Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 498 of 521.
- CVE-2024-11401 Rapid7 Insight Platform Privilege Escalation Vulnerability
- CVE-2024-11400 HUSKY – Products Filter for WooCommerce <= 1.3.6.3 - Reflected Cross-Site Scripting via really_curr_tax Parameter
- CVE-2024-1140 Twister Antivirus v8.17 - Out-of-bounds Read
- CVE-2024-11399 Information disclosure in BeeDrive for desktop
- CVE-2024-11398 Path traversal in Synology Router Manager (SRM)
- CVE-2024-11396 Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
- CVE-2024-11395 Memory corruption in Chrome
- CVE-2024-11394 Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2024-11393 Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2024-11392 Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2024-11391 Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-11390 Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS
- CVE-2024-1139 Cluster-monitoring-operator: credentials leak
- CVE-2024-11388 Cross-site scripting in Dino Game – Embed Google Chrome Dinosaur Game in your website
- CVE-2024-11387 Easy Liveblogs <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11386 GatorMail SmartForms <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11385 Pure CSS Circle Progress bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11384 Arena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11383 CC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11382 Cross-site scripting in Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites
- CVE-2024-11381 Control horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11380 Mini Program API <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1138 TIBCO FTL Privilege Escalation
- CVE-2024-11379 Broadcast <= 51.01 - Reflected Cross-Site Scripting
- CVE-2024-11378 Bizapp for WooCommerce <= 2.0.8 - Reflected Cross-Site Scripting
- CVE-2024-11377 Automate Hub Free by Sperse.IO <= 1.7.0 - Reflected Cross-Site Scripting
- CVE-2024-11376 Cross-site scripting in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
- CVE-2024-11375 WC1C <= 0.23.0 - Reflected Cross-Site Scripting
- CVE-2024-11374 TWChat – Send or receive messages from users <= 4.0.4 - Reflected Cross-Site Scripting
- CVE-2024-11373 Connexion Logs <= 3.0.2 - Log Deletion via CSRF
- CVE-2024-11372 Connexion Logs <= 3.0.2 - Admin+ SQL Injection
- CVE-2024-11371 Theater for WordPress <= 0.18.6.2 - Reflected Cross-Site Scripting
- CVE-2024-11370 Subaccounts for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting
- CVE-2024-1137 TIBCO ActiveSpaces Information Leak Vulnerability
- CVE-2024-11369 Store credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site Scripting
- CVE-2024-11368 Splash Sync <= 2.0.7 - Reflected Cross-Site Scripting
- CVE-2024-11367 Smoove connector for Elementor forms <= 4.1.0 - Reflected Cross-Site Scripting
- CVE-2024-11366 SEO Landing Page Generator <= 1.66.2 - Reflected Cross-Site Scripting
- CVE-2024-11365 Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting
- CVE-2024-11364 Rockwell Automation Third Party Vulnerability in Arena®
- CVE-2024-11363 Same but Different – Related Posts by Taxonomy <= 1.0.16 - Reflected Cross-Site Scripting
- CVE-2024-11362 Cross-site scripting in PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI)
- CVE-2024-11361 PDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site Scripting
- CVE-2024-11360 Page Parts <= 1.4.3 - Reflected Cross-Site Scripting
- CVE-2024-1136 Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass
- CVE-2024-11359 Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting
- CVE-2024-11358 Insecure Android File Provider Paths
- CVE-2024-11357 Goodlayers Core < 2.0.10 - Contributor+ Stored XSS
- CVE-2024-11356 Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking
- CVE-2024-11355 Missing authorization in Ultimate YouTube Video & Shorts Player With Vimeo
- CVE-2024-11354 Missing authorization in Ultimate YouTube Video & Shorts Player With Vimeo
- CVE-2024-11353 SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion
- CVE-2024-11352 TwentyTwenty <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11351 Information disclosure in Restrict – membership, site, content and user access restrictions for WordPress
- CVE-2024-11350 AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover
- CVE-2024-1135 HTTP Request Smuggling in benoitc/gunicorn
- CVE-2024-11349 AdForest <= 5.1.6 - Authentication Bypass
- CVE-2024-11348 Reflected XSS in Eura7 CMSmanager
- CVE-2024-11347 Access of Resource Using Incompatible Type in Postscript interpreter
- CVE-2024-11346 Access of Resource Using Incompatible Type in Postscript interpreter
- CVE-2024-11345 Heap-based memory vulnerability in the Postscript interpreter in various Lexmark devices
- CVE-2024-11344 Type confusion vulnerability in the Postscript interpreter in various Lexmark devices
- CVE-2024-11343 Telerik Document Processing Path Traversal
- CVE-2024-11342 Skt NURCaptcha <= 3.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-11341 Simple Redirection <= 1.5 - Cross-Site Request Forgery to Arbitrary Site Redirect
- CVE-2024-1134 SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11339 Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11338 PIXNET Plugin <= 2.9.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting
- CVE-2024-11337 Horoscope And Tarot <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11336 Clickbank WordPress Plugin (Storefront) <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-11335 Cross-site scripting in UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included
- CVE-2024-11334 My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export
- CVE-2024-11333 HLS Player <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-11332 Cross-site scripting in HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents
- CVE-2024-11331 isee-products-extractor <= 2.1.3 - Reflected Cross-Site Scripting
- CVE-2024-11330 Custom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site Scripting
- CVE-2024-1133 Tutor LMS <= 2.6.0 - Missing Authorization
- CVE-2024-11329 Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting
- CVE-2024-11328 CLUEVO LMS, E-Learning Platform <= 1.13.2 - Reflected Cross-Site Scripting
- CVE-2024-11327 Cross-site scripting in ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages
- CVE-2024-11326 Campaign Monitor Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting
- CVE-2024-11325 AWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting
- CVE-2024-11324 Accounting for WooCommerce <= 1.6.6 - Reflected Cross-Site Scripting
- CVE-2024-11323 AI Quiz | Quiz Maker <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- CVE-2024-11322 CyberPower PowerPanel Business Unauthenticated Restart DoS
- CVE-2024-11321 Reflected XSS in Hi e-learning's Learning Management System (LMS)
- CVE-2024-11320 Command Injection leading to RCE via LDAP Misconfiguration
- CVE-2024-1132 Keycloak: path transversal in redirection validation
- CVE-2024-11319 Stored XSS in Open Source Project "django-cms"
- CVE-2024-11318 IDOR vulnerability in AbsysNet
- CVE-2024-11317 PHP Session Fixation
- CVE-2024-11316 Filesize Check
- CVE-2024-11315 TRCore DVC - Arbitrary File Upload through Path Traversal
- CVE-2024-11314 TRCore DVC - Arbitrary File Upload through Path Traversal
- CVE-2024-11313 TRCore DVC - Arbitrary File Upload through Path Traversal
- CVE-2024-11312 TRCore DVC - Arbitrary File Upload through Path Traversal
- CVE-2024-11311 TRCore DVC - Arbitrary File Upload through Path Traversal
- CVE-2024-11310 TRCore DVC - Arbitrary File Read through Path Traversal
- CVE-2024-11309 TRCore DVC - Arbitrary File Read through Path Traversal
- CVE-2024-11308 TRCore DVC - Use of Hard-coded Cryptographic Key