# Vulnerabilities published in 2024


- [CVE-2024-8013](https://insights.sbomify.com/CVE-2024-8013/): CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines (low 2.2)
- [CVE-2024-8012](https://insights.sbomify.com/CVE-2024-8012/): Auth bypass in Workspace Control (high 7.8)
- [CVE-2024-8011](https://insights.sbomify.com/CVE-2024-8011/): Privilege escalation in Options+ (low 2.0)
- [CVE-2024-8010](https://insights.sbomify.com/CVE-2024-8010/): XML External Entity Injection via Publisher in WSO2 API Manager Allows Reading Arbitrary Files (low 3.5)
- [CVE-2024-8009](https://insights.sbomify.com/CVE-2024-8009/): Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure (medium 4.3)
- [CVE-2024-8008](https://insights.sbomify.com/CVE-2024-8008/): Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation (medium 5.2)
- [CVE-2024-8007](https://insights.sbomify.com/CVE-2024-8007/): Openstack-tripleo-common: rhosp director disables tls verification for registry mirrors (high 8.1)
- [CVE-2024-8006](https://insights.sbomify.com/CVE-2024-8006/): NULL pointer dereference in libpcap before 1.10.5 with remote packet capture support (medium 4.4)
- [CVE-2024-8005](https://insights.sbomify.com/CVE-2024-8005/): demozx gf_cms JWT Authentication auth.go init hard-coded credentials (medium 6.9)
- [CVE-2024-8004](https://insights.sbomify.com/CVE-2024-8004/): Cross-site scripting in ENOVIA Collaborative Industry Innovator (high 8.7)
- [CVE-2024-8003](https://insights.sbomify.com/CVE-2024-8003/): Go-Tribe gotribe-admin Log routes.go InitRoutes deserialization (medium 5.1)
- [CVE-2024-8002](https://insights.sbomify.com/CVE-2024-8002/): VIWIS LMS File Upload cross site scripting (medium 6.9)
- [CVE-2024-8001](https://insights.sbomify.com/CVE-2024-8001/): VIWIS LMS Print authorization (medium 6.9)
- [CVE-2024-8000](https://insights.sbomify.com/CVE-2024-8000/): Security feature bypass in EOS (medium 5.3)
- [CVE-2024-7998](https://insights.sbomify.com/CVE-2024-7998/): Other in Octopus Server (low 2.6)
- [CVE-2024-7995](https://insights.sbomify.com/CVE-2024-7995/): Autodesk VRED Design Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7994](https://insights.sbomify.com/CVE-2024-7994/): Stack-Based Buffer Overflow Vulnerability in Autodesk Revit (high 7.8)
- [CVE-2024-7993](https://insights.sbomify.com/CVE-2024-7993/): Out-of-Bounds Write Vulnerability in Autodesk Revit (high 7.8)
- [CVE-2024-7992](https://insights.sbomify.com/CVE-2024-7992/): Autodesk AutoCAD DWG Stack-Based Buffer Overflow Code Execution Vulnerability (high 7.8)
- [CVE-2024-7991](https://insights.sbomify.com/CVE-2024-7991/): Autodesk AutoCAD DWG Out-of-Bounds Write Code Execution Vulnerability (high 7.8)
- [CVE-2024-7988](https://insights.sbomify.com/CVE-2024-7988/): ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities (critical 9.3)
- [CVE-2024-7987](https://insights.sbomify.com/CVE-2024-7987/): Rockwell Automation ThinManager® ThinServer™ Information Disclosure and Remote Code Execution Vulnerabilities (high 8.5)
- [CVE-2024-7986](https://insights.sbomify.com/CVE-2024-7986/): Rockwell Automation ThinManager® ThinServer™ Information Disclosure (medium 6.8)
- [CVE-2024-7985](https://insights.sbomify.com/CVE-2024-7985/): FileOrganizer <= 1.0.9 - Authenticated (Subscriber+) Arbitrary File Upload (high 7.5)
- [CVE-2024-7984](https://insights.sbomify.com/CVE-2024-7984/): Joy Of Text Lite – SMS messaging for WordPress <= 2.3.1 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-7983](https://insights.sbomify.com/CVE-2024-7983/): Denial of Service in open-webui/open-webui (high 7.5)
- [CVE-2024-7982](https://insights.sbomify.com/CVE-2024-7982/): Registrations for The Events Calendar < 2.12.4 - Unauthenticated Stored XSS (critical 9.6)
- [CVE-2024-7981](https://insights.sbomify.com/CVE-2024-7981/): Other in Chrome (medium 4.3)
- [CVE-2024-7980](https://insights.sbomify.com/CVE-2024-7980/): Privilege escalation in Chrome (high 7.3)
- [CVE-2024-7979](https://insights.sbomify.com/CVE-2024-7979/): Privilege escalation in Chrome (high 7.0)
- [CVE-2024-7978](https://insights.sbomify.com/CVE-2024-7978/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2024-7977](https://insights.sbomify.com/CVE-2024-7977/): Privilege escalation in Chrome (high 7.8)
- [CVE-2024-7976](https://insights.sbomify.com/CVE-2024-7976/): Other in Chrome (medium 4.3)
- [CVE-2024-7975](https://insights.sbomify.com/CVE-2024-7975/): Other in Chrome (medium 4.3)
- [CVE-2024-7974](https://insights.sbomify.com/CVE-2024-7974/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7973](https://insights.sbomify.com/CVE-2024-7973/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7972](https://insights.sbomify.com/CVE-2024-7972/): Memory corruption in Chrome (high 8.1)
- [CVE-2024-7971](https://insights.sbomify.com/CVE-2024-7971/): Google Chromium V8 Type Confusion (high 8.8, exploited in the wild)
- [CVE-2024-7970](https://insights.sbomify.com/CVE-2024-7970/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7969](https://insights.sbomify.com/CVE-2024-7969/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7968](https://insights.sbomify.com/CVE-2024-7968/): Use after free in Chrome (high 8.8)
- [CVE-2024-7967](https://insights.sbomify.com/CVE-2024-7967/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7966](https://insights.sbomify.com/CVE-2024-7966/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7965](https://insights.sbomify.com/CVE-2024-7965/): Google Chromium V8 Inappropriate Implementation (high 8.8, exploited in the wild)
- [CVE-2024-7964](https://insights.sbomify.com/CVE-2024-7964/): Use after free in Chrome (high 8.8)
- [CVE-2024-7963](https://insights.sbomify.com/CVE-2024-7963/): CMSMasters Content Composer <= 1.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-7962](https://insights.sbomify.com/CVE-2024-7962/): Arbitrary File Read via Insufficient Validation in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-7961](https://insights.sbomify.com/CVE-2024-7961/): Rockwell Automation Path Traversal Vulnerability in Pavilion8® (high 8.6)
- [CVE-2024-7960](https://insights.sbomify.com/CVE-2024-7960/): Rockwell Automation Incorrect Privileges and Path Traversal Vulnerability in Pavilion8® (high 8.8)
- [CVE-2024-7957](https://insights.sbomify.com/CVE-2024-7957/): Arbitrary File Overwrite in danswer-ai/danswer (critical 9.1)
- [CVE-2024-7956](https://insights.sbomify.com/CVE-2024-7956/): Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud (high 7.6)
- [CVE-2024-7955](https://insights.sbomify.com/CVE-2024-7955/): Starbox < 3.5.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7954](https://insights.sbomify.com/CVE-2024-7954/): SPIP porte_plume Plugin Arbitrary PHP Execution (critical 9.8)
- [CVE-2024-7953](https://insights.sbomify.com/CVE-2024-7953/): DataEdgePlatform DataMosaix™ Private Cloud (high 8.7)
- [CVE-2024-7952](https://insights.sbomify.com/CVE-2024-7952/): DataEdgePlatform DataMosaix™ Private Cloud (high 8.7)
- [CVE-2024-7950](https://insights.sbomify.com/CVE-2024-7950/): Missing authorization in WP Job Portal – AI-Powered Recruitment System for Company or Job Board website (critical 9.8)
- [CVE-2024-7949](https://insights.sbomify.com/CVE-2024-7949/): SourceCodester Online Graduate Tracer System fetch_genderit.php sql injection (medium 5.3)
- [CVE-2024-7948](https://insights.sbomify.com/CVE-2024-7948/): SourceCodester Accounts Manager App Update Account Page update-account.php cross site scripting (medium 5.3)
- [CVE-2024-7947](https://insights.sbomify.com/CVE-2024-7947/): SourceCodester Point of Sales and Inventory Management System login.php sql injection (medium 6.9)
- [CVE-2024-7946](https://insights.sbomify.com/CVE-2024-7946/): itsourcecode Online Blood Bank Management System User Signup register.php sql injection (medium 6.9)
- [CVE-2024-7945](https://insights.sbomify.com/CVE-2024-7945/): itsourcecode Laravel Property Management System Notes Page create cross site scripting (medium 5.3)
- [CVE-2024-7944](https://insights.sbomify.com/CVE-2024-7944/): itsourcecode Laravel Property Management System DocumentsController.php UpdateDocumentsRequest unrestricted upload (medium 5.3)
- [CVE-2024-7943](https://insights.sbomify.com/CVE-2024-7943/): itsourcecode Laravel Property Management System PropertiesController.php upload unrestricted upload (medium 5.3)
- [CVE-2024-7942](https://insights.sbomify.com/CVE-2024-7942/): SourceCodester Leads Manager Tool update-leads.php cross site scripting (medium 5.3)
- [CVE-2024-7941](https://insights.sbomify.com/CVE-2024-7941/): Open redirect in MicroSCADA SYS600 (medium 4.3)
- [CVE-2024-7940](https://insights.sbomify.com/CVE-2024-7940/): Missing authorization in MicroSCADA SYS600 (high 8.3)
- [CVE-2024-7939](https://insights.sbomify.com/CVE-2024-7939/): Stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x (high 8.7)
- [CVE-2024-7938](https://insights.sbomify.com/CVE-2024-7938/): Cross-site scripting in 3DSwymer (high 8.7)
- [CVE-2024-7937](https://insights.sbomify.com/CVE-2024-7937/): itsourcecode Project Expense Monitoring System printtransfer.php sql injection (medium 5.3)
- [CVE-2024-7936](https://insights.sbomify.com/CVE-2024-7936/): itsourcecode Project Expense Monitoring System transferred_report.php sql injection (medium 5.3)
- [CVE-2024-7935](https://insights.sbomify.com/CVE-2024-7935/): itsourcecode Project Expense Monitoring System print.php sql injection (medium 5.3)
- [CVE-2024-7934](https://insights.sbomify.com/CVE-2024-7934/): itsourcecode Project Expense Monitoring System execute.php sql injection (medium 5.3)
- [CVE-2024-7933](https://insights.sbomify.com/CVE-2024-7933/): itsourcecode Project Expense Monitoring System Backend Login login1.php sql injection (medium 6.9)
- [CVE-2024-7932](https://insights.sbomify.com/CVE-2024-7932/): Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x (high 8.7)
- [CVE-2024-7931](https://insights.sbomify.com/CVE-2024-7931/): SourceCodester Online Graduate Tracer System view_csprofile.php sql injection (medium 5.3)
- [CVE-2024-7930](https://insights.sbomify.com/CVE-2024-7930/): SourceCodester Clinics Patient Management System get_packings.php sql injection (medium 5.3)
- [CVE-2024-7929](https://insights.sbomify.com/CVE-2024-7929/): SourceCodester Simple Forum Website Signup Page registration.php cross site scripting (medium 6.9)
- [CVE-2024-7928](https://insights.sbomify.com/CVE-2024-7928/): FastAdmin lang path traversal (medium 5.3)
- [CVE-2024-7927](https://insights.sbomify.com/CVE-2024-7927/): ZZCMS class.php path traversal (medium 6.9)
- [CVE-2024-7926](https://insights.sbomify.com/CVE-2024-7926/): ZZCMS about_edit.php path traversal (medium 6.9)
- [CVE-2024-7925](https://insights.sbomify.com/CVE-2024-7925/): ZZCMS eginfo.php information disclosure (medium 5.3)
- [CVE-2024-7924](https://insights.sbomify.com/CVE-2024-7924/): ZZCMS list.php path traversal (medium 6.9)
- [CVE-2024-7923](https://insights.sbomify.com/CVE-2024-7923/): Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore (critical 9.8)
- [CVE-2024-7922](https://insights.sbomify.com/CVE-2024-7922/): D-Link DNS-1550-04 myMusic.cgi cgi_write_playlist command injection (medium 5.3)
- [CVE-2024-7921](https://insights.sbomify.com/CVE-2024-7921/): Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control (medium 5.3)
- [CVE-2024-7920](https://insights.sbomify.com/CVE-2024-7920/): Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetParkInThroughDeivces access control (medium 5.3)
- [CVE-2024-7919](https://insights.sbomify.com/CVE-2024-7919/): Anhui Deshun Intelligent Technology Jieshun JieLink+ JSOTC2016 GetDataList access control (medium 6.9)
- [CVE-2024-7918](https://insights.sbomify.com/CVE-2024-7918/): Pocket Widget <= 0.1.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7917](https://insights.sbomify.com/CVE-2024-7917/): DouPHP Favicon system.php unrestricted upload (medium 5.1)
- [CVE-2024-7916](https://insights.sbomify.com/CVE-2024-7916/): nafisulbari/itsourcecode Insurance Management System Add Nominee Page addNominee.php cross site scripting (medium 5.3)
- [CVE-2024-7915](https://insights.sbomify.com/CVE-2024-7915/): macOS Sensei Mac Cleaner Local Privilege Escalation via PID Reuse - Race Condition Attack (high 7.8)
- [CVE-2024-7914](https://insights.sbomify.com/CVE-2024-7914/): SourceCodester Yoga Class Registration System SystemSettings.php cross site scripting (medium 5.3)
- [CVE-2024-7913](https://insights.sbomify.com/CVE-2024-7913/): itsourcecode Billing System addclient1.php sql injection (medium 6.9)
- [CVE-2024-7912](https://insights.sbomify.com/CVE-2024-7912/): CodeAstro Online Railway Reservation System assets exposure of information through directory listing (medium 6.9)
- [CVE-2024-7911](https://insights.sbomify.com/CVE-2024-7911/): SourceCodester Simple Online Bidding System index.php file inclusion (medium 5.3)
- [CVE-2024-7910](https://insights.sbomify.com/CVE-2024-7910/): CodeAstro Online Railway Reservation System Profile Photo Update emp-profile-avatar.php unrestricted upload (medium 5.1)
- [CVE-2024-7909](https://insights.sbomify.com/CVE-2024-7909/): TOTOLINK EX1200L cstecgi.cgi setLanguageCfg stack-based overflow (high 8.7)
- [CVE-2024-7908](https://insights.sbomify.com/CVE-2024-7908/): TOTOLINK EX1200L cstecgi.cgi setDefResponse stack-based overflow (high 8.7)
- [CVE-2024-7907](https://insights.sbomify.com/CVE-2024-7907/): TOTOLINK X6000R cstecgi.cgi setSyslogCfg command injection (medium 5.3)
- [CVE-2024-7906](https://insights.sbomify.com/CVE-2024-7906/): DedeBIZ Attachment Settings select_images_post.php get_mime_type unrestricted upload (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/155/