Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 429 of 521.
- CVE-2024-24693 Zoom Rooms Client for Windows - Improper Access Control
- CVE-2024-24692 Zoom Rooms Client for Windows - Race Condition
- CVE-2024-24691 Privilege escalation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows
- CVE-2024-24690 Zoom Clients - Improper Input Validation
- CVE-2024-2469 Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance
- CVE-2024-24686 Memory corruption in libigl
- CVE-2024-24685 Memory corruption in libigl
- CVE-2024-24684 Memory corruption in libigl
- CVE-2024-24683 Apache Hop Engine: ID isn't escaped when generating HTML
- CVE-2024-24681 Hardcoded credentials in yealink:configuration encryption tool
- CVE-2024-24680 Django denial-of-service attack in the intcomma template filter
- CVE-2024-2468 EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute
- CVE-2024-2467 Perl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack)
- CVE-2024-2466 TLS certificate check bypass with mbedTLS
- CVE-2024-2465 Open redirection in CDeX
- CVE-2024-2464 Application users enumeration in CDeX
- CVE-2024-2463 Weak password recovery mechanism in CDeX
- CVE-2024-24623 Softaculous Webuzo FTP Management Command Injection
- CVE-2024-24622 Softaculous Webuzo Password Reset Command Injection
- CVE-2024-24621 Softaculous Webuzo Authentication Bypass
- CVE-2024-2462 Weak cryptography in ECST
- CVE-2024-2461 Path traversal in FOX61x
- CVE-2024-2460 GamiPress – Button <= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-24595 Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance
- CVE-2024-24594 Cross-site scripting in ClearML
- CVE-2024-24593 Cross-site request forgery in ClearML
- CVE-2024-24592 Auth bypass in ClearML
- CVE-2024-24591 Allegro AI ClearML path traversal vulnerability
- CVE-2024-24590 Allegro AI ClearML vulnerable to deserialization of untrusted data
- CVE-2024-2459 UX Flat <= 4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-24584 Memory corruption in libigl
- CVE-2024-24583 Memory corruption in libigl
- CVE-2024-24582 Privilege escalation in Intel(R) processors
- CVE-2024-24581 Arkcompiler runtime has an out-of-bounds write vulnerability
- CVE-2024-24580 Denial of service in Intel(R) Data Center GPU Max Series 1100 and 1550 products
- CVE-2024-2458 Cross-site scripting in Powerkit – Supercharge your WordPress Site
- CVE-2024-24579 Tar path traversal in stereoscope when processing OCI tar archives
- CVE-2024-24578 RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload
- CVE-2024-24577 libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`
- CVE-2024-24576 Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows
- CVE-2024-24575 libgit2 is vulnerable to a denial of service attack in `git_revparse_single`
- CVE-2024-24574 phpMyFAQ vulnerable to stored XSS on attachments filename
- CVE-2024-24573 facileManager Privilege Escalation via Mass Assignment
- CVE-2024-24572 facileManager Authenticated Variable Manipulation leading to SQL Injection
- CVE-2024-24571 facileManager Systemic Cross-Site Scripting (XSS)
- CVE-2024-24570 Statamic account takeover via XSS and password reset link
- CVE-2024-2457 Cross-site scripting in Modal Window – create popup modal window
- CVE-2024-24569 `ZipSecurity#isBelowCurrentDirectory` is vulnerable to partial-path traversal vulnerability
- CVE-2024-24568 Suricata http2: header handling evasion
- CVE-2024-24567 raw_call `value=` kwargs not disabled for static and delegate calls
- CVE-2024-24566 Lobe Chat unauthorized access to plugins
- CVE-2024-24565 CrateDB database has an arbitrary file read vulnerability
- CVE-2024-24564 Vyper extract32 can ready dirty memory
- CVE-2024-24563 Vyper array negative index vulnerability
- CVE-2024-24562 Security headers not set in vantage6-UI
- CVE-2024-24561 Vyper bounds check on built-in `slice()` function can be overflowed
- CVE-2024-24560 Vyper external calls can overflow return data to return input buffer
- CVE-2024-2456 Ecwid Ecommerce Shopping Cart <= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-24559 Vyper SHA3 code generation bug
- CVE-2024-24558 react-query-streamed-hydration xss
- CVE-2024-24557 Moby classic builder cache poisoning
- CVE-2024-24556 XSS in @urql/next
- CVE-2024-24554 Bludit - Insecure Token Generation
- CVE-2024-24553 Bludit uses SHA1 as Password Hashing Algorithm
- CVE-2024-24552 Bludit is Vulnerable to Session Fixation
- CVE-2024-24551 Bludit - Remote Code Execution (RCE) through Image API
- CVE-2024-24550 Bludit - Remote Code Execution (RCE) through File API
- CVE-2024-2455 Cross-site scripting in Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin
- CVE-2024-24549 Apache Tomcat: HTTP/2 header handling DoS
- CVE-2024-24548 Information disclosure in Payment EX
- CVE-2024-24543 Memory corruption in tenda:ac9 firmware
- CVE-2024-2454 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2024-24539 Auth bypass in fusionpbx:fusionpbx
- CVE-2024-2453 Advantech WebAccess/SCADA SQL Injection
- CVE-2024-24525 Code injection in epoint:epointwebbuilder
- CVE-2024-24524 Cross-site request forgery in flusity:flusity
- CVE-2024-24520 Code injection in lepton-cms:leptoncms
- CVE-2024-2452 Integer wraparound, under-allocation, and heap buffer overflow in Eclipse ThreadX NetX Duo __portable_aligned_alloc()
- CVE-2024-24512 Cross-site scripting in pkp.sfu:open journal systems
- CVE-2024-24511 Cross-site scripting in pkp.sfu:open journal systems
- CVE-2024-24510 Cross-site scripting in alinto:sogo
- CVE-2024-2451 Improper fingerprint validation in the TeamViewer Client
- CVE-2024-24507 Cross-site scripting in act-on:act-on
- CVE-2024-24506 Cross-site scripting in limesurvey:limesurvey
- CVE-2024-2450 Auth bypass in Mattermost
- CVE-2024-24496 Missing authorization in remyandrade:daily habit tracker
- CVE-2024-24495 SQL injection in remyandrade:daily habit tracker
- CVE-2024-24494 Cross-site scripting in remyandrade:daily habit tracker
- CVE-2024-2449 LoadMaster Cross-Site Request Forgery (CSRF)
- CVE-2024-24488 Information disclosure in tendacn:cp3 firmware
- CVE-2024-24487 Denial of service in silextechnology:ds-600 firmware
- CVE-2024-24486 Missing authorization in silextechnology:ds-600 firmware
- CVE-2024-24485 Information disclosure in silextechnology:ds-600 firmware
- CVE-2024-24482 Path traversal in apktool:apktool
- CVE-2024-2448 LoadMaster Command Injection Vulnerability
- CVE-2024-24479 Memory corruption in fedoraproject:fedora
- CVE-2024-24478 Denial of service in wireshark:wireshark
- CVE-2024-24476 Memory corruption in fedoraproject:fedora
- CVE-2024-24474 Integer overflow in qemu:qemu
- CVE-2024-24470 Cross-site request forgery in flusity:flusity