# Vulnerabilities published in 2024


- [CVE-2024-7263](https://insights.sbomify.com/CVE-2024-7263/): Arbitrary Code Execution in WPS Office (critical 9.3)
- [CVE-2024-7262](https://insights.sbomify.com/CVE-2024-7262/): Kingsoft WPS Office Path Traversal (critical 9.3, exploited in the wild)
- [CVE-2024-7261](https://insights.sbomify.com/CVE-2024-7261/): Command injection in NWA1123ACv3 firmware (critical 9.8)
- [CVE-2024-7260](https://insights.sbomify.com/CVE-2024-7260/): Keycloak-core: open redirect on account page (medium 6.1)
- [CVE-2024-7259](https://insights.sbomify.com/CVE-2024-7259/): Ovirt-engine: potential exposure of cleartext provider passwords via web ui (medium 4.9)
- [CVE-2024-7258](https://insights.sbomify.com/CVE-2024-7258/): Missing authorization in WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping (high 8.8)
- [CVE-2024-7257](https://insights.sbomify.com/CVE-2024-7257/): File upload in YayExtra – WooCommerce Extra Product Options (critical 9.8)
- [CVE-2024-7256](https://insights.sbomify.com/CVE-2024-7256/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7255](https://insights.sbomify.com/CVE-2024-7255/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7254](https://insights.sbomify.com/CVE-2024-7254/): Stack overflow in Protocol Buffers Java Lite (high 8.7)
- [CVE-2024-7253](https://insights.sbomify.com/CVE-2024-7253/): NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7252](https://insights.sbomify.com/CVE-2024-7252/): Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7251](https://insights.sbomify.com/CVE-2024-7251/): Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7250](https://insights.sbomify.com/CVE-2024-7250/): Comodo Internet Security Pro cmdagent Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7249](https://insights.sbomify.com/CVE-2024-7249/): Comodo Firewall Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7248](https://insights.sbomify.com/CVE-2024-7248/): Comodo Internet Security Pro Directory Traversal Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7247](https://insights.sbomify.com/CVE-2024-7247/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-7246](https://insights.sbomify.com/CVE-2024-7246/): HPACK table poisoning in gRPC C++, Python & Ruby (medium 6.3)
- [CVE-2024-7245](https://insights.sbomify.com/CVE-2024-7245/): Panda Security Dome VPN Incorrect Permission Assignment Local Privilege Escalation Vulnerability (high 7.0)
- [CVE-2024-7244](https://insights.sbomify.com/CVE-2024-7244/): Panda Security Dome VPN DLL Hijacking Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7243](https://insights.sbomify.com/CVE-2024-7243/): Panda Security Dome Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7242](https://insights.sbomify.com/CVE-2024-7242/): Panda Security Dome Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7241](https://insights.sbomify.com/CVE-2024-7241/): Panda Security Dome Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7240](https://insights.sbomify.com/CVE-2024-7240/): F-Secure Total Link Following Local Privilege Escalation Vulnerability (high 7.3)
- [CVE-2024-7239](https://insights.sbomify.com/CVE-2024-7239/): VIPRE Advanced Security Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7238](https://insights.sbomify.com/CVE-2024-7238/): VIPRE Advanced Security SBAMSvc Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7237](https://insights.sbomify.com/CVE-2024-7237/): AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7236](https://insights.sbomify.com/CVE-2024-7236/): AVG AntiVirus Free icarus Arbitrary File Creation Denial of Service Vulnerability (medium 5.3)
- [CVE-2024-7235](https://insights.sbomify.com/CVE-2024-7235/): AVG AntiVirus Free Link Following Denial-of-Service Vulnerability (medium 6.1)
- [CVE-2024-7234](https://insights.sbomify.com/CVE-2024-7234/): AVG AntiVirus Free AVGSvc Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7233](https://insights.sbomify.com/CVE-2024-7233/): Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7232](https://insights.sbomify.com/CVE-2024-7232/): Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7231](https://insights.sbomify.com/CVE-2024-7231/): Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7230](https://insights.sbomify.com/CVE-2024-7230/): Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7229](https://insights.sbomify.com/CVE-2024-7229/): Avast Cleanup Premium Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7228](https://insights.sbomify.com/CVE-2024-7228/): Avast Free Antivirus Link Following Denial-of-Service Vulnerability (medium 6.1)
- [CVE-2024-7227](https://insights.sbomify.com/CVE-2024-7227/): Avast Free Antivirus AvastSvc Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-7226](https://insights.sbomify.com/CVE-2024-7226/): SourceCodester Medicine Tracker System Password Change cross-site request forgery (medium 6.9)
- [CVE-2024-7225](https://insights.sbomify.com/CVE-2024-7225/): SourceCodester Insurance Management System Edit Insurance Policy Page update_policy cross site scripting (medium 5.3)
- [CVE-2024-7224](https://insights.sbomify.com/CVE-2024-7224/): SourceCodester Lot Reservation Management System lot_details.php sql injection (medium 5.3)
- [CVE-2024-7223](https://insights.sbomify.com/CVE-2024-7223/): SourceCodester Lot Reservation Management System view_model.php sql injection (medium 5.3)
- [CVE-2024-7222](https://insights.sbomify.com/CVE-2024-7222/): SourceCodester Lot Reservation Management System home.php sql injection (medium 5.3)
- [CVE-2024-7221](https://insights.sbomify.com/CVE-2024-7221/): SourceCodester/Campcodes School Log Management System manage_user.php sql injection (medium 5.3)
- [CVE-2024-7220](https://insights.sbomify.com/CVE-2024-7220/): SourceCodester/Campcodes School Log Management System print_barcode.php sql injection (medium 5.3)
- [CVE-2024-7219](https://insights.sbomify.com/CVE-2024-7219/): SourceCodester/Campcodes School Log Management System ajax.php sql injection (medium 6.9)
- [CVE-2024-7218](https://insights.sbomify.com/CVE-2024-7218/): SourceCodester/Campcodes School Log Management System ajax.php cross site scripting (medium 5.1)
- [CVE-2024-7217](https://insights.sbomify.com/CVE-2024-7217/): TOTOLINK CA300-PoE cstecgi.cgi loginauth buffer overflow (medium 5.3)
- [CVE-2024-7216](https://insights.sbomify.com/CVE-2024-7216/): TOTOLINK LR1200 shadow.sample hard-coded password (low 2.1)
- [CVE-2024-7215](https://insights.sbomify.com/CVE-2024-7215/): TOTOLINK LR1200 cstecgi.cgi NTPSyncWithHost command injection (medium 5.3)
- [CVE-2024-7214](https://insights.sbomify.com/CVE-2024-7214/): TOTOLINK LR350 cstecgi.cgi setWanCfg command injection (medium 5.3)
- [CVE-2024-7213](https://insights.sbomify.com/CVE-2024-7213/): TOTOLINK A7000R cstecgi.cgi setWizardCfg buffer overflow (high 8.7)
- [CVE-2024-7212](https://insights.sbomify.com/CVE-2024-7212/): TOTOLINK A7000R cstecgi.cgi loginauth buffer overflow (high 8.7)
- [CVE-2024-7211](https://insights.sbomify.com/CVE-2024-7211/): The Duende Identity Server based component in 1E Platform may allow URL redirections to untrusted websites. (medium 4.7)
- [CVE-2024-7209](https://insights.sbomify.com/CVE-2024-7209/): CVE-2024-7209 (medium 6.5)
- [CVE-2024-7208](https://insights.sbomify.com/CVE-2024-7208/): CVE-2024-7208 (medium 6.5)
- [CVE-2024-7206](https://insights.sbomify.com/CVE-2024-7206/): Firmware extraction and Hardware SSL Pinning Bypass (high 7.0)
- [CVE-2024-7205](https://insights.sbomify.com/CVE-2024-7205/): sharing unnecessary device-sensitive information allows Secondary user able to take over devices as primary user (critical 9.4)
- [CVE-2024-7204](https://insights.sbomify.com/CVE-2024-7204/): Ai3 QbiBot - Stored XSS (medium 6.1)
- [CVE-2024-7203](https://insights.sbomify.com/CVE-2024-7203/): Command injection in ATP series firmware (high 7.2)
- [CVE-2024-7202](https://insights.sbomify.com/CVE-2024-7202/): Simopro Technology WinMatrix3 Web package - SQL Injection (critical 9.8)
- [CVE-2024-7201](https://insights.sbomify.com/CVE-2024-7201/): Simopro Technology WinMatrix3 Web package - SQL Injection (critical 9.8)
- [CVE-2024-7200](https://insights.sbomify.com/CVE-2024-7200/): SourceCodester Complaints Report Management System cross site scripting (medium 5.3)
- [CVE-2024-7199](https://insights.sbomify.com/CVE-2024-7199/): SourceCodester Complaints Report Management System manage_user.php sql injection (medium 5.3)
- [CVE-2024-7198](https://insights.sbomify.com/CVE-2024-7198/): SourceCodester Complaints Report Management System manage_station.php sql injection (medium 5.3)
- [CVE-2024-7197](https://insights.sbomify.com/CVE-2024-7197/): SourceCodester Complaints Report Management System manage_complaint.php sql injection (medium 5.3)
- [CVE-2024-7196](https://insights.sbomify.com/CVE-2024-7196/): SourceCodester Complaints Report Management System sql injection (medium 6.9)
- [CVE-2024-7195](https://insights.sbomify.com/CVE-2024-7195/): itsourcecode Society Management System check_admin.php sql injection (medium 5.3)
- [CVE-2024-7194](https://insights.sbomify.com/CVE-2024-7194/): itsourcecode Society Management System check_student.php sql injection (medium 5.3)
- [CVE-2024-7193](https://insights.sbomify.com/CVE-2024-7193/): Mp3tag DLL tak_deco_lib.dll uncontrolled search path (medium 4.8)
- [CVE-2024-7192](https://insights.sbomify.com/CVE-2024-7192/): itsourcecode Society Management System student.php unrestricted upload (medium 5.3)
- [CVE-2024-7191](https://insights.sbomify.com/CVE-2024-7191/): itsourcecode Society Management System get_balance.php sql injection (medium 5.3)
- [CVE-2024-7190](https://insights.sbomify.com/CVE-2024-7190/): itsourcecode Society Management System get_price.php sql injection (medium 5.3)
- [CVE-2024-7189](https://insights.sbomify.com/CVE-2024-7189/): itsourcecode Online Food Ordering System editproduct.php unrestricted upload (medium 5.3)
- [CVE-2024-7188](https://insights.sbomify.com/CVE-2024-7188/): Bylancer Quicklancer GET Parameter listing sql injection (medium 6.9)
- [CVE-2024-7187](https://insights.sbomify.com/CVE-2024-7187/): TOTOLINK A3600R cstecgi.cgi UploadCustomModule buffer overflow (high 8.7)
- [CVE-2024-7186](https://insights.sbomify.com/CVE-2024-7186/): TOTOLINK A3600R cstecgi.cgi setWiFiAclAddConfig buffer overflow (high 8.7)
- [CVE-2024-7185](https://insights.sbomify.com/CVE-2024-7185/): TOTOLINK A3600R cstecgi.cgi setWebWlanIdx buffer overflow (high 8.7)
- [CVE-2024-7184](https://insights.sbomify.com/CVE-2024-7184/): TOTOLINK A3600R cstecgi.cgi setUrlFilterRules buffer overflow (high 8.7)
- [CVE-2024-7183](https://insights.sbomify.com/CVE-2024-7183/): TOTOLINK A3600R cstecgi.cgi setUploadSetting buffer overflow (high 8.7)
- [CVE-2024-7182](https://insights.sbomify.com/CVE-2024-7182/): TOTOLINK A3600R cstecgi.cgi setUpgradeFW buffer overflow (high 8.7)
- [CVE-2024-7181](https://insights.sbomify.com/CVE-2024-7181/): TOTOLINK A3600R cstecgi.cgi setTelnetCfg command injection (medium 5.3)
- [CVE-2024-7180](https://insights.sbomify.com/CVE-2024-7180/): TOTOLINK A3600R cstecgi.cgi setPortForwardRules buffer overflow (high 8.7)
- [CVE-2024-7179](https://insights.sbomify.com/CVE-2024-7179/): TOTOLINK A3600R cstecgi.cgi setParentalRules buffer overflow (high 8.7)
- [CVE-2024-7178](https://insights.sbomify.com/CVE-2024-7178/): TOTOLINK A3600R cstecgi.cgi setMacQos buffer overflow (high 8.7)
- [CVE-2024-7177](https://insights.sbomify.com/CVE-2024-7177/): TOTOLINK A3600R cstecgi.cgi setLanguageCfg buffer overflow (high 8.7)
- [CVE-2024-7176](https://insights.sbomify.com/CVE-2024-7176/): TOTOLINK A3600R cstecgi.cgi setIpQosRules buffer overflow (high 8.7)
- [CVE-2024-7175](https://insights.sbomify.com/CVE-2024-7175/): TOTOLINK A3600R cstecgi.cgi setDiagnosisCfg os command injection (medium 5.3)
- [CVE-2024-7174](https://insights.sbomify.com/CVE-2024-7174/): TOTOLINK A3600R cstecgi.cgi setdeviceName buffer overflow (high 8.7)
- [CVE-2024-7173](https://insights.sbomify.com/CVE-2024-7173/): TOTOLINK A3600R cstecgi.cgi loginauth buffer overflow (high 8.7)
- [CVE-2024-7172](https://insights.sbomify.com/CVE-2024-7172/): TOTOLINK A3600R getSaveConfig buffer overflow (high 8.7)
- [CVE-2024-7171](https://insights.sbomify.com/CVE-2024-7171/): TOTOLINK A3600R cstecgi.cgi NTPSyncWithHost os command injection (medium 5.3)
- [CVE-2024-7170](https://insights.sbomify.com/CVE-2024-7170/): TOTOLINK A3000RU product.ini hard-coded password (medium 5.1)
- [CVE-2024-7169](https://insights.sbomify.com/CVE-2024-7169/): SourceCodester School Fees Payment System ajax.php cross-site request forgery (medium 6.9)
- [CVE-2024-7168](https://insights.sbomify.com/CVE-2024-7168/): SourceCodester School Fees Payment System manage_user.php sql injection (medium 5.3)
- [CVE-2024-7167](https://insights.sbomify.com/CVE-2024-7167/): SourceCodester School Fees Payment System manage_course.php sql injection (medium 5.3)
- [CVE-2024-7166](https://insights.sbomify.com/CVE-2024-7166/): SourceCodester School Fees Payment System receipt.php sql injection (medium 5.3)
- [CVE-2024-7165](https://insights.sbomify.com/CVE-2024-7165/): SourceCodester School Fees Payment System view_payment.php sql injection (medium 5.3)
- [CVE-2024-7164](https://insights.sbomify.com/CVE-2024-7164/): SourceCodester School Fees Payment System sql injection (medium 6.9)
- [CVE-2024-7163](https://insights.sbomify.com/CVE-2024-7163/): SeaCMS index.php cross site scripting (medium 5.3)
- [CVE-2024-7162](https://insights.sbomify.com/CVE-2024-7162/): SeaCMS cross site scripting (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/162/