Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 468 of 521.
- CVE-2024-1703 ZhongBangKeJi CRMEB openfile absolute path traversal
- CVE-2024-1702 keerti1924 PHP-MYSQL-User-Login-System edit.php sql injection
- CVE-2024-1701 keerti1924 PHP-MYSQL-User-Login-System edit.php access control
- CVE-2024-1700 keerti1924 PHP-MYSQL-User-Login-System signup.php cross site scripting
- CVE-2024-1698 SQL injection in NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
- CVE-2024-1697 Custom WooCommerce Checkout Fields Editor <= 1.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-1696 Santesoft Sante FFT Imaging Out-of-bounds Write
- CVE-2024-1695 Privilege escalation in HP Application Enabling Software Driver
- CVE-2024-1694 Security feature bypass in Omaha
- CVE-2024-1693 SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update
- CVE-2024-1692 Cross-site scripting in BoldGrid Easy SEO – Simple and Effective SEO
- CVE-2024-1691 Otter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG Upload
- CVE-2024-1690 Missing authorization in Wallet for WooCommerce
- CVE-2024-1689 WooCommerce Tools <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation
- CVE-2024-1688 Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval
- CVE-2024-1687 Missing authorization in Thank You Page Customizer for WooCommerce – Increase Your Sales
- CVE-2024-1686 Missing authorization in Thank You Page Customizer for WooCommerce – Increase Your Sales
- CVE-2024-1685 Social Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection
- CVE-2024-1684 Otter Blocks PRO <= 2.6.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via File Field CSS
- CVE-2024-1683 DLL Injection in Tenable Identity Exposure Secure Relay
- CVE-2024-1682 Unclaimed S3 Bucket Reference in psf/requests Documentation
- CVE-2024-1681 Log Injection Vulnerability in corydolphin/flask-cors
- CVE-2024-1680 Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- CVE-2024-1679 Cross-site scripting in Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce
- CVE-2024-1678 Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API
- CVE-2024-1677 Missing authorization in Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce
- CVE-2024-1676 Security feature bypass in Chrome
- CVE-2024-1675 Security feature bypass in Chrome
- CVE-2024-1674 Security feature bypass in Chrome
- CVE-2024-1673 Use after free in Chrome
- CVE-2024-1672 Security feature bypass in Chrome
- CVE-2024-1671 Security feature bypass in Chrome
- CVE-2024-1670 Use after free in Chrome
- CVE-2024-1669 Memory corruption in Chrome
- CVE-2024-1668 Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries
- CVE-2024-1666 Unauthorized Radar Creation in lunary-ai/lunary
- CVE-2024-1664 Responsive Gallery Grid < 2.3.11 - Admin+ Stored XSS
- CVE-2024-1663 Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS
- CVE-2024-1662 Information Disclosure in Porty's PowerBank
- CVE-2024-1661 Totolink X6000R shadow hard-coded credentials
- CVE-2024-1660 Top Bar < 3.0.5 - Admin+ Stored XSS
- CVE-2024-1659 Arbitrary File Upload in MegaBIP
- CVE-2024-1658 Grid Shortcodes < 1.1.1 - Contributor+ Stored XSS
- CVE-2024-1657 Platform: insecure websocket used when interacting with eda server
- CVE-2024-1656 Misconfiguration in Octopus Server
- CVE-2024-1655 ASUS WiFi Router - OS Command Injection
- CVE-2024-1654 Unauthorized write operations in PaperCut NG/MF
- CVE-2024-1653 Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition
- CVE-2024-1652 Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory
- CVE-2024-1651 Torrentpier 2.4.1 - RCE
- CVE-2024-1650 Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory
- CVE-2024-1649 Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory
- CVE-2024-1648 electron-pdf 20.0.0 - Local File Read via Server Side XSS
- CVE-2024-1647 pyhtml2pdf 0.0.6 - Local File Read via Server Side XSS
- CVE-2024-1646 Authentication Bypass in parisneo/lollms-webui
- CVE-2024-1645 Mollie Forms <= 2.6.3 - Missing Authorization
- CVE-2024-1644 Suite CRM v7.14.2 - RCE via Local File Inclusion
- CVE-2024-1643 Unauthorized Organization Access in lunary-ai/lunary
- CVE-2024-1642 MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk
- CVE-2024-1641 Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication
- CVE-2024-1640 Missing authorization in Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder
- CVE-2024-1639 Missing authorization in License Manager for WooCommerce
- CVE-2024-1638 Bluetooth characteristic LESC security requirement not enforced without additional flags
- CVE-2024-1637 360 Javascript Viewer <= 1.7.12 - Missing Authorization to Plugin Settings Update
- CVE-2024-1636 Potential Cross-Site Scripting (XSS) in the page editing area
- CVE-2024-1635 Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol
- CVE-2024-1634 Missing authorization in Scheduling Plugin – Online Booking for WordPress
- CVE-2024-1633 FIP Header Integer Overflow
- CVE-2024-1632 Incorrect access control in the Sitefinity backend
- CVE-2024-1631 agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`
- CVE-2024-1630 Path traversal in LOGIQ E10
- CVE-2024-1629 Path traversal in LOGIQ E10
- CVE-2024-1628 OS command injection vulnerabilities in GE HealthCare ultrasound devices
- CVE-2024-1626 IDOR Vulnerability in lunary-ai/lunary
- CVE-2024-1625 IDOR Vulnerability in lunary-ai/lunary
- CVE-2024-1624 Command injection in Documentation server
- CVE-2024-1623 Insufficient session timeout vulnerability in Sagemcom router
- CVE-2024-1622 Routinator terminates when RTR connection is reset too quickly after opening
- CVE-2024-1621 uniFLOW Online device registration susceptible to compromise
- CVE-2024-1619 Other in Kaspersky Security for Linux Mail Server 8
- CVE-2024-1618 Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard
- CVE-2024-1610 OPPO Store app include remote account token hijacking and sensitive information leakage
- CVE-2024-1609 OPPO Store APP has a WebView component privilege escalation vulnerability.
- CVE-2024-1608 OPPO Usercenter Credit sdk
- CVE-2024-1606 HTML injection in BMC Control-M
- CVE-2024-1605 DLL side-loading in BMC Control-M
- CVE-2024-1604 Incorrect authorization in BMC Control-M
- CVE-2024-1603 confirmed
- CVE-2024-1602 Stored XSS leading to RCE in parisneo/lollms-webui
- CVE-2024-1601 SQL Injection in parisneo/lollms-webui
- CVE-2024-1600 Local File Inclusion in parisneo/lollms-webui
- CVE-2024-1598 Potential buffer overflow when handling UEFI variables
- CVE-2024-1597 pgjdbc SQL Injection via line comment generation
- CVE-2024-1596 Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload
- CVE-2024-1595 Delta Electronics CNCSoft-B DOPSoft Uncontrolled Search Path Element
- CVE-2024-1594 Local File Read via Path Traversal in mlflow/mlflow
- CVE-2024-1593 Path Traversal via Parameter Smuggling in mlflow/mlflow
- CVE-2024-1592 Complianz – GDPR/CCPA Cookie Consent <= 6.5.6 - Cross-Site Request Forgery to Data Request Deletion
- CVE-2024-1591 Privilege Management for Windows < 24.1 Information Leak
- CVE-2024-1590 Cross-site scripting in Page Builder: Pagelayer – Drag and Drop website builder