Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 425 of 521.
- CVE-2024-25130 Tuleap's mass update clears the permissions on artifact field
- CVE-2024-2513 WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute
- CVE-2024-25129 Limited data exfiltration in CodeQL CLI
- CVE-2024-25128 Flask-AppBuilder incorrect authentication when using auth type OpenID
- CVE-2024-25126 Rack ReDos in content type parsing (2nd degree polynomial)
- CVE-2024-25125 Absolute path traversal vulnerability in digdag server
- CVE-2024-25124 Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials
- CVE-2024-25123 Path Manipulation in file mslib/index.py in MSS
- CVE-2024-25122 Cross-site Scripting sidekiq-unique-jobs UI server vulnerability
- CVE-2024-25121 Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3
- CVE-2024-25120 Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3
- CVE-2024-25119 Information Disclosure of Encryption Key in TYPO3 Install Tool
- CVE-2024-25118 Information Disclosure of Hashed Passwords in TYPO3 Backend Forms
- CVE-2024-25117 php-svg-lib lacks path validation on font through SVG inline styles
- CVE-2024-25116 Specially crafted CF.RESERVE command can lead to denial-of-service
- CVE-2024-25115 RedisBloom heap buffer overflow in CF.LOADCHUNK command
- CVE-2024-25114 Sensitive Information Disclosure (JailID) to users in Collabora Online
- CVE-2024-25112 Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2
- CVE-2024-25111 SQUID-2024:1 Denial of Service in HTTP Chunked Decoding
- CVE-2024-25110 Azure IoT Platform Device SDK Remote Code Execution Vulnerability
- CVE-2024-2511 Unbounded memory growth with session handling in TLSv1.3
- CVE-2024-25109 Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki
- CVE-2024-25108 Insufficient authorization allowing elevated access to resources in pixelfed
- CVE-2024-25107 Cross-Site Scripting in WikiDiscover
- CVE-2024-25106 OpenObserve Unauthorized Access Vulnerability in Users API
- CVE-2024-25103 Dynamic Link Library (DLL) Hijacking Vulnerability in CDAC AppSamvid Software
- CVE-2024-25102 Information Disclosure Vulnerability in CDAC AppSamvid Software
- CVE-2024-25101 WordPress Maspik – Spam blacklist Plugin <= 0.10.6 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-25100 WordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerability
- CVE-2024-25099 WordPress Paytium: Mollie payment forms & donations Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-25098 WordPress PB oEmbed HTML5 Audio Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-25097 WordPress TNC PDF viewer Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-25096 WordPress canto plugin <= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability
- CVE-2024-25095 WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerability
- CVE-2024-25094 WordPress PJ News Ticker Plugin <= 1.9.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-25093 WordPress GD Rating System Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-25092 WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability
- CVE-2024-25091 Security feature bypass in RevoWorks Browser
- CVE-2024-25090 Cross-site scripting in Apache Roller
- CVE-2024-2509 Gutenberg Blocks by Kadence Blocks < 3.2.26 - Contributor+ Stored XSS
- CVE-2024-25089 Code injection in malwarebytes:binisoft windows firewall control
- CVE-2024-25088 Privilege escalation in jungo:windriver
- CVE-2024-25087 Denial of service in jungo:windriver
- CVE-2024-25086 Privilege escalation in jungo:windriver
- CVE-2024-25083 Privilege escalation in beyondtrust:privilege management for windows
- CVE-2024-25082 Command injection in debian:debian linux
- CVE-2024-25081 Command injection in debian:debian linux
- CVE-2024-25080 WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer.
- CVE-2024-2508 WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification
- CVE-2024-25079 Memory corruption in insyde:insydeh2o
- CVE-2024-25078 Memory corruption in insyde:kernel
- CVE-2024-25077 An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices.
- CVE-2024-25076 An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices.
- CVE-2024-25075 An issue was discovered in Softing uaToolkit Embedded before 1.41.1.
- CVE-2024-25074 Null dereference in samsung:exynos 1080 firmware
- CVE-2024-25073 Null dereference in samsung:exynos 1080 firmware
- CVE-2024-2507 JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL
- CVE-2024-25066 XML external entity in Authentication Manager
- CVE-2024-25065 Apache OFBiz: Path traversal allowing authentication bypass.
- CVE-2024-25064 Missing authorization in HikCentral Professional
- CVE-2024-25063 Missing authorization in HikCentral Professional
- CVE-2024-25062 Use after free in xmlsoft:libxml2
- CVE-2024-2506 Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS
- CVE-2024-25053 IBM Cognos Analytics improper certificate validation
- CVE-2024-25052 IBM Jazz Reporting Service information disclosure
- CVE-2024-25051 IBM Jazz Reporting Service insufficient session expiration
- CVE-2024-25050 IBM i privilege escalation
- CVE-2024-2505 GamiPress < 6.8.9 - Broken Access Control
- CVE-2024-25048 IBM MQ code execution
- CVE-2024-25047 IBM Cognos Analytics log injection
- CVE-2024-25046 IBM Db2 for Linux, UNIX and Windows denial of service
- CVE-2024-25042 IBM Cognos Analytics cross-site scripting
- CVE-2024-25041 IBM Cognos Analytics cross-site scripting
- CVE-2024-2504 Cross-site scripting in Page Builder: Pagelayer – Drag and Drop website builder
- CVE-2024-25039 IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities
- CVE-2024-25037 IBM Cognos Controller information disclosure
- CVE-2024-25036 IBM Cognos Controller authentication bypass
- CVE-2024-25035 IBM Cognos Controller information disclosure
- CVE-2024-25034 IBM Planning Analytics file upload
- CVE-2024-25031 IBM Storage Defender information disclosure
- CVE-2024-25030 Information disclosure in Db2 for Linux, UNIX and Windows
- CVE-2024-2503 Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid
- CVE-2024-25029 IBM Personal Communications code execution
- CVE-2024-25027 IBM Security Verify Access Container information disclosure
- CVE-2024-25026 IBM WebSphere Application Server denial of service
- CVE-2024-25024 IBM QRadar Suite Software information disclosure
- CVE-2024-25023 IBM QRadar Suite Software information disclosure
- CVE-2024-25021 IBM AIX command execution
- CVE-2024-25020 IBM Cognos Controller file upload
- CVE-2024-2502 Failure to update the tamper reset cause register when a tamper event occurs
- CVE-2024-25019 IBM Cognos Controller file upload
- CVE-2024-25016 IBM MQ denial of service
- CVE-2024-25015 IBM MQ denial of service
- CVE-2024-25011 Ericsson Catalog Manager and Ericsson Order Care - Exposure of Sensitive Information Vulnerability
- CVE-2024-25010 Ericsson RAN Compute and Site Controller 6610 - Improper Input Validation Vulnerability
- CVE-2024-2501 Hubbub Lite – Fast, Reliable Social Network Sharing Buttons <= 1.33.1 - PHP Object Injection
- CVE-2024-25009 Ericsson Packet Core Controller (PCC) - Improper Input Validation Vulnerability
- CVE-2024-25008 Ericsson RAN Compute and Site Controller 6610 - Improper Input Validation Vulnerability
- CVE-2024-25007 Ericsson Network Manager - Improper Neutralization of Formula Elements Vulnerability
- CVE-2024-25006 Path traversal in xenforo:xenforo