CVEs from 2024
Total
6,592
critical
critical 174
high
high 1,069
medium
medium 2,083
low
low 49
% Critical
2.6%
% with KEV
2.5%
% with exploit
3.4%
Top products
- mbed_tls 15
- operations_analytics_log_analysis 14
- surveillance_station 12
- checkmk 10
- office 8
- profilegrid 8
- office_long_term_servicing_channel 6
- propertyhive 5
Top packages
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-55876 | unknown | — | — | 2y ago | XWiki's scheduler in subwiki allows scheduling operations for any main wiki user | |||
| CVE-2024-55877 | unknown | — | — | 2y ago | XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList | |||
| CVE-2024-55879 | unknown | — | — | 2y ago | XWiki allows RCE from script right in configurable sections | |||
| CVE-2024-12401 | unknown | — | — | 2y ago | cert-manager ha a potential slowdown / DoS when parsing specially crafted PEM inputs | |||
| CVE-2024-12397 | unknown | — | — | 2y ago | io.quarkus.http/quarkus-http-core: Quarkus HTTP Cookie Smuggling | |||
| CVE-2024-45337 | unknown | — | — | 2y ago | Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerCo… | |||
| CVE-2024-53677 | unknown | — | — | 2y ago | Apache Struts file upload logic is flawed | |||
| CVE-2024-6156 | unknown | — | — | 2y ago | Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. | |||
| CVE-2024-6219 | unknown | — | — | 2y ago | Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured. | |||
| CVE-2024-55601 | unknown | — | — | 2y ago | Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks… | |||
| CVE-2024-55565 | unknown | — | — | 2y ago | nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. | |||
| CVE-2024-53907 | unknown | — | — | 2y ago | An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. The strip_tags() method and striptags template filter are subject to a potential denial-of-service attack… | |||
| CVE-2024-53908 | unknown | — | — | 2y ago | An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subje… | |||
| CVE-2024-54140 | unknown | — | — | 2y ago | sigstore-java has a vulnerability with bundle verification | |||
| CVE-2024-38829 | unknown | — | — | 2y ago | Spring LDAP data exposure vulnerability | |||
| CVE-2024-37303 | unknown | — | — | 2y ago | Synapse's unauthenticated writes to the media repository allow planting of problematic content | |||
| CVE-2024-37302 | unknown | — | — | 2y ago | Synapse denial of service through media disk space consumption | |||
| CVE-2024-45106 | unknown | — | — | 2y ago | Apache Ozone: Improper authentication when generating S3 secrets | |||
| CVE-2024-53981 | unknown | — | — | 2y ago | python-multipart is a streaming multipart parser for Python. When parsing form data, python-multipart skips line breaks (CR \r or LF \n) in front of the first boundary and any tailing bytes after the… | |||
| CVE-2024-53990 | unknown | — | — | 2y ago | AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s | |||
| CVE-2024-38827 | unknown | — | — | 2y ago | Spring Framework has Authorization Bypass for Case Sensitive Comparisons | |||
| CVE-2024-35371 | unknown | — | — | 2y ago | Ant-Media-Server vulnerable to Improper Output Neutralization for Logs | |||
| CVE-2024-36623 | unknown | — | — | 2y ago | moby through v25.0.3 has a Race Condition vulnerability in the streamformatter package which can be used to trigger multiple concurrent write operations resulting in data corruption or application cr… | |||
| CVE-2024-36620 | unknown | — | — | 2y ago | moby v25.0.0 - v26.0.2 is vulnerable to NULL Pointer Dereference via daemon/images/image_history.go. | |||
| CVE-2024-36621 | unknown | — | — | 2y ago | moby v25.0.5 is affected by a Race Condition in builder/builder-next/adapters/snapshot/layer.go. The vulnerability could be used to trigger concurrent builds that call the EnsureLayer function result… | |||
| CVE-2024-49203 | unknown | — | — | 2y ago | Querydsl vulnerable to HQL injection through orderBy | |||
| CVE-2024-54003 | unknown | — | — | 2y ago | Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability | |||
| CVE-2024-54004 | unknown | — | — | 2y ago | Jenkins Filesystem List Parameter Plugin has Path Traversal vulnerability | |||
| CVE-2024-53267 | unknown | — | — | 2y ago | sigstore-java has vulnerability with bundle verification | |||
| CVE-2024-10039 | unknown | — | — | 2y ago | Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination | |||
| CVE-2024-9666 | unknown | — | — | 2y ago | Keycloak proxy header handling Denial-of-Service (DoS) vulnerability | |||
| CVE-2024-10451 | unknown | — | — | 2y ago | Keycloak Build Process Exposes Sensitive Data | |||
| CVE-2024-53916 | unknown | — | — | 2y ago | In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileg… | |||
| CVE-2024-52797 | unknown | — | — | 2y ago | Searching Opencast may cause a denial of service | |||
| CVE-2024-31141 | unknown | — | — | 2y ago | Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider | |||
| CVE-2024-52304 | unknown | — | — | 2y ago | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.10.11, the Python parser parses newlines in chunk extensions incorrectly which can lead to request s… | |||
| CVE-2024-52303 | unknown | — | — | 2y ago | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a request produces a MatchInfoError… | |||
| CVE-2024-52506 | unknown | — | — | 2y ago | Graylog concurrent PDF report rendering can leak other users' reports | |||
| CVE-2024-52318 | unknown | — | — | 2y ago | Incorrect object recycling and reuse vulnerability in Apache Tomcat. This issue affects Apache Tomcat: 11.0.0, 10.1.31, 9.0.96. Users are recommended to upgrade to version 11.0.1, 10.1.32 or 9.0.97… | |||
| CVE-2024-8781 | unknown | — | — | 2y ago | Execution with Unnecessary Privileges, : Improper Protection of Alternate Path vulnerability in TR7 Application Security Platform (ASP) allows Privilege Escalation, -Privilege Abuse. This issue affe… | |||
| CVE-2024-52317 | unknown | — | — | 2y ago | Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between us… | |||
| CVE-2024-52316 | unknown | — | — | 2y ago | Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta Authentication (formerly JASPIC) ServerAuthContext component which may throw an exception dur… | |||
| CVE-2024-38828 | unknown | — | — | 2y ago | Spring MVC controller vulnerable to a DoS attack | |||
| CVE-2024-39610 | unknown | — | — | 2y ago | FitNesse Cross-site scripting | |||
| CVE-2024-42499 | unknown | — | — | 2y ago | FitNesse Path Traversal | |||
| CVE-2024-7787 | unknown | — | — | 2y ago | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ITG Computer Technology vSRM Supplier Relationship Management System allows Reflected XSS,… | |||
| CVE-2024-52554 | unknown | — | — | 2y ago | Script security bypass vulnerability in Jenkins Shared Library Version Override Plugin | |||
| CVE-2024-52550 | unknown | — | — | 2y ago | Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin | |||
| CVE-2024-52553 | unknown | — | — | 2y ago | Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin | |||
| CVE-2024-52551 | unknown | — | — | 2y ago | Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin | |||
| CVE-2024-52552 | unknown | — | — | 2y ago | Stored XSS vulnerability in Jenkins Authorize Project Plugin | |||
| CVE-2024-52549 | unknown | — | — | 2y ago | Missing permission check in Jenkins Script Security Plugin | |||
| CVE-2024-51996 | unknown | — | — | 2y ago | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. When consuming a persisted remember-me cookie, Symfony does not check if the username persisted i… | |||
| CVE-2024-47535 | unknown | — | — | 2y ago | Denial of Service attack on windows app using netty | |||
| CVE-2024-8074 | unknown | — | — | 2y ago | Missing Authentication for Critical Function, Missing Authorization vulnerability in Nomysoft Informatics Nomysem allows Collect Data as Provided by Users. This issue affects Nomysem: before 13.10.2… | |||
| CVE-2024-51135 | unknown | — | — | 2y ago | powertac-server XML External Entity vulnerability | |||
| CVE-2024-52007 | unknown | — | — | 2y ago | XXE vulnerability in XSLT parsing in `org.hl7.fhir.core` | |||
| CVE-2024-47072 | unknown | — | — | 2y ago | XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream | |||
| CVE-2024-51504 | unknown | — | — | 2y ago | Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server | |||
| CVE-2024-51755 | unknown | — | — | 2y ago | Twig is a template language for PHP. In a sandbox, an attacker can access attributes of Array-like objects as they were not checked by the security policy. They are now checked via the property polic… | |||
| CVE-2024-51754 | unknown | — | — | 2y ago | Twig is a template language for PHP. In a sandbox, an attacker can call `__toString()` on an object even if the `__toString()` method is not allowed by the security policy when the object is part of … | |||
| CVE-2024-51751 | unknown | — | — | 2y ago | Gradio vulnerable to arbitrary file read with File and UploadButton components | |||
| CVE-2024-51736 | unknown | — | — | 2y ago | Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory i… | |||
| CVE-2024-50345 | unknown | — | — | 2y ago | symfony/http-foundation is a module for the Symphony PHP framework which defines an object-oriented layer for the HTTP specification. The `Request` class, does not parse URI with special characters t… | |||
| CVE-2024-50343 | unknown | — | — | 2y ago | symfony/validator is a module for the Symphony PHP framework which provides tools to validate values. It is possible to trick a `Validator` configured with a regular expression using the `$` metachar… | |||
| CVE-2024-50342 | unknown | — | — | 2y ago | symfony/http-client is a module for the Symphony PHP framework which provides powerful methods to fetch HTTP resources synchronously or asynchronously. When using the `NoPrivateNetworkHttpClient`, so… | |||
| CVE-2024-50341 | unknown | — | — | 2y ago | symfony/security-bundle is a module for the Symphony PHP framework which provides a tight integration of the Security component into the Symfony full-stack framework. The custom `user_checker` define… | |||
| CVE-2024-50340 | unknown | — | — | 2y ago | symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the `register_argv_argc` php directive is set to `on` , and users call any… | |||
| CVE-2024-51132 | unknown | — | — | 2y ago | HAPI FHIR XML External Entity (XXE) vulnerability | |||
| CVE-2024-51746 | unknown | — | — | 2y ago | Gitsign is a keyless Sigstore to signing tool for Git commits with your a GitHub / OIDC identity. gitsign may select the wrong Rekor entry to use during online verification when multiple entries are … | |||
| CVE-2024-36117 | unknown | — | — | 2y ago | Reposilite vulnerable to path traversal while serving javadoc expanded files (arbitrary file read) (`GHSL-2024-074`) | |||
| CVE-2024-51127 | unknown | — | — | 2y ago | hornetq vulnerable to file overwrite, sensitive information disclosure | |||
| CVE-2024-23590 | unknown | — | — | 2y ago | Apache Kylin Session Fixation vulnerability | |||
| CVE-2024-42835 | unknown | — | — | 2y ago | langflow has vulnerability in PythonCodeTool component | |||
| CVE-2024-48910 | unknown | — | — | 2y ago | DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify was vulnerable to prototype pollution. This vulnerability is fixed in 2.4.2. | |||
| CVE-2024-48307 | unknown | — | — | 2y ago | JeecgBoot SQL Injection vulnerability | |||
| CVE-2024-43382 | unknown | — | — | 2y ago | Snowflake JDBC Security Advisory | |||
| CVE-2024-48063 | unknown | — | — | 2y ago | In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE. NOTE: this is disputed by multiple parties because this is intended behavior in PyTorch distributed computing. | |||
| CVE-2024-45477 | unknown | — | — | 2y ago | Apache NiFi Cross-site Scripting vulnerability | |||
| CVE-2024-38821 | unknown | — | — | 2y ago | Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications | |||
| CVE-2024-49771 | unknown | — | — | 2y ago | MPXJ has a Potential Path Traversal Vulnerability | |||
| CVE-2024-49760 | unknown | — | — | 2y ago | OpenRefine has a path traversal in LoadLanguageCommand | |||
| CVE-2024-47883 | unknown | — | — | 2y ago | Butterfly has path/URL confusion in resource handling leading to multiple weaknesses | |||
| CVE-2024-47882 | unknown | — | — | 2y ago | OpenRefine's error page lacks escaping, leading to potential Cross-site Scripting on import of malicious project | |||
| CVE-2024-47881 | unknown | — | — | 2y ago | OpenRefine's SQLite integration allows filesystem access, remote code execution (RCE) | |||
| CVE-2024-47880 | unknown | — | — | 2y ago | OpenRefine has a reflected cross-site scripting vulnerability (XSS) from POST request in ExportRowsCommand | |||
| CVE-2024-47879 | unknown | — | — | 2y ago | OpenRefine's PreviewExpressionCommand, which is eval, lacks protection against cross-site request forgery (CSRF) | |||
| CVE-2024-47878 | unknown | — | — | 2y ago | OpenRefine has a reflected cross-site scripting vulnerability (XSS) in GData extension (authorized.vt) | |||
| CVE-2024-45031 | unknown | — | — | 2y ago | Apache Syncope: Stored XSS in Console and Enduser | |||
| CVE-2024-38002 | unknown | — | — | 2y ago | Liferay Portal and Liferay DXP Workflow Component Does Not Check User Permissions | |||
| CVE-2024-26273 | unknown | — | — | 2y ago | Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor | |||
| CVE-2024-26271 | unknown | — | — | 2y ago | Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the My Account Widget | |||
| CVE-2024-26272 | unknown | — | — | 2y ago | Liferay Portal and Liferay DXP Vulnerable to Cross-Site Request Forgery (CSRF) via the Content Page Editor | |||
| CVE-2024-8980 | unknown | — | — | 2y ago | Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console | |||
| CVE-2024-38820 | unknown | — | — | 2y ago | Spring Framework DataBinder Case Sensitive Match Exception | |||
| CVE-2024-49580 | unknown | — | — | 2y ago | JetBrains Ktor information disclosure | |||
| CVE-2024-45217 | unknown | — | — | 2y ago | Insecure Default Initialization of Resource vulnerability in Apache Solr | |||
| CVE-2024-45216 | unknown | — | — | 2y ago | Improper Authentication vulnerability in Apache Solr | |||
| CVE-2024-47874 | unknown | — | — | 2y ago | Starlette is an Asynchronous Server Gateway Interface (ASGI) framework/toolkit. Prior to version 0.40.0, Starlette treats `multipart/form-data` parts without a `filename` as text form fields and buff… | |||
| CVE-2024-47876 | unknown | — | — | 2y ago | SAK-50571 Sakai Kernel users created with type roleview can login as a normal user |