# Vulnerabilities published in 2024


- [CVE-2024-7161](https://insights.sbomify.com/CVE-2024-7161/): SeaCMS Password Change cross-site request forgery (medium 6.9)
- [CVE-2024-7160](https://insights.sbomify.com/CVE-2024-7160/): TOTOLINK A3700R cstecgi.cgi setWanCfg command injection (medium 5.3)
- [CVE-2024-7159](https://insights.sbomify.com/CVE-2024-7159/): TOTOLINK A3600R Telnet Service product.ini hard-coded password (medium 5.1)
- [CVE-2024-7158](https://insights.sbomify.com/CVE-2024-7158/): TOTOLINK A3100R HTTP POST Request cstecgi.cgi setTelnetCfg command injection (medium 5.3)
- [CVE-2024-7157](https://insights.sbomify.com/CVE-2024-7157/): TOTOLINK A3100R getSaveConfig buffer overflow (high 8.7)
- [CVE-2024-7156](https://insights.sbomify.com/CVE-2024-7156/): TOTOLINK A3700R apmib Configuration ExportSettings.sh information disclosure (medium 6.9)
- [CVE-2024-7155](https://insights.sbomify.com/CVE-2024-7155/): TOTOLINK A3300R shadow.sample hard-coded password (low 2.0)
- [CVE-2024-7154](https://insights.sbomify.com/CVE-2024-7154/): TOTOLINK A3700R Password Reset wizard.html access control (medium 5.3)
- [CVE-2024-7153](https://insights.sbomify.com/CVE-2024-7153/): Netgear WN604 siteSurvey.php direct request (medium 6.9)
- [CVE-2024-7152](https://insights.sbomify.com/CVE-2024-7152/): Tenda O3 setMacFilterList fromSafeSetMacFilter stack-based overflow (high 8.7)
- [CVE-2024-7151](https://insights.sbomify.com/CVE-2024-7151/): Tenda O3 setMacFilter fromMacFilterSet stack-based overflow (high 8.7)
- [CVE-2024-7150](https://insights.sbomify.com/CVE-2024-7150/): Slider by 10Web – Responsive Image Slider <= 1.2.57 - Authenticated (Contributor+) SQL Injection via id Parameter (high 8.8)
- [CVE-2024-7149](https://insights.sbomify.com/CVE-2024-7149/): Path traversal in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) (high 8.8)
- [CVE-2024-7147](https://insights.sbomify.com/CVE-2024-7147/): JetBlocks <= 1.3.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-7146](https://insights.sbomify.com/CVE-2024-7146/): JetTabs <= 2.2.3 - Authenticated (Contributor+) Arbitrary Local File Inclusion (high 8.8)
- [CVE-2024-7145](https://insights.sbomify.com/CVE-2024-7145/): JetElements <= 2.6.20 - Authenticated (Contributor+) Arbitrary Local File Inclusion (high 8.8)
- [CVE-2024-7144](https://insights.sbomify.com/CVE-2024-7144/): JetElements <= 2.6.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-7143](https://insights.sbomify.com/CVE-2024-7143/): Pulpcore: rbac permissions incorrectly assigned in tasks that create objects (medium 6.7)
- [CVE-2024-7142](https://insights.sbomify.com/CVE-2024-7142/): Security feature bypass in CloudVision Appliance (medium 4.6)
- [CVE-2024-7141](https://insights.sbomify.com/CVE-2024-7141/): CSRF in Gliffy (medium 5.9)
- [CVE-2024-7139](https://insights.sbomify.com/CVE-2024-7139/): Denial of Service in Silicon Labs RS9116 Bluetooth SDK (medium 6.5)
- [CVE-2024-7138](https://insights.sbomify.com/CVE-2024-7138/): Denial of Service in Silicon Labs RS9116 Bluetooth SDK (medium 6.5)
- [CVE-2024-7137](https://insights.sbomify.com/CVE-2024-7137/): Denial of Service in Silicon Labs RS9116 Bluetooth SDK (medium 6.5)
- [CVE-2024-7136](https://insights.sbomify.com/CVE-2024-7136/): JetSearch <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-7135](https://insights.sbomify.com/CVE-2024-7135/): Tainacan <= 0.21.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read (medium 6.5)
- [CVE-2024-7134](https://insights.sbomify.com/CVE-2024-7134/): LiquidPoll <= 3.3.78 - Unauthenticated Stored Cross-Site Scripting via form_data Parameter (high 7.2)
- [CVE-2024-7133](https://insights.sbomify.com/CVE-2024-7133/): My Sticky Bar < 2.7.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7132](https://insights.sbomify.com/CVE-2024-7132/): CoBlocks < 3.1.13 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-7130](https://insights.sbomify.com/CVE-2024-7130/): Reflected XSS in Kion Computer's KION Exchange Programs Software (medium 5.5)
- [CVE-2024-7129](https://insights.sbomify.com/CVE-2024-7129/): Appointment Booking Calendar < 1.6.7.43 - Admin+ Template Injection to RCE (high 7.2)
- [CVE-2024-7128](https://insights.sbomify.com/CVE-2024-7128/): Openshift-console: unauthenticated data exposure (medium 5.3)
- [CVE-2024-7127](https://insights.sbomify.com/CVE-2024-7127/): XSS in Stackposts - Social Marketing Tool (high 7.2)
- [CVE-2024-7125](https://insights.sbomify.com/CVE-2024-7125/): Authentication Bypass Vulnerability in Hitachi Ops Center Common Services (high 7.8)
- [CVE-2024-7124](https://insights.sbomify.com/CVE-2024-7124/): Reflected XSS in DInGO dLibra (medium 5.3)
- [CVE-2024-7122](https://insights.sbomify.com/CVE-2024-7122/): Elementor Addon Elements <= 1.13.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (medium 6.4)
- [CVE-2024-7120](https://insights.sbomify.com/CVE-2024-7120/): Raisecom MSG1200/MSG2100E/MSG2200/MSG2300 Web Interface list_base_config.php os command injection (medium 5.3)
- [CVE-2024-7119](https://insights.sbomify.com/CVE-2024-7119/): MD-MAFUJUL-HASAN Online-Payroll-Management-System employee_viewmore.php sql injection (medium 5.3)
- [CVE-2024-7118](https://insights.sbomify.com/CVE-2024-7118/): MD-MAFUJUL-HASAN Online-Payroll-Management-System department_viewmore.php sql injection (medium 5.3)
- [CVE-2024-7117](https://insights.sbomify.com/CVE-2024-7117/): MD-MAFUJUL-HASAN Online-Payroll-Management-System shift_viewmore.php sql injection (medium 5.3)
- [CVE-2024-7116](https://insights.sbomify.com/CVE-2024-7116/): MD-MAFUJUL-HASAN Online-Payroll-Management-System branch_viewmore.php sql injection (medium 5.3)
- [CVE-2024-7115](https://insights.sbomify.com/CVE-2024-7115/): MD-MAFUJUL-HASAN Online-Payroll-Management-System designation_viewmore.php sql injection (medium 5.3)
- [CVE-2024-7114](https://insights.sbomify.com/CVE-2024-7114/): Tianchoy Blog so.php sql injection (medium 5.3)
- [CVE-2024-7113](https://insights.sbomify.com/CVE-2024-7113/): Allocation of Resources Without Limits or Throttling in AVEVA SuiteLink Server (high 8.7)
- [CVE-2024-7112](https://insights.sbomify.com/CVE-2024-7112/): Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection (high 8.8)
- [CVE-2024-7110](https://insights.sbomify.com/CVE-2024-7110/): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (medium 6.4)
- [CVE-2024-7108](https://insights.sbomify.com/CVE-2024-7108/): Incorrect Authorization in National Keep's CyberMath (high 8.2)
- [CVE-2024-7107](https://insights.sbomify.com/CVE-2024-7107/): Directory Traversal in National Keep's CyberMath (medium 6.8)
- [CVE-2024-7106](https://insights.sbomify.com/CVE-2024-7106/): Spina CMS media_folders cross-site request forgery (medium 6.9)
- [CVE-2024-7105](https://insights.sbomify.com/CVE-2024-7105/): ForIP Tecnologia Administração PABX Lista Ura Page detalheIdUra sql injection (medium 5.3)
- [CVE-2024-7104](https://insights.sbomify.com/CVE-2024-7104/): Remote Code Execution in SFS Consulting's ww.Winsure (critical 9.2)
- [CVE-2024-7103](https://insights.sbomify.com/CVE-2024-7103/): Reflected Cross-Site Scripting (XSS) in WSO2 Identity Server 7.0.0 Sub-Organization Login Flow (medium 4.6)
- [CVE-2024-7102](https://insights.sbomify.com/CVE-2024-7102/): Execution with Unnecessary Privileges in GitLab (critical 9.6)
- [CVE-2024-7101](https://insights.sbomify.com/CVE-2024-7101/): ForIP Tecnologia Administração PABX Authentication Form login sql injection (medium 6.9)
- [CVE-2024-7100](https://insights.sbomify.com/CVE-2024-7100/): Bold Page Builder <= 5.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_button Shortcode (medium 6.4)
- [CVE-2024-7099](https://insights.sbomify.com/CVE-2024-7099/): SQL Injection in netease-youdao/qanything (critical 9.8)
- [CVE-2024-7098](https://insights.sbomify.com/CVE-2024-7098/): XML Injection in SFS Consulting's ww.Winsure (critical 9.2)
- [CVE-2024-7097](https://insights.sbomify.com/CVE-2024-7097/): Incorrect Authorization in Multiple WSO2 Products via SOAP Admin Service Allowing Unauthorized User Signup (medium 4.3)
- [CVE-2024-7096](https://insights.sbomify.com/CVE-2024-7096/): Privilege Escalation in Multiple WSO2 Products via SOAP Admin Service Due to Business Logic Flaw (medium 4.2)
- [CVE-2024-7095](https://insights.sbomify.com/CVE-2024-7095/): Denial of service in EOS (medium 4.3)
- [CVE-2024-7094](https://insights.sbomify.com/CVE-2024-7094/): Code injection in JS Help Desk – AI-Powered Support & Ticketing System (critical 9.8)
- [CVE-2024-7093](https://insights.sbomify.com/CVE-2024-7093/): Server-Side Template Injection in Dispatch Message Templates (critical 9.4)
- [CVE-2024-7092](https://insights.sbomify.com/CVE-2024-7092/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-7091](https://insights.sbomify.com/CVE-2024-7091/): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (medium 4.1)
- [CVE-2024-7090](https://insights.sbomify.com/CVE-2024-7090/): LH Add Media From Url <= 1.23 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-7085](https://insights.sbomify.com/CVE-2024-7085/): Exposure of private information vulnerability has been discovered in OpenText™ Solutions Business Manager (SBM). (high 8.2)
- [CVE-2024-7084](https://insights.sbomify.com/CVE-2024-7084/): Ajax Search Lite < 4.12.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7083](https://insights.sbomify.com/CVE-2024-7083/): Email Encoder < 2.3.4 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-7082](https://insights.sbomify.com/CVE-2024-7082/): easy-table-of-contents < 2.0.68 - Editor+ Stored XSS (medium 6.1)
- [CVE-2024-7081](https://insights.sbomify.com/CVE-2024-7081/): itsourcecode Tailoring Management System expcatadd.php sql injection (medium 5.3)
- [CVE-2024-7080](https://insights.sbomify.com/CVE-2024-7080/): SourceCodester Insurance Management System direct request (medium 6.9)
- [CVE-2024-7079](https://insights.sbomify.com/CVE-2024-7079/): Openshift-console: unauthenticated installation of helm charts (medium 6.5)
- [CVE-2024-7078](https://insights.sbomify.com/CVE-2024-7078/): Unauthenticate SQLi in Semtek Informatics Software's Semtek Sempos (critical 9.2)
- [CVE-2024-7077](https://insights.sbomify.com/CVE-2024-7077/): Reflected XSS in Semtek Informatics Software's Semtek Sempos (medium 5.3)
- [CVE-2024-7076](https://insights.sbomify.com/CVE-2024-7076/): SQLi in Semtek Informatics Software's Semtek Sempos (critical 9.3)
- [CVE-2024-7074](https://insights.sbomify.com/CVE-2024-7074/): Authenticated Arbitrary File Upload in Multiple WSO2 Products via SOAP Admin Service Leading to Remote Code Execution (medium 6.8)
- [CVE-2024-7073](https://insights.sbomify.com/CVE-2024-7073/): Unauthenticated Server-Side Request Forgery (SSRF) in Multiple WSO2 Products via SOAP Admin Services (medium 6.5)
- [CVE-2024-7071](https://insights.sbomify.com/CVE-2024-7071/): Unauthenticate SQLi in Brain Information Technologies' Brain Low-Code (critical 9.3)
- [CVE-2024-7069](https://insights.sbomify.com/CVE-2024-7069/): SourceCodester Employee and Visitor Gate Pass Logging System sql injection (medium 5.3)
- [CVE-2024-7068](https://insights.sbomify.com/CVE-2024-7068/): SourceCodester Insurance Management System update_sub_category cross site scripting (medium 5.3)
- [CVE-2024-7067](https://insights.sbomify.com/CVE-2024-7067/): kirilkirkov Ecommerce-Laravel-Bootstrap Cart.php getCartProductsIds deserialization (medium 5.3)
- [CVE-2024-7066](https://insights.sbomify.com/CVE-2024-7066/): F-logic DataCube3 HTTP POST Request config_time_sync.php os command injection (medium 6.9)
- [CVE-2024-7065](https://insights.sbomify.com/CVE-2024-7065/): Spina CMS cross-site request forgery (medium 6.9)
- [CVE-2024-7064](https://insights.sbomify.com/CVE-2024-7064/): ElementsKit Pro <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-7063](https://insights.sbomify.com/CVE-2024-7063/): ElementsKit Pro <= 3.6.6 - Authenticated (Contributor+) Sensitive Information Exposure (medium 4.3)
- [CVE-2024-7062](https://insights.sbomify.com/CVE-2024-7062/): Local Privilege Escalation in Nimble Commander <= v1.6.0, Build 4087 (high 8.8)
- [CVE-2024-7061](https://insights.sbomify.com/CVE-2024-7061/): Privilege escalation in Okta Verify for Windows (medium 5.5)
- [CVE-2024-7060](https://insights.sbomify.com/CVE-2024-7060/): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (low 2.6)
- [CVE-2024-7059](https://insights.sbomify.com/CVE-2024-7059/): Code injection in Genetec Security Center (high 8.9)
- [CVE-2024-7058](https://insights.sbomify.com/CVE-2024-7058/): Relative Path Traversal in parisneo/lollms-webui (medium 4.4)
- [CVE-2024-7057](https://insights.sbomify.com/CVE-2024-7057/): Improper Access Control in GitLab (medium 4.3)
- [CVE-2024-7056](https://insights.sbomify.com/CVE-2024-7056/): WPForms < 1.9.1.6 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-7055](https://insights.sbomify.com/CVE-2024-7055/): FFmpeg pnmdec.c pnm_decode_frame heap-based overflow (medium 6.9)
- [CVE-2024-7054](https://insights.sbomify.com/CVE-2024-7054/): Popup Maker <= 1.19.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-7052](https://insights.sbomify.com/CVE-2024-7052/): Forminator < 1.38.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-7050](https://insights.sbomify.com/CVE-2024-7050/): Auth bypass in OpenText Directory Services (high 8.3)
- [CVE-2024-7048](https://insights.sbomify.com/CVE-2024-7048/): IDOR in open-webui/open-webui (medium 6.3)
- [CVE-2024-7047](https://insights.sbomify.com/CVE-2024-7047/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 7.7)
- [CVE-2024-7044](https://insights.sbomify.com/CVE-2024-7044/): Stored XSS in open-webui/open-webui (medium 6.8)
- [CVE-2024-7043](https://insights.sbomify.com/CVE-2024-7043/): Improper Access Control in open-webui/open-webui (high 8.1)
- [CVE-2024-7042](https://insights.sbomify.com/CVE-2024-7042/): Prompt Injection in langchain-ai/langchainjs Leading to SQL Injection (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/163/