Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 511 of 521.
- CVE-2024-10125 Lack of JWT issuer and signer validation
- CVE-2024-10124 Missing authorization in Vayu Blocks – Website Builder for the Block Editor
- CVE-2024-10123 Tenda AC8 saveParentControlInfo compare_parentcontrol_time stack-based overflow
- CVE-2024-10122 Topdata Inner Rep Plus WebServer Operator Details Form InnerRepPlus.html missing password field masking
- CVE-2024-10121 wfh45678 Radar Interface authorization
- CVE-2024-10120 wfh45678 Radar upload unrestricted upload
- CVE-2024-1012 Wanhu ezOFFICE wf_printnum.jsp sql injection
- CVE-2024-10119 SECOM WRTM326 - OS Command Injection
- CVE-2024-10118 SECOM WRTR-304GN-304TW-UPSC - OS Command Injection
- CVE-2024-10117 WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode
- CVE-2024-10116 Twitter Follow Button <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter
- CVE-2024-10114 Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2024-10113 Cross-site scripting in WP AdCenter – Ad Manager & Adsense Ads
- CVE-2024-10112 Simple News <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode
- CVE-2024-10111 OAuth Single Sign On – SSO (OAuth Client) <= 6.26.3 - Authentication Bypass
- CVE-2024-10110 Denial of Service in aimhubio/aim
- CVE-2024-1011 SourceCodester Employee Management System Leave delete-leave.php access control
- CVE-2024-10109 Incorrect Authorization in mintplex-labs/anything-llm
- CVE-2024-10108 WPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcode
- CVE-2024-10107 Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS
- CVE-2024-10106 Ember ZNet buffer overflow in 'packet handoff' plugin
- CVE-2024-10105 Jobs for WordPress < 2.7.11 - Contributor+ Stored XSS
- CVE-2024-10104 Jobs for WordPress < 2.7.8 - Contributor+ Stored XSS
- CVE-2024-10103 MailPoet < 5.3.2 - Admin+ Stored XSS
- CVE-2024-10102 Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS
- CVE-2024-10101 Stored XSS in binary-husky/gpt_academic
- CVE-2024-10100 Path Traversal in binary-husky/gpt_academic
- CVE-2024-1010 SourceCodester Employee Management System edit-profile.php cross site scripting
- CVE-2024-10099 Stored XSS in comfyanonymous/comfyui
- CVE-2024-10098 ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access
- CVE-2024-10097 Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider
- CVE-2024-10095 Progress UI for WPF format provider unsafe deserialization vulnerability
- CVE-2024-10094 Code injection in Pega Infinity
- CVE-2024-10093 VSO ConvertXtoDvd ConvertXtoDvd.exe uncontrolled search path
- CVE-2024-10092 Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation
- CVE-2024-10091 Cross-site scripting in ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor
- CVE-2024-10090 XSS in iKSORIS
- CVE-2024-1009 SourceCodester Employee Management System login.php sql injection
- CVE-2024-10089 XSS in iKSORIS
- CVE-2024-10088 XSS in iKSORIS
- CVE-2024-10087 XSS in iKSORIS
- CVE-2024-10086 Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation
- CVE-2024-10085 Denial of service in EcoStruxure™ Modicon Communication Server
- CVE-2024-10084 Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode
- CVE-2024-10083 Denial of service in Uni-Telway driver
- CVE-2024-10082 codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service
- CVE-2024-10081 codechecker vulnerable to authentication bypass when using specifically crafted URLs
- CVE-2024-10080 WP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
- CVE-2024-1008 SourceCodester Employee Management System Profile Page edit-photo.php unrestricted upload
- CVE-2024-10079 WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection
- CVE-2024-10078 WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
- CVE-2024-10076 Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS
- CVE-2024-10075 Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution
- CVE-2024-10074 Liteos_a has an use after free vulnerability
- CVE-2024-10073 flairNLP flair Mode File Loader clustering.py ClusteringModel code injection
- CVE-2024-10072 ESAFENET CDG EncryptPolicyService.java actionAddEncryptPolicyGroup sql injection
- CVE-2024-10071 ESAFENET CDG EncryptPolicyService.java actionUpdateEncryptPolicyEdit sql injection
- CVE-2024-10070 ESAFENET CDG PolicyPushControlAction.java actionPolicyPush sql injection
- CVE-2024-1007 SourceCodester Employee Management System edit_profile.php sql injection
- CVE-2024-10069 ESAFENET CDG MailDecryptApplicationService.java actionPassMainApplication sql injection
- CVE-2024-10068 OpenSight Software FlashFXP FlashFXP.exe uncontrolled search path
- CVE-2024-1006 Shanxi Diankeyun Technology NODERP Cookie common.php improper authentication
- CVE-2024-10057 RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode
- CVE-2024-10056 Contact Form Builder <= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcode
- CVE-2024-10055 Cross-site scripting in WP Click to Chat – Email, Live Chat, Call & Book Now Buttons
- CVE-2024-10054 Happyforms < 1.26.3 - Admin+ Stored XSS
- CVE-2024-10051 Unauthenticated Denial of Service in shaunwei/realchar
- CVE-2024-10050 Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode
- CVE-2024-1005 Shanxi Diankeyun Technology NODERP log file access
- CVE-2024-10049 Edit WooCommerce Templates <= 1.1.2 - Reflected Cross-Site Scripting via page
- CVE-2024-10048 Post Status Notifier Lite and Premium <= 1.11.6 - Reflected Cross-Site Scripting via page
- CVE-2024-10047 Directory Listing Vulnerability in parisneo/lollms-webui
- CVE-2024-10046 افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting
- CVE-2024-10045 Transients Manager <= 2.0.6 - Cross-Site Request Forgery
- CVE-2024-10044 SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchat
- CVE-2024-10043 Incorrect Authorization in GitLab
- CVE-2024-10041 Pam: libpam: libpam vulnerable to read hashed password
- CVE-2024-10040 Infinite-Scroll <= 2.6.2 - Cross-Site Request Forgery to Plugin Settings Update
- CVE-2024-1004 Totolink N200RE cstecgi.cgi loginAuth stack-based overflow
- CVE-2024-10038 WP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-10037 Null dereference in RTU500
- CVE-2024-10035 Code Injection in BG-TEK's CoslatV3
- CVE-2024-10034 Cross-site scripting in Mixed Media Gallery Blocks
- CVE-2024-10033 Aap-gateway: xss on aap-gateway
- CVE-2024-10032 Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console
- CVE-2024-10031 Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications
- CVE-2024-1003 Totolink N200RE cstecgi.cgi setLanguageCfg stack-based overflow
- CVE-2024-10029 Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console
- CVE-2024-10028 Information disclosure in Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin
- CVE-2024-10027 WP Booking Calendar < 10.6.3 - Admin+ Stored XSS
- CVE-2024-10026 Improved Seeding and Hashing In gVisor
- CVE-2024-10025 Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx
- CVE-2024-10024 code-projects Pharmacy Management System manage_medicine_stock.php sql injection
- CVE-2024-10023 code-projects Pharmacy Management System add_new_medicine.php sql injection
- CVE-2024-10022 code-projects Pharmacy Management System manage_supplier.php sql injection
- CVE-2024-10021 code-projects Pharmacy Management System manage_purchase.php sql injection
- CVE-2024-10020 Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider
- CVE-2024-1002 Totolink N200RE cstecgi.cgi setIpPortFilterRules stack-based overflow
- CVE-2024-10019 Path Traversal and OS Command Injection in parisneo/lollms-webui
- CVE-2024-10018 Missing authorization in com.transsion.aivoiceassistant