Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 469 of 521.
- CVE-2024-1589 SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Form Settings
- CVE-2024-1588 SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Settings
- CVE-2024-1587 Newsmatic <= 1.3.4 - Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content
- CVE-2024-1586 Schema & Structured Data for WP & AMP <= 1.26 - Authenticated (Custom) Stored Cross-Site Scripting
- CVE-2024-1585 Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-1584 Analytify <= 5.2.1 - Missing Authorization to Unauthenticated Google Analytics Tracking ID Modification
- CVE-2024-1582 WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-1580 Integer overflow in VideoLAN dav1d
- CVE-2024-1579 Insufficient seeding of random number generator
- CVE-2024-1578 Multiple MiCard PLUS card reader dropped characters
- CVE-2024-1577 Remote Code Execution in MegaBIP
- CVE-2024-1576 SQL Injection in MegaBIP
- CVE-2024-1575 Privilege escalation in WBE660S firmware
- CVE-2024-1574 Privilege escalation in AnalytiX
- CVE-2024-1573 Auth bypass in AnalytiX
- CVE-2024-1572 WP ULike <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-1571 WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed
- CVE-2024-1570 ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-1569 Uncontrolled Resource Consumption in parisneo/lollms-webui
- CVE-2024-1568 Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck
- CVE-2024-1567 Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload
- CVE-2024-1566 Redirects <= 1.2.1 - Missing Authorization via save
- CVE-2024-1565 EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL
- CVE-2024-1564 Schema Pro < 2.7.16 - Contributor+ Custom Field Access
- CVE-2024-1563 Race condition in Focus for iOS
- CVE-2024-1562 WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization
- CVE-2024-1561 Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio
- CVE-2024-1560 Path Traversal Vulnerability in mlflow/mlflow
- CVE-2024-1559 Link Library <= 7.6 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-1558 Path Traversal Vulnerability in mlflow/mlflow
- CVE-2024-1557 Memory corruption in Firefox
- CVE-2024-1556 Null dereference in Firefox
- CVE-2024-1555 Security feature bypass in Firefox
- CVE-2024-1554 Security feature bypass in Firefox
- CVE-2024-1553 Memory corruption in Firefox
- CVE-2024-1552 Memory corruption in Firefox
- CVE-2024-1551 Security feature bypass in Firefox
- CVE-2024-1550 Security feature bypass in Firefox
- CVE-2024-1549 Security feature bypass in Firefox
- CVE-2024-1548 Security feature bypass in Firefox
- CVE-2024-1547 Security feature bypass in Firefox
- CVE-2024-1546 Memory corruption in Firefox
- CVE-2024-1545 Fault Injection of RSA encryption in WolfCrypt
- CVE-2024-1544 ECDSA nonce bias caused by truncation
- CVE-2024-1543 AES T-Table sub-cache-line leakage
- CVE-2024-1541 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-1540 Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow
- CVE-2024-1539 Missing Authorization in GitLab
- CVE-2024-1538 File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion
- CVE-2024-1537 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-1536 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-1535 ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-1534 Booster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde
- CVE-2024-1533 Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1532 Other in RTU500 series CMU firmware
- CVE-2024-1531 Information disclosure in RTU500 series CMU firmware
- CVE-2024-1530 ECshop view_sendlist.php sql injection
- CVE-2024-1529 Cross-site Scripting in CMS Made Simple
- CVE-2024-1528 Cross-site Scripting in CMS Made Simple
- CVE-2024-1527 Unrestricted Upload of File with Dangerous Type in CMS Made Simple
- CVE-2024-1526 Hubbub Lite < 1.33.1 - Unauthenticated Password Protected Posts Access
- CVE-2024-1525 Authentication Bypass Using an Alternate Path or Channel in GitLab
- CVE-2024-1524 A local user can be impersonated when using federated authentication with Silent JIT Provisioning.
- CVE-2024-1523 EC-WEB FS-EZViewer(Web) - SQL Injection
- CVE-2024-1522 Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui
- CVE-2024-1521 Cross-site scripting in Elementor Website Builder Pro
- CVE-2024-1520 OS Command Injection in parisneo/lollms-webui
- CVE-2024-1519 Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2024-1516 WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation
- CVE-2024-1514 WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection
- CVE-2024-1512 MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection
- CVE-2024-1511 Path Traversal Vulnerability in parisneo/lollms-webui
- CVE-2024-1510 Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-1509 Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100
- CVE-2024-1508 Cross-site scripting in Prime Slider – Addons for Elementor
- CVE-2024-1507 Cross-site scripting in Prime Slider – Addons for Elementor
- CVE-2024-1506 Cross-site scripting in Prime Slider – Addons for Elementor
- CVE-2024-1505 Privilege escalation in Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
- CVE-2024-1504 SecuPress Free — WordPress Security <= 2.2.5.1 - Cross-Site Request Forgery to Banned IP Address
- CVE-2024-1503 Cross-site request forgery in Tutor LMS – eLearning and online course solution
- CVE-2024-1502 Missing authorization in Tutor LMS – eLearning and online course solution
- CVE-2024-1501 Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation
- CVE-2024-1500 Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor
- CVE-2024-1499 Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1498 Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget
- CVE-2024-1497 Cross-site scripting in Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- CVE-2024-1496 Featured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url
- CVE-2024-1495 Uncontrolled Resource Consumption in GitLab
- CVE-2024-1493 Uncontrolled Resource Consumption in GitLab
- CVE-2024-1492 WPify Woo Czech <= 4.0.8 - Missing Authorization
- CVE-2024-1491 Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function
- CVE-2024-1490 Wago: Vulnerability in WBM through Open VPN
- CVE-2024-1489 SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery
- CVE-2024-1488 Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation
- CVE-2024-1487 Photos and Files Contest Gallery < 21.3.1 - Author+ Stored Cross Site Scripting
- CVE-2024-1486 Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices
- CVE-2024-1485 Registry-support: decompress can delete files outside scope via relative paths
- CVE-2024-1484 Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting
- CVE-2024-1483 Path Traversal Vulnerability in mlflow/mlflow
- CVE-2024-1482 Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution