# Vulnerabilities published in 2024


- [CVE-2024-7582](https://insights.sbomify.com/CVE-2024-7582/): Tenda i22 apPortalAccessCodeAuth formApPortalAccessCodeAuth buffer overflow (high 8.7)
- [CVE-2024-7581](https://insights.sbomify.com/CVE-2024-7581/): Tenda A301 WifiBasicSet formWifiBasicSet stack-based overflow (high 8.7)
- [CVE-2024-7580](https://insights.sbomify.com/CVE-2024-7580/): Alien Technology ALR-F800 system.html os command injection (medium 5.3)
- [CVE-2024-7579](https://insights.sbomify.com/CVE-2024-7579/): Alien Technology ALR-F800 File Name upgrade.cgi popen os command injection (medium 5.3)
- [CVE-2024-7578](https://insights.sbomify.com/CVE-2024-7578/): Alien Technology ALR-F800 cmd.php improper authorization (medium 6.9)
- [CVE-2024-7577](https://insights.sbomify.com/CVE-2024-7577/): IBM InfoSphere Information Server information disclosure (medium 4.4)
- [CVE-2024-7576](https://insights.sbomify.com/CVE-2024-7576/): Progress UI for WPF format provider unsafe deserialization vulnerability (high 7.8)
- [CVE-2024-7575](https://insights.sbomify.com/CVE-2024-7575/): Improper neutralization special element in hyperlinks (high 7.8)
- [CVE-2024-7574](https://insights.sbomify.com/CVE-2024-7574/): Christmasify! <= 1.5.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-7573](https://insights.sbomify.com/CVE-2024-7573/): Relevanssi Live Ajax Search <= 2.4 - Unauthenticated WP_Query Argument Injection (medium 5.3)
- [CVE-2024-7572](https://insights.sbomify.com/CVE-2024-7572/): Misconfiguration in Desktop and Server Management (high 7.1)
- [CVE-2024-7571](https://insights.sbomify.com/CVE-2024-7571/): Privilege escalation in Secure Access Client (high 7.8)
- [CVE-2024-7570](https://insights.sbomify.com/CVE-2024-7570/): Security feature bypass in ITSM (high 8.3)
- [CVE-2024-7569](https://insights.sbomify.com/CVE-2024-7569/): Information disclosure in ITSM (critical 9.6)
- [CVE-2024-7568](https://insights.sbomify.com/CVE-2024-7568/): Favicon Generator <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion (critical 9.6)
- [CVE-2024-7567](https://insights.sbomify.com/CVE-2024-7567/): Rockwell Automation Micro850/870 Vulnerable to denial-of-service Vulnerability via CIP/Modbus Port (medium 6.9)
- [CVE-2024-7565](https://insights.sbomify.com/CVE-2024-7565/): SMARTBEAR SoapUI unpackageAll Directory Traversal Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-7564](https://insights.sbomify.com/CVE-2024-7564/): Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability (medium 4.3)
- [CVE-2024-7562](https://insights.sbomify.com/CVE-2024-7562/): Privilege escalation in InstallShield (high 7.3)
- [CVE-2024-7561](https://insights.sbomify.com/CVE-2024-7561/): The Next <= 1.1.0 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-7560](https://insights.sbomify.com/CVE-2024-7560/): News Flash <= 1.1.0 - Authenticated (Editor+) PHP Object Injection (high 7.2)
- [CVE-2024-7559](https://insights.sbomify.com/CVE-2024-7559/): File Manager Pro <= 8.3.7 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-7558](https://insights.sbomify.com/CVE-2024-7558/): JUJU_CONTEXT_ID is a predictable authentication secret (high 8.7)
- [CVE-2024-7557](https://insights.sbomify.com/CVE-2024-7557/): Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai (high 8.8)
- [CVE-2024-7556](https://insights.sbomify.com/CVE-2024-7556/): Wordpress Simple Share Plugin <=0.5.3 - Admin+ XSS (medium 4.8)
- [CVE-2024-7554](https://insights.sbomify.com/CVE-2024-7554/): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (medium 4.9)
- [CVE-2024-7553](https://insights.sbomify.com/CVE-2024-7553/): Accessing Untrusted Directory May Allow Local Privilege Escalation (high 7.3)
- [CVE-2024-7552](https://insights.sbomify.com/CVE-2024-7552/): DataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injection (medium 5.3)
- [CVE-2024-7551](https://insights.sbomify.com/CVE-2024-7551/): juzaweb CMS Theme Editor default path traversal (medium 5.1)
- [CVE-2024-7550](https://insights.sbomify.com/CVE-2024-7550/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7548](https://insights.sbomify.com/CVE-2024-7548/): LearnPress – WordPress LMS Plugin <= 4.2.6.9.3 - Authenticated (Contributor+) SQL Injection via order Parameter (high 8.8)
- [CVE-2024-7547](https://insights.sbomify.com/CVE-2024-7547/): oFono SMS Decoder Stack-based Buffer Overflow Privilege Escalation Vulnerability (high 7.0)
- [CVE-2024-7546](https://insights.sbomify.com/CVE-2024-7546/): oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7545](https://insights.sbomify.com/CVE-2024-7545/): oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7544](https://insights.sbomify.com/CVE-2024-7544/): oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7543](https://insights.sbomify.com/CVE-2024-7543/): oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7542](https://insights.sbomify.com/CVE-2024-7542/): oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-7541](https://insights.sbomify.com/CVE-2024-7541/): oFono AT CMT Command Uninitialized Variable Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-7540](https://insights.sbomify.com/CVE-2024-7540/): oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-7539](https://insights.sbomify.com/CVE-2024-7539/): oFono CUSD Stack-based Buffer Overflow Code Execution Vulnerability (high 7.8)
- [CVE-2024-7538](https://insights.sbomify.com/CVE-2024-7538/): oFono CUSD AT Command Stack-based Buffer Overflow Code Execution Vulnerability (high 7.8)
- [CVE-2024-7537](https://insights.sbomify.com/CVE-2024-7537/): oFono QMI SMS Handling Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-7536](https://insights.sbomify.com/CVE-2024-7536/): Use after free in Chrome (high 8.8)
- [CVE-2024-7535](https://insights.sbomify.com/CVE-2024-7535/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7534](https://insights.sbomify.com/CVE-2024-7534/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7533](https://insights.sbomify.com/CVE-2024-7533/): Use after free in Chrome (high 8.8)
- [CVE-2024-7532](https://insights.sbomify.com/CVE-2024-7532/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7531](https://insights.sbomify.com/CVE-2024-7531/): Weak cryptography in Firefox (medium 6.3)
- [CVE-2024-7530](https://insights.sbomify.com/CVE-2024-7530/): Use after free in Firefox (critical 9.8)
- [CVE-2024-7529](https://insights.sbomify.com/CVE-2024-7529/): Security feature bypass in Firefox (high 8.1)
- [CVE-2024-7528](https://insights.sbomify.com/CVE-2024-7528/): Use after free in Firefox (critical 9.8)
- [CVE-2024-7527](https://insights.sbomify.com/CVE-2024-7527/): Use after free in Firefox (high 8.8)
- [CVE-2024-7526](https://insights.sbomify.com/CVE-2024-7526/): Information disclosure in Firefox (high 7.5)
- [CVE-2024-7525](https://insights.sbomify.com/CVE-2024-7525/): Security feature bypass in Firefox (critical 9.1)
- [CVE-2024-7524](https://insights.sbomify.com/CVE-2024-7524/): Cross-site scripting in Firefox (medium 6.1)
- [CVE-2024-7523](https://insights.sbomify.com/CVE-2024-7523/): Security feature bypass in Firefox (medium 6.3)
- [CVE-2024-7522](https://insights.sbomify.com/CVE-2024-7522/): Memory corruption in Firefox (critical 9.1)
- [CVE-2024-7521](https://insights.sbomify.com/CVE-2024-7521/): Use after free in Firefox (critical 9.8)
- [CVE-2024-7520](https://insights.sbomify.com/CVE-2024-7520/): Memory corruption in Firefox (high 8.8)
- [CVE-2024-7519](https://insights.sbomify.com/CVE-2024-7519/): Memory corruption in Firefox (high 8.8)
- [CVE-2024-7518](https://insights.sbomify.com/CVE-2024-7518/): Other in Firefox (medium 6.5)
- [CVE-2024-7517](https://insights.sbomify.com/CVE-2024-7517/): Privileged escalation via crafted use of portcfg command (high 8.5)
- [CVE-2024-7516](https://insights.sbomify.com/CVE-2024-7516/): Brocade Fabric OS before 9.2.2 does not enforce strict host key checking (high 7.0)
- [CVE-2024-7515](https://insights.sbomify.com/CVE-2024-7515/): Denial of service in Compact GuardLogix 5380 (5069 – L3zS2) (high 8.7)
- [CVE-2024-7514](https://insights.sbomify.com/CVE-2024-7514/): WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal (medium 6.5)
- [CVE-2024-7513](https://insights.sbomify.com/CVE-2024-7513/): Rockwell Automation FactoryTalk® View Site Edition Code Execution Vulnerability via File Permissions (high 8.5)
- [CVE-2024-7512](https://insights.sbomify.com/CVE-2024-7512/): Concrete CMS Stored XSS in Board instances (medium 4.6)
- [CVE-2024-7511](https://insights.sbomify.com/CVE-2024-7511/): Trimble SketchUp Pro SKP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-7510](https://insights.sbomify.com/CVE-2024-7510/): Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-7509](https://insights.sbomify.com/CVE-2024-7509/): Trimble SketchUp SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-7508](https://insights.sbomify.com/CVE-2024-7508/): Trimble SketchUp Viewer SKP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-7507](https://insights.sbomify.com/CVE-2024-7507/): Denial of service in Compact GuardLogix 5380 (5069- L3zS2) (high 8.7)
- [CVE-2024-7506](https://insights.sbomify.com/CVE-2024-7506/): itsourcecode Tailoring Management System setlogo.php unrestricted upload (medium 5.3)
- [CVE-2024-7505](https://insights.sbomify.com/CVE-2024-7505/): itsourcecode Bike Delivery System contact_us_action.php sql injection (medium 6.9)
- [CVE-2024-7503](https://insights.sbomify.com/CVE-2024-7503/): WooCommerce - Social Login <= 2.7.5 - Authentication Bypass to Account Takeover (critical 9.8)
- [CVE-2024-7502](https://insights.sbomify.com/CVE-2024-7502/): Delta Electronics DIAScreen Stack-Based Buffer Overflow (high 8.5)
- [CVE-2024-7501](https://insights.sbomify.com/CVE-2024-7501/): Download Plugins and Themes from Dashboard <= 1.8.7 - Cross-Site Request Forgery (medium 4.2)
- [CVE-2024-7500](https://insights.sbomify.com/CVE-2024-7500/): itsourcecode Airline Reservation System admin_class.php save_settings unrestricted upload (medium 5.3)
- [CVE-2024-7499](https://insights.sbomify.com/CVE-2024-7499/): itsourcecode Airline Reservation System flights.php sql injection (medium 5.3)
- [CVE-2024-7498](https://insights.sbomify.com/CVE-2024-7498/): itsourcecode Airline Reservation System Admin Login Page login.php login2 sql injection (medium 6.9)
- [CVE-2024-7497](https://insights.sbomify.com/CVE-2024-7497/): itsourcecode Airline Reservation System index.php file inclusion (medium 5.3)
- [CVE-2024-7496](https://insights.sbomify.com/CVE-2024-7496/): itsourcecode Airline Reservation System index.php file inclusion (medium 5.3)
- [CVE-2024-7495](https://insights.sbomify.com/CVE-2024-7495/): itsourcecode Laravel Accounting System HomeController.php unrestricted upload (medium 5.3)
- [CVE-2024-7494](https://insights.sbomify.com/CVE-2024-7494/): SourceCodester Clinics Patient Management System new_prescription.php sql injection (medium 5.3)
- [CVE-2024-7493](https://insights.sbomify.com/CVE-2024-7493/): WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta (critical 9.8)
- [CVE-2024-7492](https://insights.sbomify.com/CVE-2024-7492/): MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update (high 8.8)
- [CVE-2024-7491](https://insights.sbomify.com/CVE-2024-7491/): HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.1 - Insecure Direct Object Reference to Unsubscribe (medium 5.3)
- [CVE-2024-7490](https://insights.sbomify.com/CVE-2024-7490/): Remote Code Execution in Advanced Software Framework DHCP server (critical 9.5)
- [CVE-2024-7489](https://insights.sbomify.com/CVE-2024-7489/): Cross-site scripting in Forms for Mailchimp by Optin Cat – Grow Your MailChimp List (medium 4.4)
- [CVE-2024-7488](https://insights.sbomify.com/CVE-2024-7488/): Business Logic Error in RestApp Inc.'s Online Ordering System (medium 5.3)
- [CVE-2024-7487](https://insights.sbomify.com/CVE-2024-7487/): Improper Authentication in WSO2 Identity Server 7.0.0 Allows Bypass of App-Native Authentication (medium 5.8)
- [CVE-2024-7486](https://insights.sbomify.com/CVE-2024-7486/): MultiPurpose <= 1.2.0 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-7485](https://insights.sbomify.com/CVE-2024-7485/): Traffic Manager <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-7484](https://insights.sbomify.com/CVE-2024-7484/): CRM Perks Forms <= 1.1.3 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2024-7481](https://insights.sbomify.com/CVE-2024-7481/): Improper signature verification of Printer driver installation in TeamViewer Remote Clients (high 8.8)
- [CVE-2024-7480](https://insights.sbomify.com/CVE-2024-7480/): Improper access control in Avaya Aura System Manager (medium 4.2)
- [CVE-2024-7479](https://insights.sbomify.com/CVE-2024-7479/): Improper signature verification of VPN driver installation in TeamViewer Remote Clients (high 8.8)
- [CVE-2024-7478](https://insights.sbomify.com/CVE-2024-7478/): Username Enumeration via External User Stores in Multiple WSO2 Products Allows User Account Discovery (medium 5.8)
- [CVE-2024-7477](https://insights.sbomify.com/CVE-2024-7477/): Avaya Aura System Manager SQL injection vulnerability (medium 6.5)
- [CVE-2024-7476](https://insights.sbomify.com/CVE-2024-7476/): Broken Access Control in lunary-ai/lunary (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/159/