# Vulnerabilities published in 2024


- [CVE-2024-8332](https://insights.sbomify.com/CVE-2024-8332/): master-nan Sweet-CMS index sql injection (medium 5.3)
- [CVE-2024-8331](https://insights.sbomify.com/CVE-2024-8331/): OpenRapid RapidCMS user-move-run.php sql injection (medium 5.3)
- [CVE-2024-8330](https://insights.sbomify.com/CVE-2024-8330/): Gether Technology 6SHR System - Unrestricted File Upload (high 8.8)
- [CVE-2024-8329](https://insights.sbomify.com/CVE-2024-8329/): Gether Technology 6SHR System - SQL Injection (high 8.8)
- [CVE-2024-8328](https://insights.sbomify.com/CVE-2024-8328/): HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - Reflected XSS (medium 5.4)
- [CVE-2024-8327](https://insights.sbomify.com/CVE-2024-8327/): HWA JIUH DIGITAL TECHNOLOGY Easy test Online Learning and Testing Platform - SQL injection (high 8.8)
- [CVE-2024-8326](https://insights.sbomify.com/CVE-2024-8326/): Information disclosure in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions (high 8.8)
- [CVE-2024-8325](https://insights.sbomify.com/CVE-2024-8325/): Cross-site scripting in BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor (medium 6.4)
- [CVE-2024-8324](https://insights.sbomify.com/CVE-2024-8324/): XO Slider <= 3.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8323](https://insights.sbomify.com/CVE-2024-8323/): Cross-site scripting in Pricing Table WordPress Plugin – Easy Pricing Tables (medium 6.4)
- [CVE-2024-8322](https://insights.sbomify.com/CVE-2024-8322/): Auth bypass in Endpoint Manager (medium 4.3)
- [CVE-2024-8321](https://insights.sbomify.com/CVE-2024-8321/): Missing authorization in Endpoint Manager (medium 5.8)
- [CVE-2024-8320](https://insights.sbomify.com/CVE-2024-8320/): Auth bypass in Endpoint Manager (medium 5.3)
- [CVE-2024-8319](https://insights.sbomify.com/CVE-2024-8319/): Tourfic <= 2.11.20 - Cross-Site Request Forgery in Multiple Functions (medium 4.3)
- [CVE-2024-8318](https://insights.sbomify.com/CVE-2024-8318/): Cross-site scripting in Attributes for Blocks (medium 6.4)
- [CVE-2024-8317](https://insights.sbomify.com/CVE-2024-8317/): Cross-site scripting in WP AdCenter – Ad Manager & Adsense Ads (medium 6.4)
- [CVE-2024-8316](https://insights.sbomify.com/CVE-2024-8316/): Progress UI for WPF format provider unsafe deserialization vulnerability (high 7.8)
- [CVE-2024-8315](https://insights.sbomify.com/CVE-2024-8315/): Improper Handling of Insufficient Permissions or Privileges in B&R APROL (medium 6.8)
- [CVE-2024-8314](https://insights.sbomify.com/CVE-2024-8314/): Improper session handling in B&R APROL (medium 5.5)
- [CVE-2024-8313](https://insights.sbomify.com/CVE-2024-8313/): Default or Guessable SNMP community names in B&R APROL (high 8.7)
- [CVE-2024-8312](https://insights.sbomify.com/CVE-2024-8312/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2024-8311](https://insights.sbomify.com/CVE-2024-8311/): Improper Protection of Alternate Path in GitLab (medium 6.5)
- [CVE-2024-8310](https://insights.sbomify.com/CVE-2024-8310/): OPW Fuel Management Systems SiteSentinel Missing Authentication for Critical Function (critical 9.8)
- [CVE-2024-8309](https://insights.sbomify.com/CVE-2024-8309/): SQL Injection in langchain-ai/langchain (medium 4.9)
- [CVE-2024-8308](https://insights.sbomify.com/CVE-2024-8308/): Siempelkamp: SQL injection due to improper handling of HTTP request input data (medium 6.5)
- [CVE-2024-8306](https://insights.sbomify.com/CVE-2024-8306/): Privilege escalation in Vijeo Designer (high 7.8)
- [CVE-2024-8305](https://insights.sbomify.com/CVE-2024-8305/): MongoDB Server secondaries may crash due to forced index constraints (medium 6.5)
- [CVE-2024-8304](https://insights.sbomify.com/CVE-2024-8304/): jpress Template Module edit path traversal (medium 5.1)
- [CVE-2024-8303](https://insights.sbomify.com/CVE-2024-8303/): dingfanzu CMS getBasicInfo.php sql injection (medium 5.3)
- [CVE-2024-8302](https://insights.sbomify.com/CVE-2024-8302/): dingfanzu CMS chpwd.php sql injection (medium 5.3)
- [CVE-2024-8301](https://insights.sbomify.com/CVE-2024-8301/): dingfanzu CMS checkin.php sql injection (medium 6.9)
- [CVE-2024-8300](https://insights.sbomify.com/CVE-2024-8300/): Malicious Code Execution Vulnerability in GENESIS64 and ICONICS Suite (high 7.0)
- [CVE-2024-8299](https://insights.sbomify.com/CVE-2024-8299/): Malicious Code Execution Vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, MC Works64, and GENESIS32 (high 7.8)
- [CVE-2024-8298](https://insights.sbomify.com/CVE-2024-8298/): Information disclosure in EMUI (medium 6.2)
- [CVE-2024-8297](https://insights.sbomify.com/CVE-2024-8297/): kitsada8621 Digital Library Management System jwt_refresh_token_middleware.go JwtRefreshAuth neutralization for logs (medium 6.9)
- [CVE-2024-8296](https://insights.sbomify.com/CVE-2024-8296/): FeehiCMS index.php insert unrestricted upload (medium 5.3)
- [CVE-2024-8295](https://insights.sbomify.com/CVE-2024-8295/): FeehiCMS index.php createBanner unrestricted upload (medium 5.3)
- [CVE-2024-8294](https://insights.sbomify.com/CVE-2024-8294/): FeehiCMS index.php update unrestricted upload (medium 5.3)
- [CVE-2024-8292](https://insights.sbomify.com/CVE-2024-8292/): Auth bypass in WP-Recall – Registration, Profile, Commerce & More (critical 9.8)
- [CVE-2024-8291](https://insights.sbomify.com/CVE-2024-8291/): Concrete CMS Stored XSS in Image Editor Background Color (medium 5.1)
- [CVE-2024-8290](https://insights.sbomify.com/CVE-2024-8290/): Missing authorization in WCFM – Frontend Manager for WooCommerce (high 8.8)
- [CVE-2024-8289](https://insights.sbomify.com/CVE-2024-8289/): Missing authorization in MultiVendorX – WooCommerce Multivendor Marketplace Solutions (critical 9.8)
- [CVE-2024-8288](https://insights.sbomify.com/CVE-2024-8288/): Cross-site scripting in Guten Post Layout – An Advanced Post Grid Collection (medium 6.4)
- [CVE-2024-8287](https://insights.sbomify.com/CVE-2024-8287/): Security feature bypass in Anbox Cloud (high 7.5)
- [CVE-2024-8286](https://insights.sbomify.com/CVE-2024-8286/): GDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF (medium 6.5)
- [CVE-2024-8285](https://insights.sbomify.com/CVE-2024-8285/): Kroxylicious: missing upstream kafka tls hostname verification (medium 5.9)
- [CVE-2024-8284](https://insights.sbomify.com/CVE-2024-8284/): Download Manager <= 3.2.98 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8283](https://insights.sbomify.com/CVE-2024-8283/): Slider by 10Web < 1.2.59 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8282](https://insights.sbomify.com/CVE-2024-8282/): Cross-site scripting in Ibtana – WordPress Website Builder (medium 6.4)
- [CVE-2024-8281](https://insights.sbomify.com/CVE-2024-8281/): Command injection in HX Enclosure Certified Node (ThinkAgile) XCC (high 7.2)
- [CVE-2024-8280](https://insights.sbomify.com/CVE-2024-8280/): Command injection in HX Enclosure Certified Node (ThinkAgile) XCC (high 7.2)
- [CVE-2024-8279](https://insights.sbomify.com/CVE-2024-8279/): Command injection in HX Enclosure Certified Node (ThinkAgile) XCC (high 7.2)
- [CVE-2024-8278](https://insights.sbomify.com/CVE-2024-8278/): Command injection in HX Enclosure Certified Node (ThinkAgile) XCC (high 7.2)
- [CVE-2024-8277](https://insights.sbomify.com/CVE-2024-8277/): WooCommerce Photo Reviews Premium <= 1.3.13.2 - Authentication Bypass to Account Takeover and Privilege Escalation (critical 9.8)
- [CVE-2024-8276](https://insights.sbomify.com/CVE-2024-8276/): Cross-site scripting in WPZOOM Portfolio Lite – Filterable Portfolio Plugin (medium 6.4)
- [CVE-2024-8275](https://insights.sbomify.com/CVE-2024-8275/): The Events Calendar <= 6.6.4 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-8274](https://insights.sbomify.com/CVE-2024-8274/): WP Booking Calendar <= 10.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8273](https://insights.sbomify.com/CVE-2024-8273/): Auth bypass in Server (high 7.1)
- [CVE-2024-8272](https://insights.sbomify.com/CVE-2024-8272/): macOS Universal Audio (UAConnect) <= 2.7.0 - Local Privilege Escalation (high 7.8)
- [CVE-2024-8271](https://insights.sbomify.com/CVE-2024-8271/): FOX – Currency Switcher Professional for WooCommerce <= 1.4.2.1 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-8270](https://insights.sbomify.com/CVE-2024-8270/): macOS Rocket.Chat: TCC Policy Bypass via Dylib Injection Due to Missing Code Signing Flags and Dangerous Entitlements (medium 5.5)
- [CVE-2024-8269](https://insights.sbomify.com/CVE-2024-8269/): MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.3 - Unauthorized User Registration (high 7.3)
- [CVE-2024-8268](https://insights.sbomify.com/CVE-2024-8268/): Frontend Dashboard <= 2.2.4 - Authenticated (Subscriber+) Arbitrary Function Call (high 8.8)
- [CVE-2024-8267](https://insights.sbomify.com/CVE-2024-8267/): Cross-site scripting in Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player (medium 6.4)
- [CVE-2024-8266](https://insights.sbomify.com/CVE-2024-8266/): Execution with Unnecessary Privileges in GitLab (medium 4.4)
- [CVE-2024-8264](https://insights.sbomify.com/CVE-2024-8264/): Information disclosure in Robot Schedule Enterprise (medium 5.5)
- [CVE-2024-8263](https://insights.sbomify.com/CVE-2024-8263/): Privilege escalation in GitHub Enterprise Server (medium 6.2)
- [CVE-2024-8262](https://insights.sbomify.com/CVE-2024-8262/): Path Traversal in Proliz Software's OBS (critical 9.8)
- [CVE-2024-8261](https://insights.sbomify.com/CVE-2024-8261/): IDOR in Proliz Software's OBS (high 7.5)
- [CVE-2024-8260](https://insights.sbomify.com/CVE-2024-8260/): OPA SMB Force-Authentication (medium 6.1)
- [CVE-2024-8259](https://insights.sbomify.com/CVE-2024-8259/): Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program (critical 9.8)
- [CVE-2024-8258](https://insights.sbomify.com/CVE-2024-8258/): Insecure Electron Fuses in Logitech Options Plus Allowing Arbitrary Code Execution on macOS (low 2.0)
- [CVE-2024-8256](https://insights.sbomify.com/CVE-2024-8256/): Incorrect Permission Assignment in RutOS based routers and TSWOS based managed switches (medium 5.9)
- [CVE-2024-8255](https://insights.sbomify.com/CVE-2024-8255/): Path Traversal in Ocean Data Systems Dream Report (high 8.4)
- [CVE-2024-8254](https://insights.sbomify.com/CVE-2024-8254/): Code injection in Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress (medium 5.4)
- [CVE-2024-8253](https://insights.sbomify.com/CVE-2024-8253/): Post Grid and Gutenberg Blocks 2.2.87 - 2.2.90 - Authenticated (Subscriber+) Privilege Escalation (high 8.8)
- [CVE-2024-8252](https://insights.sbomify.com/CVE-2024-8252/): Clean Login <= 1.14.5 - Authenticated (Contributor+) Local File Inclusion (high 8.8)
- [CVE-2024-8251](https://insights.sbomify.com/CVE-2024-8251/): Prisma Injection in mintplex-labs/anything-llm (medium 5.3)
- [CVE-2024-8250](https://insights.sbomify.com/CVE-2024-8250/): Expired Pointer Dereference in Wireshark (high 7.8)
- [CVE-2024-8249](https://insights.sbomify.com/CVE-2024-8249/): Unauthenticated Denial of Service (DoS) in mintplex-labs/anything-llm (high 7.5)
- [CVE-2024-8248](https://insights.sbomify.com/CVE-2024-8248/): Path Traversal in mintplex-labs/anything-llm (high 7.2)
- [CVE-2024-8247](https://insights.sbomify.com/CVE-2024-8247/): Newsletters <= 4.9.9.2 - Authenticated Privilege Escalation (high 8.8)
- [CVE-2024-8246](https://insights.sbomify.com/CVE-2024-8246/): Privilege escalation in Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) (high 8.8)
- [CVE-2024-8245](https://insights.sbomify.com/CVE-2024-8245/): GamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRF (medium 4.3)
- [CVE-2024-8244](https://insights.sbomify.com/CVE-2024-8244/): Walk/WalkDir in path/filepath susceptible to symlink race (low 3.7)
- [CVE-2024-8243](https://insights.sbomify.com/CVE-2024-8243/): Plugin Upgrade Time Out <= 1.0 - Stored XSS via CSRF (medium 6.3)
- [CVE-2024-8242](https://insights.sbomify.com/CVE-2024-8242/): File upload in MStore API – Create Native Android & iOS Apps On The Cloud (medium 4.3)
- [CVE-2024-8241](https://insights.sbomify.com/CVE-2024-8241/): Nova Blocks by Pixelgrade <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Attribute (medium 6.4)
- [CVE-2024-8239](https://insights.sbomify.com/CVE-2024-8239/): Starbox < 3.5.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-8238](https://insights.sbomify.com/CVE-2024-8238/): Unrestricted Code Execution in aimhubio/aim (medium 5.9)
- [CVE-2024-8237](https://insights.sbomify.com/CVE-2024-8237/): Inefficient Algorithmic Complexity in GitLab (medium 6.5)
- [CVE-2024-8236](https://insights.sbomify.com/CVE-2024-8236/): Cross-site scripting in Elementor Website Builder – more than just a page builder (medium 6.4)
- [CVE-2024-8235](https://insights.sbomify.com/CVE-2024-8235/): Libvirt: crash of virtinterfaced via virconnectlistinterfaces() (medium 6.2)
- [CVE-2024-8234](https://insights.sbomify.com/CVE-2024-8234/): Command injection in NWA1100-N firmware (high 7.5)
- [CVE-2024-8233](https://insights.sbomify.com/CVE-2024-8233/): Inefficient Algorithmic Complexity in GitLab (high 7.5)
- [CVE-2024-8232](https://insights.sbomify.com/CVE-2024-8232/): iniNet Solutions SpiderControl SCADA Web Server Unrestricted Upload of File with Dangerous Type (high 8.7)
- [CVE-2024-8231](https://insights.sbomify.com/CVE-2024-8231/): Tenda O6 setPortForward fromVirtualSet stack-based overflow (high 8.7)
- [CVE-2024-8230](https://insights.sbomify.com/CVE-2024-8230/): Tenda O6 setMacFilterList fromSafeSetMacFilter stack-based overflow (high 8.7)
- [CVE-2024-8229](https://insights.sbomify.com/CVE-2024-8229/): Tenda O6 operateMacFilter frommacFilterModify stack-based overflow (high 8.7)
- [CVE-2024-8228](https://insights.sbomify.com/CVE-2024-8228/): Tenda O5 setMacFilterList fromSafeSetMacFilter stack-based overflow (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/152/