Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 485 of 521.
- CVE-2024-12657 IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E000 null pointer dereference
- CVE-2024-12656 FabulaTech USB over Network IOCT ftusbbus2.sys 0x220448 null pointer dereference
- CVE-2024-12655 FabulaTech USB over Network IOCT ftusbbus2.sys 0x220420 null pointer dereference
- CVE-2024-12654 FabulaTech USB over Network IOCT ftusbbus2.sys 0x220408 null pointer dereference
- CVE-2024-12653 FabulaTech USB over Network IOCT ftusbbus2.sys 0x22040C null pointer dereference
- CVE-2024-12652 Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection')
- CVE-2024-12651 Sensitive Data Exposure in PTT Inc.'s HGS Mobile App
- CVE-2024-12650 Wago: Vulnerability in libwagosnmp
- CVE-2024-1265 CodeAstro University Management System Attendance Management att_add.php cross site scripting
- CVE-2024-12649 Memory corruption in Color imageCLASS LBP632Cdw
- CVE-2024-12648 Memory corruption in Color imageCLASS LBP632Cdw
- CVE-2024-12647 Memory corruption in Color imageCLASS LBP632Cdw
- CVE-2024-12646 Chunghwa Telecom topm-client - Arbitrary File Delete
- CVE-2024-12645 Chunghwa Telecom topm-client - Arbitrary File Read
- CVE-2024-12644 Chunghwa Telecom tbm-client - Arbitrary File Copy and Paste
- CVE-2024-12643 Chunghwa Telecom tbm-client - Arbitrary File Delete
- CVE-2024-12642 Chunghwa Telecom TenderDocTransfer - Arbitrary File Write
- CVE-2024-12641 Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE
- CVE-2024-1264 Juanpao JPShop UploadsController.php actionUpdate unrestricted upload
- CVE-2024-12638 Bulk Me Now <= 2.0 - Reflected XSS
- CVE-2024-12637 Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposure
- CVE-2024-12636 Cross-site request forgery in Privacy Policy Generator – WPLP Legal Pages
- CVE-2024-12635 WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id'
- CVE-2024-12634 Cross-site request forgery in Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins
- CVE-2024-12633 JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page
- CVE-2024-1263 Juanpao JPShop API PosterController.php actionUpdate unrestricted upload
- CVE-2024-12629 Prototype Pollution in Progress® Telerik® KendoReact
- CVE-2024-12628 bodi0’s Easy Cache <= 0.8 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-12627 Deserialization in Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce
- CVE-2024-12626 AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value
- CVE-2024-12624 Cross-site scripting in Sina Extension for Elementor
- CVE-2024-12623 DICOM Support <= 0.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12622 WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12621 Yumpu E-Paper publishing <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12620 Missing authorization in AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations
- CVE-2024-1262 Juanpao JPShop API MaterialController.php actionUpdate unrestricted upload
- CVE-2024-12619 Insufficient Granularity of Access Control in GitLab
- CVE-2024-12618 Newsletter2Go <= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset
- CVE-2024-12617 WC Price History for Omnibus <= 2.1.3 - Missing Authorization
- CVE-2024-12616 Bitly's WordPress Plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
- CVE-2024-12615 Passwords Manager <= 1.4.8 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-12614 Passwords Manager <= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key
- CVE-2024-12613 Passwords Manager <= 1.4.8 - Unauthenticated SQL Injection
- CVE-2024-12612 School Management System for Wordpress <= 93.2.0 - Unauthenticated SQL Injection
- CVE-2024-12611 School Management System for Wordpress <= 93.0.0 - Reflected Cross-Site Scripting
- CVE-2024-12610 School Management System for Wordpress <= 93.0.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
- CVE-2024-1261 Juanpao JPShop API ComboController.php actionIndex unrestricted upload
- CVE-2024-12609 School Management System for Wordpress <= 92.0.0 - Authenticated (Student+) SQL Injection via 'view-attendance'
- CVE-2024-12607 SQL injection in School Management System for Wordpress
- CVE-2024-12606 Missing authorization in Opace AI Scribe: SEO Content Creator & Humaizer for OpenAI & Anthropic
- CVE-2024-12605 Cross-site request forgery in Opace AI Scribe: SEO Content Creator & Humaizer for OpenAI & Anthropic
- CVE-2024-12604 Improper Authentication in Tapandsign Technologies Tap and Sign App
- CVE-2024-12603 Auth bypass in com.transsion.applock
- CVE-2024-12602 Auth bypass in HarmonyOS
- CVE-2024-12601 Calculated Fields Form <= 5.2.63 - Denial of Service
- CVE-2024-12600 Custom Product Tabs Lite for WooCommerce <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection
- CVE-2024-1260 Juanpao JPShop API ComboController.php actionIndex unrestricted upload
- CVE-2024-12599 Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder
- CVE-2024-12598 Cross-site scripting in MyBookProgress by Stormhill Media
- CVE-2024-12597 HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css
- CVE-2024-12596 Missing authorization in LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes
- CVE-2024-12595 AHAthat Plugin <= 1.6 - Reflected XSS via REQUEST_URI
- CVE-2024-12594 ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation
- CVE-2024-12593 Cross-site scripting in PDF for WPForms + Drag and Drop Template Builder
- CVE-2024-12592 Sellsy <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12591 MagicPost <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode
- CVE-2024-12590 WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
- CVE-2024-1259 Juanpao JPShop API AppController.php unrestricted upload
- CVE-2024-12589 Cross-site scripting in Finale Lite – Sales Countdown Timer & Discount for WooCommerce
- CVE-2024-12588 Cross-site scripting in Shortcodes and extra features for Phlox theme
- CVE-2024-12587 Contact Form Master <= 1.0.7 - Reflected XSS
- CVE-2024-12586 Chalet Montagne Com Tools <= 2.7.8 - Reflected XSS
- CVE-2024-12585 PropertyHive < 2.1.1 - Reflected XSS
- CVE-2024-12584 Information disclosure in Xpro Addons — 140+ Widgets for Elementor
- CVE-2024-12583 Code injection in Dynamics 365 Integration
- CVE-2024-12582 Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service
- CVE-2024-12581 Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-12580 Logs Debug Injection in danny-avila/librechat
- CVE-2024-1258 Juanpao JPShop API params.php hard-coded key
- CVE-2024-12579 Minify HTML <= 2.1.10 - - Regular Expressions Denial of Service
- CVE-2024-12578 Tickera – WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data Exposure
- CVE-2024-12577 GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet
- CVE-2024-12576 GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address
- CVE-2024-12575 Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposure
- CVE-2024-12574 SVG Shortcode <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
- CVE-2024-12572 Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-12571 Store Locator <= 3.98.10 - Unauthenticated Local File Inclusion
- CVE-2024-12570 Privilege Context Switching Error in GitLab
- CVE-2024-1257 Jspxcms find_text.do cross site scripting
- CVE-2024-12569 Sensitive Information in Driver’s Log File
- CVE-2024-12568 Email Subscribers < 5.7.45 - Admin+ Stored XSS
- CVE-2024-12567 Email Subscribers < 5.7.45 - Admin+ Stored XSS
- CVE-2024-12566 Email Subscribers < 5.7.45 - Admin+ Stored XSS
- CVE-2024-12564 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3
- CVE-2024-12563 s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode
- CVE-2024-12562 s2Member Pro <= 241216 - Unauthenticated PHP Object Injection
- CVE-2024-12561 Affiliate Sales in Google Analytics and other tools <= 2.0.0 - Open Redirect
- CVE-2024-12560 Information disclosure in Button Block – Design Stylish, Interactive, and Multi-Functional Buttons
- CVE-2024-1256 Jspxcms filter_text.do cross site scripting
- CVE-2024-12559 ClickDesigns <= 1.8.0 - Missing Authorization to API Key Modification or Removal