Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 502 of 521.
- CVE-2024-11010 FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion
- CVE-2024-11009 SQL injection in Automatic Internal Links for SEO by Pagup
- CVE-2024-11008 Members <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
- CVE-2024-11007 Command injection in Connect Secure
- CVE-2024-11006 Command injection in Connect Secure
- CVE-2024-11005 Command injection in Connect Secure
- CVE-2024-11004 Cross-site scripting in Connect Secure
- CVE-2024-11003 Command injection in needrestart
- CVE-2024-11002 Code injection in InPost Gallery
- CVE-2024-11000 CodeAstro Real Estate Management System About Us Page aboutedit.php unrestricted upload
- CVE-2024-1100 SQLi in Vadi Corporate Information Systems' DIGIKENT GIS
- CVE-2024-10999 CodeAstro Real Estate Management System About Us Page aboutadd.php unrestricted upload
- CVE-2024-10998 1000 Projects Bookstore Management System process_category_add.php sql injection
- CVE-2024-10997 1000 Projects Bookstore Management System book_list.php sql injection
- CVE-2024-10996 1000 Projects Bookstore Management System process_category_edit.php sql injection
- CVE-2024-10995 Codezips Hospital Appointment System removeDoctorResult.php sql injection
- CVE-2024-10994 Codezips Online Institute Management System edit_user.php unrestricted upload
- CVE-2024-10993 Codezips Online Institute Management System manage_website.php unrestricted upload
- CVE-2024-10991 Codezips Hospital Appointment System editBranchResult.php sql injection
- CVE-2024-10990 SourceCodester Online Veterinary Appointment System view_service.php sql injection
- CVE-2024-1099 Rebuild read-raw getFileOfData cross site scripting
- CVE-2024-10989 code-projects E-Health Care System detail.php sql injection
- CVE-2024-10988 code-projects E-Health Care System doctor_login.php sql injection
- CVE-2024-10987 code-projects E-Health Care System user_appointment.php sql injection
- CVE-2024-10986 Local File Read (LFI) by Tarslip Symlink via arxiv_download() API in binary-husky/gpt_academic
- CVE-2024-10980 Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS
- CVE-2024-1098 Rebuild proxy-download QiniuCloud.getStorageFile information disclosure
- CVE-2024-10979 PostgreSQL PL/Perl environment variable changes execute arbitrary code
- CVE-2024-10978 PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID
- CVE-2024-10977 PostgreSQL libpq retains an error message from man-in-the-middle
- CVE-2024-10976 PostgreSQL row security below e.g. subqueries disregards user ID changes
- CVE-2024-10975 Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission
- CVE-2024-10973 Keycloak: cli option for encrypted jgroups ignored
- CVE-2024-10972 WinPmem Improper Input Validation vulnerability
- CVE-2024-10971 Missing authorization in DVLS (Devolutions Server)
- CVE-2024-10970 Code injection in Motors – Car Dealership & Classified Listings Plugin
- CVE-2024-1097 Stored XSS in craigk5n/webcalendar
- CVE-2024-10969 1000 Projects Bookstore Management System Login login_process.php sql injection
- CVE-2024-10968 1000 Projects Bookstore Management System contact_process.php sql injection
- CVE-2024-10967 code-projects E-Health Care System delete_user_appointment_request.php sql injection
- CVE-2024-10966 TOTOLINK X18 cstecgi.cgi os command injection
- CVE-2024-10965 emqx neuron JSON File schema information disclosure
- CVE-2024-10964 emqx neuron plugin_handle.c handle_add_plugin buffer overflow
- CVE-2024-10963 Pam: improper hostname interpretation in pam_access leads to access control bypass
- CVE-2024-10962 Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection
- CVE-2024-10961 Social Login <= 5.9.0 - Authentication Bypass via Disqus OAuth provider
- CVE-2024-10960 Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads
- CVE-2024-1096 Twister Antivirus v8.17 - Denial of Service
- CVE-2024-10959 Code injection in Active Products Tables for WooCommerce. Use constructor to create tables
- CVE-2024-10958 WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay
- CVE-2024-10957 UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection
- CVE-2024-10956 Cross-Site WebSocket Hijacking in binary-husky/gpt_academic
- CVE-2024-10955 ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgpt
- CVE-2024-10954 Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim`
- CVE-2024-10953 data.all authenticated users can perform mutating update operations on persisted notification records
- CVE-2024-10952 Authors List <= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax
- CVE-2024-10950 Code Injection in binary-husky/gpt_academic
- CVE-2024-1095 Build & Control Block Patterns – Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorization
- CVE-2024-10948 Arbitrary File Read via Upload Function in binary-husky/gpt_academic
- CVE-2024-10947 SQL injection in Interlib Library Cluster Automation Management System
- CVE-2024-10946 SQL injection in Interlib Library Cluster Automation Management System
- CVE-2024-10945 FactoryTalk® Updater Local Privilege Escalation
- CVE-2024-10944 FactoryTalk® Updater Remote Code Execution
- CVE-2024-10943 FactoryTalk® Updater Authentication Bypass
- CVE-2024-10942 All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection
- CVE-2024-10941 Denial of service in Firefox
- CVE-2024-10940 Exposure of Sensitive System Information via ImagePromptTemplate in langchain-ai/langchain
- CVE-2024-1094 Missing authorization in Timetics – Appointment Booking & Scheduling
- CVE-2024-10939 Image Widget < 4.4.11 - Admin+ Stored XSS
- CVE-2024-10938 OVRI Payment 1.7.0 - Malicious .htaccess directive
- CVE-2024-10937 Information disclosure in Related Posts By PickPlugins
- CVE-2024-10936 String Locator <= 2.6.6 - Unauthenticated PHP Object Injection
- CVE-2024-10935 Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
- CVE-2024-10934 OpenBSD NFS double-free vulnerability
- CVE-2024-10933 OpenBSD readdir directory traversal
- CVE-2024-10932 Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace'
- CVE-2024-10930 Carrier Block Load Privilege Escalation
- CVE-2024-1093 Change Memory Limit <= 1.0 - Missing Authorization via admin_logic()
- CVE-2024-10929 Spectre-BSE
- CVE-2024-10928 MonoCMS Posts Page opensaved.php cross site scripting
- CVE-2024-10927 MonoCMS Account Information Page account.php cross site scripting
- CVE-2024-10926 IBPhoenix ibWebAdmin Tabelas Section toggle_fold_panel.php cross site scripting
- CVE-2024-10925 Authorization Bypass Through User-Controlled Key in GitLab
- CVE-2024-10924 Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass
- CVE-2024-10923 Improper Neutralization vulnerability has been discovered in OpenText™ ALM Octane Management.
- CVE-2024-10921 Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server
- CVE-2024-10920 mariazevedo88 travels-java-api JWT Secret JwtAuthenticationTokenFilter.java doFilterInternal hard-coded key
- CVE-2024-1092 Missing authorization in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- CVE-2024-10919 didi Super-Jacoco triggerUnitCover os command injection
- CVE-2024-10918 Stack-based Buffer Overflow in libmodbus library
- CVE-2024-10917 Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength
- CVE-2024-10916 D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L HTTP GET Request info.xml information disclosure
- CVE-2024-10915 D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
- CVE-2024-10914 D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection
- CVE-2024-10913 Clone <= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace'
- CVE-2024-10912 Denial of Service in lm-sys/fastchat
- CVE-2024-10910 Code injection in Grid Plus – Unlimited grid layout
- CVE-2024-1091 ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Plugin Data Removal in reinitialize
- CVE-2024-10909 Pojo Forms <= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode
- CVE-2024-10908 Open Redirect in lm-sys/fastchat