Vulnerabilities published in 2024
52,042 vulnerabilities were published in 2024: CVEs, GitHub and ecosystem advisories, and malicious packages. Page 515 of 521.
- CVE-2024-0697 Backuply – Backup, Restore, Migrate and Clone <= 1.2.3 - Authenticated (Administrator+) Directory Traversal
- CVE-2024-0696 AtroCore AtroPIM Product Series Overview cross site scripting
- CVE-2024-0695 EFS Easy Chat Server HTTP GET Request denial of service
- CVE-2024-0693 EFS Easy File Sharing FTP denial of service
- CVE-2024-0692 SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability
- CVE-2024-0691 FileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import
- CVE-2024-0690 Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
- CVE-2024-0689 Custom Field Suite <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-0688 WebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-0687 Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposure
- CVE-2024-0685 Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection
- CVE-2024-0684 Coreutils: heap overflow in split --line-bytes with very long lines
- CVE-2024-0683 Bulgarisation for WooCommerce <= 3.0.14 - Missing Authorization
- CVE-2024-0682 Page Restrict <= 2.5.5 - Protection Mechanism Bypass
- CVE-2024-0681 Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass
- CVE-2024-0680 WP Private Content Plus <= 3.6 - Protection Mechanism Bypass
- CVE-2024-0679 ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation
- CVE-2024-0678 Order Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site Scripting
- CVE-2024-0677 Pz-LinkCard <= 2.5.1 - Contributor+ SSRF
- CVE-2024-0676 Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines
- CVE-2024-0675 Improper checking for unusual or exceptional conditions vulnerability in Lamassu Bitcoin ATM Douro machines
- CVE-2024-0674 Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines
- CVE-2024-0673 Pz-LinkCard <= 2.5.1 - Admin+ Stored XSS
- CVE-2024-0672 Pz-LinkCard <= 2.5.1 - Reflected XSS
- CVE-2024-0671 Mali GPU Kernel Driver allows improper GPU memory processing operations
- CVE-2024-0670 Privilege escalation in windows agent
- CVE-2024-0669 Cross-Frame Scripting (XFS) on Plone CMS
- CVE-2024-0668 Advanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action
- CVE-2024-0667 Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute
- CVE-2024-0665 WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting
- CVE-2024-0664 Meks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-0662 Cross-site scripting in FancyBox for WordPress
- CVE-2024-0660 Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-0659 Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options
- CVE-2024-0658 Insert PHP Code Snippet <= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-0657 Internal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-0656 Password Protected <= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting
- CVE-2024-0655 Novel-Plus list sql injection
- CVE-2024-0654 DeepFaceLab Util.py deserialization
- CVE-2024-0653 Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping
- CVE-2024-0652 PHPGurukul Company Visitor Management System search-visitor.php cross site scripting
- CVE-2024-0651 PHPGurukul Company Visitor Management System search-visitor.php sql injection
- CVE-2024-0650 Project Worlds Visitor Management System URL dataset.php cross site scripting
- CVE-2024-0649 ZhiHuiYun Search ImageController.php download_network_image server-side request forgery
- CVE-2024-0648 Yunyou CMS Common.php unrestricted upload
- CVE-2024-0647 Sparksuite SimpleMDE iFrame cross site scripting
- CVE-2024-0646 Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination
- CVE-2024-0645 Buffer Overflow Vulnerability in Explorer++
- CVE-2024-0643 Unrestricted upload of dangerous file types in C21 Live Encoder and Live Mosaic
- CVE-2024-0642 Inadequate access control in C21 Live Encoder and Live Mosaic
- CVE-2024-0641 Kernel: deadlock leading to denial of service in tipc_crypto_key_revoke
- CVE-2024-0640 Stored XSS in chatwoot/chatwoot
- CVE-2024-0639 Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos
- CVE-2024-0638 Privilege escalation in mk_oracle plugins
- CVE-2024-0637 Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability
- CVE-2024-0632 Cross-site scripting in Automatic Translator with Google Translate
- CVE-2024-0631 Duitku Payment Gateway <= 2.11.6 - Missing Authorization via check_duitku_response
- CVE-2024-0630 WP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source
- CVE-2024-0629 2Checkout Payment Gateway for WooCommerce <= 6.2 - Missing Authorization via sniff_ins
- CVE-2024-0628 Server-side request forgery in WP RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging
- CVE-2024-0627 Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name
- CVE-2024-0626 WooCommerce Clover Payment Gateway <= 1.3.1 - Missing Authorization via callback_handler
- CVE-2024-0625 Cross-site scripting in WPFront Notification Bar
- CVE-2024-0624 Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update
- CVE-2024-0623 VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery
- CVE-2024-0622 Local privilege escalation vulnerability could affect OpenText Operations Agent on Non-Windows platforms.
- CVE-2024-0621 Simple Share Buttons Adder <= 8.4.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settings
- CVE-2024-0620 PPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass
- CVE-2024-0619 Payflex Payment Gateway <= 2.5.0 - Missing Authorization to Order Status Update
- CVE-2024-0618 Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title
- CVE-2024-0617 Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()
- CVE-2024-0616 Passster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure
- CVE-2024-0615 Content Control <= 2.1.0 - Missing Authorization to Sensitive Information Exposure
- CVE-2024-0614 Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings
- CVE-2024-0613 Delete Custom Fields <= 0.3.1 - Cross-Site Request Forgery to Post Meta Deletion
- CVE-2024-0612 Content Views <= 3.6.2 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings
- CVE-2024-0611 Cross-site scripting in Master Slider – Responsive Touch Slider
- CVE-2024-0610 Piraeus Bank WooCommerce Payment Gateway <= 1.6.5.1 - Unauthenticated SQL Injection
- CVE-2024-0609 Cross-site scripting in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support
- CVE-2024-0608 SQL injection in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support
- CVE-2024-0607 Kernel: nf_tables: pointer math issue in nft_byteorder_eval()
- CVE-2024-0606 Cross-site scripting in Focus for iOS
- CVE-2024-0605 Race condition in Focus for iOS
- CVE-2024-0604 Cross-site scripting in Gallery by FooGallery
- CVE-2024-0603 ZhiCms giftcontroller.php deserialization
- CVE-2024-0602 Cross-site scripting in YARPP – Yet Another Related Posts Plugin
- CVE-2024-0601 ZhongFuCheng3y Austin Email Message Template AustinFileUtils.java getRemoteUrl2File server-side request forgery
- CVE-2024-0599 Jspxcms Document Management Page InfoController.java cross site scripting
- CVE-2024-0598 Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- CVE-2024-0597 SEO Plugin by Squirrly SEO <= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
- CVE-2024-0596 Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()
- CVE-2024-0595 Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()
- CVE-2024-0594 Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection
- CVE-2024-0593 Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure
- CVE-2024-0592 Related Posts for WordPress <= 2.2.1 - Cross-Site Request Forgery
- CVE-2024-0591 wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting.
- CVE-2024-0590 Microsoft Clarity <= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
- CVE-2024-0589 Cross-site scripting in Remote Desktop Manager
- CVE-2024-0588 Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery
- CVE-2024-0587 Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting