Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 500 of 521.
- CVE-2024-11209 Apereo CAS 2FA login improper authentication
- CVE-2024-11208 Apereo CAS login session expiration
- CVE-2024-11207 Apereo CAS login redirect
- CVE-2024-11206 Information disclosure in com.transsion.phoenix
- CVE-2024-11205 Missing authorization in WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More
- CVE-2024-11204 ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter
- CVE-2024-11203 Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more
- CVE-2024-11202 Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode
- CVE-2024-11201 Cross-site scripting in Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
- CVE-2024-11200 Goodlayers Core <= 2.0.7 - Reflected Cross-Site Scripting via 'font-family'
- CVE-2024-1120 Missing authorization in Finale Lite – Sales Countdown Timer & Discount for WooCommerce
- CVE-2024-11199 Rescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcode
- CVE-2024-11198 GD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter
- CVE-2024-11197 Lock User Account <= 1.0.5 - User Lock Bypass
- CVE-2024-11196 Multi-column Tag Map <= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode
- CVE-2024-11195 Cross-site scripting in Email Subscription Popup
- CVE-2024-11194 Missing authorization in Classified Listing – AI-Powered Classified ads & Business Directory Plugin
- CVE-2024-11193 Information disclosure in YugabyteDB Anywhere
- CVE-2024-11192 Cross-site scripting in Sp*tify Play Button for WordPress
- CVE-2024-11190 jwp-a11y <= 4.1.7 - Admin+ Stored XSS
- CVE-2024-1119 Order Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data Export
- CVE-2024-11189 Social Share And Social Locker – ARSocial < 1.4.2 - Admin+ Stored XSS
- CVE-2024-11188 Cross-site scripting in Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder
- CVE-2024-11187 Many records in the additional section cause CPU exhaustion
- CVE-2024-11186 Missing authorization in CloudVision Portal
- CVE-2024-11185 Security feature bypass in EOS
- CVE-2024-11184 WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG
- CVE-2024-11183 Simple Side Tab < 2.2.0 - Admin+ Stored XSS
- CVE-2024-11182 MDaemon Email Server Cross-Site Scripting (XSS)
- CVE-2024-11181 Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-11180 ElementsKit Elementor addons <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-1118 Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection
- CVE-2024-11179 MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-11178 Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP
- CVE-2024-11176 Incorrect evaluation of effective permissions in M-Files Aino
- CVE-2024-11175 Public CMS Voting Management save cross site scripting
- CVE-2024-11173 Unhandled Exception in danny-avila/librechat
- CVE-2024-11172 Denial of Service in danny-avila/librechat
- CVE-2024-11171 Improper Input Validation in danny-avila/librechat
- CVE-2024-11170 Path Traversal in danny-avila/librechat
- CVE-2024-1117 openBI Screen.php index code injection
- CVE-2024-11169 Unhandled Exception Leading to Server Crash in danny-avila/librechat
- CVE-2024-11168 Improper validation of IPv6 and IPvFuture addresses
- CVE-2024-11167 Improper Access Control in danny-avila/librechat
- CVE-2024-11166 Missing authorization in Collision Avoidance Systems
- CVE-2024-11165 Information disclosure in YugabyteDB Anywhere
- CVE-2024-1116 openBI Upload.php index unrestricted upload
- CVE-2024-11159 Information disclosure in Thunderbird
- CVE-2024-11158 Rockwell Automation Arena® Uninitialized Vulnerability
- CVE-2024-11157 Rockwell Automation Third Party Vulnerability in Arena
- CVE-2024-11156 Rockwell Automation Arena® Out of Bounds Write Vulnerability
- CVE-2024-11155 Rockwell Automation Arena® Use After Free Vulnerability
- CVE-2024-11154 Missing authorization in PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
- CVE-2024-11153 Information disclosure in Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More
- CVE-2024-11150 WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion
- CVE-2024-1115 openBI Setting.php dlfile os command injection
- CVE-2024-11149 OpenBSD vmm GDTR limits
- CVE-2024-11148 OpenBSD httpd(8) null dereference
- CVE-2024-11147 ECOVACS lawnmowers and vacuums deterministic root password
- CVE-2024-11146 TrueFiling authorization bypass via user-controlled keys
- CVE-2024-11145 Easy Folder Listing Pro deserialization vulnerability
- CVE-2024-11144 Race Condition with LightFTP
- CVE-2024-11143 Cross-site request forgery in Kognetiks Chatbot for WordPress
- CVE-2024-11142 CSRF in Gosoft Software's Proticaret E-Commerce
- CVE-2024-11141 Sailthru Triggermail < 1.1 - Subscriber+ Stored XSS
- CVE-2024-11140 Real WP Shop Lite Ajax eCommerce Shopping Cart <= 2.0.8 - Admin+ Stored XSS
- CVE-2024-1114 openBI Screen.php dlfile access control
- CVE-2024-11139 Memory corruption in EcoStruxure™ Power Build Rapsody
- CVE-2024-11138 DedeCMS friendlink_add.php unrestricted upload
- CVE-2024-11137 IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary
- CVE-2024-11136 Arbitrary file removal via path traversal in TCL Camera
- CVE-2024-11135 Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees
- CVE-2024-11134 Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export
- CVE-2024-11133 Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download
- CVE-2024-11132 Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-11131 Memory corruption in Camera Firmware
- CVE-2024-11130 ZZCMS msg.php cross site scripting
- CVE-2024-1113 openBI Unity.php uploadUnity unrestricted upload
- CVE-2024-11129 Generation of Error Message Containing Sensitive Information in GitLab
- CVE-2024-11128 Insufficient Hardened Runtime or Library Validation signing in Bitdefender Virus Scanner for macOS
- CVE-2024-11127 code-projects Job Recruitment admin.php sql injection
- CVE-2024-11126 Digistar AG-30 Plus Login Page excessive authentication
- CVE-2024-11125 GetSimpleCMS profile.php cross-site request forgery
- CVE-2024-11124 TimGeyssens UIOMatic uioMaticObject.r sql injection
- CVE-2024-11123 上海灵当信息科技有限公司 Lingdang CRM pdf.php path traversal
- CVE-2024-11122 上海灵当信息科技有限公司 Lingdang CRM index.php unrestricted upload
- CVE-2024-11121 上海灵当信息科技有限公司 Lingdang CRM index.php sql injection
- CVE-2024-11120 GeoVision Devices OS Command Injection
- CVE-2024-1112 Buffer Overflow Vulnerability in Resource Hacker
- CVE-2024-11119 BNE Gallery Extended <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode
- CVE-2024-11118 404 Error Monitor <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update via updatePluginSettings Function
- CVE-2024-11117 Security feature bypass in Chrome
- CVE-2024-11116 Other in Chrome
- CVE-2024-11115 Security feature bypass in Chrome
- CVE-2024-11114 Security feature bypass in Chrome
- CVE-2024-11113 Use after free in Chrome
- CVE-2024-11112 Use after free in Chrome
- CVE-2024-11111 Other in Chrome
- CVE-2024-11110 Security feature bypass in Chrome
- CVE-2024-1111 SourceCodester QR Code Login System add-user.php cross site scripting