Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 467 of 521.
- CVE-2024-1807 Product Sort and Display for WooCommerce <= 2.4.1 - Missing Authorization
- CVE-2024-1806 Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2024-1805 WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute
- CVE-2024-1804 Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml
- CVE-2024-1803 Missing authorization in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more
- CVE-2024-1802 Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more
- CVE-2024-1801 Progress Telerik Reporting Local Deserialization Vulnerability
- CVE-2024-1800 Progress Telerik Report Server Deserialization
- CVE-2024-1799 SQL injection in GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress
- CVE-2024-1798 Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml
- CVE-2024-1797 SQL injection in WP ULike – Like & Dislike Buttons for Engagement and Feedback
- CVE-2024-1796 Cross-site scripting in HUSKY – Products Filter Professional for WooCommerce
- CVE-2024-1795 HUSKY – Products Filter for WooCommerce Professional <= 1.3.5.2 - Authenticated (Contributor+) SQL Injection
- CVE-2024-1794 Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload
- CVE-2024-1793 SQL injection in AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth
- CVE-2024-1792 CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-1791 CodeMirror Blocks <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1790 Ajax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read
- CVE-2024-1789 SQL injection in WP SMTP
- CVE-2024-1787 Cross-site scripting in Contests by Rewards Fuel
- CVE-2024-1786 D-Link DIR-600M C1 Telnet Service buffer overflow
- CVE-2024-1785 Contests by Rewards Fuel <= 2.0.62 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-1784 Limbas main_admin.php sql injection
- CVE-2024-1783 Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflow
- CVE-2024-1782 Blue Triad EZAnalytics <= 1.0 - Reflected Cross-Site Scripting via 'bt_webid'
- CVE-2024-1781 Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection
- CVE-2024-1780 BizCalendar Web <= 1.1.0.25 - Reflected Cross-Site Scripting via 'tab'
- CVE-2024-1779 Missing authorization in Admin side data storage for Contact Form 7
- CVE-2024-1778 Missing authorization in Admin side data storage for Contact Form 7
- CVE-2024-1777 Admin side data storage for Contact Form 7 <= 1.1.1 - Cross-Site Request Forgery
- CVE-2024-1776 Admin side data storage for Contact Form 7 <= 1.1.1 - Authenticated (Admin+) SQL Injection
- CVE-2024-1775 Nextend Social Login and Register <= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_description
- CVE-2024-1774 Customily Product Personalizer <= 1.23.3 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-1773 PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection
- CVE-2024-1772 Deserialization in Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio
- CVE-2024-1771 Total <= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Update
- CVE-2024-1770 Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection
- CVE-2024-1769 JM Twitter Cards <= 14 - Information Exposure via Meta Description
- CVE-2024-1768 Clever Fox <= 25.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1767 Blocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1766 Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
- CVE-2024-1765 Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche
- CVE-2024-1764 Privilege escalation in Server
- CVE-2024-1763 Missing authorization in Wp Social Login and Register Social Counter
- CVE-2024-1762 NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent
- CVE-2024-1761 WP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
- CVE-2024-1760 Cross-site request forgery in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin
- CVE-2024-1759 WP ULike <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-1758 SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
- CVE-2024-1756 WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure
- CVE-2024-1755 NPS computy <= 2.7.5 - Results Deletion via CSRF
- CVE-2024-1754 NPS computy <= 2.7.5 - Admin+ Stored XSS
- CVE-2024-1753 Buildah: buildah: container escape via improper bind mount validation
- CVE-2024-1752 Font Farsi <= 1.6.6 - Admin+ Stored XSS in Settings
- CVE-2024-1751 Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-1750 TemmokuMVC Image Download images_get_down.php img_replace deserialization
- CVE-2024-1749 Bdtask Bhojon Best Restaurant Management Software Message Page message cross site scripting
- CVE-2024-1748 van_der_Schaar LAB AutoPrognosis Release Note load_model_from_file deserialization
- CVE-2024-1747 WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS
- CVE-2024-1746 Testimonial Slider < 2.3.8 - Admin+ Stored XSS
- CVE-2024-1745 Testimonial Slider < 2.3.7 - Author+ Settings Update
- CVE-2024-1744 IDOR in Ariva Computer's Accord ORS
- CVE-2024-1743 WooCommerce Customers Manager < 29.8 - Reflected XSS
- CVE-2024-1742 Information disclosure in mk_oracle Checkmk agent plugin
- CVE-2024-1741 Improper Authorization in lunary-ai/lunary
- CVE-2024-1740 Incorrect Authorization in lunary-ai/lunary
- CVE-2024-1739 Case Insensitive Email Address Validation Vulnerability in lunary-ai/lunary
- CVE-2024-1738 Incorrect Authorization in lunary-ai/lunary
- CVE-2024-1737 BIND's database will be slow if a very large number of RRs exist at the same name
- CVE-2024-1736 Uncontrolled Resource Consumption in GitLab
- CVE-2024-1735 Armeria SAML authentication bypass due to missing validation on unsigned SAML messages
- CVE-2024-1733 Word Replacer Pro <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update
- CVE-2024-1732 Missing authorization in Sharkdropship & affiliate for AliExpress
- CVE-2024-1731 Auto Refresh Single Page <= 1.1 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-1730 Cross-site scripting in Prime Slider – Addons for Elementor
- CVE-2024-1729 Timing Attack Vulnerability in gradio-app/gradio
- CVE-2024-1728 Local File Inclusion in gradio-app/gradio
- CVE-2024-1727 CSRF Vulnerability in gradio-app/gradio
- CVE-2024-1726 Quarkus: security checks in resteasy reactive may trigger a denial of service
- CVE-2024-1725 Kubevirt-csi: persistentvolume allows access to hcp's root node
- CVE-2024-1724 snapd allows $HOME/bin symlink
- CVE-2024-1723 SiteOrigin Widgets Bundle <= 1.58.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1722 Keycloak-core: dos via account lockout
- CVE-2024-1721 Security feature bypass in Passwordless
- CVE-2024-1720 Cross-site scripting in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
- CVE-2024-1719 Cross-site request forgery in Contact Form 7 – PayPal & Stripe Add-on
- CVE-2024-1718 Business logic in Claudio Sanches – Checkout Cielo for WooCommerce
- CVE-2024-1717 Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
- CVE-2024-1716 Admin Bar Remover <= 1.0.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- CVE-2024-1714 Access Request for Entitlement Values with Leading/Trailing Whitespace
- CVE-2024-1713 Plv8 Deferred Trigger Privilege Escalation
- CVE-2024-1712 Carousel Slider < 2.2.7 - Editor+ Stored XSS
- CVE-2024-1711 Create by Mediavine <= 1.9.4 - Unauthenticated SQL Injection via 'id'
- CVE-2024-1710 Addon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-1709 ConnectWise ScreenConnect Authentication Bypass
- CVE-2024-1708 ConnectWise ScreenConnect Path Traversal
- CVE-2024-1707 GARO WALLBOX GLB+ T2EV7 Software Update index.jsp#settings cross site scripting
- CVE-2024-1706 ZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting
- CVE-2024-1705 Shopwind Installation DefaultController.php actionCreate code injection
- CVE-2024-1704 ZhongBangKeJi CRMEB crud delete path traversal