Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 441 of 521.
- CVE-2024-22938 Privilege escalation in bosscms:bosscms
- CVE-2024-22936 Cross-site scripting in manuelaldape:parents \& student portal
- CVE-2024-2293 Site Reviews <= 6.11.4 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name
- CVE-2024-22927 Cross-site scripting in eyoucms:eyoucms
- CVE-2024-22923 SQL injection in advradius:adv radius
- CVE-2024-22922 Privilege escalation in projectworlds:visitor management system
- CVE-2024-22920 Use after free in swftools:swftools
- CVE-2024-2292 Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data
- CVE-2024-22919 Memory corruption in swftools:swftools
- CVE-2024-22917 SQL injection in lopalopa:dynamic lab management system
- CVE-2024-22916 Memory corruption in dlink:go-rt-ac750 firmware
- CVE-2024-22915 Use after free in swftools:swftools
- CVE-2024-22914 Use after free in swftools:swftools
- CVE-2024-22913 Memory corruption in swftools:swftools
- CVE-2024-22912 Memory corruption in swftools:swftools
- CVE-2024-22911 Memory corruption in swftools:swftools
- CVE-2024-22910 Cross-site scripting in crushftp:crushftp
- CVE-2024-2291 MOVEit Transfer Logging Bypass Vulnerability
- CVE-2024-22905 Memory corruption in arm:mbed os
- CVE-2024-22903 Command injection in vinchin:vinchin backup and recovery
- CVE-2024-22902 Hardcoded credentials in vinchin:vinchin backup and recovery
- CVE-2024-22901 Hardcoded credentials in vinchin:vinchin backup and recovery
- CVE-2024-22900 Command injection in vinchin:vinchin backup and recovery
- CVE-2024-2290 Advanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Admin+) PHP Object Injection
- CVE-2024-22899 Code injection in vinchin:vinchin backup and recovery
- CVE-2024-22895 File upload in dedecms:dedecms
- CVE-2024-22894 Weak cryptography in alpha-innotec:heat pumps firmware
- CVE-2024-22893 Information disclosure in openslides:openslides
- CVE-2024-22892 Weak cryptography in openslides:openslides
- CVE-2024-22891 Nteract Remote Code Execution vulnerability
- CVE-2024-2289 PowerPack Lite for Beaver Builder <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element link
- CVE-2024-22889 Phone information disclosure vulnerability
- CVE-2024-22880 Cross-site scripting in zadarma:zadarma
- CVE-2024-2288 CSRF File Upload Vulnerability in parisneo/lollms-webui
- CVE-2024-22877 Cross-site scripting in strangebee:thehive
- CVE-2024-22876 Cross-site scripting in strangebee:thehive
- CVE-2024-22873 Server-side request forgery in tencent:blueking configuration management database
- CVE-2024-22871 Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service
- CVE-2024-2287 Knight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-22862 Integer overflow in ffmpeg:ffmpeg
- CVE-2024-22861 Integer overflow in ffmpeg:ffmpeg
- CVE-2024-22860 Integer overflow in ffmpeg:ffmpeg
- CVE-2024-2286 Sky Addons for Elementor <= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL
- CVE-2024-22859 Cross-site request forgery in laravel:livewire
- CVE-2024-22857 Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog_rule_new().The size of record_name is MAXLEN_PATH(1024) + 1 but file_path may have
- CVE-2024-22856 A SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal >= v.3.0 allows authenticated attackers
- CVE-2024-22855 Cross-site scripting in itssglobal:imlog
- CVE-2024-22854 Cross-site scripting in darktrace:threat visualizer
- CVE-2024-22853 Hardcoded credentials in dlink:go-rt-ac750 firmware
- CVE-2024-22852 Memory corruption in dlink:go-rt-ac750 firmware
- CVE-2024-22851 Path traversal in liveconfig:liveconfig
- CVE-2024-2285 boyiddha Automated-Mess-Management-System member_edit.php cross site scripting
- CVE-2024-2284 boyiddha Automated-Mess-Management-System Chat Book chat.php cross site scripting
- CVE-2024-22836 Command injection in akaunting:akaunting
- CVE-2024-22830 Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources.
- CVE-2024-2283 boyiddha Automated-Mess-Management-System view.php sql injection
- CVE-2024-22824 File upload in auntvt:timo
- CVE-2024-2282 boyiddha Automated-Mess-Management-System Login Page index.php sql injection
- CVE-2024-22819 Cross-site request forgery in flycms project:flycms
- CVE-2024-22818 Cross-site request forgery in flycms project:flycms
- CVE-2024-22817 Cross-site request forgery in flycms project:flycms
- CVE-2024-22815 Denial of service in tormach:pathpilot controller
- CVE-2024-22813 Hardcoded credentials in tormach:pathpilot controller
- CVE-2024-22811 Denial of service in tormach:pathpilot controller
- CVE-2024-2281 boyiddha Automated-Mess-Management-System Setting index.php access control
- CVE-2024-22809 Missing authorization in tormach:pathpilot controller
- CVE-2024-22808 Denial of service in tormach:pathpilot controller
- CVE-2024-22807 Missing authorization in tormach:pathpilot controller
- CVE-2024-2280 Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links
- CVE-2024-22795 Privilege escalation in forescout:secureconnector
- CVE-2024-2279 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2024-22780 CA17 TeamsACS Cross Site Scripting vulnerability
- CVE-2024-2278 WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSS
- CVE-2024-22779 Path traversal in kihron:serverrpexposer
- CVE-2024-22778 Denial of service in hackmd:codimd
- CVE-2024-22776 Cross-site scripting in wallosapp:wallos
- CVE-2024-22774 An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges via the ccsservice.exe component.
- CVE-2024-22773 Auth bypass in intelbras:action rf 1200 firmware
- CVE-2024-22772 Hitron Systems DVR LGUVR-8H Improper Input Validation Vulnerability
- CVE-2024-22771 Hitron Systems DVR LGUVR-4H Improper Input Validation Vulnerability
- CVE-2024-22770 Hitron Systems DVR HVR-16781 Improper Input Validation Vulnerability
- CVE-2024-2277 Cross-site request forgery in G-Prescription Gynaecology & OBS Consultation Software
- CVE-2024-22769 Hitron Systems DVR HVR-8781 Improper Input Validation Vulnerability
- CVE-2024-22768 Hitron Systems DVR HVR-4781 Improper Input Validation Vulnerability
- CVE-2024-2276 Bdtask G-Prescription Gynaecology & OBS Consultation Software Edit Venue Page cross site scripting
- CVE-2024-22752 Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable
- CVE-2024-22751 Memory corruption in dlink:dir-882 a1 firmware
- CVE-2024-2275 Bdtask G-Prescription Gynaecology & OBS Consultation Software OBS Patient/Gynee Prescription cross site scripting
- CVE-2024-22749 Memory corruption in gpac:gpac
- CVE-2024-2274 Bdtask G-Prescription Gynaecology & OBS Consultation Software Prescription Dashboard Index cross site scripting
- CVE-2024-22734 Hardcoded credentials in amcsgroup:trux waste management
- CVE-2024-22733 Null dereference in tp-link:mr200 firmware
- CVE-2024-2273 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-22729 Command injection in netis-systems:mw5360 firmware
- CVE-2024-22727 Other in teltonika:trb140 firmware
- CVE-2024-22725 Cross-site scripting in orthanc-server:orthanc
- CVE-2024-22724 File upload in oscommerce:oscommerce
- CVE-2024-22723 Webtrees Path Traversal vulnerability
- CVE-2024-22722 Code injection in formtools:form tools
- CVE-2024-22721 Cross-site request forgery in formtools:form tools