# Vulnerabilities published in 2024


- [CVE-2024-8119](https://insights.sbomify.com/CVE-2024-8119/): The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via page (medium 6.1)
- [CVE-2024-8118](https://insights.sbomify.com/CVE-2024-8118/): Grafana alerting wrong permission on datasource rule write endpoint (medium 5.1)
- [CVE-2024-8117](https://insights.sbomify.com/CVE-2024-8117/): The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Reflected Cross-Site Scripting via selected_option (medium 6.1)
- [CVE-2024-8116](https://insights.sbomify.com/CVE-2024-8116/): Incorrect Authorization in GitLab (medium 5.3)
- [CVE-2024-8114](https://insights.sbomify.com/CVE-2024-8114/): Missing Authorization in GitLab (high 8.2)
- [CVE-2024-8113](https://insights.sbomify.com/CVE-2024-8113/): Stored XSS in Placeholder Samples in Mail Preview (high 7.2)
- [CVE-2024-8112](https://insights.sbomify.com/CVE-2024-8112/): thinkgem JeeSite Cookie login cross site scripting (medium 6.9)
- [CVE-2024-8110](https://insights.sbomify.com/CVE-2024-8110/): Denial of service in Dual-redundant Platform for Computer (PC2CKM) (high 7.5)
- [CVE-2024-8108](https://insights.sbomify.com/CVE-2024-8108/): Share This Image <= 2.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via alignment Parameter (medium 6.4)
- [CVE-2024-8107](https://insights.sbomify.com/CVE-2024-8107/): Slider Revolution <= 6.7.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-8106](https://insights.sbomify.com/CVE-2024-8106/): The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Sensitive Information Exposure (medium 6.5)
- [CVE-2024-8105](https://insights.sbomify.com/CVE-2024-8105/): Insecure Platform Key (PK) used in UEFI system firmware signature (medium 6.4)
- [CVE-2024-8104](https://insights.sbomify.com/CVE-2024-8104/): Path traversal in The Ultimate WordPress Toolkit – WP Extended (high 8.8)
- [CVE-2024-8103](https://insights.sbomify.com/CVE-2024-8103/): WP Category Dropdown <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter (medium 6.4)
- [CVE-2024-8102](https://insights.sbomify.com/CVE-2024-8102/): The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2024-8101](https://insights.sbomify.com/CVE-2024-8101/): Stored XSS in aimhubio/aim (high 7.2)
- [CVE-2024-8100](https://insights.sbomify.com/CVE-2024-8100/): Privilege escalation in CloudVision (high 8.7)
- [CVE-2024-8099](https://insights.sbomify.com/CVE-2024-8099/): Server-Side Request Forgery (SSRF) in vanna-ai/vanna (high 8.3)
- [CVE-2024-8097](https://insights.sbomify.com/CVE-2024-8097/): Sensitive information exposure when the org.glassfish.admingui LOGGER is set to FINEST level (medium 6.7)
- [CVE-2024-8096](https://insights.sbomify.com/CVE-2024-8096/): OCSP stapling bypass with GnuTLS (medium 6.5)
- [CVE-2024-8095](https://insights.sbomify.com/CVE-2024-8095/): BabelZ – Google Translate Widget <= 1.1.5 - CSRF to Stored XSS (medium 6.1)
- [CVE-2024-8094](https://insights.sbomify.com/CVE-2024-8094/): Ntz Antispam <= 2.0e - Settings Update via CSRF (medium 6.5)
- [CVE-2024-8093](https://insights.sbomify.com/CVE-2024-8093/): Posts reminder <= 0.20 - Settings Update via CSRF (medium 4.8)
- [CVE-2024-8092](https://insights.sbomify.com/CVE-2024-8092/): Accordion Image Menu <= 3.1.3 - Stored XSS via CSRF (medium 5.4)
- [CVE-2024-8091](https://insights.sbomify.com/CVE-2024-8091/): Enhanced Search Box <= 0.6.1 - Settings Update via CSRF (medium 4.8)
- [CVE-2024-8090](https://insights.sbomify.com/CVE-2024-8090/): JavaScript Logic <= 0.1 - CSRF to Stored XSS (medium 6.1)
- [CVE-2024-8089](https://insights.sbomify.com/CVE-2024-8089/): SourceCodester E-Commerce System controller.php unrestricted upload (medium 5.3)
- [CVE-2024-8088](https://insights.sbomify.com/CVE-2024-8088/): Infinite loop when iterating over zip archive entry names from zipfile.Path (high 8.7)
- [CVE-2024-8087](https://insights.sbomify.com/CVE-2024-8087/): SourceCodester E-Commerce System popup_Item.php sql injection (medium 5.3)
- [CVE-2024-8086](https://insights.sbomify.com/CVE-2024-8086/): SourceCodester E-Commerce System Admin Login login.php sql injection (medium 6.9)
- [CVE-2024-8085](https://insights.sbomify.com/CVE-2024-8085/): PeoplePond <= 1.1.9 - CSRF to Stored XSS (medium 6.1)
- [CVE-2024-8084](https://insights.sbomify.com/CVE-2024-8084/): SourceCodester Online Computer and Laptop Store Setting SystemSettings.php cross site scripting (medium 5.1)
- [CVE-2024-8083](https://insights.sbomify.com/CVE-2024-8083/): SourceCodester Online Computer and Laptop Store Master.php sql injection (medium 5.3)
- [CVE-2024-8082](https://insights.sbomify.com/CVE-2024-8082/): Widgets Reset <= 0.1 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-8081](https://insights.sbomify.com/CVE-2024-8081/): itsourcecode Payroll Management System login.php sql injection (medium 6.9)
- [CVE-2024-8080](https://insights.sbomify.com/CVE-2024-8080/): SourceCodester Online Health Care System search.php sql injection (medium 5.3)
- [CVE-2024-8079](https://insights.sbomify.com/CVE-2024-8079/): TOTOLINK AC1200 T8 exportOvpn buffer overflow (high 8.7)
- [CVE-2024-8078](https://insights.sbomify.com/CVE-2024-8078/): TOTOLINK AC1200 T8 setTracerouteCfg buffer overflow (high 8.7)
- [CVE-2024-8077](https://insights.sbomify.com/CVE-2024-8077/): TOTOLINK AC1200 T8 setTracerouteCfg os command injection (medium 5.3)
- [CVE-2024-8076](https://insights.sbomify.com/CVE-2024-8076/): TOTOLINK AC1200 T8 setDiagnosisCfg buffer overflow (high 8.7)
- [CVE-2024-8075](https://insights.sbomify.com/CVE-2024-8075/): TOTOLINK AC1200 T8 setDiagnosisCfg os command injection (medium 5.3)
- [CVE-2024-8074](https://insights.sbomify.com/CVE-2024-8074/): Sensetive Data Exposure in Nomysoft Informatics' Nomysem (critical 9.3)
- [CVE-2024-8073](https://insights.sbomify.com/CVE-2024-8073/): Command Injection Vulnerability in Hillstone Networks Web Application Firewall (critical 9.8)
- [CVE-2024-8072](https://insights.sbomify.com/CVE-2024-8072/): Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users (medium 5.3)
- [CVE-2024-8071](https://insights.sbomify.com/CVE-2024-8071/): System Role with edit access to permissions can elevate themselves to system admin (medium 4.7)
- [CVE-2024-8070](https://insights.sbomify.com/CVE-2024-8070/): Information disclosure in EVlink Home Smart (high 8.5)
- [CVE-2024-8069](https://insights.sbomify.com/CVE-2024-8069/): Citrix Session Recording Deserialization of Untrusted Data (medium 5.1, exploited in the wild)
- [CVE-2024-8068](https://insights.sbomify.com/CVE-2024-8068/): Citrix Session Recording Improper Privilege Management (medium 5.1, exploited in the wild)
- [CVE-2024-8067](https://insights.sbomify.com/CVE-2024-8067/): Unicode "best fit" argument injection (medium 5.8)
- [CVE-2024-8066](https://insights.sbomify.com/CVE-2024-8066/): File Manager Pro – Filester <= 1.8.6- Authenticated (Subscriber+) Arbitrary File Upload (high 7.5)
- [CVE-2024-8065](https://insights.sbomify.com/CVE-2024-8065/): CSRF in danswer-ai/danswer (high 8.1)
- [CVE-2024-8063](https://insights.sbomify.com/CVE-2024-8063/): Divide by Zero in ollama/ollama (high 7.5)
- [CVE-2024-8062](https://insights.sbomify.com/CVE-2024-8062/): Denial of Service in h2oai/h2o-3 (high 7.5)
- [CVE-2024-8061](https://insights.sbomify.com/CVE-2024-8061/): Denial of Service in aimhubio/aim (high 7.5)
- [CVE-2024-8059](https://insights.sbomify.com/CVE-2024-8059/): Information disclosure in HX Enclosure Certified Node (ThinkAgile) XCC (medium 4.3)
- [CVE-2024-8058](https://insights.sbomify.com/CVE-2024-8058/): Path traversal in FileZ Client (high 7.6)
- [CVE-2024-8057](https://insights.sbomify.com/CVE-2024-8057/): Improper Access Control in danswer-ai/danswer (medium 4.3)
- [CVE-2024-8056](https://insights.sbomify.com/CVE-2024-8056/): MM-Breaking News <= 0.7.9 - Reflected XSS (medium 6.1)
- [CVE-2024-8055](https://insights.sbomify.com/CVE-2024-8055/): Local File Read (LFI) by Prompt Injection via SnowFlake SQL in vanna-ai/vanna (high 7.5)
- [CVE-2024-8054](https://insights.sbomify.com/CVE-2024-8054/): MM-Breaking News <= 0.7.9 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-8053](https://insights.sbomify.com/CVE-2024-8053/): Improper Authentication in open-webui/open-webui (high 7.5)
- [CVE-2024-8052](https://insights.sbomify.com/CVE-2024-8052/): Review Ratings <= 1.6 - Stored XSS via CSRF (medium 4.8)
- [CVE-2024-8051](https://insights.sbomify.com/CVE-2024-8051/): Special Feed Items <= 1.0.1 - Stored XSS via CSRF (medium 5.7)
- [CVE-2024-8050](https://insights.sbomify.com/CVE-2024-8050/): Custom Author Base <= 1.1.1 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-8049](https://insights.sbomify.com/CVE-2024-8049/): Telerik Document Processing Improper Handling of Memory Resources (medium 6.5)
- [CVE-2024-8048](https://insights.sbomify.com/CVE-2024-8048/): Telerik Reporting Insecure Expression Evaluation (high 7.8)
- [CVE-2024-8047](https://insights.sbomify.com/CVE-2024-8047/): Visual Sound (old) <= 1.06 - Settings Update via CSRF (medium 5.7)
- [CVE-2024-8046](https://insights.sbomify.com/CVE-2024-8046/): Cross-site scripting in Logo Showcase Ultimate – Logo Carousel, Logo Slider & Logo Grid (medium 6.4)
- [CVE-2024-8045](https://insights.sbomify.com/CVE-2024-8045/): Cross-site scripting in Advanced WordPress Backgrounds (medium 6.4)
- [CVE-2024-8044](https://insights.sbomify.com/CVE-2024-8044/): infolinks Ad Wrap <= 1.0.2 - Settings Update via CSRF (medium 5.7)
- [CVE-2024-8043](https://insights.sbomify.com/CVE-2024-8043/): Vikinghammer Tweet <= 0.2.4 - Stored XSS via CSRF (medium 5.7)
- [CVE-2024-8042](https://insights.sbomify.com/CVE-2024-8042/): Rapid7 Insight Platform Unauthorized Empty Group Creation (low 2.4)
- [CVE-2024-8041](https://insights.sbomify.com/CVE-2024-8041/): Uncontrolled Resource Consumption in GitLab (medium 6.5)
- [CVE-2024-8040](https://insights.sbomify.com/CVE-2024-8040/): Missing authorization in 3DSwymer (high 7.7)
- [CVE-2024-8039](https://insights.sbomify.com/CVE-2024-8039/): Misconfiguration in com.afmobi.boomplayer (critical 9.8)
- [CVE-2024-8038](https://insights.sbomify.com/CVE-2024-8038/): Vulnerable juju introspection abstract UNIX domain socket (high 7.9)
- [CVE-2024-8037](https://insights.sbomify.com/CVE-2024-8037/): Vulnerable juju hook tool abstract UNIX domain socket (medium 6.5)
- [CVE-2024-8036](https://insights.sbomify.com/CVE-2024-8036/): Unauthorized Modifications of Firmware and Configuration (medium 4.6)
- [CVE-2024-8035](https://insights.sbomify.com/CVE-2024-8035/): Other in Chrome (medium 4.3)
- [CVE-2024-8034](https://insights.sbomify.com/CVE-2024-8034/): Other in Chrome (medium 4.3)
- [CVE-2024-8033](https://insights.sbomify.com/CVE-2024-8033/): Other in Chrome (medium 4.3)
- [CVE-2024-8032](https://insights.sbomify.com/CVE-2024-8032/): Smooth Gallery Replacement <= 1.0 - CSRF to Stored XSS (medium 6.1)
- [CVE-2024-8031](https://insights.sbomify.com/CVE-2024-8031/): Secure Downloads < 1.2.3 - Admin+ Arbitrary File Download (medium 6.5)
- [CVE-2024-8030](https://insights.sbomify.com/CVE-2024-8030/): Deserialization in Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor (critical 9.8)
- [CVE-2024-8029](https://insights.sbomify.com/CVE-2024-8029/): Stored XSS in imartinez/privategpt (medium 4.7)
- [CVE-2024-8028](https://insights.sbomify.com/CVE-2024-8028/): Denial of Service in danswer-ai/danswer (high 7.5)
- [CVE-2024-8027](https://insights.sbomify.com/CVE-2024-8027/): Stored Cross-Site Scripting (XSS) in netease-youdao/QAnything (medium 6.1)
- [CVE-2024-8026](https://insights.sbomify.com/CVE-2024-8026/): CSRF due to overly permissive CORS headers in netease-youdao/qanything (high 8.1)
- [CVE-2024-8025](https://insights.sbomify.com/CVE-2024-8025/): Nikon NEF Codec Thumbnail Provider NRW File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.0)
- [CVE-2024-8024](https://insights.sbomify.com/CVE-2024-8024/): CORS Misconfiguration in netease-youdao/qanything (high 7.5)
- [CVE-2024-8023](https://insights.sbomify.com/CVE-2024-8023/): chillzhuang SpringBlade list sql injection (medium 5.3)
- [CVE-2024-8022](https://insights.sbomify.com/CVE-2024-8022/): Genexis Tilgin Home Gateway cross site scripting (medium 5.3)
- [CVE-2024-8021](https://insights.sbomify.com/CVE-2024-8021/): Open Redirect in gradio-app/gradio (medium 5.4)
- [CVE-2024-8020](https://insights.sbomify.com/CVE-2024-8020/): Denial of Service in lightning-ai/pytorch-lightning (high 7.5)
- [CVE-2024-8019](https://insights.sbomify.com/CVE-2024-8019/): Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning (critical 9.1)
- [CVE-2024-8018](https://insights.sbomify.com/CVE-2024-8018/): Denial of Service (DOS) in imartinez/privategpt (high 7.5)
- [CVE-2024-8017](https://insights.sbomify.com/CVE-2024-8017/): Cross-site Scripting (XSS) in open-webui/open-webui (critical 9.0)
- [CVE-2024-8016](https://insights.sbomify.com/CVE-2024-8016/): The Events Calendar Pro <= 7.0.2 - Authenticated (Administrator+) PHP Object Injection to Remote Code Execution (critical 9.1)
- [CVE-2024-8015](https://insights.sbomify.com/CVE-2024-8015/): Telerik Report Server Insecure Type Resolution (critical 9.1)
- [CVE-2024-8014](https://insights.sbomify.com/CVE-2024-8014/): Telerik Reporting EntityDataSource Insecure Type Resolution (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/154/