25694 BUG-000163019 - Stored XSS in Portal for ArcGIS
- CVE-2024-25693 Portal for ArcGIS has a directory traversal vulnerability.
- CVE-2024-25692 BUG-000154722 - Cross-site request forgery (CSRF) issue in Portal for ArcGIS
- CVE-2024-25691 BUG-000165286 - Reflected XSS in Portal for ArcGIS
- CVE-2024-25690 HTML injection in ArcGIS Web AppBuilder
- CVE-2024-2569 SourceCodester Employee Task Management System admin-manage-user.php redirect
- CVE-2024-2568 heyewei JFinalCMS Custom Data Page sql injection
- CVE-2024-25679 Weak cryptography in pquic:pquic
- CVE-2024-25678 Security feature bypass in litespeedtech:lsquic
- CVE-2024-25677 Security feature bypass in minbrowser:min
- CVE-2024-25676 An issue was discovered in ViewerJS 0.5.8.
- CVE-2024-25675 Other in misp-project:misp
- CVE-2024-25674 File upload in misp-project:misp
- CVE-2024-25673 Other in couchbase:couchbase server
- CVE-2024-2567 jurecapuder AndroidWeatherApp Backup File androidmanifest.xml backup
- CVE-2024-25662 Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious URLs.
- CVE-2024-25661 Information disclosure in nokia:transcend network management system
- CVE-2024-25660 Privilege escalation in nokia:transcend network management system
- CVE-2024-2566 Fujian Kelixin Communication Command and Dispatch Platform get_extension_yl.php sql injection
- CVE-2024-25659 Misconfiguration in nokia:transcend network management system
- CVE-2024-25658 Information disclosure in nokia:transcend network management system
- CVE-2024-25657 An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could a
- CVE-2024-25656 Improper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer Premis
- CVE-2024-25655 Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow
- CVE-2024-25654 Information disclosure in avsystem:unified management platform
- CVE-2024-25653 Missing authorization in delinea:secret server
- CVE-2024-25652 Missing authorization in Secret Server
- CVE-2024-25651 Information disclosure in delinea:secret server
- CVE-2024-25650 Weak cryptography in delinea:distributed engine
- CVE-2024-2565 PandaXGO PandaX File Extension upload.go unrestricted upload
- CVE-2024-25649 Information disclosure in delinea:secret server
- CVE-2024-25648 Use after free in Foxit Reader
- CVE-2024-25647 Misconfiguration in Intel(R) Binary Configuration Tool software for Windows
- CVE-2024-25646 Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence
- CVE-2024-25645 Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal)
- CVE-2024-25644 Information Disclosure vulnerability in NetWeaver (WSRM)
- CVE-2024-25643 Missing authorization check in SAP Fiori app (My Overtime Requests)
- CVE-2024-25642 Improper Certificate Validation in SAP Cloud Connector
- CVE-2024-25641 Cacti RCE vulnerability when importing packages
- CVE-2024-25640 Improper Neutralization of Alternate XSS Syntax in iris-web
- CVE-2024-2564 PandaXGO PandaX user.go ExportUser path traversal
- CVE-2024-25639 Prompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clients
- CVE-2024-25638 DNSJava DNSSEC Bypass
- CVE-2024-25637 Reflected XSS via X-October-Request-Handler Header
- CVE-2024-25636 Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts
- CVE-2024-25635 IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS
- CVE-2024-25634 IDOR make user can read e-mail log sent by other events
- CVE-2024-25633 In eLabFTW, if administrators can create users, users can too
- CVE-2024-25632 Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances
- CVE-2024-25631 Unencrypted traffic between pods when using Wireguard and an external kvstore
- CVE-2024-25630 Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryption
- CVE-2024-2563 PandaXGO PandaX upload.go DeleteImage path traversal
- CVE-2024-25629 c-ares out of bounds read in ares__read_line()
- CVE-2024-25628 Insufficient Session Expiration in alf.io
- CVE-2024-25627 Cross-Site Scripting (XSS) via File Upload in Alf.io
- CVE-2024-25626 Yocto Project Security Advisory - BitBake/Toaster
- CVE-2024-25625 Pimcore Host Header Injection in user invitation link
- CVE-2024-25624 iris-web vulnerable to Server Side Template Injection in reports
- CVE-2024-25623 Lack of media type verification of Activity Streams objects allows impersonation of remote accounts
- CVE-2024-25622 H2O ignores headers configuration directives
- CVE-2024-25621 containerd affected by a local privilege escalation via wide permissions on CRI directory
- CVE-2024-25620 Dependency management path traversal in helm
- CVE-2024-2562 PandaXGO PandaX role_menu.go InsertRole sql injection
- CVE-2024-25619 Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon
- CVE-2024-25618 External OpenID Connect Account Takeover by E-Mail Change in mastodon
- CVE-2024-25617 Denial of Service in HTTP Header parser in squid proxy
- CVE-2024-25616 Information disclosure in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points
- CVE-2024-25615 Denial of service in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points
- CVE-2024-25614 Path traversal in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points
- CVE-2024-25613 Command injection in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points
- CVE-2024-25612 Command injection in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points
- CVE-2024-25611 Command injection in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points