Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 483 of 521.
- CVE-2024-12869 Improper Authentication in infiniflow/ragflow
- CVE-2024-12867 Server-side request forgery in Arctic Hub
- CVE-2024-12866 Local File Inclusion in netease-youdao/qanything
- CVE-2024-12864 Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanything
- CVE-2024-12863 Stored XSS in Discussions functionality
- CVE-2024-12862 REST API allows users without permissions to remove external collaborators
- CVE-2024-12861 Path traversal in W2S – Migrate WooCommerce to Shopify
- CVE-2024-12860 CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover
- CVE-2024-1286 Paid Memberships Pro - Membership Maps Add On < 0.7 - Contributor+ Sensitive Information Disclosure
- CVE-2024-12859 BoomBox Theme Extensions <= 1.8.0 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- CVE-2024-12857 AdForest <= 5.1.8 - Authentication Bypass
- CVE-2024-12856 Four-Faith Industrial Router adjust_sys_time OS Command Injection
- CVE-2024-12855 Missing authorization in AdForest
- CVE-2024-12854 Garden Gnome Package <= 2.3.0 - Authenticated (Author+) Arbitrary File Upload
- CVE-2024-12853 Modula Image Gallery <= 2.11.10 - Authenticated (Author+) Arbitrary File Upload
- CVE-2024-12852 Happy Addons for Elementor <= 3.15.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12851 Element Pack Lite - Addons for Elementor <= 5.10.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12850 Database Backup and check Tables Automated With Scheduler 2024 <= 2.32 - Authenticated (Admin+) Arbitrary File Read
- CVE-2024-1285 Page Builder Sandwich <= 5.1.0 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editing
- CVE-2024-12849 Error Log Viewer By WP Guru <= 1.0.1.3 - Missing Authorization to Unauthenticated Arbitrary File Read
- CVE-2024-12848 SKT Page Builder <= 4.6 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-12847 NETGEAR DGN setup.cgi OS Command Injection
- CVE-2024-12846 Emlog Pro link.php cross site scripting
- CVE-2024-12845 Emlog Pro common.php cross site scripting
- CVE-2024-12844 Emlog Pro store.php cross site scripting
- CVE-2024-12843 Emlog Pro plugin.php cross site scripting
- CVE-2024-12842 Emlog Pro user.php cross site scripting
- CVE-2024-12841 Emlog Pro tag.php cross site scripting
- CVE-2024-1284 Use after free in Chrome
- CVE-2024-12839 Changing Information Technology CGFIDO - Authentication Bypass
- CVE-2024-12838 Changing Information Technology CGFIDO - Authentication Bypass
- CVE-2024-12837 GPU DDK - Exploitable kernel double free on apsFenceSyncCheckpoints allocated with arbitrary size
- CVE-2024-12836 Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability
- CVE-2024-12835 Delta Electronics DRASimuCAD ICS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
- CVE-2024-12834 Delta Electronics DRASimuCAD STP File Parsing Type Confusion Remote Code Execution Vulnerability
- CVE-2024-12833 Paessler PRTG Network Monitor SNMP Cross-Site Scripting Authentication Bypass Vulnerability
- CVE-2024-12832 Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability
- CVE-2024-12831 Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability
- CVE-2024-12830 Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability
- CVE-2024-1283 Memory corruption in Chrome
- CVE-2024-12829 Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability
- CVE-2024-12828 Webmin CGI Command Injection Remote Code Execution Vulnerability
- CVE-2024-12827 DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset
- CVE-2024-12826 GoHero Store Customizer for WooCommerce <= 3.5 - Missing Authorization to Unuthenticated Settings Update
- CVE-2024-12825 Missing authorization in Custom Related Posts
- CVE-2024-12824 Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
- CVE-2024-12822 Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update
- CVE-2024-12821 Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- CVE-2024-12820 MK Google Directions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1282 Cross-site scripting in Email Encoder – Protect Email Addresses and Phone Numbers
- CVE-2024-12819 Searchie <= 1.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12818 WP Smart TV <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12817 Etsy Importer <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12816 NOTICE BOARD BY TOWKIR <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12815 Point Maker <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12814 Loan Comparison <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12813 Open Hours – Easy Opening Hours <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12812 WP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information
- CVE-2024-12811 Traveler <= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode
- CVE-2024-12810 Missing authorization in JobCareer | Job Board Responsive WordPress Theme
- CVE-2024-12809 Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12808 WP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS
- CVE-2024-12807 Social Share Buttons for WordPress <= 2.7 - Admin+ Stored XSS
- CVE-2024-12806 Path traversal in SonicOS
- CVE-2024-12805 Memory corruption in SonicOS
- CVE-2024-12803 Memory corruption in SonicOS
- CVE-2024-12802 Auth bypass in SonicOS
- CVE-2024-12801 SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks
- CVE-2024-12800 IP Based Login < 2.4.1 - Admin+ Stored XSS
- CVE-2024-12799 Insufficiently Protected Credentials
- CVE-2024-12798 JaninoEventEvaluator vulnerability
- CVE-2024-12797 RFC7250 handshakes with unauthenticated servers don't abort as expected
- CVE-2024-12796 Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP
- CVE-2024-12794 Codezips E-Commerce Site editorder.php sql injection
- CVE-2024-12793 PbootCMS IndexController.php path traversal
- CVE-2024-12792 Codezips E-Commerce Site newadmin.php sql injection
- CVE-2024-12791 Codezips E-Commerce Site signin.php sql injection
- CVE-2024-12790 code-projects Hostel Management Site room-details.php cross site scripting
- CVE-2024-1279 Paid Memberships Pro < 2.12.9 - Contributor+ Arbitrary User Custom Field Disclosure
- CVE-2024-12789 PbootCMS IndexController.php code injection
- CVE-2024-12788 Codezips Technical Discussion Forum signinpost.php sql injection
- CVE-2024-12787 1000 Projects Attendance Tracking Management System check_student_login.php sql injection
- CVE-2024-12786 Privilege escalation in Adobe Downloader
- CVE-2024-12785 itsourcecode Vehicle Management System sendmail.php sql injection
- CVE-2024-12784 itsourcecode Vehicle Management System editbill.php sql injection
- CVE-2024-12783 itsourcecode Vehicle Management System billaction.php cross site scripting
- CVE-2024-12782 Missing authorization in Apeos C3070
- CVE-2024-12781 Missing authorization in Aurum - WordPress & WooCommerce Shopping Theme
- CVE-2024-1278 Cross-site scripting in Easy Social Feed – Social Photos Gallery and Post Feed for WordPress
- CVE-2024-12779 SSRF in infiniflow/ragflow
- CVE-2024-12778 Denial of Service in aimhubio/aim
- CVE-2024-12777 Denial of Service in aimhubio/aim
- CVE-2024-12776 Authentication Bypass in langgenius/dify
- CVE-2024-12775 SSRF in langgenius/dify
- CVE-2024-12774 Altra Side Menu <= 2.0 - Abitrary Menu Deletion via CSRF
- CVE-2024-12773 Altra Side Menu <= 2.0 - Admin+ SQL Injection
- CVE-2024-12772 Ninja Tables < 5.0.17 - Admin+ Stored XSS
- CVE-2024-12771 eCommerce Product Catalog Plugin for WordPress <= 3.3.43 - Cross-Site Request Forgery to Password Reset
- CVE-2024-12770 WP ULike < 4.7.6 - Admin+ Stored XSS
- CVE-2024-1277 Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting