Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 430 of 521.
- CVE-2024-2447 Mattermost fails to authenticate the source of certain types of post actions
- CVE-2024-24469 Cross-site request forgery in flusity:flusity
- CVE-2024-24468 Cross-site request forgery in flusity:flusity
- CVE-2024-2446 Denial of service in Mattermost
- CVE-2024-24459 Memory corruption in HPE Athonet Core
- CVE-2024-24458 Memory corruption in HPE Athonet Core
- CVE-2024-24457 Memory corruption in HPE Athonet Core
- CVE-2024-24456 Memory corruption in HPE Athonet Core
- CVE-2024-24455 Memory corruption in HPE Athonet Core
- CVE-2024-24454 Memory corruption in HPE Athonet Core
- CVE-2024-24453 Memory corruption in HPE Athonet Core
- CVE-2024-24452 Memory corruption in HPE Athonet Core
- CVE-2024-24451 A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attacker
- CVE-2024-24450 Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allo
- CVE-2024-2445 Reflected XSS in Mattermost Jira plugin
- CVE-2024-24449 An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a D
- CVE-2024-24447 A buffer overflow in the ngap_amf_handle_pdu_session_resource_setup_response function of oai-cn5g-amf up to v2.0.0 allows attackers to cause
- CVE-2024-24446 An uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a cra
- CVE-2024-24445 OpenAirInterface CN5G AMF (oai-cn5g-amf) <= 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which al
- CVE-2024-24444 Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause
- CVE-2024-24443 An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-a
- CVE-2024-24442 A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers
- CVE-2024-2444 Inline Related Posts < 3.5.0 - Admin+ Stored XSS
- CVE-2024-24432 Denial of service in open5gs:open5gs
- CVE-2024-24431 Denial of service in open5gs:open5gs
- CVE-2024-24430 Denial of service in open5gs:open5gs
- CVE-2024-2443 Command injection in GitHub Enterprise Server
- CVE-2024-24429 Denial of service in open5gs:open5gs
- CVE-2024-24428 Denial of service in open5gs:open5gs
- CVE-2024-24427 Denial of service in open5gs:open5gs
- CVE-2024-24426 Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attacke
- CVE-2024-24425 Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp.
- CVE-2024-24424 A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2
- CVE-2024-24423 Memory corruption in linuxfoundation:magma
- CVE-2024-24422 Memory corruption in linuxfoundation:magma
- CVE-2024-24421 Memory corruption in linuxfoundation:magma
- CVE-2024-24420 Denial of service in linuxfoundation:magma
- CVE-2024-2442 Path Traversal vulnerability in Franklin Fueling System EVO 550/5000
- CVE-2024-24419 Memory corruption in linuxfoundation:magma
- CVE-2024-24418 Memory corruption in linuxfoundation:magma
- CVE-2024-24417 Memory corruption in linuxfoundation:magma
- CVE-2024-24416 Memory corruption in linuxfoundation:magma
- CVE-2024-2441 VikBooking < 1.6.8 - Insecure Direct Object References
- CVE-2024-24409 Privilege Escalation
- CVE-2024-24407 SQL injection in mayurik:best courier management system
- CVE-2024-24402 Privilege escalation in nagios:nagios xi
- CVE-2024-24401 SQL injection in nagios:nagios xi
- CVE-2024-2440 Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions
- CVE-2024-24399 File upload in lepton-cms:leptoncms
- CVE-2024-24398 Stimulsoft Dashboard.JS directory traversal vulnerability
- CVE-2024-24397 Stimulsoft Dashboard.JS Cross Site Scripting vulnerability
- CVE-2024-24396 Stimulsoft Dashboard.JS Cross Site Scripting vulnerability
- CVE-2024-24393 File upload in oaooa:pichome
- CVE-2024-2439 Salon booking system <= 9.6.5 - Editor+ Stored XSS
- CVE-2024-24389 Cross-site scripting in xunruicms:xunruicms
- CVE-2024-24388 Cross-site scripting in xunruicms:xunruicms
- CVE-2024-24386 Code injection in vitalpbx:vitalpbx
- CVE-2024-24377 Command injection in idocv:idocview
- CVE-2024-24375 SQL injection in jfinalcms project:jfinalcms
- CVE-2024-2436 Lightweight Accordion <= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-24350 File upload in softwarepublico:e-sic livre
- CVE-2024-2435 Stored XSS in Timeline View
- CVE-2024-2434 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
- CVE-2024-24337 Code injection in koha:koha
- CVE-2024-24336 A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Li
- CVE-2024-24335 Memory corruption in rt-thread:rt-thread
- CVE-2024-24334 Memory corruption in rt-thread:rt-thread
- CVE-2024-24333 Command injection in totolink:a3300r firmware
- CVE-2024-24332 Command injection in totolink:a3300r firmware
- CVE-2024-24331 Command injection in totolink:a3300r firmware
- CVE-2024-24330 Command injection in totolink:a3300r firmware
- CVE-2024-2433 PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss
- CVE-2024-24329 Command injection in totolink:a3300r firmware
- CVE-2024-24328 Command injection in totolink:a3300r firmware
- CVE-2024-24327 Command injection in totolink:a3300r firmware
- CVE-2024-24326 Command injection in totolink:a3300r firmware
- CVE-2024-24325 Command injection in totolink:a3300r firmware
- CVE-2024-24324 Hardcoded credentials in totolink:a8000ru firmware
- CVE-2024-24323 SQL injection in linlinjava:litemall
- CVE-2024-24321 Command injection in dlink:dir-816 firmware
- CVE-2024-24320 Path traversal in mgt-commerce:cloudpanel
- CVE-2024-2432 GlobalProtect App: Local Privilege Escalation (PE) Vulnerability
- CVE-2024-24313 An issue in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/FormModel.php and
- CVE-2024-24312 SQL injection vulnerability in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Model
- CVE-2024-24311 Path traversal in lineagrafica:multilingual and multistore sitemap pro
- CVE-2024-24310 SQL injection in ethercreation:generate barcode on invoice \/ delivery slip
- CVE-2024-2431 GlobalProtect App: Local User Can Disable GlobalProtect
- CVE-2024-24309 Missing authorization in ecomiz:survey tma
- CVE-2024-24308 SQL injection in boostmyshop:boostmyshop
- CVE-2024-24307 Path traversal in prestalife:product designer
- CVE-2024-24304 Missing authorization in sinch:mailjet
- CVE-2024-24303 SQL injection in hipresta:gift wrapping pro
- CVE-2024-24302 Deserialization in prestalife:product designer
- CVE-2024-24301 Command injection in 4ipnet:eap-767 firmware
- CVE-2024-24300 Hardcoded credentials in 4ipnet:eap-767 firmware
- CVE-2024-2430 Website Content in Page or Post < 2024.04.09 - Contributor+ Stored Cross-Site Scripting
- CVE-2024-24294 Blackprint @blackprint/engine Prototype Pollution issue
- CVE-2024-24293 MiguelCastillo @bit/loader Prototype Pollution issue
- CVE-2024-24292 Code injection in aliconnect:software development kit
- CVE-2024-24291 Open redirect in yzmcms:yzmcms