Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 512 of 521.
- CVE-2024-10017 PJW Mime Config <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-10016 File Upload Types by WPForms <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- CVE-2024-10015 Cross-site scripting in ConvertCalculator: Build Cost, Price, Quotation, ROI Interactive Calculators
- CVE-2024-10014 Flat UI Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode
- CVE-2024-10013 Progress UI for WinForms format provider unsafe deserialization vulnerability
- CVE-2024-10012 Progress UI for WPF format provider unsafe deserialization vulnerability
- CVE-2024-10011 BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal
- CVE-2024-10010 LearnPress < 4.2.7.2 - Admin+ Stored XSS
- CVE-2024-1001 Totolink N200RE cstecgi.cgi main stack-based overflow
- CVE-2024-10009 Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injection
- CVE-2024-10008 Missing authorization in Masteriyo LMS – Online Course Builder for eLearning, LMS & Education
- CVE-2024-10007 Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation
- CVE-2024-10006 Consul L7 Intentions Vulnerable To Headers Bypass
- CVE-2024-10005 Consul L7 Intentions Vulnerable To URL Path Bypass
- CVE-2024-10004 Security feature bypass in Firefox for iOS
- CVE-2024-10003 Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions
- CVE-2024-10002 Rover IDX <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator
- CVE-2024-10001 Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling
- CVE-2024-10000 Cross-site scripting in Masteriyo LMS – Online Course Builder for eLearning, LMS & Education
- CVE-2024-1000 Totolink N200RE cstecgi.cgi setTracerouteCfg stack-based overflow
- CVE-2024-0999 Totolink N200RE cstecgi.cgi setParentalRules stack-based overflow
- CVE-2024-0998 Totolink N200RE cstecgi.cgi setDiagnosisCfg stack-based overflow
- CVE-2024-0997 Totolink N200RE cstecgi.cgi setOpModeCfg stack-based overflow
- CVE-2024-0996 Tenda i9 httpd setcfm formSetCfm stack-based overflow
- CVE-2024-0995 Tenda W6 httpd wifiSSIDset formwrlSSIDset stack-based overflow
- CVE-2024-0994 Tenda W6 httpd setcfm formSetCfm stack-based overflow
- CVE-2024-0993 Tenda i6 httpd WifiMacFilterGet formWifiMacFilterGet stack-based overflow
- CVE-2024-0992 Tenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflow
- CVE-2024-0991 Tenda i6 httpd setcfm formSetCfm stack-based overflow
- CVE-2024-0990 Tenda i6 httpd setAutoPing formSetAutoPing stack-based overflow
- CVE-2024-0989 Sichuan Yougou Technology KuERP Service.php del_sn_db path traversal
- CVE-2024-0988 Sichuan Yougou Technology KuERP common.php checklogin improper authentication
- CVE-2024-0987 Sichuan Yougou Technology KuERP log neutralization for logs
- CVE-2024-0986 Issabel PBX Asterisk-Cli os command injection
- CVE-2024-0985 PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL
- CVE-2024-0984 ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in disableOptimization
- CVE-2024-0983 ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in enableOptimization
- CVE-2024-0981 Cross-site scripting in Okta Browser Plugin
- CVE-2024-0980 Path traversal in Okta Verify for Windows
- CVE-2024-0979 Dashboard Widgets Suite <= 3.4.3 - Reflected Cross-Site Scripting
- CVE-2024-0978 My Private Site <= 3.0.14 - Improper Access Control to Sensitive Information Exposure via REST API
- CVE-2024-0977 Cross-site scripting in Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline)
- CVE-2024-0976 WP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via plugin
- CVE-2024-0975 WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API
- CVE-2024-0974 Social Media Widget < 4.0.9 - Admin+ Stored XSS
- CVE-2024-0973 Widget for Social Page Feeds < 6.4 - Admin+ Stored XSS
- CVE-2024-0972 BuddyPress Members Only <= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST API
- CVE-2024-0971 SQL injection in Nessus
- CVE-2024-0970 User Activity Tracking and Log < 4.1.4 - IP Spoofing
- CVE-2024-0969 ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API
- CVE-2024-0967 OpenText / Micro Focus ArcSight Enterprise Security Manager Remote Vulnerability
- CVE-2024-0966 Shariff Wrapper <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0965 Simple Page Access Restriction <= 1.0.21 - Improper Access Control to Sensitive Information Exposure via REST API
- CVE-2024-0964 LFI in Gradio
- CVE-2024-0963 Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0962 obgm libcoap Configuration File coap_oscore.c get_split_entry stack-based overflow
- CVE-2024-0961 SiteOrigin Widgets Bundle <= 1.58.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0960 flink-extended ai-flow workflow_command.py cloudpickle.loads deserialization
- CVE-2024-0959 StanfordVL GibsonEnv pposgd_fuse.py cloudpickle.load deserialization
- CVE-2024-0958 CodeAstro Stock Management System Add Category index.php cross site scripting
- CVE-2024-0957 Cross-site scripting in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels
- CVE-2024-0956 WP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL Injection
- CVE-2024-0955 Stored XSS vulnerability
- CVE-2024-0954 Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets
- CVE-2024-0953 Open redirect in Firefox for iOS
- CVE-2024-0952 WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id
- CVE-2024-0951 Advanced Social Feeds Widget & Shortcode <= 1.7 - Admin+ Stored XSS
- CVE-2024-0949 Improper Access Control in Talya Informatics' Elektraweb
- CVE-2024-0948 NetBox Home Page Configuration config-revisions cross site scripting
- CVE-2024-0947 Cookies Manipulation in Talya Informatics' Elektraweb
- CVE-2024-0946 60IndexPage Parameter index.php server-side request forgery
- CVE-2024-0945 60IndexPage Parameter file.php server-side request forgery
- CVE-2024-0944 Totolink T8 cstecgi.cgi session expiration
- CVE-2024-0943 Totolink N350RT cstecgi.cgi session expiration
- CVE-2024-0942 Totolink N200RE V5 cstecgi.cgi session expiration
- CVE-2024-0941 Novel-Plus list sql injection
- CVE-2024-0939 Byzoro Smart S210 Management Platform uploadfile.php unrestricted upload
- CVE-2024-0938 Tongda OA 2017 delete_webmail.php sql injection
- CVE-2024-0937 van_der_Schaar LAB synthcity PKL File load_from_file deserialization
- CVE-2024-0936 van_der_Schaar LAB TemporAI PKL File load_from_file deserialization
- CVE-2024-0935 Information disclosure in DELMIA Apriso
- CVE-2024-0933 Niushop B2B2C Upload.php unrestricted upload
- CVE-2024-0932 Tenda AC10U setSmartPowerManagement stack-based overflow
- CVE-2024-0931 Tenda AC10U saveParentControlInfo stack-based overflow
- CVE-2024-0930 Tenda AC10U fromSetWirelessRepeat stack-based overflow
- CVE-2024-0929 Tenda AC10U fromNatStaticSetting stack-based overflow
- CVE-2024-0928 Tenda AC10U fromDhcpListClient stack-based overflow
- CVE-2024-0927 Tenda AC10U fromAddressNat stack-based overflow
- CVE-2024-0926 Tenda AC10U formWifiWpsOOB stack-based overflow
- CVE-2024-0925 Tenda AC10U formSetVirtualSer stack-based overflow
- CVE-2024-0924 Tenda AC10U formSetPPTPServer stack-based overflow
- CVE-2024-0923 Tenda AC10U formSetDeviceName stack-based overflow
- CVE-2024-0922 Tenda AC10U formQuickIndex stack-based overflow
- CVE-2024-0921 D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection
- CVE-2024-0920 TRENDnet TEW-822DRE POST Request admin_ping.htm command injection
- CVE-2024-0919 TRENDnet TEW-815DAP POST Request do_setNTP command injection
- CVE-2024-0918 TRENDnet TEW-800MB POST Request os command injection
- CVE-2024-0917 PaddlePaddle vulnerable to remote code execution
- CVE-2024-0916 Unauthenticated Remote Code Execution in UvDesk Community
- CVE-2024-0914 Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)