Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 471 of 521.
- CVE-2024-14010 Typora 1.7.4 OS Command Injection via Export PDF Preferences
- CVE-2024-1401 Profile Box Shortcode And Widget < 1.2.1 Admin+ Stored XSS
- CVE-2024-14009 Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile
- CVE-2024-14008 Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard
- CVE-2024-14007 TVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information Disclosure
- CVE-2024-14006 Nagios XI < 2024R1.2.2 Host Header Injection
- CVE-2024-14005 Nagios XI < 2024R1.2 Command Injection via Docker Wizard
- CVE-2024-14004 Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf)
- CVE-2024-14003 Nagios XI < 2024R1.2 RCE via NRDP Server Plugins
- CVE-2024-14002 Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis
- CVE-2024-14001 Nagios XI < 2024R1.1.3 XSS via Executive Summary Report
- CVE-2024-14000 Nagios XI < 2024R1.1.3 XSS via Capacity Planning Report
- CVE-2024-1400 Mollie Forms <= 2.6.3 - Missing Authorization to Arbitrary Post Duplication
- CVE-2024-13999 Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure
- CVE-2024-13998 Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure
- CVE-2024-13997 Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host
- CVE-2024-13996 Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change
- CVE-2024-13995 Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure
- CVE-2024-13994 Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization
- CVE-2024-13993 Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers
- CVE-2024-13992 Nagios XI < 2024R1.1 XSS via Missing Page / 404
- CVE-2024-13991 Huijietong Cloud Video Platform fileDownload Arbitrary File Read
- CVE-2024-13990 MicroWorld eScan AV Insecure Update Mechanism Allows Man-in-the-Middle Replacement of Updates
- CVE-2024-1399 Restaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-13987 Cross-site scripting in RADIUS Server
- CVE-2024-13986 Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE
- CVE-2024-13985 Dahua EIMS capture_handle.action RCE
- CVE-2024-13984 Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload
- CVE-2024-13983 Other in Chrome
- CVE-2024-13982 SPON IP Network Intercom System rj_get_token.php Arbitrary File Read
- CVE-2024-13981 LiveBos UploadFile.do Arbitrary File Upload
- CVE-2024-13980 H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE
- CVE-2024-1398 Ultimate Bootstrap Elements for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13979 St. Joe ERP System SingleRowQueryConverter SQL Injection
- CVE-2024-13978 LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference
- CVE-2024-13976 Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection
- CVE-2024-13975 Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse
- CVE-2024-13974 Business logic in Sophos Firewall
- CVE-2024-13973 SQL injection in Sophos Firewall
- CVE-2024-13972 Privilege escalation in Sophos Intercept X for Windows Core Agent
- CVE-2024-13971 Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro
- CVE-2024-1397 HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag
- CVE-2024-13967 ession-Management Failure
- CVE-2024-13966 ZKTeco BioTime default password
- CVE-2024-13962 Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810
- CVE-2024-13961 Avast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation Vulnerability
- CVE-2024-13960 Link Following Local Privilege Escalation Vulnerability in AVG TuneUp Version 23.4
- CVE-2024-1396 Cross-site scripting in Shortcodes and extra features for Phlox theme
- CVE-2024-13959 Link Following Local Privilege Escalation Vulnerability in AVG TuneUp 24.2.16593.9844
- CVE-2024-13958 Stored Cross Site Scripting
- CVE-2024-13957 SSRF Server Side Request Forgery
- CVE-2024-13956 SSL Verification Bypass
- CVE-2024-13955 SQL Injection 2nd Order
- CVE-2024-13954 Serialization / Deserialization of configuration data
- CVE-2024-13953 Sensitive Information disclosed in log files
- CVE-2024-13952 Remote Code Execution
- CVE-2024-13951 One way hash with predictable salt
- CVE-2024-13950 Log Injection
- CVE-2024-1395 Mali GPU Kernel Driver allows improper GPU memory processing operations
- CVE-2024-13949 Log Forging
- CVE-2024-13948 Insecure Permissions
- CVE-2024-13947 External System or Configuration Control
- CVE-2024-13946 Binary Planting / LoadLibrary DLL's not Signed
- CVE-2024-13945 Stored Absolute Path Traversal
- CVE-2024-13944 Race condition in CleanUp
- CVE-2024-13943 Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability
- CVE-2024-13942 Race condition in RK3588s
- CVE-2024-13941 ouch-org ouch zip.rs convert_zip_date_time memory corruption
- CVE-2024-13940 Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook
- CVE-2024-1394 Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
- CVE-2024-13939 Information disclosure in String::Compare::ConstantTime
- CVE-2024-13933 FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Cross-Site Request Forgery in Multiple Functions
- CVE-2024-13931 Authenticated Relative Path Traversal
- CVE-2024-13930 Authenticated Unchecked Loop Condition
- CVE-2024-1393 Cross-site scripting in Addon Elements for Elementor (formerly Elementor Addon Elements)
- CVE-2024-13929 Authenticated Servlet Command Injection
- CVE-2024-13928 Authenticated SQL Injection
- CVE-2024-13926 WP-Syntax <= 1.2 - Author+ Potential ReDoS
- CVE-2024-13925 Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive Logging
- CVE-2024-13924 Starter Templates by FancyWP <= 2.0.0 - Unauthenticated Blind Server-Side Request Forgery
- CVE-2024-13923 Server-side request forgery in Order Export & Order Import for WooCommerce
- CVE-2024-13922 Path traversal in Order Export & Order Import for WooCommerce
- CVE-2024-13921 Deserialization in Order Export & Order Import for WooCommerce
- CVE-2024-13920 Path traversal in Order Export & Order Import for WooCommerce
- CVE-2024-1392 Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget
- CVE-2024-13919 Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page
- CVE-2024-13918 Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page
- CVE-2024-13917 Intent Injection in Kruger&Matz AppLock application
- CVE-2024-13916 Exposure of Applications' Encryption PINs in Kruger&Matz AppLock
- CVE-2024-13915 Unrestricted Access to Exported Service in com.pri.factorytest
- CVE-2024-13914 Path traversal in File Manager Advanced Shortcode
- CVE-2024-13913 InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion
- CVE-2024-13911 Information disclosure in Database Backup and Table Integrity Check with Automated Scheduling
- CVE-2024-13910 Path traversal in Database Backup and Table Integrity Check with Automated Scheduling
- CVE-2024-1391 Cross-site scripting in Addon Elements for Elementor (formerly Elementor Addon Elements)
- CVE-2024-13909 Accredible Certificates & Open Badges <= 1.4.9 - Authenticated (Administrator+) SQL Injection via orderby Parameter
- CVE-2024-13908 SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload
- CVE-2024-13907 Server-side request forgery in Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid
- CVE-2024-13906 Deserialization in Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress
- CVE-2024-13905 OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery