Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 513 of 521.
- CVE-2024-0913 WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection
- CVE-2024-0912 CCURE passwords exposed to administrators
- CVE-2024-0911 Indent: heap-based buffer overflow in set_buf_break()
- CVE-2024-0910 Restrict for Elementor <= 1.0.7 - Protection Mechanism Bypass
- CVE-2024-0909 Anonymous Restricted Content <= 1.6.2 - Protection Mechanism Bypass
- CVE-2024-0908 Missing authorization in Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters
- CVE-2024-0907 NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()
- CVE-2024-0906 f(x) Private Site <= 1.2.1 - Sensitive Information Exposure
- CVE-2024-0905 Fancy Product Designer < 6.1.8 - Reflected Cross Site Scripting
- CVE-2024-0904 Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting
- CVE-2024-0903 Cross-site scripting in UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds
- CVE-2024-0902 Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title
- CVE-2024-0901 SEGV and out of bounds memory read from malicious packet
- CVE-2024-0900 Missing authorization in EleSpare – News, Magazine and Blog Addons for Elementor
- CVE-2024-0899 Information disclosure in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
- CVE-2024-0898 Chat Bubble <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2024-0897 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0896 Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0895 PDF Flipbook, 3D Flipbook – DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0893 Schema App Structured Data <= 2.2.0 - Missing Authorization
- CVE-2024-0892 Schema App Structured Data <= 2.2.0 - Cross-Site Request Forgery
- CVE-2024-0891 hongmaple octopus cross site scripting
- CVE-2024-0890 hongmaple octopus edit sql injection
- CVE-2024-0889 Kmint21 Golden FTP Server PASV Command denial of service
- CVE-2024-0888 BORGChat Service Port 7551 denial of service
- CVE-2024-0887 Mafiatic Blue Server Connection denial of service
- CVE-2024-0886 Poikosoft EZ CD Audio Converter Activation denial of service
- CVE-2024-0885 SpyCamLizard HTTP GET Request denial of service
- CVE-2024-0884 SourceCodester Online Tours & Travels Management System payment.php exec sql injection
- CVE-2024-0883 SourceCodester Online Tours & Travels Management System pay.php prepare sql injection
- CVE-2024-0882 qwdigital LinkWechat Universal Download Interface resource path traversal
- CVE-2024-0881 Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access
- CVE-2024-0880 Qidianbang qdbcrm Password Reset cross-site request forgery
- CVE-2024-0879 Authentication bypass in vector-admin domain restriction
- CVE-2024-0875 Stored XSS in openemr/openemr
- CVE-2024-0874 Coredns: cd bit response is cached and served later
- CVE-2024-0873 Watu Quiz <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0872 Watu Quiz <= 3.4.1 - Sensitive Information Disclosure
- CVE-2024-0871 Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget
- CVE-2024-0870 YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update
- CVE-2024-0869 Instant Images <= 6.1.0 - Authenticated (Author+) Arbitrary Options Update
- CVE-2024-0868 coreActivity < 2.1 - Unauthenticated IP Spoofing
- CVE-2024-0867 Email Log <= 2.4.8 - Unauthenticated Hook Injection
- CVE-2024-0866 Check & Log Email <= 1.0.9 - Unauthenticated Hook Injection
- CVE-2024-0865 Hardcoded credentials in EcoStruxure IT Gateway
- CVE-2024-0864 RCE in Laragon
- CVE-2024-0862 Server-side request forgery in Enterprise Protection
- CVE-2024-0861 Direct Request ('Forced Browsing') in GitLab
- CVE-2024-0860 Cleartext Transmission of Sensitive Information in Softing edgeConnector and edgeAggregator
- CVE-2024-0859 Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery
- CVE-2024-0858 Innovs HR < 1.0.3.7.1 - Employee Creation via CSRF
- CVE-2024-0857 SQLi in Universal Software's FlexWater Corporate Water Management
- CVE-2024-0856 Booking Calendar < 1.3.83 - CSRF appointment scheduling
- CVE-2024-0855 Spiffy Calendar < 4.9.9 - Broken Access Control
- CVE-2024-0854 Open redirect in DiskStation Manager (DSM)
- CVE-2024-0853 OCSP verification bypass with TLS session reuse
- CVE-2024-0852 coreActivity < 1.8.1 - Unauthenticated Stored XSS
- CVE-2024-0851 SQLi in Grup Arge Energy and Control Systems's Smartpower
- CVE-2024-0849 Leanote 2.7.0 - Local File Read
- CVE-2024-0848 AA Cash Calculator <= 1.0 - Reflected Cross-Site Scripting via invoice
- CVE-2024-0847 5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages
- CVE-2024-0845 PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render
- CVE-2024-0844 Path traversal in Popup More Popups, Lightboxes, and more popup modules
- CVE-2024-0842 Backuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of Service
- CVE-2024-0841 Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function
- CVE-2024-0840 Grandstream UCM Series IP PBX HTTP Parameter Injection
- CVE-2024-0839 FeedWordPress <= 2022.0222 - Insecure Direct Object Referece
- CVE-2024-0838 Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0837 Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor
- CVE-2024-0836 Missing authorization in Review Schema – Review & Structure Data Schema Plugin
- CVE-2024-0835 Royal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update
- CVE-2024-0834 Cross-site scripting in Elementor Addon Elements
- CVE-2024-0833 Privilege Elevation via Telerik Test Studio
- CVE-2024-0832 Privilege Elevation via Telerik Reporting Installer
- CVE-2024-0831 Vault May Expose Sensitive Information When Configuring An Audit Log Device
- CVE-2024-0830 Comments Extra Fields For Post,Pages and CPT <= 5.0 - Cross-Site Request Forgery
- CVE-2024-0829 Comments Extra Fields For Post,Pages and CPT <= 5.0 - Missing Authorization
- CVE-2024-0828 Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Missing Authorization
- CVE-2024-0827 Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Cross-Site Request Forgery
- CVE-2024-0826 Qi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0825 Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.3.2 - Authenticated (Contributor+) PHP Object Injection
- CVE-2024-0824 Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything
- CVE-2024-0823 Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
- CVE-2024-0822 Ovirt: authentication bypass
- CVE-2024-0821 Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scripting
- CVE-2024-0820 Jobs for WordPress < 2.7.4 - Contributor+ Stored XSS
- CVE-2024-0819 Incomplete protection of personal password settings
- CVE-2024-0818 PaddlePaddle Path Traversal vulnerability
- CVE-2024-0817 PaddlePaddle command injection vulnerability
- CVE-2024-0816 Memory corruption in DX3300-T1 firmware
- CVE-2024-0815 PaddlePaddle command injection in paddle.utils.download._wget_download
- CVE-2024-0814 Security feature bypass in Chrome
- CVE-2024-0813 Use after free in Chrome
- CVE-2024-0812 Memory corruption in Chrome
- CVE-2024-0811 Information disclosure in Chrome
- CVE-2024-0810 Security feature bypass in Chrome
- CVE-2024-0809 Security feature bypass in Chrome
- CVE-2024-0808 Integer overflow in Chrome
- CVE-2024-0807 Use after free in Chrome
- CVE-2024-0806 Use after free in Chrome