Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 503 of 521.
- CVE-2024-10907 Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchat
- CVE-2024-10906 Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gpt
- CVE-2024-10905 IdentityIQ Improper Access Control VulnerabilityIdentityIQ Improper Access Control Vulnerability
- CVE-2024-10904 Stored XSS in Server Admin API
- CVE-2024-10903 Broken Link Checker < 2.4.2 - Admin+ SSRF
- CVE-2024-10902 Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gpt
- CVE-2024-10901 Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gpt
- CVE-2024-10900 Missing authorization in ProfileGrid – User Profiles, Groups and Communities
- CVE-2024-1090 ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in stopOptimizeAll
- CVE-2024-10899 Code injection in Product Table and List Builder for WooCommerce Lite
- CVE-2024-10898 Contact Form 7 Email Add on <= 1.9 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-10897 Tutor LMS Elementor Addons <= 2.1.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
- CVE-2024-10896 Logo Slider < 4.5.0 - Contributor+ Stored XSS
- CVE-2024-10895 Cross-site scripting in Counter Up – Animated Number Counter & Milestone Showcase
- CVE-2024-10894 Payment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10893 WP Booking Calendar < 10.6.5 - Admin+ Stored XSS
- CVE-2024-10892 Cost Calculator Builder < 3.2.43 - Settings update via CSRF
- CVE-2024-10891 Save as PDF Plugin by Pdfcrowd <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10890 WPAdverts – Classifieds Plugin <= 2.1.7 - Reflected Cross-Site Scripting
- CVE-2024-1089 ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in optimizeAllOn
- CVE-2024-10887 NiceJob <= 3.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10886 Cross-site scripting in Tribute Testimonials – WordPress Testimonial Grid/Slider
- CVE-2024-10885 SearchIQ – The Search Solution <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10884 SimpleForm Contact Form Submissions <= 2.1.0 - Reflected Cross-Site Scripting
- CVE-2024-10883 SimpleForm – Contact form made simple <= 2.2.0 - Reflected Cross-Site Scripting
- CVE-2024-10882 Product Delivery Date for WooCommerce - Lite <= 2.8.0 - Reflected Cross-Site Scripting
- CVE-2024-10881 LUNA RADIO PLAYER <= 6.24.11.07 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2024-10880 JobBoardWP – Job Board Listings and Submissions <= 1.3.0 - Reflected Cross-Site Scripting
- CVE-2024-1088 Password Protected Store for WooCommerce <= 2.2 - Information Exposure via REST API
- CVE-2024-10879 ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting
- CVE-2024-10878 Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting
- CVE-2024-10877 AFI – The Easiest Integration Plugin <= 1.92.0 - Reflected Cross-Site Scripting
- CVE-2024-10876 Cross-site scripting in Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More
- CVE-2024-10875 Gallery Manager <= 1.6.58 - Reflected Cross-Site Scripting
- CVE-2024-10874 Quotes llama <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10873 LA-Studio Element Kit for Elementor <= 1.4.2 - Authenticated (Contributor+) Local File Inclusion
- CVE-2024-10872 Getwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10871 Category Ajax Filter <= 2.8.2 - Unauthenticated Local File Inclusion
- CVE-2024-10869 GuardGiant Brute Force Protection <= 2.2.6 - Reflected Cross-Site Scripting
- CVE-2024-10868 Enter Addons – Ultimate Template Builder for Elementor <= 2.1.9 - Authenticated (Contributor+) Post Disclosure
- CVE-2024-10867 Cross-site scripting in Borderless – Addons and Templates for Elementor
- CVE-2024-10866 Export Import Menus <= 1.9.1 - Missing Authorization to Unauthenticated Menu Export
- CVE-2024-10865 Reflected Cross-Site Scripting vulnerability in OpenText Advanced Authentication
- CVE-2024-10864 SQL Injection vulnerability has been discovered in OpenText™ Advanced Authentication.
- CVE-2024-10863 Client-side audit exclusion vulnerability
- CVE-2024-10862 NEX-Forms <= 8.7.15 - Authenticated (Admin+) SQL Injection
- CVE-2024-10861 Missing authorization in Popup Box – Create Countdown, Coupon, Video, Contact Form Popups
- CVE-2024-10860 Missing authorization in NextMove Lite – Thank You Page for WooCommerce
- CVE-2024-1086 Linux Kernel Use-After-Free
- CVE-2024-10858 Jetpack 13.0-14.0 - Unauthenticated DOM-XSS
- CVE-2024-10857 Product Input Fields for WooCommerce <= 1.9 - Authenticated (Contributor+) Arbitrary File Read
- CVE-2024-10856 Booking Calendar WpDevArt <= 3.2.19 - Authenticated (Contributor+) SQL Injection
- CVE-2024-10855 Missing authorization in Image Optimizer, Resizer and CDN – Sirv
- CVE-2024-10854 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Import
- CVE-2024-10853 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Order Deletion
- CVE-2024-10852 Buy one click WooCommerce <= 2.2.9 - Missing Authorization to Authenticated (Subscriber+) Settings Export
- CVE-2024-10851 Razorpay Payment Button <= 2.4.6 - Reflected Cross-Site Scripting
- CVE-2024-10850 Razorpay Payment Button for Elementor <= 1.2.5 - Reflected Cross-Site Scripting
- CVE-2024-1085 Use-after-free in Linux kernel's netfilter: nf_tables component
- CVE-2024-10849 NewsMash <= 1.0.71 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10848 NewsMunch <= 1.0.35 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10847 Storely <= 18 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10846 Excessive Platform Resource Consumption within a Loop when unmarshalling Compose file having recursive loop
- CVE-2024-10845 1000 Projects Bookstore Management System book_detail.php sql injection
- CVE-2024-10844 1000 Projects Bookstore Management System search.php sql injection
- CVE-2024-10842 romadebrian WEB-Sekolah Backend Proses_Edit_Akun.php cross site scripting
- CVE-2024-10841 romadebrian WEB-Sekolah Mail Proses_Kirim.php sql injection
- CVE-2024-10840 romadebrian WEB-Sekolah Backend akun_edit.php cross site scripting
- CVE-2024-1084 Cross-site scripting in Enterprise Server
- CVE-2024-10839 XML External Entity
- CVE-2024-10838 Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB read
- CVE-2024-10837 SysBasics Customize My Account for WooCommerce <= 2.7.29 - Reflected Cross-Site Scripting via tab Parameter
- CVE-2024-10836 Flixita <= 1.0.82 - Reflected Cross-Site Scripting via id Parameter
- CVE-2024-10835 Arbitrary File Write via SQL Injection in eosphoros-ai/db-gpt
- CVE-2024-10834 Arbitrary File Write in eosphoros-ai/db-gpt
- CVE-2024-10833 Arbitrary File Write in eosphoros-ai/db-gpt
- CVE-2024-10832 Posti Shipping <= 3.10.3 - Reflected Cross-Site Scripting
- CVE-2024-10831 Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt
- CVE-2024-10830 Path Traversal in eosphoros-ai/db-gpt
- CVE-2024-1083 Simple Restrict <= 1.2.6 - Missing Authorization to Sensitive Information Exposure
- CVE-2024-10829 Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gpt
- CVE-2024-10828 Advanced Order Export For WooCommerce <= 3.5.5 - Unauthenticated PHP Object Injection via Order Details
- CVE-2024-10827 Use after free in Chrome
- CVE-2024-10826 Use after free in Chrome
- CVE-2024-10825 Hide My WP Ghost – Security & Firewall <= 5.3.01 - Reflected Cross-Site Scripting via URL
- CVE-2024-10824 Missing authorization in Enterprise Server
- CVE-2024-10821 Denial of Service (DoS) in invoke-ai/invokeai
- CVE-2024-10820 WooCommerce Upload Files <= 84.3 - Unauthenticated Arbitrary File Upload
- CVE-2024-1082 Path traversal in Enterprise Server
- CVE-2024-10819 CSRF to XSS in binary-husky/gpt_academic
- CVE-2024-10818 JSFiddle Shortcode < 1.1.3 - Contributor+ XSS via Shortcode
- CVE-2024-10816 LUNA RADIO PLAYER <= 6.24.01.24 - Unauthenticated Arbitrary File Read
- CVE-2024-10815 PostLists <= 2.0.2 - Reflected XSS
- CVE-2024-10814 Code Embed <= 2.5 - Authenticated (Contributor+) Server-Side Request Forgery
- CVE-2024-10813 Product Table for WooCommerce by CodeAstrology (wooproducttable.com) <= 3.5.1 - Information Exposure
- CVE-2024-10812 Open Redirect in binary-husky/gpt_academic
- CVE-2024-10811 Path traversal in Endpoint Manager
- CVE-2024-10810 code-projects E-Health Care System app_request.php sql injection
- CVE-2024-1081 3D FlipBook – PDF Flipbook WordPress <= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks
- CVE-2024-10809 code-projects E-Health Care System chat.php sql injection