Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 479 of 521.
- CVE-2024-13244 Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008
- CVE-2024-13243 Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007
- CVE-2024-13242 Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006
- CVE-2024-13241 Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005
- CVE-2024-13240 Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004
- CVE-2024-1324 QQWorld Auto Save Images <= 1.9.8 - Missing Authorization to Arbitrary Post Content Retrieval
- CVE-2024-13239 Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003
- CVE-2024-13238 Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002
- CVE-2024-13237 File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001
- CVE-2024-13236 Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-13235 Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-13234 Product Table by WBW <= 2.1.2 - Unuthenticated SQL Injection
- CVE-2024-13232 Missing authorization in WordPress Awesome Import & Export Plugin - Import & Export WordPress Data
- CVE-2024-13231 WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update
- CVE-2024-13230 SQL injection in Social Share, Social Login and Social Comments Plugin – Super Socializer
- CVE-2024-1323 Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-13229 Rank Math SEO <= 1.0.235 - Missing Authorization to Authenticated (Contributor+) Arbitrary Schema Deletion
- CVE-2024-13228 Information disclosure in Qubely – Advanced Gutenberg Blocks
- CVE-2024-13227 Cross-site scripting in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
- CVE-2024-13226 A5 Custom Login Page <= 2.8.1 - Reflected XSS
- CVE-2024-13225 ECT Home Page Products <= 1.9 - Reflected XSS
- CVE-2024-13224 SlideDeck 1 Lite Content Slider <= 1.4.8 - Reflected XSS
- CVE-2024-13223 Tabulate <= 2.10.3 - Reflected XSS
- CVE-2024-13222 User Messages <= 1.2.4 - Reflected XSS
- CVE-2024-13221 Fantastic Elasticsearch <= 4.1.0 - Reflected XSS
- CVE-2024-13220 Google Map Professional <= 1.0 - Reflected XSS
- CVE-2024-1322 Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Change
- CVE-2024-13219 Policy Genius <= 2.0.4 - Reflected XSS
- CVE-2024-13218 Fast Tube <= 2.3.1 - Reflected XSS
- CVE-2024-13217 Jeg Elementor Kit <= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas
- CVE-2024-13216 Information disclosure in HT Event – WordPress Event Manager Plugin for Elementor
- CVE-2024-13215 Elementor Addon Elements <= 1.13.10 - Authenticated (Contributor+) Sensitive Information Exposure via Modal Popup
- CVE-2024-13213 SingMR HouseRent toAdminUpdateHousePage cross site scripting
- CVE-2024-13212 SingMR HouseRent AddHouseController.java upload unrestricted upload
- CVE-2024-13211 SingMR HouseRent AdminController.java access control
- CVE-2024-13210 donglight bookstore电商书城系统说明 AdminBookController. java uploadPicture unrestricted upload
- CVE-2024-1321 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Unauthenticated Booking Payment Bypass
- CVE-2024-13209 Redaxo CMS Structure Management Page index.php cross site scripting
- CVE-2024-13208 WP Google Map < 1.9.4 - Admin+ Stored XSS
- CVE-2024-13207 Widget for Social Page Feeds < 6.4.2 - Admin+ Stored XSS
- CVE-2024-13206 REVE Antivirus reveinstall default permission
- CVE-2024-13205 kurniaramadhan E-Commerce-PHP Create Product Page create_product.php cross site scripting
- CVE-2024-13204 kurniaramadhan E-Commerce-PHP blog-details.php sql injection
- CVE-2024-13203 kurniaramadhan E-Commerce-PHP cross-site request forgery
- CVE-2024-13202 wander-chu SpringBoot-Blog Blog Article PageController.java modifiyArticle cross site scripting
- CVE-2024-13201 wander-chu SpringBoot-Blog Admin Attachment AttachtController.java upload unrestricted upload
- CVE-2024-13200 wander-chu SpringBoot-Blog HTTP POST Request BaseInterceptor.java preHandle access control
- CVE-2024-1320 EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-13199 langhsu Mblog Blog System Search Bar search cross site scripting
- CVE-2024-13198 langhsu Mblog Blog System login observable response discrepancy
- CVE-2024-13197 donglight bookstore电商书城系统说明 AdminUserControlle.java updateUser cross site scripting
- CVE-2024-13196 donglight bookstore电商书城系统说明 BookInfoController.java BookSearchList cross site scripting
- CVE-2024-13195 donglight bookstore电商书城系统说明 HttpUtil.java getHtml server-side request forgery
- CVE-2024-13194 Sucms admin_members.php sql injection
- CVE-2024-13193 SEMCMS Image Library Management Page SEMCMS_Images.php sql injection
- CVE-2024-13192 ZeroWdd myblog BlogController.java update cross site scripting
- CVE-2024-13191 ZeroWdd myblog uploadController.java upload unrestricted upload
- CVE-2024-13190 ZeroWdd myblog BlogMapper.xml xml injection
- CVE-2024-1319 Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists Disclosure
- CVE-2024-13189 ZeroWdd myblog MyBlogMvcConfig.java permission
- CVE-2024-13188 MicroWorld eScan Antivirus Installation var default permission
- CVE-2024-13187 Kingsoft WPS Office TCC code injection
- CVE-2024-13186 MinigameCenter information leakage vulnerability
- CVE-2024-13185 MinigameCenter module information leakage vulnerability
- CVE-2024-13184 The Ultimate WordPress Toolkit – WP Extended <= 3.0.12 - Unauthenticated SQL Injection via Login Attempts Module
- CVE-2024-13183 Orbit Fox by ThemeIsle <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter
- CVE-2024-13182 WP Directorybox Manager <= 2.5 - Authentication Bypass
- CVE-2024-13181 Auth bypass in Avalanche
- CVE-2024-13180 Path traversal in Avalanche
- CVE-2024-1318 RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication
- CVE-2024-13179 Auth bypass in Avalanche
- CVE-2024-13178 Other in Chrome
- CVE-2024-13177 Symlink Following in Netskope Client Postinstall Script
- CVE-2024-13176 Timing side-channel in ECDSA signature computation
- CVE-2024-13175 IDOR in Vidco Software's VOC TESTER
- CVE-2024-13174 SQLi in E1 Informatics' Web Application
- CVE-2024-13173 Health information leakage vulnerability
- CVE-2024-13172 Security feature bypass in Endpoint Manager
- CVE-2024-13171 File upload in Endpoint Manager
- CVE-2024-13170 Memory corruption in Endpoint Manager
- CVE-2024-1317 RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection
- CVE-2024-13169 Memory corruption in Endpoint Manager
- CVE-2024-13168 Memory corruption in Endpoint Manager
- CVE-2024-13167 Memory corruption in Endpoint Manager
- CVE-2024-13166 Memory corruption in Endpoint Manager
- CVE-2024-13165 Memory corruption in Endpoint Manager
- CVE-2024-13164 Privilege escalation in Endpoint Manager
- CVE-2024-13163 Deserialization in Endpoint Manager
- CVE-2024-13162 SQL injection in Endpoint Manager
- CVE-2024-13161 Ivanti Endpoint Manager (EPM) Absolute Path Traversal
- CVE-2024-13160 Ivanti Endpoint Manager (EPM) Absolute Path Traversal
- CVE-2024-1316 Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events Access
- CVE-2024-13159 Ivanti Endpoint Manager (EPM) Absolute Path Traversal
- CVE-2024-13158 Code injection in Endpoint Manager
- CVE-2024-13157 Cross-site scripting in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- CVE-2024-13156 Cross-site scripting in HTML5 Video Player – Embed and Play Videos in Custom Player
- CVE-2024-13155 Cross-site scripting in Unlimited Elements For Elementor
- CVE-2024-13153 Cross-site scripting in Unlimited Elements For Elementor
- CVE-2024-13152 SQLi in BSS Software's Mobuy Online Machinery Monitoring Panel
- CVE-2024-13151 SQLi in ESBI Informatics's Auto Service Software