Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 506 of 521.
- CVE-2024-10617 Tongda OA check_seal.php sql injection
- CVE-2024-10616 Tongda OA webSignSubmit.php sql injection
- CVE-2024-10615 Tongda OA 2017 delete_data_attach.php sql injection
- CVE-2024-10614 Customer Reviews for WooCommerce <= 5.61.0 - Missing Authorization to Authenticated (Subscriber+) Import Cancellation
- CVE-2024-10613 ESAFENET CDG SystemEncryptPolicyService.java delSystemEncryptPolicy sql injection
- CVE-2024-10612 ESAFENET CDG HookInvalidCourseService.java removeHookInvalidCourse sql injection
- CVE-2024-10611 ESAFENET CDG PrintScreenListService.java delProtocol sql injection
- CVE-2024-10610 ESAFENET CDG ProtocolService.java delProtocol sql injection
- CVE-2024-1061 SQL injection in bplugins:html5 video player
- CVE-2024-10609 itsourcecode Tailoring Management System Project typeadd.php sql injection
- CVE-2024-10608 code-projects Courier Management System login.php sql injection
- CVE-2024-10607 code-projects Courier Management System track-result.php sql injection
- CVE-2024-10606 WP Travel Engine <= 6.2.1 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Update
- CVE-2024-10605 code-projects Blood Bank Management System request.php cross-site request forgery
- CVE-2024-10604 Identifiable Header Values In Fuchsia Leading To Tracking of The User
- CVE-2024-10603 Weak cryptography in gVisor
- CVE-2024-10602 Tongda OA 2017 data_picker_link.php sql injection
- CVE-2024-10601 Tongda OA 2017 delete.php sql injection
- CVE-2024-10600 Tongda OA 2017 submenu.php sql injection
- CVE-2024-1060 Use after free in Chrome
- CVE-2024-10599 Tongda OA 2017 package_static_resources.php resource consumption
- CVE-2024-10598 Tongda OA Annual Leave data.php improper authorization
- CVE-2024-10597 ESAFENET CDG PolicyActionService.java delPolicyAction sql injection
- CVE-2024-10596 ESAFENET CDG EncryptPolicyTypeService.java delEntryptPolicySort sql injection
- CVE-2024-10595 ESAFENET CDG PublicDocInfoAjax.java delDifferCourseList sql injection
- CVE-2024-10594 ESAFENET CDG FileDirectoryService.java docHistory sql injection
- CVE-2024-10593 WPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion
- CVE-2024-10592 Mapster WP Maps <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10591 Missing authorization in MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics
- CVE-2024-10590 Opt-In Downloads <= 4.07 - Authenticated (Subscriber+) Arbitrary File Upload
- CVE-2024-1059 Use after free in Chrome
- CVE-2024-10589 Leopard <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
- CVE-2024-10588 Debug Tool <= 2.2 - Missing Authorization to Information Exposure
- CVE-2024-10587 Funnelforms Free <= 3.7.5.1 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-10586 Debug Tool <= 2.2 - Unauthenticated Arbitrary File Creation
- CVE-2024-10585 InfiniteWP Client <= 1.13.0 - Unauthenticated Limited Directory Traversal to Arbitrary .txt File Reading
- CVE-2024-10584 DirectoryPress <= 3.6.16 - Authenticated (Author+) Stored Cross-Site Scripting
- CVE-2024-10583 Cross-site scripting in Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
- CVE-2024-10582 Missing authorization in Music Player for Elementor – Audio Player & Podcast Player
- CVE-2024-10581 DirectoryPress Frontend <= 2.7.9 - Cross-Site Request Forgery to Listing Status Update
- CVE-2024-10580 Missing authorization in Hustle – Email Marketing, Lead Generation, Optins, Popups
- CVE-2024-1058 SiteOrigin Widgets Bundle <= 1.58.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10579 Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.5 - Missing Authorization to Unpublished Form Exposure
- CVE-2024-10578 Pubnews <= 1.0.7 - Authenticated (Subscriber+) Arbitrary Plugin Installation
- CVE-2024-10577 Fat Rat Collect <= 2.7.3 - Reflected Cross-Site Scripting
- CVE-2024-10576 Unauthorized factory reset of Infinix devices
- CVE-2024-10575 Missing authorization in EcoStruxure IT Gateway
- CVE-2024-10574 Missing authorization in Quiz Maker Agency
- CVE-2024-10573 Mpg123: buffer overflow when writing decoded pcm samples
- CVE-2024-10572 Denial of Service and Arbitrary File Write in h2oai/h2o-3
- CVE-2024-10571 Chartify – WordPress Chart Plugin <= 2.9.5 - Unauthenticated Local File Inclusion via source
- CVE-2024-10570 SQL injection in Login Security, FireWall, Malware removal by CleanTalk
- CVE-2024-1057 Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
- CVE-2024-10569 Zip Bomb Vulnerability in gradio-app/gradio
- CVE-2024-10568 Ajax Search Lite < 4.12.4 - Admin+ Stored XSS
- CVE-2024-10567 TI WooCommerce Wishlist <= 2.9.1 - Missing Authorization to Unauthenticated Plugin Setup Wizard Access
- CVE-2024-10566 Slider by 10Web < 1.2.62 - Contributor+ Stored XSS
- CVE-2024-10565 Slider by 10Web < 1.2.62 - Admin+ Stored XSS via Widget
- CVE-2024-10563 WooCommerce Cart Count Shortcode < 1.1.0 - Contributor+ XSS
- CVE-2024-10562 Form Maker by 10Web < 1.15.31 - Admin+ Stored XSS
- CVE-2024-10561 Codezips Pet Shop Management System birdsupdate.php sql injection
- CVE-2024-10560 Form Maker by 10Web < 1.15.30 - Admin+ Stored XSS
- CVE-2024-1056 Cross-site scripting in FunnelKit Funnel Builder Pro
- CVE-2024-10559 SourceCodester Airport Booking Management System details buffer overflow
- CVE-2024-10558 Form Maker by 10Web < 1.15.30 - Admin+ Stored XSS
- CVE-2024-10557 code-projects Blood Bank Management System updateprofile.php cross-site request forgery
- CVE-2024-10556 Codezips Pet Shop Management System birdsadd.php sql injection
- CVE-2024-10555 MaxButtons < 9.8.1 - Admin+ Stored XSS via Button Width
- CVE-2024-10554 WP-Advanced-Search < 3.3.9.3 - Admin+ Stored XSS
- CVE-2024-10553 Jdbc Deserialization in h2oai/h2o-3
- CVE-2024-10552 Flexmls® IDX Plugin <= 3.14.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via API parameters
- CVE-2024-10551 Sticky Social Icons <= 1.2.1 - Admin+ Stored XSS
- CVE-2024-10550 Denial of Service by ReDOS in h2oai/h2o-3
- CVE-2024-1055 Cross-site scripting in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates)
- CVE-2024-10549 Denial of Service by ReDOS in h2oai/h2o-3
- CVE-2024-10548 Information disclosure in Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker
- CVE-2024-10547 WP Membership <= 1.6.2 - Unauthenticated Arbitrary File Upload
- CVE-2024-10546 open-scratch Teaching 在线教学平台 URL getDictItemsByTable sql injection
- CVE-2024-10545 NextGEN Gallery < 3.59.9 - Admin+ Stored XSS
- CVE-2024-10544 Woo Manage Fraud Orders <= 2.6.1 - Unauthenticated Information Exposure via Log Files
- CVE-2024-10543 Tumult Hype Animations <= 1.9.14 - Missing Authorization
- CVE-2024-10542 Missing authorization in Spam protection, Honeypot, Anti-Spam by CleanTalk
- CVE-2024-10540 SQL injection in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress
- CVE-2024-1054 Booster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10539 Reflected XSS in Uyumsoft's ERP
- CVE-2024-10538 Happy Addons for Elementor <= 3.12.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison
- CVE-2024-10537 Missing authorization in WP User Manager – User Profile Builder & Membership
- CVE-2024-10536 Missing authorization in FancyPost – Post Blocks, Grids & Sliders for Block Editor and Elementor
- CVE-2024-10535 Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
- CVE-2024-10534 Improper Access Control in Dataprom Informatics' PACS-ACSS
- CVE-2024-10533 WP Chat App <= 3.6.8 - Missing Authorization to Authenticated (Subscriber+) Filebird Plugin Installation
- CVE-2024-10532 Bard Extra <= 1.2.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import
- CVE-2024-10531 Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Update
- CVE-2024-10530 Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Addition
- CVE-2024-1053 Event Tickets and Registration <= 5.8.1 - Missing Authorization
- CVE-2024-10529 Kognetiks Chatbot for WordPress <= 2.1.7 - Missing Authorization to Authenticated (Subscriber+) Assistant Deletion
- CVE-2024-10528 Ultimate Member <= 2.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Profile Picture Update
- CVE-2024-10527 Spacer <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Limited Information Disclosure
- CVE-2024-10526 Rapid7 Velociraptor Local Privilege Escalation In Windows Velociraptor Service
- CVE-2024-10525 Eclipse Mosquito: Heap Buffer Overflow in my_subscribe_callback