# Vulnerabilities published in 2024


- [CVE-2024-7475](https://insights.sbomify.com/CVE-2024-7475/): Improper Access Control in lunary-ai/lunary (critical 9.1)
- [CVE-2024-7474](https://insights.sbomify.com/CVE-2024-7474/): IDOR in lunary-ai/lunary (critical 9.1)
- [CVE-2024-7473](https://insights.sbomify.com/CVE-2024-7473/): IDOR Vulnerability in lunary-ai/lunary (high 7.5)
- [CVE-2024-7472](https://insights.sbomify.com/CVE-2024-7472/): Email Injection Vulnerability in lunary-ai/lunary (medium 5.3)
- [CVE-2024-7470](https://insights.sbomify.com/CVE-2024-7470/): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface vpn_template_style.php sslvpn_config_mod os command injection (medium 5.3)
- [CVE-2024-7469](https://insights.sbomify.com/CVE-2024-7469/): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_vpn_web_custom.php sslvpn_config_mod os command injection (medium 5.3)
- [CVE-2024-7468](https://insights.sbomify.com/CVE-2024-7468/): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_service_manage.php sslvpn_config_mod os command injection (medium 5.3)
- [CVE-2024-7467](https://insights.sbomify.com/CVE-2024-7467/): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_ip_network.php sslvpn_config_mod os command injection (medium 5.3)
- [CVE-2024-7466](https://insights.sbomify.com/CVE-2024-7466/): PMWeb Web Application Firewall cross site scripting (medium 5.1)
- [CVE-2024-7465](https://insights.sbomify.com/CVE-2024-7465/): TOTOLINK CP450 cstecgi.cgi loginauth buffer overflow (high 8.7)
- [CVE-2024-7464](https://insights.sbomify.com/CVE-2024-7464/): TOTOLINK CP900 Telnet Service setTelnetCfg command injection (medium 5.3)
- [CVE-2024-7463](https://insights.sbomify.com/CVE-2024-7463/): TOTOLINK CP900 cstecgi.cgi UploadCustomModule buffer overflow (high 8.7)
- [CVE-2024-7462](https://insights.sbomify.com/CVE-2024-7462/): TOTOLINK N350RT cstecgi.cgi setWizardCfg buffer overflow (high 8.7)
- [CVE-2024-7461](https://insights.sbomify.com/CVE-2024-7461/): ForIP Tecnologia Administração PABX monitcallcenter authMonitCallcenter sql injection (medium 6.9)
- [CVE-2024-7460](https://insights.sbomify.com/CVE-2024-7460/): OSWAPP Warehouse Inventory System change_password.php cross-site request forgery (medium 6.9)
- [CVE-2024-7459](https://insights.sbomify.com/CVE-2024-7459/): OSWAPP Warehouse Inventory System edit_account.php cross-site request forgery (medium 6.9)
- [CVE-2024-7458](https://insights.sbomify.com/CVE-2024-7458/): elunez eladmin Database Management/Deployment Management upload path traversal (medium 5.1)
- [CVE-2024-7457](https://insights.sbomify.com/CVE-2024-7457/): macOS Stash network-management utility: Unauthorized Manipulation of System Network Preferences (high 7.8)
- [CVE-2024-7456](https://insights.sbomify.com/CVE-2024-7456/): SQL Injection in lunary-ai/lunary (critical 9.8)
- [CVE-2024-7455](https://insights.sbomify.com/CVE-2024-7455/): itsourcecode Tailoring Management System partedit.php sql injection (medium 5.3)
- [CVE-2024-7454](https://insights.sbomify.com/CVE-2024-7454/): SourceCodester Clinics Patient Management System patients.php patient_name sql injection (medium 5.3)
- [CVE-2024-7453](https://insights.sbomify.com/CVE-2024-7453/): FastAdmin Attachment Management Section 4 cross site scripting (medium 5.1)
- [CVE-2024-7452](https://insights.sbomify.com/CVE-2024-7452/): itsourcecode Placement Management System view_company.php sql injection (medium 5.3)
- [CVE-2024-7451](https://insights.sbomify.com/CVE-2024-7451/): itsourcecode Placement Management System apply_now.php sql injection (medium 5.3)
- [CVE-2024-7450](https://insights.sbomify.com/CVE-2024-7450/): itsourcecode Placement Management System Image resume_upload.php unrestricted upload (medium 5.3)
- [CVE-2024-7449](https://insights.sbomify.com/CVE-2024-7449/): itsourcecode Placement Management System login.php sql injection (medium 6.9)
- [CVE-2024-7448](https://insights.sbomify.com/CVE-2024-7448/): Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability (high 8.0)
- [CVE-2024-7447](https://insights.sbomify.com/CVE-2024-7447/): Missing authorization in Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free (medium 5.3)
- [CVE-2024-7446](https://insights.sbomify.com/CVE-2024-7446/): itsourcecode Ticket Reservation System list_tickets.php sql injection (medium 5.1)
- [CVE-2024-7445](https://insights.sbomify.com/CVE-2024-7445/): itsourcecode Ticket Reservation System checkout_ticket_save.php sql injection (medium 5.1)
- [CVE-2024-7444](https://insights.sbomify.com/CVE-2024-7444/): itsourcecode Ticket Reservation System Login Page login.php sql injection (medium 6.9)
- [CVE-2024-7443](https://insights.sbomify.com/CVE-2024-7443/): Vivotek IB8367A upload_file.cgi getenv command injection (medium 5.3)
- [CVE-2024-7442](https://insights.sbomify.com/CVE-2024-7442/): Vivotek SD9364 upload_file.cgi getenv command injection (medium 5.3)
- [CVE-2024-7441](https://insights.sbomify.com/CVE-2024-7441/): Vivotek SD9364 httpd read stack-based overflow (high 8.7)
- [CVE-2024-7440](https://insights.sbomify.com/CVE-2024-7440/): Vivotek CC8160 upload_file.cgi getenv command injection (medium 5.3)
- [CVE-2024-7439](https://insights.sbomify.com/CVE-2024-7439/): Vivotek CC8160 httpd read stack-based overflow (high 8.7)
- [CVE-2024-7438](https://insights.sbomify.com/CVE-2024-7438/): SimpleMachines SMF User Alert Read Status index.php resource injection (medium 5.3)
- [CVE-2024-7437](https://insights.sbomify.com/CVE-2024-7437/): SimpleMachines SMF Delete User index.php resource injection (medium 5.3)
- [CVE-2024-7436](https://insights.sbomify.com/CVE-2024-7436/): D-Link DI-8100 msp_info.htm msp_info_htm command injection (medium 5.3)
- [CVE-2024-7435](https://insights.sbomify.com/CVE-2024-7435/): Attire <= 2.0.6 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-7434](https://insights.sbomify.com/CVE-2024-7434/): UltraPress <= 1.2.2 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-7433](https://insights.sbomify.com/CVE-2024-7433/): Empowerment <= 1.0.2 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-7432](https://insights.sbomify.com/CVE-2024-7432/): Unseen Blog <= 1.0.0 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-7429](https://insights.sbomify.com/CVE-2024-7429/): Zotpress <= 7.3.12 - Missing Authorization (medium 4.3)
- [CVE-2024-7428](https://insights.sbomify.com/CVE-2024-7428/): Potential Open Redirect issues affect OpenText™ Network Node Manager i (NNMi). (medium 4.8)
- [CVE-2024-7427](https://insights.sbomify.com/CVE-2024-7427/): Potential Cross-Site Scripting vulnerability affect OpenText™ Network Node Manager i (NNMi). (medium 4.8)
- [CVE-2024-7426](https://insights.sbomify.com/CVE-2024-7426/): Information disclosure in Community by PeepSo – Download from PeepSo.com (medium 5.3)
- [CVE-2024-7425](https://insights.sbomify.com/CVE-2024-7425/): WP All Export Pro <= 1.9.1 - Authenticated (ShopManager+) Arbtirary Options Update (medium 6.8)
- [CVE-2024-7424](https://insights.sbomify.com/CVE-2024-7424/): Multiple Page Generator Plugin – MPG <= 4.0.1 - Missing Authorization (medium 5.4)
- [CVE-2024-7423](https://insights.sbomify.com/CVE-2024-7423/): Stream <= 4.0.1 - Cross-Site Request Forgery to Arbitrary Options Update (high 8.8)
- [CVE-2024-7422](https://insights.sbomify.com/CVE-2024-7422/): Theme My Login <= 7.1.7 - Cross-Site Request Forgery to Settings Update (medium 4.3)
- [CVE-2024-7421](https://insights.sbomify.com/CVE-2024-7421/): Information disclosure in Remote Desktop Manager (medium 5.5)
- [CVE-2024-7420](https://insights.sbomify.com/CVE-2024-7420/): Insert PHP Code Snippet <= 1.3.6 - Cross-Site Request Forgery to Code Snippet Activate/Deactivate/Deletion (medium 5.8)
- [CVE-2024-7419](https://insights.sbomify.com/CVE-2024-7419/): WP All Export Pro <= 1.9.1 - Unauthenticated Remote Code Execution via Custom Export Fields (high 8.3)
- [CVE-2024-7418](https://insights.sbomify.com/CVE-2024-7418/): The Post Grid <= 7.7.11 - Authenticated (Contributor+) Information Disclosure (medium 4.3)
- [CVE-2024-7417](https://insights.sbomify.com/CVE-2024-7417/): Royal Elementor Addons and Templates <= 1.3.986 - Authenticated (Subscriber+) Private Post Disclosure (medium 4.3)
- [CVE-2024-7416](https://insights.sbomify.com/CVE-2024-7416/): Reveal Template <= 3.7 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-7415](https://insights.sbomify.com/CVE-2024-7415/): Remember Me Controls <= 2.0.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-7414](https://insights.sbomify.com/CVE-2024-7414/): PDF Builder for WPForms <= 1.2.116 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-7413](https://insights.sbomify.com/CVE-2024-7413/): Obfuscate Email <= 3.8.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-7412](https://insights.sbomify.com/CVE-2024-7412/): No Update Nag <= 1.4.12 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-7411](https://insights.sbomify.com/CVE-2024-7411/): Newsletters <= 4.9.9 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-7410](https://insights.sbomify.com/CVE-2024-7410/): My Custom CSS PHP & ADS <= 3.3 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-7409](https://insights.sbomify.com/CVE-2024-7409/): Qemu: denial of service via improper synchronization in qemu nbd server during socket closure (high 7.5)
- [CVE-2024-7408](https://insights.sbomify.com/CVE-2024-7408/): Information Disclosure Vulnerability in Airveda Air Quality Monitor (high 8.6)
- [CVE-2024-7407](https://insights.sbomify.com/CVE-2024-7407/): Weak password encoding in Streamsoft Prestiż (high 8.2)
- [CVE-2024-7404](https://insights.sbomify.com/CVE-2024-7404/): Improper Restriction of Rendered UI Layers or Frames in GitLab (medium 6.8)
- [CVE-2024-7402](https://insights.sbomify.com/CVE-2024-7402/): Netskope Client Configuration Tampering with Local MITM (high 7.0)
- [CVE-2024-7401](https://insights.sbomify.com/CVE-2024-7401/): Client Enrollment Process Bypass (high 8.5)
- [CVE-2024-7400](https://insights.sbomify.com/CVE-2024-7400/): Local privilege escalation in ESET products for Windows (high 8.5)
- [CVE-2024-7399](https://insights.sbomify.com/CVE-2024-7399/): Samsung MagicINFO 9 Server Path Traversal (high 8.8, exploited in the wild)
- [CVE-2024-7398](https://insights.sbomify.com/CVE-2024-7398/): Concrete CMS Stored XSS Vulnerability in Calendar Event Addition Feature (medium 4.6)
- [CVE-2024-7397](https://insights.sbomify.com/CVE-2024-7397/): Unauthenticated Command Injection (critical 9.3)
- [CVE-2024-7396](https://insights.sbomify.com/CVE-2024-7396/): Plaintext Communication (high 7.1)
- [CVE-2024-7395](https://insights.sbomify.com/CVE-2024-7395/): Insufficient Authentication (critical 9.3)
- [CVE-2024-7394](https://insights.sbomify.com/CVE-2024-7394/): Concrete CMS version 9.0.0 through 9.3.2 and below 8.5.18 - Stored XSS in getAttributeSetName() (medium 4.6)
- [CVE-2024-7392](https://insights.sbomify.com/CVE-2024-7392/): ChargePoint Home Flex Bluetooth Low Energy Denial-of-Service Vulnerability (medium 4.3)
- [CVE-2024-7391](https://insights.sbomify.com/CVE-2024-7391/): ChargePoint Home Flex Bluetooth Low Energy Information Disclosure Vulnerability (low 2.6)
- [CVE-2024-7390](https://insights.sbomify.com/CVE-2024-7390/): WP Testimonial Widget <= 3.1 - Missing Authorization (medium 5.3)
- [CVE-2024-7389](https://insights.sbomify.com/CVE-2024-7389/): Forminator <= 1.29.1 - HubSpot Developer API Key Sensitive Information Exposure (high 7.5)
- [CVE-2024-7388](https://insights.sbomify.com/CVE-2024-7388/): WP Bannerize Pro <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting (medium 4.0)
- [CVE-2024-7387](https://insights.sbomify.com/CVE-2024-7387/): Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy (critical 9.1)
- [CVE-2024-7386](https://insights.sbomify.com/CVE-2024-7386/): Premium Packages – Sell Digital Products Securely <= 5.9.1 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-7385](https://insights.sbomify.com/CVE-2024-7385/): WordPress Simple HTML Sitemap <= 3.1 - Authenticated (Admin+) SQL Injection (critical 9.1)
- [CVE-2024-7384](https://insights.sbomify.com/CVE-2024-7384/): AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function (high 7.5)
- [CVE-2024-7383](https://insights.sbomify.com/CVE-2024-7383/): Libnbd: nbd server improper certificate validation (high 7.4)
- [CVE-2024-7382](https://insights.sbomify.com/CVE-2024-7382/): Linkify Text <= 1.9.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-7381](https://insights.sbomify.com/CVE-2024-7381/): Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution (medium 5.3)
- [CVE-2024-7380](https://insights.sbomify.com/CVE-2024-7380/): Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion (medium 4.3)
- [CVE-2024-7378](https://insights.sbomify.com/CVE-2024-7378/): SourceCodester Simple Realtime Quiz System manage_question.php sql injection (medium 5.3)
- [CVE-2024-7377](https://insights.sbomify.com/CVE-2024-7377/): SourceCodester Simple Realtime Quiz System view_result.php sql injection (medium 5.3)
- [CVE-2024-7376](https://insights.sbomify.com/CVE-2024-7376/): SourceCodester Simple Realtime Quiz System print_quiz_records.php sql injection (medium 5.3)
- [CVE-2024-7375](https://insights.sbomify.com/CVE-2024-7375/): SourceCodester Simple Realtime Quiz System my_quiz_result.php sql injection (medium 5.3)
- [CVE-2024-7374](https://insights.sbomify.com/CVE-2024-7374/): SourceCodester Simple Realtime Quiz System manage_user.php sql injection (medium 5.3)
- [CVE-2024-7373](https://insights.sbomify.com/CVE-2024-7373/): SourceCodester Simple Realtime Quiz System ajax.php sql injection (medium 5.3)
- [CVE-2024-7372](https://insights.sbomify.com/CVE-2024-7372/): SourceCodester Simple Realtime Quiz System quiz_board.php sql injection (medium 5.3)
- [CVE-2024-7371](https://insights.sbomify.com/CVE-2024-7371/): SourceCodester Simple Realtime Quiz System quiz_view.php sql injection (medium 5.3)
- [CVE-2024-7370](https://insights.sbomify.com/CVE-2024-7370/): SourceCodester Simple Realtime Quiz System manage_quiz.php sql injection (medium 5.3)
- [CVE-2024-7369](https://insights.sbomify.com/CVE-2024-7369/): SourceCodester Simple Realtime Quiz System Login ajax.php sql injection (medium 6.9)
- [CVE-2024-7368](https://insights.sbomify.com/CVE-2024-7368/): SourceCodester Simple Realtime Quiz System ajax.php cross site scripting (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/160/