Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 445 of 521.
- CVE-2024-22267 Use after free in VMware Fusion
- CVE-2024-22266 VMware Avi Load Balancer updates address multiple vulnerabilities
- CVE-2024-22264 VMware Avi Load Balancer updates address multiple vulnerabilities
- CVE-2024-22263 Arbitrary File Write Vulnerability in Spring Cloud Data Flow
- CVE-2024-22262 CVE-2024-22262: Spring Framework URL Parsing with Host Validation
- CVE-2024-22261 SQL Injection in Harbor scan log API
- CVE-2024-22260 Information disclosure in VMware Workspace One UEM
- CVE-2024-2226 Cross-site scripting in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
- CVE-2024-22259 CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report)
- CVE-2024-22258 CVE-2024-22258: PKCE Downgrade in Spring Authorization Server
- CVE-2024-22257 Erroneous authentication pass in Spring Security
- CVE-2024-22256 Information disclosure in VMware Cloud Director
- CVE-2024-22255 Information disclosure vulnerability
- CVE-2024-22254 Out-of-bounds write vulnerability
- CVE-2024-22253 Use-after-free vulnerability
- CVE-2024-22252 Use-after-free vulnerability
- CVE-2024-22251 Out-of-bounds read vulnerability
- CVE-2024-22250 Session Hijack Vulnerability in Deprecated EAP Browser Plugin
- CVE-2024-22248 Open redirect in VMware SD-WAN Orchestrator
- CVE-2024-22247 Auth bypass in VMware SD-WAN Edge
- CVE-2024-22246 Command injection in VMware SD-WAN Edge
- CVE-2024-22245 Arbitrary Authentication Relay Vulnerability in Deprecated EAP Browser Plugin
- CVE-2024-22244 Harbor Open Redirect URL
- CVE-2024-22243 CVE-2024-22243: Spring Framework URL Parsing with Host Validation
- CVE-2024-22241 Cross-site scripting in VMware Aria Operations for Networks
- CVE-2024-22240 Information disclosure in VMware Aria Operations for Networks
- CVE-2024-2224 Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466)
- CVE-2024-22239 Privilege escalation in VMware Aria Operations for Networks
- CVE-2024-22238 Cross-site scripting in VMware Aria Operations for Networks
- CVE-2024-22237 Privilege escalation in VMware Aria Operations for Networks
- CVE-2024-22236 Spring Cloud Contract vulnerable to local information disclosure
- CVE-2024-22235 Privilege escalation in VMware Aria Operations
- CVE-2024-22234 CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated
- CVE-2024-22233 CVE-2024-22233: Spring Framework server Web DoS Vulnerability
- CVE-2024-22232 Specially crafted url can be created which leads to a directory traversal in the salt file server
- CVE-2024-22231 Syndic cache directory creation is vulnerable to a directory traversal attack
- CVE-2024-22230 Cross-site scripting in Unity
- CVE-2024-2223 Incorrect Regular Expression in GravityZone Update Server (VA-11465)
- CVE-2024-22229 Other in Unity
- CVE-2024-22228 Command injection in Unity
- CVE-2024-22227 Command injection in Unity
- CVE-2024-22226 Path traversal in Unity
- CVE-2024-22225 Command injection in Unity
- CVE-2024-22224 Command injection in Unity
- CVE-2024-22223 Command injection in Unity
- CVE-2024-22222 Command injection in Unity
- CVE-2024-22221 SQL injection in Unity
- CVE-2024-22220 Cross-site scripting in terminalfour:formbank
- CVE-2024-2222 Advanced Classifieds & Directory Pro <= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletion
- CVE-2024-22219 XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users
- CVE-2024-22218 XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users
- CVE-2024-22217 Server-side request forgery in terminalfour:terminalfour
- CVE-2024-22216 Missing authorization in microchip:maxview storage manager
- CVE-2024-22213 Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app
- CVE-2024-22212 Nextcloud global site selector authentication bypass
- CVE-2024-22211 FreeRDP integer Overflow leading to Heap Overflow
- CVE-2024-2221 Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant
- CVE-2024-22209 XBlock custom auth does not respect JWT Scopes
- CVE-2024-22208 phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes
- CVE-2024-22207 Default swagger-ui configuration exposes all files in the module
- CVE-2024-22206 @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
- CVE-2024-22205 Whoogle Search Server Side Request Forgery vulnerability
- CVE-2024-22204 Whoogle Search Limited File Write vulnerability
- CVE-2024-22203 Whoogle Search Server Side Request Forgery vulnerability
- CVE-2024-22202 User Removal Page Allows Spoofing Of User Details
- CVE-2024-22201 Jetty connection leaking on idle timeout when TCP congested
- CVE-2024-22200 vantage6-UI docker image leaks software version information
- CVE-2024-2220 Button contact VR <= 4.7 - Admin+ Stored XSS
- CVE-2024-22199 Django Template Engine Vulnerable to XSS
- CVE-2024-22198 Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)
- CVE-2024-22197 Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)
- CVE-2024-22196 Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)
- CVE-2024-22195 Jinja vulnerable to Cross-Site Scripting (XSS)
- CVE-2024-22194 cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code
- CVE-2024-22193 vantage6 unencrypted task can be created in encrypted collaboration
- CVE-2024-22192 Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders
- CVE-2024-22191 Stored cross-site scripting (XSS) in `key_value` field in Avo
- CVE-2024-22190 Untrusted search path under some conditions on Windows allows arbitrary code execution
- CVE-2024-22189 QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack
- CVE-2024-22188 TYPO3 Install Tool vulnerable to Code Execution
- CVE-2024-22187 Memory corruption in P3-550E
- CVE-2024-22186 Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking
- CVE-2024-22185 Race condition in Intel(R) processors with Intel(R) ACTM
- CVE-2024-22184 Privilege escalation in Intel(R) Quartus(R) Prime Pro Edition Design Software
- CVE-2024-22182 Commend WS203VICM Argument Injection
- CVE-2024-22181 Memory corruption in libigl
- CVE-2024-22180 Camera has a use after free vulnerability
- CVE-2024-2218 LuckyWP Table of Contents <= 2.1.4 - Admin+ Stored XSS
- CVE-2024-22179 Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data
- CVE-2024-22178 Path traversal in OAS Platform
- CVE-2024-22177 Audio has an improper preservation of permissions vulnerability
- CVE-2024-22170 Unchecked buffer in Dynamic DNS client
- CVE-2024-2217 Improper Access Control in gaizhenbiao/chuanhuchatgpt
- CVE-2024-22169 Misconfiguration in node.js causing a code execution in WD Discovery
- CVE-2024-22168 Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps
- CVE-2024-22167 SanDisk PrivateAccess DLL Hijacking Vulnerability
- CVE-2024-22165 Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creation
- CVE-2024-22164 Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachments
- CVE-2024-22163 WordPress Shield Security Plugin <= 18.5.7 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-22162 WordPress WPZOOM Shortcodes Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)