Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 509 of 521.
- CVE-2024-10326 RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets
- CVE-2024-10325 Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-10324 Information disclosure in RTMKit
- CVE-2024-10323 JetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-10322 Brizy – Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-10321 Information disclosure in All-in-One Addons for Elementor – WidgetKit
- CVE-2024-10320 Cookielay <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode
- CVE-2024-1032 openBI Test Connection Databasesource.php testConnection deserialization
- CVE-2024-10319 Information disclosure in Xpro Addons — 140+ Widgets for Elementor
- CVE-2024-10318 NGINX OpenID Connect Vulnerability
- CVE-2024-10316 Information disclosure in Stratum Widgets for Elementor
- CVE-2024-10315 Insecure Configuration in Gliffy Online
- CVE-2024-10314 Unauthenticated Denial of Service via Auto Generation Function
- CVE-2024-10313 iniNet Solutions SpiderControl SCADA PC HMI Editor Path Traversal
- CVE-2024-10312 Information disclosure in Exclusive Addons for Elementor
- CVE-2024-10311 External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass
- CVE-2024-10310 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-1031 CodeAstro Expense Management System Add Expenses Page 5-Add-Expenses.php cross site scripting
- CVE-2024-10309 Tracking Code Manager < 2.4.0 - Contributor+ Stored XSS
- CVE-2024-10308 Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget
- CVE-2024-10307 Allocation of Resources Without Limits or Throttling in GitLab
- CVE-2024-10306 Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests
- CVE-2024-10302 Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure
- CVE-2024-10301 PHPGurukul Medical Card Generation System Search search-medicalcard.php sql injection
- CVE-2024-10300 PHPGurukul Medical Card Generation System View Enquiry Page view-enquiry.php sql injection
- CVE-2024-1030 Cogites eReserv tenancyDetail.php cross site scripting
- CVE-2024-10299 PHPGurukul Medical Card Generation System Managecard View Detail Page view-card-detail.php sql injection
- CVE-2024-10298 PHPGurukul Medical Card Generation System Managecard Edit Card Detail Page edit-card-detail.php sql injection
- CVE-2024-10297 PHPGurukul Medical Card Generation System Managecard Edit Image Page changeimage.php sql injection
- CVE-2024-10296 PHPGurukul Medical Card Generation System Report of Medical Card Page card-bwdates-reports-details.php sql injection
- CVE-2024-10295 Auth bypass in Red Hat 3scale API Management Platform 2
- CVE-2024-10294 CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change
- CVE-2024-10293 ZZCMS functions.php Ebak_SetGotoPak unrestricted upload
- CVE-2024-10292 ZZCMS ChangeTable.php unrestricted upload
- CVE-2024-10291 ZZCMS phome.php Ebak_DotranExecutSQL sql injection
- CVE-2024-10290 ZZCMS inc.php information disclosure
- CVE-2024-1029 Cogites eReserv tenancyDetail.php cross site scripting
- CVE-2024-10289 Cross-Site Scripting (XSS) vulnerability in LocalServer
- CVE-2024-10288 Cross-Site Scripting (XSS) vulnerability in LocalServer
- CVE-2024-10287 Cross-Site Scripting (XSS) vulnerability in LocalServer
- CVE-2024-10286 Cross-Site Scripting (XSS) vulnerability in LocalServer
- CVE-2024-10285 CE21 Suite <= 2.2.0 - JWT Token Disclosure
- CVE-2024-10284 CE21 Suite <= 2.2.0 - Authentication Bypass
- CVE-2024-10283 Tenda RX9/RX9 Pro SetNetControlList sub_4337EC stack-based overflow
- CVE-2024-10282 Tenda RX9/RX9 Pro SetVirtualServerCfg sub_42EA38 stack-based overflow
- CVE-2024-10281 Tenda RX9/RX9 Pro SetStaticRouteCfg sub_42EEE0 stack-based overflow
- CVE-2024-10280 Tenda AC6/AC7/AC8/AC9/AC10/AC10U/AC15/AC18/AC500/AC1206 GetIPTV websReadEvent null pointer dereference
- CVE-2024-1028 SourceCodester Facebook News Feed Like Post cross site scripting
- CVE-2024-10279 ESAFENET CDG PrintPolicyService.java sql injection
- CVE-2024-10278 ESAFENET CDG ReUserOrganiseService.java sql injection
- CVE-2024-10277 ESAFENET CDG UsbKeyAjax.java sql injection
- CVE-2024-10276 Telestream Sentry Reports Page page cross site scripting
- CVE-2024-10275 Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary
- CVE-2024-10274 Improper Authorization in lunary-ai/lunary
- CVE-2024-10273 Improper Privilege Management in lunary-ai/lunary
- CVE-2024-10272 Broken Access Control in lunary-ai/lunary
- CVE-2024-10270 Org.keycloak:keycloak-services: keycloak denial of service
- CVE-2024-1027 SourceCodester Facebook News Feed Like Post unrestricted upload
- CVE-2024-10269 Easy SVG Support <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-10268 Cross-site scripting in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- CVE-2024-10267 Information Disclosure in transformeroptimus/superagi
- CVE-2024-10266 Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets
- CVE-2024-10265 Cross-site scripting in Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- CVE-2024-10264 HTTP Request Smuggling in netease-youdao/qanything
- CVE-2024-10263 Tickera – WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution
- CVE-2024-10262 Drop Shadow Boxes <= 1.7.14 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
- CVE-2024-10261 Code injection in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction
- CVE-2024-10260 Tripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File Upload
- CVE-2024-1026 Cogites eReserv config.php cross site scripting
- CVE-2024-10256 Misconfiguration in Endpoint Manager
- CVE-2024-10254 Memory corruption in App Store
- CVE-2024-10253 Race condition in App Store
- CVE-2024-10252 Code Injection in langgenius/dify
- CVE-2024-10251 Privilege escalation in Security Controls
- CVE-2024-10250 Nioland <= 1.2.6 - Reflected Cross-Site Scripting via s
- CVE-2024-10247 YouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL Injection
- CVE-2024-10245 Relais 2FA <= 1.0 - Authentication Bypass
- CVE-2024-10244 SQLi in ISDO Software's Web Software
- CVE-2024-10242 Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection
- CVE-2024-10241 Private channel names leaked with Ctrl+K when ElasticSearch is enabled
- CVE-2024-10240 Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
- CVE-2024-1024 SourceCodester Facebook News Feed Like New Account cross site scripting
- CVE-2024-10239 fld->used_bytes without sanity check causes stack overflow
- CVE-2024-10238 fld->used_bytes without sanity check causes stack overflow
- CVE-2024-10237 SMC BMC Firmware Image Authentication Design Issue
- CVE-2024-10234 Wildfly: wildfly vulnerable to cross-site scripting (xss)
- CVE-2024-10233 SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode
- CVE-2024-10232 AtomChat <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat Shortcode
- CVE-2024-10231 Memory corruption in Chrome
- CVE-2024-10230 Memory corruption in Chrome
- CVE-2024-1023 Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx
- CVE-2024-10229 Security feature bypass in Chrome
- CVE-2024-10228 Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user
- CVE-2024-10227 affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode
- CVE-2024-10226 Arconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode
- CVE-2024-10225 Denial of Service in haotian-liu/llava
- CVE-2024-10224 Command injection in Module::ScanDeps
- CVE-2024-10223 HT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode
- CVE-2024-10222 SVG Support <= 2.5.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-10220 Arbitrary command execution through gitRepo volume