Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 489 of 521.
- CVE-2024-1227 Multiple vulnerabilities in Rejetto's Http File Server
- CVE-2024-12269 Safe Ai Malware Protection for WP <= 1.0.17 - Missing Authorization to Unauthenticated Database Export
- CVE-2024-12268 Responsive Blocks – WordPress Gutenberg Blocks <= 1.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12267 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.8.5 - Limited Arbitrary File Deletion
- CVE-2024-12266 ELEX WooCommerce Dynamic Pricing and Discounts <= 2.1.7 - Missing Authorization
- CVE-2024-12265 Web3 Cryptocurrency Payments by DePay for WooCommerce <= 2.12.17 - Missing Authorization to Information Exposure
- CVE-2024-12264 PayU CommercePro Plugin <= 3.8.3 - Unauthenticated Privilege Escalation
- CVE-2024-12263 Missing authorization in Child Theme Creator by Orbisius
- CVE-2024-12262 Ebook Store <= 5.8001 - Reflected Cross-Site Scripting via 'step'
- CVE-2024-12261 SmartEmailing.cz <= 2.2.0 - Reflected Cross-Site Scripting
- CVE-2024-12260 Ultimate Endpoints With Rest Api <= 2.2.2 - Reflected Cross-Site Scripting
- CVE-2024-1226 Multiple vulnerabilities in Rejetto's Http File Server
- CVE-2024-12259 CRM WordPress Plugin – RepairBuddy <= 3.8120 - Missing Authorization to Account Takeover/Privilege Escalation
- CVE-2024-12258 WP Service Payment Form With Authorize.net <= 2.6.3 - Reflected Cross-Site Scripting
- CVE-2024-12257 CardGate Payments for WooCommerce <= 3.2.1 - Reflected Cross-Site Scripting
- CVE-2024-12256 Simple Video Management System <= 1.0.4 - Reflected Cross-Site Scripting
- CVE-2024-12255 Accept Stripe Payments Using Contact Form 7 <= 2.5 - Unauthenticated Information Exposure
- CVE-2024-12254 Unbounded memory buffering in SelectorSocketTransport.writelines()
- CVE-2024-12253 Missing authorization in Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- CVE-2024-12252 SEO LAT Auto Post <= 2.2.1 - Missing Authorization to File Overwrite/Upload (Remote Code Execution)
- CVE-2024-12251 Improper neutralization special element in hyperlinks
- CVE-2024-12250 Accept Authorize.NET Payments Using Contact Form 7 <= 2.2 - Unauthenticated Information Exposure
- CVE-2024-1225 QiboSoft QiboCMS X1 Pay.php rmb_pay deserialization
- CVE-2024-12249 GS Insever Portfolio <= 1.4.5 - Missing Authorization to Authenticated (Subscriber+) CSS Injection
- CVE-2024-12248 Out-of-bounds Write vulnerability in Contec Health CMS8000 Patient Monitor
- CVE-2024-12247 Improper propagation of permission scheme updates across cluster nodes
- CVE-2024-12245 Blind SQL Injection in Logout
- CVE-2024-12244 Missing Authorization in GitLab
- CVE-2024-12243 Gnutls: gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos
- CVE-2024-12240 Page Builder by SiteOrigin <= 2.31.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Row Label Parameter
- CVE-2024-1224 Information Disclosure Vulnerability in CDAC USB Pratirodh
- CVE-2024-12239 PowerPack Lite for Beaver Builder <= 1.3.0.5 - Reflected Cross-Site Scripting via Navigate Parameter
- CVE-2024-12238 Code injection in Ninja Forms – The Contact Form Builder That Grows With You
- CVE-2024-12237 Server-side request forgery in Photo Gallery Slideshow & Masonry Tiled Gallery
- CVE-2024-12236 Use of Custom URI for media inputs with VPC-SC enabled potentially leads to data exfiltration
- CVE-2024-12235 Shenzhen Dashi Tongzhou Information Technology AgileBPM AuthorizationTokenCheckFilter.java doFilter access control
- CVE-2024-12234 1000 Projects Beauty Parlour Management System edit-customer-detailed.php sql injection
- CVE-2024-12233 code-projects Online Notice Board Profile Picture registration.php unrestricted upload
- CVE-2024-12232 code-projects Simple CRUD Functionality index.php cross site scripting
- CVE-2024-12231 CodeZips Project Management System index.php sql injection
- CVE-2024-12230 PHPGurukul Complaint Management System subcategory.php sql injection
- CVE-2024-1223 Improper authorization controls in PaperCut NG/MF
- CVE-2024-12229 PHPGurukul Complaint Management System complaint-search.php sql injection
- CVE-2024-12228 PHPGurukul Complaint Management System user-search.php sql injection
- CVE-2024-12227 MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereference
- CVE-2024-12226 Information disclosure in Kubernetes Worker or Kubernetes Agent
- CVE-2024-12225 Io.quarkus:quarkus-security-webauthn: quarkus webauthn unexpected authentication bypass
- CVE-2024-12224 idna accepts Punycode labels that do not produce any non-ASCII when decoded
- CVE-2024-12223 Stored Cross-site Scripting (XSS) in Nutanix Prism Central
- CVE-2024-12222 Deliver via Shipos for WooCommerce <= 2.1.7 - Reflected Cross-Site Scripting via dvsfw_bulk_label_url Parameter
- CVE-2024-12221 Turnkey bbPress by WeaverTheme <= 1.6.3 - Reflected Cross-Site Scripting via _wpnonce Parameter
- CVE-2024-12220 SMS for WooCommerce <= 2.8.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-1222 Incorrect authorization controls in PaperCut NG/MF APIs
- CVE-2024-12219 Stop Registration Spam <= 1.23 - Cross-Site Request Forgery to Cross-Site Scripting
- CVE-2024-12218 Woocommerce check pincode/zipcode for shipping <= 2.0.4 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-12217 Path Traversal in gradio-app/gradio
- CVE-2024-12216 Arbitrary File Write via TarSlip in dmlc/gluon-cv
- CVE-2024-12215 Remote Code Execution in kedro-org/kedro
- CVE-2024-12214 WooCommerce HSS Extension for Streaming Video <= 3.31 - Reflected Cross-Site Scripting via videolink Parameter
- CVE-2024-12213 WP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_register
- CVE-2024-12212 Horner Automation Cscape Out-of-bounds Read
- CVE-2024-12211 Cross-site scripting in Pega Infinity
- CVE-2024-12210 Missing authorization in Print Invoice & Delivery Notes for WooCommerce
- CVE-2024-1221 Improper access controls on APIs on Linux and macOS in PaperCut NG/MF
- CVE-2024-12209 WP Umbrella: Update Backup Restore & Monitoring <= 2.17.0 - Unauthenticated Local File Inclusion
- CVE-2024-12207 Toggles Shortcode and Widget <= 1.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-12206 Wordpress Header Builder Plugin <= 1.3.8 - Cross-Site Request Forgery to Header Deletion
- CVE-2024-12205 Themesflat Addons For Elementor <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12204 Coupon X: Discount Pop Up, Promo Code Pop Ups, Announcement Pop Up, WooCommerce Popups <= 1.3.5 - Missing Authorization
- CVE-2024-12203 RSS Icon Widget <= 5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-12202 Croma Music <= 3.6 - Authenticated (Subscriber+) Arbitrary Options Update in ironMusic_ajax
- CVE-2024-12201 Hash Form <= 1.2.1 - Missing Authorization to Authenticated (Contributor+) Form Style Creation
- CVE-2024-12200 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-1220 NPort W2150A/W2250A Series Web Server Stack-based Buffer Overflow Vulnerability
- CVE-2024-12199 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12198 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12197 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12196 Missing authorization in Server
- CVE-2024-12195 SQL injection in Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- CVE-2024-12194 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12193 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12192 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12191 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12190 Missing authorization in Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder
- CVE-2024-1219 Easy Social Feed < 6.5.6 - Contributor+ Stored XSS
- CVE-2024-12189 Cross-site scripting in WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder
- CVE-2024-12188 1000 Projects Library Management System stu.php sql injection
- CVE-2024-12187 1000 Projects Library Management System showbook.php sql injection
- CVE-2024-12186 code-projects Hotel Management System Available Room hotelnew.c stack-based overflow
- CVE-2024-12185 code-projects Hotel Management System Administrator Login Password stack-based overflow
- CVE-2024-12184 WordPress Contact Forms by Cimatti <= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download
- CVE-2024-12183 DedeCMS HTTP POST Request carbuyaction.php RemoveXSS cross site scripting
- CVE-2024-12182 DedeCMS soft_add.php cross site scripting
- CVE-2024-12181 DedeCMS SWF File uploads_add.php cross site scripting
- CVE-2024-12180 DedeCMS article_add.php cross site scripting
- CVE-2024-1218 Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization
- CVE-2024-12179 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12178 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-12177 Ai Image Alt Text Generator for WP <= 1.0.6 - Reflected Cross-Site Scripting
- CVE-2024-12176 WordLift – AI powered SEO – Schema <= 3.54.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update