Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 497 of 521.
- CVE-2024-11504 SQL Injection in Streamsoft Prestiż
- CVE-2024-11503 WP Tabs < 2.2.7 - Admin+ Stored XSS
- CVE-2024-11502 Planning Center Online Giving <= 1.0.0 - Contributor+ XSS via Shortcode
- CVE-2024-11501 Gallery <= 1.3 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-1150 Improper validation of update packages
- CVE-2024-11499 Null dereference in RTU500
- CVE-2024-11498 Resource exhaustion via Stack overflow in libjxl
- CVE-2024-11497 Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation
- CVE-2024-11496 Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update
- CVE-2024-11495 Buffer overflow in OllyDbg
- CVE-2024-11494 Auth bypass in P-6101C firmware
- CVE-2024-11493 115cms pageAE.html cross site scripting
- CVE-2024-11492 115cms appurladd.html cross site scripting
- CVE-2024-11491 115cms useradmin.html cross site scripting
- CVE-2024-11490 115cms set.html cross site scripting
- CVE-2024-1149 Improper validation of update packages
- CVE-2024-11489 115cms file.html cross site scripting
- CVE-2024-11488 115cms web_user.html cross site scripting
- CVE-2024-11487 Code4Berry Decoration Management System Between Dates Reports btndates_report.php sql injection
- CVE-2024-11486 Code4Berry Decoration Management System User Permission user_permission.php
- CVE-2024-11485 Code4Berry Decoration Management System User userregister.php permission
- CVE-2024-11484 Code4Berry Decoration Management System User Image update_image.php access control
- CVE-2024-11483 Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5
- CVE-2024-11482 Command injection in Trellix Enterprise Security Manager (ESM)
- CVE-2024-11481 Path traversal in Trellix Enterprise Security Manager (ESM)
- CVE-2024-1148 Weak Access Control - Arbitrary file upload
- CVE-2024-11479 Authenticated HTML Injection in Issuetrak Ticket Comment Function
- CVE-2024-11477 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability
- CVE-2024-1147 Weak Access Control - Arbitrary file download
- CVE-2024-11468 Privilege escalation in Omnissa Horizon Client for MacOS
- CVE-2024-11467 Privilege escalation in Omnissa Horizon Client for MacOS
- CVE-2024-11466 Intro Tour Tutorial DeepPresentation <= 6.5.2 - Reflected Cross-Site Scripting
- CVE-2024-11465 Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection
- CVE-2024-11464 Easy Code Snippets <= 1.0.2 - Reflected Cross-Site Scripting
- CVE-2024-11463 DeBounce Email Validator <= 5.6.5 - Reflected Cross-Site Scripting
- CVE-2024-11462 Filestack Official <= 2.1.0 - Reflected Cross-Site Scripting
- CVE-2024-11461 Form Data Collector <= 2.2.3 - Reflected Cross-Site Scripting
- CVE-2024-11460 Verowa Connect <= 3.0.1 - Unauthenticated SQL Injection
- CVE-2024-1146 Cross-site Scripting at Alma Devklan Blog
- CVE-2024-11459 Country Blocker <= 3.2 - Reflected Cross-Site Scripting
- CVE-2024-11458 FAQ Builder AYS <= 1.7.1 - Reflected Cross-Site Scripting
- CVE-2024-11457 Feedpress Generator – External RSS Frontend Customizer <= 1.2.1 - Reflected Cross-Site Scripting
- CVE-2024-11456 Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site Scripting
- CVE-2024-11455 Include Mastodon Feed <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11454 Untrusted Search Path vulnerability in Autodesk Revit
- CVE-2024-11453 Cross-site scripting in GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets
- CVE-2024-11452 Chamber Dashboard Business Directory <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11451 Zooom <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11450 ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1145 Observable Response Discrepancy at Alma Devklan Blog
- CVE-2024-11449 Server-Side Request Forgery in haotian-liu/llava
- CVE-2024-11447 Cross-site scripting in Community by PeepSo – Download from PeepSo.com
- CVE-2024-11446 Chessgame Shizzle <= 1.3.0 - Reflected Cross-Site Scripting
- CVE-2024-11445 Image Magnify <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11444 CLUEVO LMS, E-Learning Platform <= 1.13.2 - Cross-Site Request Forgery to Module Deletion
- CVE-2024-11443 de:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update
- CVE-2024-11442 Horizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11441 Stored XSS in Serge in serge-chat/serge
- CVE-2024-11440 Grey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1144 Improper Access Control at Alma Devklan Blog
- CVE-2024-11439 ScanCircle <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11438 StreamWeasels Online Status Bar <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11437 Timeline Designer <= 1.4 - Authenticated (Admin+) SQL Injection
- CVE-2024-11436 Cross-site scripting in Pie Forms — Drag & Drop Form Builder
- CVE-2024-11435 salavat counter Plugin <= 0.9.4 - Reflected Cross-Site Scripting
- CVE-2024-11434 WP – Bulk SMS – by SMS.to <= 1.0.12 - Reflected Cross-Site Scripting
- CVE-2024-11433 Surbma | SalesAutopilot Shortcode <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11432 SuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11431 Ragic Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11430 SQL Chart Builder <= 2.3.6 - Authenticated (Contributor+) SQL Injection
- CVE-2024-1143 Central Dogma Authentication Bypass Vulnerability via Session Leakage
- CVE-2024-11429 Path traversal in Stars Testimonials — Responsive Reviews & Star Ratings
- CVE-2024-11428 Lazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11427 Catch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11426 Cross-site scripting in AutoListicle: Automatically Update Numbered List Articles
- CVE-2024-11425 Denial of service in BMENOR2200H
- CVE-2024-11424 Slick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11423 Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch
- CVE-2024-11422 DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software
- CVE-2024-11420 Blocksy <= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1142 Sonatype IQ Server - Path Traversal
- CVE-2024-11419 Password for WP <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-11418 Additional Order Filters for WooCommerce <= 1.21 - Reflected Cross-Site Scripting
- CVE-2024-11417 dejure.org Vernetzungsfunktion <= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-11416 WIP Incoming Lite <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-11415 WP-Orphanage Extended <= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation
- CVE-2024-11414 RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11413 HostFact bestelformulier integratie <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11412 Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11411 Spotlightr <= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11410 Cross-site scripting in Yoo Bar – Floating Notification & Promo Bar for Website
- CVE-2024-1141 Glance-store: glance store access key logged in debug log level
- CVE-2024-11409 Grid View Gallery <= 1.0 - Authenticated (Editor+) PHP Object Injection
- CVE-2024-11408 Slotti Ajanvaraus <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11407 Denial of Service through Data corruption in gRPC-C++
- CVE-2024-11406 Stored XSS in django CMS Attributes Fields
- CVE-2024-11405 WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting
- CVE-2024-11404 File Upload Bypass in django Filer
- CVE-2024-11403 Out of Bounds Memory Read/Write in libjxl
- CVE-2024-11402 WordPress Block Editor Bootstrap Blocks plugin <= 6.6.1 - Reflected Cross Site Scripting (XSS) vulnerability