Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 470 of 521.
- CVE-2024-1481 Freeipa: specially crafted http requests potentially lead to denial of service
- CVE-2024-1480 Unitronics Vision Standard Unauthenticated Password Retrieval
- CVE-2024-1479 WP Show Posts <= 1.1.4 - Information Exposure
- CVE-2024-1478 Maintenance Mode <= 3.0.1 - Information Exposure
- CVE-2024-1477 Easy Maintenance Mode <= 1.4.2 - Information Exposure
- CVE-2024-1476 Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure
- CVE-2024-1475 Coming Soon Maintenance Mode <= 1.0.5 - Information Exposure
- CVE-2024-1474 WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface
- CVE-2024-1473 Coming Soon & Maintenance Mode by Colorlib <= 1.0.99 - Information Exposure
- CVE-2024-1472 WP Maintenance <= 6.1.6 - Information Exposure
- CVE-2024-1471 HTML Injection Vulnerability
- CVE-2024-1470 Elevation of Privilege attack on NetIQ Client login extension
- CVE-2024-1468 Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload
- CVE-2024-1467 Server-side request forgery in Starter Templates – AI-Powered Templates for Elementor & Gutenberg
- CVE-2024-1466 Cross-site scripting in Livemesh Addons by Elementor
- CVE-2024-1465 Cross-site scripting in Livemesh Addons by Elementor
- CVE-2024-1464 Cross-site scripting in Livemesh Addons by Elementor
- CVE-2024-1463 LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting
- CVE-2024-1462 Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST API
- CVE-2024-1461 Cross-site scripting in Livemesh Addons by Elementor
- CVE-2024-1460 MSI Afterburner v4.6.5.16370 - Kernel Memory Leak
- CVE-2024-1459 Undertow: directory traversal vulnerability
- CVE-2024-1458 Cross-site scripting in Livemesh Addons by Elementor
- CVE-2024-1456 S3 Bucket Takeover in h2oai/h2o-3
- CVE-2024-1455 Billion Laughs Attack leading to DoS in langchain-ai/langchain
- CVE-2024-1454 Opensc: memory use after free in authentic driver when updating token info
- CVE-2024-1453 Santesoft Sante DICOM Viewer Pro Out-of-Bounds Read
- CVE-2024-1452 GenerateBlocks <= 1.8.2 - Sensitive Information Exposure
- CVE-2024-1451 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- CVE-2024-1450 Shariff Wrapper <= 4.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1449 Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1448 Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1447 Sydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1446 NextScripts: Social Networks Auto-Poster <= 4.4.3 - Cross-Site Request Forgery to Arbitrary Post Deletion
- CVE-2024-1445 Page scroll to id <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-1443 MSI Afterburner v4.6.5.16370 - Denial of Service
- CVE-2024-1442 User with permissions to create a data source can CRUD all data sources
- CVE-2024-1441 Libvirt: off-by-one error in udevlistinterfacesbystatus()
- CVE-2024-1440 Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint
- CVE-2024-1439 Inadequate access control vulnerability in Moodle
- CVE-2024-1438 WordPress Rolo Slider plugin <= 1.0.9 - Broken Access Control vulnerability
- CVE-2024-1437 WordPress Adsmonetizer Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-1436 Information disclosure in WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit
- CVE-2024-1435 WordPress Tainacan plugin <= 0.20.6 - Sensitive Data Exposure via Log File vulnerability
- CVE-2024-1434 WordPress Media Alt Renamer Plugin 0.0.1 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-1433 KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal
- CVE-2024-1432 DeepFaceLab main.py apply_xseg deserialization
- CVE-2024-1431 Netgear R7000 Web Management Interface debuginfo.htm information disclosure
- CVE-2024-1430 Netgear R7000 Web Management Interface currentsetting.htm information disclosure
- CVE-2024-1429 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-1428 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-1427 The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag
- CVE-2024-1426 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-1425 EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link
- CVE-2024-1424 GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1422 Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet
- CVE-2024-1421 Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder
- CVE-2024-1419 Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
- CVE-2024-1418 CGC Maintenance Mode <= 1.2 - Sensitive Information Exposure
- CVE-2024-1417 Local Code Injection Vulnerability in AuthPoint Password Manager App for macOS Safari
- CVE-2024-1416 Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Missing Authorization
- CVE-2024-1415 Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Cross-Site Request Forgery
- CVE-2024-1414 Cross-site scripting in Exclusive Addons for Elementor
- CVE-2024-1413 Cross-site scripting in Exclusive Addons for Elementor
- CVE-2024-1412 Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and error
- CVE-2024-1411 Cross-site scripting in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
- CVE-2024-1410 Unbounded storage of information related to connection ID retirement, in quiche
- CVE-2024-1409 Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2024-1408 ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode
- CVE-2024-1407 Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification
- CVE-2024-1406 Linksys WRT54GL Web Management Interface SysInfo1.htm information disclosure
- CVE-2024-1405 Linksys WRT54GL Web Management Interface wlaninfo.htm information disclosure
- CVE-2024-14047 Privilege escalation in Elastic Security
- CVE-2024-14046 OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload
- CVE-2024-14045 OpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization
- CVE-2024-14044 Open5GS Diameter Rx pcrf-rx-path.c pcrf_rx_aar_cb buffer overflow
- CVE-2024-14043 Open5GS Diameter S6a mme-fd-path.c mme_s6a_subscription_data_from_avp heap-based overflow
- CVE-2024-14042 Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow
- CVE-2024-14041 Weak cryptography in BC-JAVA
- CVE-2024-14040 net: nexthop: Increase weight to u16
- CVE-2024-1404 Linksys WRT54GL Web Management Interface SysInfo.htm information disclosure
- CVE-2024-14037 Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob
- CVE-2024-14036 Dräger Core 1.0.5 Denial of Service via Malformed SDC Message
- CVE-2024-14034 Hirschmann HiEOS Authentication Bypass via HTTP Management Module
- CVE-2024-14033 Hirschmann EagleSDV Denial of Service via TLS
- CVE-2024-14032 Twitch Studio LauncherHelper XPC Missing Authorization to Root File Write
- CVE-2024-14031 Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library
- CVE-2024-14030 Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library
- CVE-2024-1403 Authentication Bypass in OpenEdge Authentication Gateway and AdminServer
- CVE-2024-14029 Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding
- CVE-2024-14028 Multiple implicit reads in parallel can result in a crash or denial of service
- CVE-2024-14027 xattr: switch to CLASS(fd)
- CVE-2024-14026 QTS, QuTS hero
- CVE-2024-14025 Video Station
- CVE-2024-14024 Video Station
- CVE-2024-14021 LlamaIndex <= 0.11.6 BGEM3Index Unsafe Deserialization
- CVE-2024-14020 carboneio carbone Formatter input.js prototype pollution
- CVE-2024-1402 Denial of service in mattermost mobile apps and server via emoji reactions
- CVE-2024-14015 Studiocart <= 2.9.0 - Reflected XSS
- CVE-2024-14012 Potential Privilege Escalation in Revenera InstallShield 2023 R1