Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 428 of 521.
- CVE-2024-24797 WordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object Injection
- CVE-2024-24796 WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object Injection
- CVE-2024-24795 Apache HTTP Server: HTTP Response Splitting in multiple modules
- CVE-2024-24794 Use after free in libdicom
- CVE-2024-24793 Use after free in libdicom
- CVE-2024-24792 Panic when parsing invalid palette-color images in golang.org/x/image
- CVE-2024-24791 Denial of service due to improper 100-continue handling in net/http
- CVE-2024-24790 Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netip
- CVE-2024-2479 MHA Sistemas arMHAzena Cadastro Page cross site scripting
- CVE-2024-24789 Mishandling of corrupt central directory record in archive/zip
- CVE-2024-24788 Malformed DNS message can cause infinite loop in net
- CVE-2024-24787 Arbitrary code execution during build on Darwin in cmd/go
- CVE-2024-24786 Infinite loop in JSON unmarshaling in google.golang.org/protobuf
- CVE-2024-24785 Errors returned from JSON marshaling may break template escaping in html/template
- CVE-2024-24784 Comments in display names are incorrectly handled in net/mail
- CVE-2024-24783 Verify panics on certificates with an unknown public key algorithm in crypto/x509
- CVE-2024-24782 HIMA: Origin Validation Error in multiple products
- CVE-2024-24781 Hima: Uncontrolled Resource Consumption in multiple products
- CVE-2024-24780 Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function
- CVE-2024-2478 BradWenqiang HR Background Management register selectAll sql injection
- CVE-2024-24779 Apache Superset: Improper data authorization when creating a new dataset
- CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation
- CVE-2024-24777 Cross-site request forgery in WBR-6012
- CVE-2024-24776 Incorrect Authorization leads to Channel Member Count Leak
- CVE-2024-24775 BIG-IP TMM vulnerability
- CVE-2024-24774 Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)
- CVE-2024-24773 Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
- CVE-2024-24772 Apache Superset: Improper Neutralisation of custom SQL on embedded context
- CVE-2024-24771 Open Forms potential multi-factor authentication bypass
- CVE-2024-24770 Username timing attack on recover password/MFA token in vantage6
- CVE-2024-2477 wpDiscuz <= 7.6.15 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Alternative Text
- CVE-2024-24769 Vantage6: No limit on emails sent for password/MFA reset
- CVE-2024-24768 1Panel set-cookie is missing the Secure keyword
- CVE-2024-24767 CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability
- CVE-2024-24766 CasaOS Username Enumeration
- CVE-2024-24765 CasaOS-UserService allows unauthorized access to any file
- CVE-2024-24764 October Open Redirect for Administrator Accounts
- CVE-2024-24763 JumpServer Open Redirect Vulnerability
- CVE-2024-24762 python-multipart vulnerable to content-type header Regular expression Denial of Service
- CVE-2024-24761 Galette public pages accessibility restriction
- CVE-2024-24760 Mailcow Docker Container Exposure to Local Network
- CVE-2024-2476 OceanWP <= 3.5.4 - Missing Authorization to Sensitive Information Exposure via Limited Local File Inclusion
- CVE-2024-24759 MindsDB Vulnerable to Bypass of SSRF Protection with DNS Rebinding
- CVE-2024-24758 Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici
- CVE-2024-24757 open-irs .env Exposure
- CVE-2024-24756 Crafatar path traversal vulnerability
- CVE-2024-24755 discourse-group-membership-ip-block is exposing potentially sensitive custom fields
- CVE-2024-24754 Bref Body Parsing Inconsistency in Event-Driven Functions
- CVE-2024-24753 Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2
- CVE-2024-24752 Bref Uploaded Files Not Deleted in Event-Driven Functions
- CVE-2024-24751 Broken Access Control in Backend Module in sf_event_mgt
- CVE-2024-24750 Backpressure request ignored in fetch() in Undici
- CVE-2024-2475 Media Library Assistant <= 3.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_gallery Shortcode
- CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat
- CVE-2024-24748 Disclosure of the existence of secret subcategories in Discourse
- CVE-2024-24747 MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
- CVE-2024-24746 Apache NimBLE: Denial of service in NimBLE Bluetooth stack
- CVE-2024-24743 XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures)
- CVE-2024-24742 Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI)
- CVE-2024-24741 Missing Authorization check in SAP Master Data Governance Material
- CVE-2024-24740 Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel)
- CVE-2024-2474 Standout Color Boxes and Buttons <= 0.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-24739 Missing authorization check in SAP BAM (Bank Account Management)
- CVE-2024-24736 Memory corruption in ypopsemail:ypops\!
- CVE-2024-24731 Silicon Labs Gecko OS http_download Stack-based Buffer Overflow
- CVE-2024-2473 WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
- CVE-2024-24725 Deserialization in gibbonedu:gibbon
- CVE-2024-24724 Code injection in gibbonedu:gibbon
- CVE-2024-24722 Privilege escalation in 12dsynergy:12dsynergy
- CVE-2024-24721 Auth bypass in innovaphone:innovaphone pbx
- CVE-2024-24720 Information disclosure in innovaphone:innovaphone pbx
- CVE-2024-2472 LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR
- CVE-2024-24719 WordPress Kikote plugin <= 1.8.9 - Broken Access Control vulnerability
- CVE-2024-24718 WordPress PropertyHive plugin <= 2.0.6 - Missing Authorization to Non-Arbitrary Plugin Installation vulnerability
- CVE-2024-24717 WordPress Beds24 Online Booking Plugin <= 2.0.23 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-24716 WordPress Awesome Support plugin <= 6.1.6 - Broken Access Control vulnerability
- CVE-2024-24715 WordPress WordPress BookIt Plugin plugin <= 2.4.0 - Price Bypass Vulnerability vulnerability
- CVE-2024-24714 WordPress Icons Font Loader Plugin <= 1.1.4 is vulnerable to Arbitrary File Upload
- CVE-2024-24713 WordPress Auto Listings Plugin <= 2.6.5 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-24712 WordPress Heateor Social Login Plugin <= 1.1.30 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-24711 WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerability
- CVE-2024-24710 WordPress Feed Them Social plugin <= 4.2.0 - Broken Access Control vulnerability
- CVE-2024-2471 FooGallery <= 2.4.14 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attachment Fields
- CVE-2024-24709 WordPress Shareaholic plugin <= 9.7.11 - Broken Access Control vulnerability
- CVE-2024-24708 WordPress W3SPEEDSTER Plugin <= 7.19 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2024-24707 WordPress Cwicly plugin <= 1.4.0.2 - Auth. Remote Code Execution (RCE) vulnerability
- CVE-2024-24706 WordPress WP-CFM Plugin <= 1.7.8 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2024-24705 WordPress Accessibility Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2024-24704 WordPress Load More Anything plugin <= 3.3.3 - Broken Access Control vulnerability
- CVE-2024-24703 WordPress MultiVendorX plugin <= 4.0.25 - Broken Access Control vulnerability
- CVE-2024-24702 WordPress Page Restrict Plugin <= 2.5.5 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2024-24701 WordPress Setka Editor Plugin <= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2024-24700 WordPress WP Editor plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2024-2470 Simple Ajax Chat < 20240412 - Admin+ Stored XSS
- CVE-2024-24699 Zoom Clients - Business Logic Error
- CVE-2024-24698 Zoom Clients - Improper Authentication
- CVE-2024-24697 Zoom Clients - Untrusted Search Path
- CVE-2024-24696 Information disclosure in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows
- CVE-2024-24695 Information disclosure in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows
- CVE-2024-24694 Zoom Desktop Client for Windows - Improper Privilege Management