Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 507 of 521.
- CVE-2024-10524 GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs
- CVE-2024-10523 Information Disclosure Vulnerability in TP-Link IoT Smart Hub
- CVE-2024-10522 Co-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter
- CVE-2024-10521 WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function
- CVE-2024-10520 WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion
- CVE-2024-1052 Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering
- CVE-2024-10519 Cross-site scripting in Wishlist for WooCommerce: Multi Wishlists Per Customer PRO
- CVE-2024-10518 ProfilePress < 4.15.15 - Admin+ Stored XSS
- CVE-2024-10517 ProfilePress < 4.15.15 - Admin+ Stored XSS
- CVE-2024-10516 Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify'
- CVE-2024-10515 SEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSS
- CVE-2024-10513 Path Traversal in mintplex-labs/anything-llm
- CVE-2024-10511 Auth bypass in PowerChute Serial Shutdown
- CVE-2024-10510 adBuddy+ (AdBlocker Detection) by NetfunkDesign <= 1.1.3 - Admin+ Stored XSS
- CVE-2024-1051 List category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10509 Codezips Online Institute Management System login.php sql injection
- CVE-2024-10508 Auth bypass in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login
- CVE-2024-10507 Codezips Free Exam Hall Seating Management System login.php sql injection
- CVE-2024-10506 code-projects Blood Bank System B-.php sql injection
- CVE-2024-10505 wuzhicms block.php edit code injection
- CVE-2024-10504 ARForms Builder < 1.7.1 - Unauthenticated Stored XSS
- CVE-2024-10503 Klokan MapTiler tileserver-gl URL cross site scripting
- CVE-2024-10502 ESAFENET CDG FileDirectoryService.java getOneFileDirectory sql injection
- CVE-2024-10501 ESAFENET CDG ExamCDGDocService.java findById sql injection
- CVE-2024-10500 ESAFENET CDG HookWhiteListService.java sql injection
- CVE-2024-1050 Import and export users and customers <= 1.26.5 - Missing Authorization
- CVE-2024-10499 AI-Engine < 2.6.5 - Admin+ SQLi
- CVE-2024-10498 Memory corruption in PowerLogic HDPM6000
- CVE-2024-10497 Missing authorization in PowerLogic HDPM6000
- CVE-2024-10496 Out of bounds read in BuildFontMap in fontmgr.cpp in NI LabVIEW
- CVE-2024-10495 Out of bounds read when loading the font table in fontmgr.cpp in NI LabVIEW
- CVE-2024-10494 Out of bounds read in HeapObjMapImpl.cpp in NI LabVIEW
- CVE-2024-10493 Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS
- CVE-2024-10492 Keycloak-quarkus-server: keycloak path trasversal
- CVE-2024-10491 Preload arbitrary resources by injecting additional `Link` headers
- CVE-2024-10490 Authentication bypass flaw in several mapp components
- CVE-2024-1049 Page Builder Gutenberg Blocks – CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-10488 Use after free in Chrome
- CVE-2024-10487 Memory corruption in Chrome
- CVE-2024-10486 Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
- CVE-2024-10484 Cross-site scripting in Spectra Gutenberg Blocks – Website Builder for the Block Editor
- CVE-2024-10483 SimplePress Forum < 6.10.11 - Reflected XSS
- CVE-2024-10482 Media Library Tools < 1.5.0 - Author+ Stored XSS via SVG
- CVE-2024-10481 Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui
- CVE-2024-10480 3DPrint Lite < 2.1 - Settings Update via CSRF
- CVE-2024-1048 Grub2: grub2-set-bootflag can be abused by local (pseudo-)users
- CVE-2024-10479 LinZhaoguan pb-cms Theme Management Module admin#themes cross site scripting
- CVE-2024-10478 LinZhaoguan pb-cms Edit Article edit cross site scripting
- CVE-2024-10477 LinZhaoguan pb-cms Permission Management Page admin#permissions cross site scripting
- CVE-2024-10476 Hardcoded credentials in BD BACTEC™ Blood Culture System
- CVE-2024-10475 Lead Form Builder < 1.9.8 - Admin+ Stored XSS
- CVE-2024-10474 Security feature bypass in Focus for iOS
- CVE-2024-10473 Logo Slider < 4.5.0 - Author+ Stored XSS
- CVE-2024-10472 Stylish Price List < 7.1.12 - Contributor+ Stored XSS
- CVE-2024-10471 Everest Forms < 3.0.4.2 - Admin+ Stored XSS
- CVE-2024-10470 WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion
- CVE-2024-1047 ThemeIsle SDK <= Various Versions - Missing Authorization
- CVE-2024-10469 CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view.
- CVE-2024-10468 Race condition in Firefox
- CVE-2024-10467 Memory corruption in Firefox
- CVE-2024-10466 Denial of service in Firefox
- CVE-2024-10465 Security feature bypass in Firefox
- CVE-2024-10464 Denial of service in Firefox
- CVE-2024-10463 Information disclosure in Firefox
- CVE-2024-10462 Security feature bypass in Firefox
- CVE-2024-10461 Cross-site scripting in Firefox
- CVE-2024-10460 Security feature bypass in Firefox
- CVE-2024-1046 Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
- CVE-2024-10459 Use after free in Firefox
- CVE-2024-10458 Security feature bypass in Firefox
- CVE-2024-10457 SSRF Vulnerabilities in significant-gravitas/autogpt
- CVE-2024-10456 Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data
- CVE-2024-10455 Reachable Assertion in µD3TN
- CVE-2024-10454 Clickjacking vulnerability in Clibo Manager
- CVE-2024-10453 Cross-site scripting in Elementor Website Builder – more than just a page builder
- CVE-2024-10452 Grafana org admin can delete pending invites in different org
- CVE-2024-10451 Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process
- CVE-2024-10450 SourceCodester Kortex Lite Advocate Office Management System POST Parameter edit_profile.php sql injection
- CVE-2024-10449 Codezips Hospital Appointment System loginAction.php sql injection
- CVE-2024-10448 code-projects Blood Bank Management System delete.php cross-site request forgery
- CVE-2024-10447 Project Worlds Online Time Table Generator staffdashboard.php sql injection
- CVE-2024-10446 Project Worlds Online Time Table Generator admindashboard.php sql injection
- CVE-2024-10445 Security feature bypass in BeeStation OS (BSM)
- CVE-2024-10444 Security feature bypass in DiskStation Manager (DSM)
- CVE-2024-10443 Command injection in BeePhotos
- CVE-2024-10442 Memory corruption in Replication Service
- CVE-2024-10441 Code injection in BeeStation OS (BSM)
- CVE-2024-10440 Sunnet eHRD CTMS - SQL Injection
- CVE-2024-1044 Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review
- CVE-2024-10439 Sunnet eHRD CTMS - Insecure Direct Object Reference
- CVE-2024-10438 Sunnet eHRD CTMS - Authentication Bypass
- CVE-2024-10437 Missing authorization in WPC Smart Messages for WooCommerce
- CVE-2024-10436 WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion
- CVE-2024-10435 didi Super-Jacoco triggerEnvCov command injection
- CVE-2024-10434 Tenda AC1206 ate ate_Tenda_mfg_check_usb3 stack-based overflow
- CVE-2024-10433 Project Worlds Simple Web-Based Chat Application index.php cross site scripting
- CVE-2024-10432 Project Worlds Simple Web-Based Chat Application index.php sql injection
- CVE-2024-10431 Codezips Pet Shop Management System deletebird.php sql injection
- CVE-2024-10430 Codezips Pet Shop Management System animalsupdate.php sql injection
- CVE-2024-1043 AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data