# Vulnerabilities published in 2024


- [CVE-2024-8443](https://insights.sbomify.com/CVE-2024-8443/): Libopensc: heap buffer overflow in openpgp driver when generating key (low 2.9)
- [CVE-2024-8442](https://insights.sbomify.com/CVE-2024-8442/): Cross-site scripting in Prime Slider – Addons for Elementor (medium 6.4)
- [CVE-2024-8441](https://insights.sbomify.com/CVE-2024-8441/): Privilege escalation in Endpoint Manager (medium 6.7)
- [CVE-2024-8440](https://insights.sbomify.com/CVE-2024-8440/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-8438](https://insights.sbomify.com/CVE-2024-8438/): Path Traversal in modelscope/agentscope (high 7.5)
- [CVE-2024-8437](https://insights.sbomify.com/CVE-2024-8437/): Missing authorization in WP Easy Gallery – WordPress Gallery Plugin (medium 4.3)
- [CVE-2024-8436](https://insights.sbomify.com/CVE-2024-8436/): WP Easy Gallery – WordPress Gallery Plugin <= 4.8.5 - Authenticated (Subscriber+) SQL Injection (critical 9.9)
- [CVE-2024-8434](https://insights.sbomify.com/CVE-2024-8434/): Missing authorization in Easy Mega Menu for WordPress – ThemeHunk (medium 4.3)
- [CVE-2024-8433](https://insights.sbomify.com/CVE-2024-8433/): Easy Mega Menu Plugin for WordPress – ThemeHunk <= 1.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8432](https://insights.sbomify.com/CVE-2024-8432/): Missing authorization in Easy Appointment Booking & Scheduling System – Webba Booking Calendar (medium 4.3)
- [CVE-2024-8431](https://insights.sbomify.com/CVE-2024-8431/): Missing authorization in Robo Gallery – Photo & Image Slider (medium 4.3)
- [CVE-2024-8430](https://insights.sbomify.com/CVE-2024-8430/): Spice Starter Sites <= 1.2.5 - Missing Authorization to Unauthenticated Demo Content Import (medium 5.3)
- [CVE-2024-8429](https://insights.sbomify.com/CVE-2024-8429/): Improper Authentication in Digital Operation Services' WiFiBurada (medium 4.3)
- [CVE-2024-8428](https://insights.sbomify.com/CVE-2024-8428/): Privilege escalation in ForumWP – Forum & Discussion Board (high 8.8)
- [CVE-2024-8427](https://insights.sbomify.com/CVE-2024-8427/): Missing authorization in Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin (medium 4.3)
- [CVE-2024-8426](https://insights.sbomify.com/CVE-2024-8426/): Pagelayer < 1.8.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8425](https://insights.sbomify.com/CVE-2024-8425/): WooCommerce Ultimate Gift Card <= 2.9.2 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-8424](https://insights.sbomify.com/CVE-2024-8424/): WatchGuard Endpoint Protection Privilege Escalation in PSANHost Enables Arbitrary File Delete as SYSTEM (high 8.5)
- [CVE-2024-8422](https://insights.sbomify.com/CVE-2024-8422/): Use after free in Zelio Soft 2 (high 7.8)
- [CVE-2024-8420](https://insights.sbomify.com/CVE-2024-8420/): DHVC Form <= 2.4.7 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2024-8419](https://insights.sbomify.com/CVE-2024-8419/): Improper Access Control vulnerability in AC4xxS devices (high 7.5)
- [CVE-2024-8418](https://insights.sbomify.com/CVE-2024-8418/): Containers/aardvark-dns: tcp query handling flaw in aardvark-dns leading to denial of service (high 7.5)
- [CVE-2024-8417](https://insights.sbomify.com/CVE-2024-8417/): 云课网络科技有限公司 Yunke Online School System videobind.html sensitive information in source (low 2.3)
- [CVE-2024-8416](https://insights.sbomify.com/CVE-2024-8416/): SourceCodester Food Ordering Management System ticket-status.php sql injection (medium 5.3)
- [CVE-2024-8415](https://insights.sbomify.com/CVE-2024-8415/): SourceCodester Food Ordering Management System add-ticket.php sql injection (medium 5.3)
- [CVE-2024-8414](https://insights.sbomify.com/CVE-2024-8414/): SourceCodester Insurance Management System cross-site request forgery (medium 6.9)
- [CVE-2024-8413](https://insights.sbomify.com/CVE-2024-8413/): Cross Site Scripting (XSS) in Raspcontrol (medium 5.4)
- [CVE-2024-8412](https://insights.sbomify.com/CVE-2024-8412/): LinuxOSsk Shakal-NG views.py redirect (medium 5.3)
- [CVE-2024-8411](https://insights.sbomify.com/CVE-2024-8411/): ABCD ABCD2 buscar_integrada.php cross site scripting (medium 5.1)
- [CVE-2024-8410](https://insights.sbomify.com/CVE-2024-8410/): ABCD ABCD2 otros_sitios.php path traversal (medium 5.3)
- [CVE-2024-8409](https://insights.sbomify.com/CVE-2024-8409/): ABCD ABCD2 show_image.php path traversal (medium 5.3)
- [CVE-2024-8408](https://insights.sbomify.com/CVE-2024-8408/): Linksys WRT54G POST Parameter apply.cgi validate_services_port stack-based overflow (medium 5.3)
- [CVE-2024-8407](https://insights.sbomify.com/CVE-2024-8407/): alwindoss akademy handlers.go cross site scripting (medium 5.3)
- [CVE-2024-8405](https://insights.sbomify.com/CVE-2024-8405/): Arbitrary File Creation in PaperCut NG/MF Web Print leading to a Denial of Service attack (medium 6.1)
- [CVE-2024-8404](https://insights.sbomify.com/CVE-2024-8404/): Arbitrary File Deletion in PaperCut NG/MF Web Print Hot folder (high 7.8)
- [CVE-2024-8403](https://insights.sbomify.com/CVE-2024-8403/): Denial-of-Service Vulnerability in Ethernet port on MELSEC iQ-F Ethernet Module and EtherNet/IP Module (high 7.5)
- [CVE-2024-8402](https://insights.sbomify.com/CVE-2024-8402/): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (low 3.7)
- [CVE-2024-8401](https://insights.sbomify.com/CVE-2024-8401/): Cross-site scripting in EcoStruxure Power Monitoring Expert (PME) 2020 (medium 5.4)
- [CVE-2024-8400](https://insights.sbomify.com/CVE-2024-8400/): Stored XSS in gaizhenbiao/chuanhuchatgpt (medium 5.4)
- [CVE-2024-8399](https://insights.sbomify.com/CVE-2024-8399/): Security feature bypass in Focus for iOS (medium 4.7)
- [CVE-2024-8398](https://insights.sbomify.com/CVE-2024-8398/): Simple Nav Archives <= 2.1.3 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-8397](https://insights.sbomify.com/CVE-2024-8397/): GDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS (medium 5.4)
- [CVE-2024-8395](https://insights.sbomify.com/CVE-2024-8395/): FlyCASS Cockpit Access Security System (CASS) SQL Injection (critical 9.3)
- [CVE-2024-8394](https://insights.sbomify.com/CVE-2024-8394/): Use after free in Thunderbird (medium 6.5)
- [CVE-2024-8393](https://insights.sbomify.com/CVE-2024-8393/): Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion (medium 6.6)
- [CVE-2024-8392](https://insights.sbomify.com/CVE-2024-8392/): WordPress Post Grid Layouts with Pagination – Sogrid <= 1.5.6 - Authenticated (Admin+) Local File Inclusion (high 7.2)
- [CVE-2024-8391](https://insights.sbomify.com/CVE-2024-8391/): Eclipse Vert.x gRPC server does not limit the maximum message size (medium 6.9)
- [CVE-2024-8389](https://insights.sbomify.com/CVE-2024-8389/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-8388](https://insights.sbomify.com/CVE-2024-8388/): Other in Firefox (medium 4.3)
- [CVE-2024-8387](https://insights.sbomify.com/CVE-2024-8387/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-8386](https://insights.sbomify.com/CVE-2024-8386/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2024-8385](https://insights.sbomify.com/CVE-2024-8385/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-8384](https://insights.sbomify.com/CVE-2024-8384/): Use after free in Firefox (critical 9.8)
- [CVE-2024-8383](https://insights.sbomify.com/CVE-2024-8383/): Security feature bypass in Firefox (high 7.5)
- [CVE-2024-8382](https://insights.sbomify.com/CVE-2024-8382/): Information disclosure in Firefox (high 8.8)
- [CVE-2024-8381](https://insights.sbomify.com/CVE-2024-8381/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-8380](https://insights.sbomify.com/CVE-2024-8380/): SourceCodester Contact Manager with Export to VCF Delete Contact delete-account.php sql injection (medium 5.3)
- [CVE-2024-8379](https://insights.sbomify.com/CVE-2024-8379/): Cost Calculator Builder < 3.2.29 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-8378](https://insights.sbomify.com/CVE-2024-8378/): Safe SVG < 2.2.6 - Author+ SVG Sanitisation Bypass (medium 4.8)
- [CVE-2024-8376](https://insights.sbomify.com/CVE-2024-8376/): Memory leak (high 7.2)
- [CVE-2024-8375](https://insights.sbomify.com/CVE-2024-8375/): Object deserialization in Reverb leading to RCE (medium 5.7)
- [CVE-2024-8374](https://insights.sbomify.com/CVE-2024-8374/): Arbitrary Code Injection in Cura (high 7.8)
- [CVE-2024-8373](https://insights.sbomify.com/CVE-2024-8373/): AngularJS improper sanitization in '<source>' element (medium 4.8)
- [CVE-2024-8372](https://insights.sbomify.com/CVE-2024-8372/): AngularJS improper sanitization in 'srcset' attribute (medium 4.8)
- [CVE-2024-8370](https://insights.sbomify.com/CVE-2024-8370/): Grocy SVG File Upload recipepictures cross site scripting (medium 5.3)
- [CVE-2024-8369](https://insights.sbomify.com/CVE-2024-8369/): EventPrime <= 4.0.4.3 - Missing Authorization to Unauthenticated Private or Password-Protected Events Disclosure (medium 5.3)
- [CVE-2024-8368](https://insights.sbomify.com/CVE-2024-8368/): code-projects Hospital Management System Login index.php sql injection (medium 6.9)
- [CVE-2024-8367](https://insights.sbomify.com/CVE-2024-8367/): HM Courts & Tribunals Service Probate Back Office Markdown NotificationService.java injection (medium 5.1)
- [CVE-2024-8366](https://insights.sbomify.com/CVE-2024-8366/): code-projects Pharmacy Management System Update My Profile Page index.php cross site scripting (medium 6.9)
- [CVE-2024-8365](https://insights.sbomify.com/CVE-2024-8365/): Vault Leaks AppRole Client Tokens And Accessor in Audit Log (medium 6.2)
- [CVE-2024-8364](https://insights.sbomify.com/CVE-2024-8364/): WP Custom Fields Search <= 1.2.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcfs-preset Shortcode (medium 6.4)
- [CVE-2024-8363](https://insights.sbomify.com/CVE-2024-8363/): Share This Image <= 2.02 - Authenticated (Contributor+) Stored Cross-Site Scripting via STI Buttons Shortcode (medium 6.4)
- [CVE-2024-8362](https://insights.sbomify.com/CVE-2024-8362/): Use after free in Chrome (high 8.8)
- [CVE-2024-8361](https://insights.sbomify.com/CVE-2024-8361/): DoS caused due to wrong hash length returned for SHA2/224 algorithm (high 7.5)
- [CVE-2024-8360](https://insights.sbomify.com/CVE-2024-8360/): Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-8359](https://insights.sbomify.com/CVE-2024-8359/): Visteon Infotainment REFLASH_DDU_FindFile Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-8358](https://insights.sbomify.com/CVE-2024-8358/): Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-8357](https://insights.sbomify.com/CVE-2024-8357/): Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-8356](https://insights.sbomify.com/CVE-2024-8356/): Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability (high 8.8)
- [CVE-2024-8355](https://insights.sbomify.com/CVE-2024-8355/): Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability (medium 6.8)
- [CVE-2024-8354](https://insights.sbomify.com/CVE-2024-8354/): Qemu-kvm: usb: assertion failure in usb_ep_get() (medium 5.5)
- [CVE-2024-8353](https://insights.sbomify.com/CVE-2024-8353/): GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2024-8352](https://insights.sbomify.com/CVE-2024-8352/): Path traversal in Social Web Suite – Social Media Auto Post, Social Media Auto Publish (high 7.5)
- [CVE-2024-8350](https://insights.sbomify.com/CVE-2024-8350/): Uncanny Groups for LearnDash <= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group Add (low 2.7)
- [CVE-2024-8349](https://insights.sbomify.com/CVE-2024-8349/): Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation (high 7.2)
- [CVE-2024-8348](https://insights.sbomify.com/CVE-2024-8348/): SourceCodester Computer Laboratory Management System Master.php delete_category sql injection (medium 5.3)
- [CVE-2024-8347](https://insights.sbomify.com/CVE-2024-8347/): SourceCodester Computer Laboratory Management System Master.php delete_record sql injection (medium 5.3)
- [CVE-2024-8346](https://insights.sbomify.com/CVE-2024-8346/): SourceCodester Computer Laboratory Management System SystemSettings.php update_settings_info sql injection (medium 5.3)
- [CVE-2024-8345](https://insights.sbomify.com/CVE-2024-8345/): SourceCodester Music Gallery Site Users.php sql injection (medium 5.3)
- [CVE-2024-8344](https://insights.sbomify.com/CVE-2024-8344/): Campcodes Supplier Management System edit_area.php sql injection (medium 5.3)
- [CVE-2024-8343](https://insights.sbomify.com/CVE-2024-8343/): SourceCodester Sentiment Based Movie Rating System User Registration Users.php sql injection (medium 6.9)
- [CVE-2024-8342](https://insights.sbomify.com/CVE-2024-8342/): SourceCodester Petshop Management System add_client.php unrestricted upload (medium 5.3)
- [CVE-2024-8341](https://insights.sbomify.com/CVE-2024-8341/): SourceCodester Petshop Management System add_user.php unrestricted upload (medium 5.3)
- [CVE-2024-8340](https://insights.sbomify.com/CVE-2024-8340/): SourceCodester Electric Billing Management System Actions.php sql injection (medium 6.9)
- [CVE-2024-8339](https://insights.sbomify.com/CVE-2024-8339/): SourceCodester Electric Billing Management System Connection Code ?page=tracks sql injection (medium 5.3)
- [CVE-2024-8338](https://insights.sbomify.com/CVE-2024-8338/): HFO4 shudong-share File Extension fileReceive.php unrestricted upload (medium 5.3)
- [CVE-2024-8337](https://insights.sbomify.com/CVE-2024-8337/): SourceCodester Contact Manager with Export to VCF index.html cross site scripting (medium 5.3)
- [CVE-2024-8336](https://insights.sbomify.com/CVE-2024-8336/): SourceCodester Music Gallery Site Master.php sql injection (medium 5.3)
- [CVE-2024-8335](https://insights.sbomify.com/CVE-2024-8335/): OpenRapid RapidCMS runlogon.php sql injection (medium 5.3)
- [CVE-2024-8334](https://insights.sbomify.com/CVE-2024-8334/): master-nan Sweet-CMS log.go LogHandler neutralization for logs (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/151/