# Vulnerabilities published in 2024


- [CVE-2024-6825](https://insights.sbomify.com/CVE-2024-6825/): Remote Code Execution in BerriAI/litellm (high 8.8)
- [CVE-2024-6824](https://insights.sbomify.com/CVE-2024-6824/): Missing authorization in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 4.3)
- [CVE-2024-6823](https://insights.sbomify.com/CVE-2024-6823/): File upload in Media Library Assistant (high 8.8)
- [CVE-2024-6822](https://insights.sbomify.com/CVE-2024-6822/): IrfanView CIN File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6821](https://insights.sbomify.com/CVE-2024-6821/): IrfanView CIN File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6820](https://insights.sbomify.com/CVE-2024-6820/): IrfanView AWD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6819](https://insights.sbomify.com/CVE-2024-6819/): IrfanView PSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6818](https://insights.sbomify.com/CVE-2024-6818/): IrfanView PSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6817](https://insights.sbomify.com/CVE-2024-6817/): IrfanView PSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6816](https://insights.sbomify.com/CVE-2024-6816/): IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6815](https://insights.sbomify.com/CVE-2024-6815/): IrfanView RLE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6814](https://insights.sbomify.com/CVE-2024-6814/): NETGEAR ProSAFE Network Management System getFilterString SQL Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-6813](https://insights.sbomify.com/CVE-2024-6813/): NETGEAR ProSAFE Network Management System getSortString SQL Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-6812](https://insights.sbomify.com/CVE-2024-6812/): IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6811](https://insights.sbomify.com/CVE-2024-6811/): IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-6810](https://insights.sbomify.com/CVE-2024-6810/): Quiz Organizer <= 2.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-6809](https://insights.sbomify.com/CVE-2024-6809/): Simple Video Directory < 1.4.3 - Unauthenticated SQLi (critical 9.8)
- [CVE-2024-6808](https://insights.sbomify.com/CVE-2024-6808/): itsourcecode Simple Task List signUp.php insertUserRecord sql injection (medium 6.9)
- [CVE-2024-6807](https://insights.sbomify.com/CVE-2024-6807/): SourceCodester Student Study Center Desk Management System HTTP POST Request Users.php cross site scripting (medium 4.8)
- [CVE-2024-6806](https://insights.sbomify.com/CVE-2024-6806/): Missing Authorization Checks In NI VeriStand Gateway For Project Resources (critical 9.8)
- [CVE-2024-6805](https://insights.sbomify.com/CVE-2024-6805/): Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources (high 7.5)
- [CVE-2024-6804](https://insights.sbomify.com/CVE-2024-6804/): Jeg Elementor Kit <= 2.6.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File (medium 6.4)
- [CVE-2024-6803](https://insights.sbomify.com/CVE-2024-6803/): itsourcecode Document Management System insert.php sql injection (medium 5.3)
- [CVE-2024-6802](https://insights.sbomify.com/CVE-2024-6802/): SourceCodester Computer Laboratory Management System Master.php sql injection (medium 5.3)
- [CVE-2024-6801](https://insights.sbomify.com/CVE-2024-6801/): SourceCodester Online Student Management System add-students.php unrestricted upload (medium 5.3)
- [CVE-2024-6800](https://insights.sbomify.com/CVE-2024-6800/): Auth bypass in GitHub Enterprise Server (critical 9.5)
- [CVE-2024-6799](https://insights.sbomify.com/CVE-2024-6799/): Missing authorization in YITH Essential Kit for WooCommerce #1 (medium 4.3)
- [CVE-2024-6798](https://insights.sbomify.com/CVE-2024-6798/): DL Verification <= 1.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6797](https://insights.sbomify.com/CVE-2024-6797/): DL Robots.txt <= 1.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6796](https://insights.sbomify.com/CVE-2024-6796/): Vulnerability in Baxter Connex Health Portal (high 8.2)
- [CVE-2024-6795](https://insights.sbomify.com/CVE-2024-6795/): Vulnerability in Baxter Connex Health Portal (critical 10.0)
- [CVE-2024-6794](https://insights.sbomify.com/CVE-2024-6794/): Deserialization of Untrusted Data in NI VeriStand Waveform Streaming Server (critical 9.8)
- [CVE-2024-6793](https://insights.sbomify.com/CVE-2024-6793/): Deserialization of Untrusted Data in NI VeriStand DataLogging Server (critical 9.8)
- [CVE-2024-6792](https://insights.sbomify.com/CVE-2024-6792/): WP ULike < 4.7.2.1 - Subscriber+ Stored-XSS (low 3.5)
- [CVE-2024-6791](https://insights.sbomify.com/CVE-2024-6791/): Directory Path Traversal Vulnerability in NI VeriStand with vsmodel Files (high 7.8)
- [CVE-2024-6790](https://insights.sbomify.com/CVE-2024-6790/): Mali GPU Kernel Driver can cause the whole system to become unresponsive (medium 4.0)
- [CVE-2024-6789](https://insights.sbomify.com/CVE-2024-6789/): Path traversal in M-Files API (high 8.4)
- [CVE-2024-6788](https://insights.sbomify.com/CVE-2024-6788/): Phoenix Contact: update feature from CHARX controller can be used to reset a low privilege user password (high 8.6)
- [CVE-2024-6787](https://insights.sbomify.com/CVE-2024-6787/): MXview One Series vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition (medium 6.0)
- [CVE-2024-6786](https://insights.sbomify.com/CVE-2024-6786/): MXview One Series vulnerable to Path Traversal (medium 6.0)
- [CVE-2024-6785](https://insights.sbomify.com/CVE-2024-6785/): MXview One and MXview One Central Manager Series store cleartext credentials in a local file (medium 6.8)
- [CVE-2024-6784](https://insights.sbomify.com/CVE-2024-6784/): SSRF Server Side Request Forgery (high 8.7)
- [CVE-2024-6783](https://insights.sbomify.com/CVE-2024-6783/): Vue client-side XSS via prototype pollution (medium 4.8)
- [CVE-2024-6782](https://insights.sbomify.com/CVE-2024-6782/): Calibre Remote Code Execution (critical 9.8)
- [CVE-2024-6781](https://insights.sbomify.com/CVE-2024-6781/): Calibre Arbitrary File Read (high 7.5)
- [CVE-2024-6780](https://insights.sbomify.com/CVE-2024-6780/): Improper permission control in com.android.server.telecom (low 3.3)
- [CVE-2024-6779](https://insights.sbomify.com/CVE-2024-6779/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-6778](https://insights.sbomify.com/CVE-2024-6778/): Race condition in Chrome (high 8.8)
- [CVE-2024-6777](https://insights.sbomify.com/CVE-2024-6777/): Use after free in Chrome (high 8.8)
- [CVE-2024-6776](https://insights.sbomify.com/CVE-2024-6776/): Use after free in Chrome (high 8.8)
- [CVE-2024-6775](https://insights.sbomify.com/CVE-2024-6775/): Use after free in Chrome (high 8.8)
- [CVE-2024-6774](https://insights.sbomify.com/CVE-2024-6774/): Use after free in Chrome (high 8.8)
- [CVE-2024-6773](https://insights.sbomify.com/CVE-2024-6773/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-6772](https://insights.sbomify.com/CVE-2024-6772/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-6770](https://insights.sbomify.com/CVE-2024-6770/): Cross-site scripting in VPSUForm – Drag & Drop Contact Form Builder with Email Automation (high 7.2)
- [CVE-2024-6769](https://insights.sbomify.com/CVE-2024-6769/): Medium to High Integrity Privilege Escalation in Microsoft Windows (high 8.4)
- [CVE-2024-6768](https://insights.sbomify.com/CVE-2024-6768/): Denial of Service in CLFS.sys (medium 6.8)
- [CVE-2024-6767](https://insights.sbomify.com/CVE-2024-6767/): WordSurvey <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parameter (medium 5.5)
- [CVE-2024-6766](https://insights.sbomify.com/CVE-2024-6766/): Shortcodes Ultimate Pro < 7.2.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-6763](https://insights.sbomify.com/CVE-2024-6763/): Jetty URI parsing of invalid authority (low 3.7)
- [CVE-2024-6762](https://insights.sbomify.com/CVE-2024-6762/): Jetty PushSessionCacheFilter can cause remote DoS attacks (low 3.1)
- [CVE-2024-6760](https://insights.sbomify.com/CVE-2024-6760/): ktrace(2) fails to detach when executing a setuid binary (high 7.5)
- [CVE-2024-6759](https://insights.sbomify.com/CVE-2024-6759/): NFS client accepts file names containing path separators (medium 5.3)
- [CVE-2024-6758](https://insights.sbomify.com/CVE-2024-6758/): Improper Privilege Management vulnerability in Sprecher Automation SPRECON-E (medium 6.5)
- [CVE-2024-6757](https://insights.sbomify.com/CVE-2024-6757/): Elementor <= 3.23.5 - Authenticated (Contributor+) Basic Information Exposure via get_image_alt Function (medium 4.3)
- [CVE-2024-6756](https://insights.sbomify.com/CVE-2024-6756/): Social Auto Poster <= 5.3.14 - Authenticated (Contributor+) Arbitrary File Upload (high 8.8)
- [CVE-2024-6755](https://insights.sbomify.com/CVE-2024-6755/): Social Auto Poster <= 5.3.14 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (medium 6.5)
- [CVE-2024-6754](https://insights.sbomify.com/CVE-2024-6754/): Missing authorization in Social Auto Poster (medium 5.4)
- [CVE-2024-6753](https://insights.sbomify.com/CVE-2024-6753/): Social Auto Poster <= 5.3.14 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-6752](https://insights.sbomify.com/CVE-2024-6752/): Social Auto Poster <= 5.3.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-6751](https://insights.sbomify.com/CVE-2024-6751/): Social Auto Poster <= 5.3.14 - Cross-Site Request Forgery via Multiple Functions (medium 6.3)
- [CVE-2024-6750](https://insights.sbomify.com/CVE-2024-6750/): Social Auto Poster <= 5.3.14 - Missing Authorization via Multiple Functions (high 7.3)
- [CVE-2024-6749](https://insights.sbomify.com/CVE-2024-6749/): Information disclosure in AXIS Camera Station (medium 6.3)
- [CVE-2024-6748](https://insights.sbomify.com/CVE-2024-6748/): SQL Injection (high 8.3)
- [CVE-2024-6747](https://insights.sbomify.com/CVE-2024-6747/): Information leak in mknotifyd (medium 5.3)
- [CVE-2024-6746](https://insights.sbomify.com/CVE-2024-6746/): NaiboWang EasySpider HTTP GET Request server.js path traversal (medium 5.3)
- [CVE-2024-6745](https://insights.sbomify.com/CVE-2024-6745/): code-projects Simple Ticket Booking Login adminauthenticate.php sql injection (medium 6.9)
- [CVE-2024-6744](https://insights.sbomify.com/CVE-2024-6744/): Memory corruption in Secure Email Gateway (critical 9.8)
- [CVE-2024-6743](https://insights.sbomify.com/CVE-2024-6743/): AguardNet Space Management System - SQL injection (critical 9.8)
- [CVE-2024-6742](https://insights.sbomify.com/CVE-2024-6742/): AguardNet Space Management System - Reflected Cross-Site Scripting (medium 5.4)
- [CVE-2024-6741](https://insights.sbomify.com/CVE-2024-6741/): Openfind Mail2000 - HttpOnly flag bypass (medium 5.8)
- [CVE-2024-6740](https://insights.sbomify.com/CVE-2024-6740/): Openfind Mail2000 - Stored XSS (medium 6.1)
- [CVE-2024-6739](https://insights.sbomify.com/CVE-2024-6739/): Openfind MailGates and MailAudit - Sensitive Cookie Without 'HttpOnly' Flag (medium 5.3)
- [CVE-2024-6738](https://insights.sbomify.com/CVE-2024-6738/): WisdomGarden Tronclass - Broken Access Control (medium 5.3)
- [CVE-2024-6737](https://insights.sbomify.com/CVE-2024-6737/): 2100 TECHNOLOGY Electronic Official Document Management System - Broken Access Control (high 8.8)
- [CVE-2024-6736](https://insights.sbomify.com/CVE-2024-6736/): SourceCodester Employee and Visitor Gate Pass Logging System view_employee.php sql injection (medium 5.3)
- [CVE-2024-6735](https://insights.sbomify.com/CVE-2024-6735/): itsourcecode Tailoring Management System setgeneral.php sql injection (medium 5.3)
- [CVE-2024-6734](https://insights.sbomify.com/CVE-2024-6734/): itsourcecode Tailoring Management System templateadd.php sql injection (medium 5.3)
- [CVE-2024-6733](https://insights.sbomify.com/CVE-2024-6733/): itsourcecode Tailoring Management System templateedit.php sql injection (medium 5.3)
- [CVE-2024-6732](https://insights.sbomify.com/CVE-2024-6732/): SourceCodester Student Study Center Desk Management System Users.php sql injection (medium 5.3)
- [CVE-2024-6731](https://insights.sbomify.com/CVE-2024-6731/): SourceCodester Student Study Center Desk Management System Master.php sql injection (medium 5.3)
- [CVE-2024-6730](https://insights.sbomify.com/CVE-2024-6730/): Nanjing Xingyuantu Technology SparkShop uploadFile unrestricted upload (medium 5.3)
- [CVE-2024-6729](https://insights.sbomify.com/CVE-2024-6729/): SourceCodester Kortex Lite Advocate Office Management System add_act.php sql injection (medium 5.3)
- [CVE-2024-6728](https://insights.sbomify.com/CVE-2024-6728/): itsourcecode Tailoring Management System typeedit.php sql injection (medium 5.3)
- [CVE-2024-6727](https://insights.sbomify.com/CVE-2024-6727/): Broken Access Control in Delphix (medium 5.4)
- [CVE-2024-6726](https://insights.sbomify.com/CVE-2024-6726/): Remote Code Execution (RCE) in Delphix (high 8.8)
- [CVE-2024-6725](https://insights.sbomify.com/CVE-2024-6725/): Formidable Forms <= 6.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 4.9)
- [CVE-2024-6724](https://insights.sbomify.com/CVE-2024-6724/): Generate Images – Magic Post Thumbnail < 5.2.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6723](https://insights.sbomify.com/CVE-2024-6723/): AI Engine < 2.4.8 - Admin+ SQLi (medium 4.7)
- [CVE-2024-6722](https://insights.sbomify.com/CVE-2024-6722/): Chatbot Support AI <= 1.0.2 - Admin+ Stored XSS (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/166/