Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 484 of 521.
- CVE-2024-12769 Simple Banner < 3.0.4 - Admin+ Stored XSS
- CVE-2024-12768 Responsive iframe <= 1.2.0 - Contributor+ Stored XSS
- CVE-2024-12767 BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR
- CVE-2024-12766 SSRF in parisneo/lollms-webui
- CVE-2024-12761 Denial of Service in brycedrennan/imaginairy
- CVE-2024-1276 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-12757 Nedap Librix Ecoreader Missing Authentication for Critical Function
- CVE-2024-12756 Avaya Spaces HTML injection (HTMLi) Vulnerability
- CVE-2024-12755 Avaya Spaces XSS Vulnerability
- CVE-2024-12754 AnyDesk Link Following Information Disclosure Vulnerability
- CVE-2024-12753 Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability
- CVE-2024-12752 Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability
- CVE-2024-12751 Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability
- CVE-2024-12750 Competition Form <= 2.0 - Competition Deletion via CSRF
- CVE-2024-1275 Vulnerability in Baxter Welch Allyn Connex Spot Monitor
- CVE-2024-12749 Competition Form <= 2.0 - Reflected XSS
- CVE-2024-12747 Rsync: race condition in rsync handling symbolic links
- CVE-2024-12746 SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0
- CVE-2024-12745 SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4
- CVE-2024-12744 SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31
- CVE-2024-12743 MailPoet < 5.5.2 - Admin+ Stored XSS
- CVE-2024-12742 Deserialization of Untrusted Data Vulnerability in NI G Web Development Software
- CVE-2024-12741 Deserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File
- CVE-2024-12740 Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software
- CVE-2024-1274 My Calendar < 3.4.24 - Authenticated Stored XSS
- CVE-2024-12739 Mobile Contact Bar < 3.0.5 - Admin+ Stored XSS
- CVE-2024-12738 Cross-site scripting in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- CVE-2024-12737 WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS
- CVE-2024-12736 BU Section Editing <= 0.9.9 - Reflected XSS
- CVE-2024-12735 Advance Post Prefix <= 1.1.1 - Admin+ SQL Injection
- CVE-2024-12734 Advance Post Prefix <= 1.1.1 - Reflected XSS
- CVE-2024-12733 AffiliateImporterEb <= 1.0.6 - Reflected XSS via Search
- CVE-2024-12732 AffiliateImporterEb <= 1.0.6 - Reflected XSS
- CVE-2024-12731 aklamator-infeed <= 2.0.0 - Reflected XSS
- CVE-2024-1273 Starbox < 3.5.0 - Contributor+ Stored XSS
- CVE-2024-12729 Code injection in Sophos Firewall
- CVE-2024-12728 Hardcoded credentials in Sophos Firewall
- CVE-2024-12727 SQL injection in Sophos Firewall
- CVE-2024-12726 ClipArt <= 0.2 - Reflected XSS
- CVE-2024-12725 Clasify Classified Listing <= 1.0.7 - Reflected XSS
- CVE-2024-12724 WP DeskLite <= 1.0.0 - Reflected XSS
- CVE-2024-12723 Infility Global <= 2.9.8 - Reflected XSS
- CVE-2024-12722 Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Stored XSS via Shortcode
- CVE-2024-12721 Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection
- CVE-2024-12720 Regular Expression Denial of Service (ReDoS) in huggingface/transformers
- CVE-2024-1272 Information Disclosure to Source Code in TNB Mobile Solutions' Cockpit Software
- CVE-2024-12719 WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal
- CVE-2024-12718 Bypass extraction filter to modify file metadata outside extraction directory
- CVE-2024-12717 aklamator-infeed <= 2.0.0 - Admin+ Stored XSS
- CVE-2024-12716 Simple Basic Contact Form < 20250114 - Admin+ Stored XSS
- CVE-2024-12715 Asgard Security Scanner <= 0.7 - Reflected XSS
- CVE-2024-12714 Backlink Monitoring Manager <= 0.1.3 - Reflected XSS
- CVE-2024-12713 Missing authorization in SureForms – Contact Form, Payment Form & Other Custom Form Builder
- CVE-2024-12712 Shopping Cart & eCommerce Store <= 5.7.8 - Missing Authorization to Order Updates
- CVE-2024-12711 RSVP and Event Management <= 2.7.13 - Missing Authorization
- CVE-2024-12710 WP-Appbox <= 4.5.3 - Reflected Cross-Site Scripting
- CVE-2024-12709 Bulk Me Now <= 2.0 - Message Deletion via CSRF
- CVE-2024-12708 Bulk Me Now <= 2.0 - Stored XSS via Shortcode
- CVE-2024-12706 SQL Injection vulnerability discovered in OpenText™ Digital Asset Management.
- CVE-2024-12705 DNS-over-HTTPS implementation suffers from multiple issues under heavy query load
- CVE-2024-12704 Denial of Service (DoS) in run-llama/llama_index
- CVE-2024-12703 Deserialization in RemoteConnect and SCADAPack x70 Utilities
- CVE-2024-12701 WP Smart Import : Import any XML File to WordPress <= 1.1.2 - Reflected Cross-Site Scripting
- CVE-2024-12700 Tibbo AggreGate Network Manager Unrestricted Upload of File with Dangerous Type
- CVE-2024-12699 Service Box <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12698 Ose-olm-catalogd-container: incomplete fix for rapid reset (cve-2023-39325/cve-2023-44487)
- CVE-2024-12697 real.Kit <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12696 Cross-site scripting in Picture Gallery – Frontend Image Uploads, AJAX Photo List
- CVE-2024-12695 Memory corruption in Chrome
- CVE-2024-12694 Use after free in Chrome
- CVE-2024-12693 Memory corruption in Chrome
- CVE-2024-12692 Memory corruption in Chrome
- CVE-2024-1269 SourceCodester Product Management System supplier.php cross site scripting
- CVE-2024-12687 Insecure YAML Deserialization
- CVE-2024-12686 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection
- CVE-2024-12683 Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSS
- CVE-2024-12682 Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSS
- CVE-2024-12680 Prisna GWT < 1.4.14 - Admin+ Stored XSS
- CVE-2024-1268 CodeAstro Restaurant POS System update_product.php unrestricted upload
- CVE-2024-12679 Prisna GWT < 1.4.14 - Admin+ Stored XSS
- CVE-2024-12678 Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens
- CVE-2024-12677 Delta Electronics DTM Soft Deserialization of Untrusted Data
- CVE-2024-12673 Privilege escalation in Vantage
- CVE-2024-12672 Rockwell Automation Third Party Vulnerability in Arena®
- CVE-2024-12671 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12670 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-1267 CodeAstro Restaurant POS System create_account.php cross site scripting
- CVE-2024-12669 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12668 Velocidex WinPmem Out of Bounds Write Vulnerability
- CVE-2024-12667 InvoicePlane view session expiration
- CVE-2024-12666 ClassCMS User Management Page admin insufficient privileges
- CVE-2024-12665 ruifang-tech Rebuild Task Comment Attachment Upload cross site scripting
- CVE-2024-12664 ruifang-tech Rebuild Project Task Comment cross site scripting
- CVE-2024-12663 funnyzpc Mee-Admin Login login observable response discrepancy
- CVE-2024-12662 IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E040 null pointer dereference
- CVE-2024-12661 IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E024 null pointer dereference
- CVE-2024-12660 IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E018 null pointer dereference
- CVE-2024-1266 CodeAstro University Management System Student Registration Form st_reg.php cross site scripting
- CVE-2024-12659 IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E004 null pointer dereference
- CVE-2024-12658 IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E01C null pointer dereference