Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 490 of 521.
- CVE-2024-12175 Rockwell Automation Code Execution Vulnerability in Arena
- CVE-2024-12174 Security feature bypass in Security Center
- CVE-2024-12173 Master Slider < 3.10.5 - Editor+ Stored XSS
- CVE-2024-12172 Missing authorization in WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses
- CVE-2024-12171 Missing authorization in ELEX WordPress HelpDesk & Customer Ticketing System
- CVE-2024-12170 ViewMedica Embed <= 1.4.15 - Cross-Site Request Forgery to SQL Injection
- CVE-2024-1217 Missing authorization in Kali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2024-12169 Denial of service in RTU500
- CVE-2024-12168 DLL Hijacking in Yandex Telemost
- CVE-2024-12167 Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via _wpnonce
- CVE-2024-12166 Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via 'page'
- CVE-2024-12165 Mollie for Contact Form 7 <= 5.0.0 - Reflected Cross-Site Scripting
- CVE-2024-12164 Missing authorization in WPSyncSheets For WPForms – Google Sheets Connector for WPForms & Real‑Time Data Export
- CVE-2024-12163 GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload
- CVE-2024-12162 Video & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site Scripting
- CVE-2024-12160 Seraphinite Bulk Discounts for WooCommerce <= 2.4.6 - Reflected Cross-Site Scripting
- CVE-2024-12159 Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposure
- CVE-2024-12158 Missing authorization in Popup – MailChimp, GetResponse and ActiveCampaign Intergrations
- CVE-2024-12157 Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injection
- CVE-2024-12156 AI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scripting
- CVE-2024-12155 SV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update
- CVE-2024-12153 GDY Modular Content <= 0.9.92 - Reflected Cross-Site Scripting
- CVE-2024-12152 MIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File Download
- CVE-2024-12151 Privilege escalation in Server
- CVE-2024-12150 SQLi in Eron Software's Wowwo CRM
- CVE-2024-1215 SourceCodester CRUD without Page Reload fetch_data.php cross site scripting
- CVE-2024-12149 Privilege escalation in Remote Desktop Manager
- CVE-2024-12148 Missing authorization in Server
- CVE-2024-12147 Netgear R6900 HTTP Header upgrade_check.cgi buffer overflow
- CVE-2024-12146 SQLi in Finder Fire Safety's Finder ERP/CRM (New System)
- CVE-2024-12145 BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion
- CVE-2024-12144 SQLi in Finder Fire Safety's Finder ERP/CRM (Old System)
- CVE-2024-12143 SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDB
- CVE-2024-12142 Information disclosure in BMXNOE0100
- CVE-2024-12140 Information disclosure in Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements
- CVE-2024-1214 Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery
- CVE-2024-12138 horilla create_skills deserialization
- CVE-2024-12137 Authentication Bypass in Elfatek Elektronics' ANKA JPD-00028
- CVE-2024-12136 Improper Access Control in Elfatek Elektronics' ANKA JPD-00028
- CVE-2024-12133 Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos
- CVE-2024-12132 Missing authorization in WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
- CVE-2024-12131 Missing authorization in WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
- CVE-2024-12130 Rockwell Automation Arena® Out of Bounds Read Vulnerability
- CVE-2024-1213 Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery
- CVE-2024-12129 Royal Core <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update
- CVE-2024-12128 Cross-site scripting in Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
- CVE-2024-12127 Cross-site scripting in Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS
- CVE-2024-12126 SEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error Parameter
- CVE-2024-12125 3scale-porta: readonly fields not validated server-side
- CVE-2024-12123 Unauthorized Modification of Ticket Requester
- CVE-2024-12122 ResAds <= 2.0.6 - Reflected Cross-Site Scripting via Multiple Parameters
- CVE-2024-12121 Broken Link Checker | Finder <= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery
- CVE-2024-12120 Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1212 Progress Kemp LoadMaster OS Command Injection
- CVE-2024-12119 Cross-site scripting in Gallery by FooGallery
- CVE-2024-12118 The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12117 Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12116 Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.2 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-12115 Poll Maker <= 5.5.4 - Cross-Site Request Forgery to Poll Duplication
- CVE-2024-12114 Missing authorization in Gallery by FooGallery
- CVE-2024-12113 Missing authorization in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress
- CVE-2024-12112 Easy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-12111 Potential LDAP injection vulnerability in OpenText Privileged Access Manager
- CVE-2024-12110 Missing authorization in Gold Addons for Elementor
- CVE-2024-1211 Cross-Site Request Forgery (CSRF) in GitLab
- CVE-2024-12109 Product Labels For Woocommerce < 1.5.9 - Admin+ SQLi
- CVE-2024-12108 WhatsUp Gold - Public API signing key rotation issue
- CVE-2024-12107 Double Free in µD3TN
- CVE-2024-12106 Missing authorization in WhatsUp Gold
- CVE-2024-12105 WhatsUp Gold - SnmpExtendedActiveMonitor path traversal
- CVE-2024-12104 Missing authorization in Atarim – Visual Feedback, Review & AI Collaboration
- CVE-2024-12103 Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure
- CVE-2024-12102 Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-12100 Bitcoin Lightning Publisher for WordPress <= 1.4.1 - Reflected Cross-Site Scripting
- CVE-2024-1210 LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API
- CVE-2024-12099 Dollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-12098 ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting
- CVE-2024-12097 SQLi in Boceksoft Informatics' E-Travel
- CVE-2024-12096 Exhibit to WP Gallery <= 0.0.2 - Reflected XSS
- CVE-2024-12094 Information Disclosure Vulnerability in Tinxy
- CVE-2024-12093 Improper Validation of Consistency within Input in GitLab
- CVE-2024-12092 Cross-site scripting in ENOVIA Collaborative Industry Innovator
- CVE-2024-12091 Cross-site scripting in ENOVIA Collaborative Industry Innovator
- CVE-2024-12090 Cross-site scripting in ENOVIA Collaborative Industry Innovator
- CVE-2024-1209 LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments
- CVE-2024-12089 Cross-site scripting in ENOVIA Collaborative Industry Innovator
- CVE-2024-12088 Rsync: --safe-links option bypass leads to path traversal
- CVE-2024-12087 Rsync: path traversal vulnerability in rsync
- CVE-2024-12086 Rsync: rsync server leaks arbitrary client files
- CVE-2024-12085 Rsync: info leak via uninitialized stack contents
- CVE-2024-12084 Rsync: heap buffer overflow in rsync due to improper checksum length handling
- CVE-2024-12083 Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers
- CVE-2024-12082 Ability Runtime has an out-of-bounds read permission bypass vulnerability
- CVE-2024-1208 LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API
- CVE-2024-12079 ECOVACS lawnmowers cleartext storage of anti-theft PIN
- CVE-2024-12078 ECOVACS lawnmowers and vacuums static BLE GATT encryption key
- CVE-2024-12077 Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id'
- CVE-2024-12076 Target Video Easy Publish <= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-12074 Denial of Service in automatic1111/stable-diffusion-webui
- CVE-2024-12073 Meteor Slides <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting