Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 491 of 521.
- CVE-2024-12072 Analytics Cat – Google Analytics Made Easy <= 1.1.2 - Reflected Cross-Site Scripting
- CVE-2024-12071 Missing authorization in Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media
- CVE-2024-12070 Denial of Service in haotian-liu/llava
- CVE-2024-1207 Booking Calendar <= 9.9 - Unauthenticated SQL Injection
- CVE-2024-12069 Lexicata <= 1.0.16 - Reflected Cross-Site Scripting
- CVE-2024-12068 Server-Side Request Forgery in haotian-liu/llava
- CVE-2024-12067 SQL injection in WP Travel – Ultimate Travel Booking System, Tour Management Engine
- CVE-2024-12066 SMSA Shipping(official) <= 2.3 - Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2024-12065 Local File Inclusion in haotian-liu/llava
- CVE-2024-12063 Denial of Service in imartinez/privategpt
- CVE-2024-12062 Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-12061 Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-12060 Cross-site scripting in WP Media Optimizer (.webp)
- CVE-2024-1206 WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton
- CVE-2024-12059 ElementInvader Addons for Elementor <= 1.3.1 - Missing Authorization to Arbitrary Options Read
- CVE-2024-12058 Path traversal in Connect Secure
- CVE-2024-12057 User credentials recorded in log files
- CVE-2024-12056 Client Secret not checked with OAuth Password grant type
- CVE-2024-12055 DoS using malicious gguf model file in ollama/ollama
- CVE-2024-12054 ZF Roll Stability Support Plus (RSSPlus) Authentication Bypass By Primary Weakness
- CVE-2024-12053 Memory corruption in Chrome
- CVE-2024-1205 File upload in Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring
- CVE-2024-12049 Woo Ukrposhta <= 1.17.11 - Reflected Cross-Site Scripting via order, post, and idd Parameters
- CVE-2024-12048 IDOR Vulnerability in transformeroptimus/superagi
- CVE-2024-12047 Cross-site scripting in WP Compress – Instant Performance & Speed Optimization
- CVE-2024-12046 Missing authorization in Medical Addon for Elementor
- CVE-2024-12045 Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
- CVE-2024-12044 Remote Code Execution by Pickle Deserialization in open-mmlab/mmdetection
- CVE-2024-12043 Cross-site scripting in Prime Slider – Addons for Elementor
- CVE-2024-12042 Cross-site scripting in MStore API – Create Native Android & iOS Apps On The Cloud
- CVE-2024-12041 Information disclosure in Directorist: AI-Powered Business Directory, Listings & Classified Ads
- CVE-2024-12040 Path traversal in Product Carousel Slider & Grid Ultimate for WooCommerce
- CVE-2024-1204 Meta Box < 5.9.4 - Contributor+ Arbitrary Posts' Custom Field Disclosure
- CVE-2024-12039 Improper Restriction of Excessive Authentication Attempts in langgenius/dify
- CVE-2024-12038 Cross-site scripting in Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC)
- CVE-2024-12037 Frontend Content Forms for User Submissions (UGC) <= 2.8.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-12036 CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read
- CVE-2024-12035 CS Framework <= 7.0 - Authenticated (Subscriber+) Arbitrary File Deletion
- CVE-2024-12034 Advanced Google reCAPTCHA <= 1.25 - Brute Force Protection IP Unblock
- CVE-2024-12033 Jupiter X Core <= 4.8.5 - Missing Authorization to Authenticated Library Sync
- CVE-2024-12032 SQL injection in Tourfic – Travel Booking, Hotel Booking & Car Rental WordPress Plugin
- CVE-2024-12031 Advanced Floating Content <= 3.8.2 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-12030 MDTF – Meta Data and Taxonomies Filter <= 1.3.3.5 - Authenticated (Contributor+) SQL Injection
- CVE-2024-1203 SQL injection in Conversios: Google Analytics (GA4), Google Ads, Conversion and Analytics Tracking for Multi-Channels
- CVE-2024-12029 Remote Code Execution via Model Deserialization in invoke-ai/invokeai
- CVE-2024-12028 Friends <= 3.2.1 - Missing Authorization
- CVE-2024-12027 Missing authorization in Message Filter for Contact Form 7
- CVE-2024-12026 Message Filter for Contact Form 7 <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) New Filter Creation
- CVE-2024-12025 Collapsing Categories <= 3.0.8 - Unauthenticated SQL Injection
- CVE-2024-12024 Cross-site scripting in EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-12023 FULL – Cliente 3.1.5 - 3.1.25 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-12021 Stored Cross-Site Scripting
- CVE-2024-12020 Reflected Cross-Site Scripting (XSS)
- CVE-2024-1202 Authentication Bypass in XPodas' Octopod
- CVE-2024-12019 Arbitrary File Read via Document API
- CVE-2024-12018 Snippet Shortcodes <= 4.1.6 - Authenticated (Subscriber+) Shortcode Deletion
- CVE-2024-12016 SQLi in CM Informatics' CM News
- CVE-2024-12015 SQL Injection in WordPress Project Manager Plugin
- CVE-2024-12014 Path Traversal vulnerability in eSignaViewer Allow Unauthorized File Access
- CVE-2024-12013 Hardcoded credentials in 130.8005
- CVE-2024-12012 Information disclosure in 130.8005
- CVE-2024-12011 Information disclosure in 130.8005
- CVE-2024-12010 Command injection in AX7501-B1 firmware
- CVE-2024-1201 PanteraSoft HDD Health search path or unquoted item vulnerability
- CVE-2024-12009 Command injection in EX5601-T1 firmware
- CVE-2024-12008 W3 Total Cache <= 2.8.1 Information Exposure via Log Files
- CVE-2024-12007 code-projects Farmacia visualizar-produto.php sql injection
- CVE-2024-12006 Missing authorization in W3 Total Cache
- CVE-2024-12005 WP-BibTeX <= 3.0.1 - Cross-Site Request Forgery to Stored and Reflected Cross-Site Scripting
- CVE-2024-12004 WPC Order Notes for WooCommerce <= 1.5.2 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
- CVE-2024-12003 WP System <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-12002 Tenda FH451/FH1201/FH1202/FH1206 GetIPTV websReadEvent null pointer dereference
- CVE-2024-12001 code-projects Wazifa System Setting updatesettings.php cross site scripting
- CVE-2024-12000 code-projects Blood Bank System Setting updatesettings.php cross site scripting
- CVE-2024-1200 Jspxcms information disclosure
- CVE-2024-11999 Supply chain in Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7 series with EcoStruxure Operator Terminal Expert runtime
- CVE-2024-11998 code-projects Farmacia visualizer-forneccedor.chp sql injection
- CVE-2024-11997 code-projects Farmacia vendas.php cross site scripting
- CVE-2024-11996 code-projects Farmacia editar-fornecedor.php cross site scripting
- CVE-2024-11995 code-projects Farmacia pagamento.php cross site scripting
- CVE-2024-11994 APM Server Insertion of Sensitive Information into Log File
- CVE-2024-11993 Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting
- CVE-2024-11992 Path traversal vulnerability in Quick.CMS
- CVE-2024-11991 Uninitialized memory access in Motoko incremental garbage collector
- CVE-2024-11990 Cross-Site Scripting (XSS) en SurgeMail de NetWin
- CVE-2024-1199 CodeAstro Employee Task Management System attendance-info.php denial of service
- CVE-2024-11986 Stored XSS in CrushFTP
- CVE-2024-11985 Denial of service in RT-AX55
- CVE-2024-11984 SUNNET Corporate Training Management System - Unrestricted Upload of File with Dangerous Type
- CVE-2024-11983 Billion Electric router - OS Command Injection
- CVE-2024-11982 Billion Electric router - Plaintext Storage of a Password
- CVE-2024-11981 Billion Electric router - Authentication Bypass
- CVE-2024-11980 Billion Electric router - Missing Authentication
- CVE-2024-1198 openBI Phar User.php addxinzhi deserialization
- CVE-2024-11979 Interinfo DreamMaker - Unrestricted File Upload through Path Traversal
- CVE-2024-11978 Interinfo DreamMaker - Arbitrary File Reading through Path Traversal
- CVE-2024-11977 kk Star Ratings – Rate Post & Collect User Feedbacks <= 5.4.10 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-11976 BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-11975 Reactflow Visitor Recording and Heatmaps <= 1.0.10 - Reflected Cross-Site Scripting
- CVE-2024-11974 Cross-site scripting in Media Library Assistant