# Vulnerabilities published in 2024


- [CVE-2024-6607](https://insights.sbomify.com/CVE-2024-6607/): Leaving pointerlock by pressing the escape key could be prevented (high 8.8)
- [CVE-2024-6606](https://insights.sbomify.com/CVE-2024-6606/): Out-of-bounds read in clipboard component (high 8.2)
- [CVE-2024-6605](https://insights.sbomify.com/CVE-2024-6605/): Firefox Android missed activation delay to prevent tapjacking (high 8.8)
- [CVE-2024-6604](https://insights.sbomify.com/CVE-2024-6604/): Memory safety bugs fixed in Firefox 128, Firefox ESR 115.13, Thunderbird 128, and Thunderbird 115.13 (high 7.5)
- [CVE-2024-6603](https://insights.sbomify.com/CVE-2024-6603/): Memory corruption in thread creation (high 7.4)
- [CVE-2024-6602](https://insights.sbomify.com/CVE-2024-6602/): Memory corruption in NSS (critical 9.8)
- [CVE-2024-6601](https://insights.sbomify.com/CVE-2024-6601/): Race condition in permission assignment (medium 4.7)
- [CVE-2024-6600](https://insights.sbomify.com/CVE-2024-6600/): Memory corruption in WebGL API (medium 6.3)
- [CVE-2024-6599](https://insights.sbomify.com/CVE-2024-6599/): Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification (medium 4.3)
- [CVE-2024-6598](https://insights.sbomify.com/CVE-2024-6598/): Denial-of-service on KNIME Business Hub when certain jobs are executed (high 7.1)
- [CVE-2024-6596](https://insights.sbomify.com/CVE-2024-6596/): Endress+Hauser: Multiple products are vulnerable to code injection (critical 9.8)
- [CVE-2024-6595](https://insights.sbomify.com/CVE-2024-6595/): Uncontrolled Search Path Element in GitLab (low 3.0)
- [CVE-2024-6594](https://insights.sbomify.com/CVE-2024-6594/): WatchGuard Firebox Single Sign-On Client Denial-of-Service (high 8.7)
- [CVE-2024-6593](https://insights.sbomify.com/CVE-2024-6593/): WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass (critical 9.3)
- [CVE-2024-6592](https://insights.sbomify.com/CVE-2024-6592/): WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass (critical 9.3)
- [CVE-2024-6591](https://insights.sbomify.com/CVE-2024-6591/): Ultimate WordPress Auction Plugin <= 4.2.7 - Missing Authorization to Unauthenticated Email Creation (medium 5.8)
- [CVE-2024-6590](https://insights.sbomify.com/CVE-2024-6590/): Missing authorization in WPGSI: Spreadsheet Integration (medium 6.3)
- [CVE-2024-6589](https://insights.sbomify.com/CVE-2024-6589/): LearnPress <= 4.2.6.8.2 - Authenticated (Contributor+) Local File Inclusion (high 8.8)
- [CVE-2024-6588](https://insights.sbomify.com/CVE-2024-6588/): Cross-site scripting in PowerPress Podcasting plugin by Blubrry (medium 6.4)
- [CVE-2024-6587](https://insights.sbomify.com/CVE-2024-6587/): SSRF in berriai/litellm (high 7.5)
- [CVE-2024-6586](https://insights.sbomify.com/CVE-2024-6586/): Server-side request forgery in Lightdash (high 7.3)
- [CVE-2024-6585](https://insights.sbomify.com/CVE-2024-6585/): Cross-site scripting in Lightdash (medium 5.4)
- [CVE-2024-6584](https://insights.sbomify.com/CVE-2024-6584/): Jetpack Boost < 3.4.7 - Admin+ SSRF (critical 9.1)
- [CVE-2024-6583](https://insights.sbomify.com/CVE-2024-6583/): Path Traversal in stangirard/quivr (medium 4.3)
- [CVE-2024-6582](https://insights.sbomify.com/CVE-2024-6582/): Broken Access Control in lunary-ai/lunary (medium 6.5)
- [CVE-2024-6581](https://insights.sbomify.com/CVE-2024-6581/): Remote Code Execution due to Stored XSS in parisneo/lollms (medium 6.5)
- [CVE-2024-6580](https://insights.sbomify.com/CVE-2024-6580/): /n software IPWorks SSH insufficient file access verification (low 2.3)
- [CVE-2024-6579](https://insights.sbomify.com/CVE-2024-6579/): Missing authorization in Web and WooCommerce Addons for WPBakery Builder (medium 4.3)
- [CVE-2024-6578](https://insights.sbomify.com/CVE-2024-6578/): Stored XSS in aimhubio/aim (high 7.2)
- [CVE-2024-6577](https://insights.sbomify.com/CVE-2024-6577/): Unclaimed S3 Bucket Usage in pytorch/serve (medium 6.3)
- [CVE-2024-6576](https://insights.sbomify.com/CVE-2024-6576/): MOVEit Transfer Privilege Escalation Vulnerability (high 7.3)
- [CVE-2024-6575](https://insights.sbomify.com/CVE-2024-6575/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2024-6574](https://insights.sbomify.com/CVE-2024-6574/): Laposta <= 1.12 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6573](https://insights.sbomify.com/CVE-2024-6573/): Intelligence <= 1.4.0 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6572](https://insights.sbomify.com/CVE-2024-6572/): Improper host key checking in active check 'Check SFTP Service' and special agent 'VNX quotas and filesystem' (medium 6.3)
- [CVE-2024-6571](https://insights.sbomify.com/CVE-2024-6571/): Optimize Images ALT Text (alt tag) & names for SEO using AI <= 3.1.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6570](https://insights.sbomify.com/CVE-2024-6570/): Glossary <= 2.2.26 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6569](https://insights.sbomify.com/CVE-2024-6569/): Campaign Monitor for WordPress <= 2.8.15 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6568](https://insights.sbomify.com/CVE-2024-6568/): Flamix: Bitrix24 and Contact Form 7 integrations <= 3.1.0 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6567](https://insights.sbomify.com/CVE-2024-6567/): Ebook Store <= 5.8001 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6566](https://insights.sbomify.com/CVE-2024-6566/): Aramex Shipping WooCommerce <= 1.1.21 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6565](https://insights.sbomify.com/CVE-2024-6565/): AForms <= 2.2.6 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6564](https://insights.sbomify.com/CVE-2024-6564/): Buffer overflow in Rensas RCAR (medium 6.7)
- [CVE-2024-6563](https://insights.sbomify.com/CVE-2024-6563/): Buffer Overflow Arbitrary Write (high 7.5)
- [CVE-2024-6562](https://insights.sbomify.com/CVE-2024-6562/): affiliate-toolkit <= 3.5.5 - Unauthenticated Full Path Dislcosure (medium 5.3)
- [CVE-2024-6560](https://insights.sbomify.com/CVE-2024-6560/): Addonify – Quick View For WooCommerce <= 1.2.16 - Unauthenticated Full Path Dislcosure (medium 5.3)
- [CVE-2024-6559](https://insights.sbomify.com/CVE-2024-6559/): XCloner <= 4.7.3 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6558](https://insights.sbomify.com/CVE-2024-6558/): HMS Industrial Networks Anybus-CompactCom 30 Cross-site Scripting (medium 6.3)
- [CVE-2024-6557](https://insights.sbomify.com/CVE-2024-6557/): SchedulePress <= 5.1.3 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6556](https://insights.sbomify.com/CVE-2024-6556/): SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.8 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6555](https://insights.sbomify.com/CVE-2024-6555/): WP Popups – WordPress Popup builder <= 2.2.0.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6554](https://insights.sbomify.com/CVE-2024-6554/): Branda – White Label WordPress, Custom Login Page Customizer <= 3.4.18 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6553](https://insights.sbomify.com/CVE-2024-6553/): WP Meteor Website Speed Optimization Addon <= 3.4.3 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6552](https://insights.sbomify.com/CVE-2024-6552/): Booking for Appointments and Events Calendar – Amelia <= 1.2 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6551](https://insights.sbomify.com/CVE-2024-6551/): GiveWP <= 3.15.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6550](https://insights.sbomify.com/CVE-2024-6550/): Gravity Forms: Multiple Form Instances <= 1.1.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6549](https://insights.sbomify.com/CVE-2024-6549/): Admin Post Navigation <= 2.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6548](https://insights.sbomify.com/CVE-2024-6548/): Add Admin JavaScript <= 2.0 - Unauthenticated Full Path Dislcosure (medium 5.3)
- [CVE-2024-6547](https://insights.sbomify.com/CVE-2024-6547/): Add Admin CSS <= 2.0.1 - Unauthenticated Full Path Dislcosure (medium 5.3)
- [CVE-2024-6546](https://insights.sbomify.com/CVE-2024-6546/): One Click Close Comments <= 2.7.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6545](https://insights.sbomify.com/CVE-2024-6545/): Admin Trim Interface <= 3.5.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6544](https://insights.sbomify.com/CVE-2024-6544/): Custom Post Limits <= 4.4.1 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6542](https://insights.sbomify.com/CVE-2024-6542/): Livestatus injection in mknotifyd (medium 6.5)
- [CVE-2024-6541](https://insights.sbomify.com/CVE-2024-6541/): Information Disclosure and Integrity Violation via Improper Message Context Handling in Multiple WSO2 Products (medium 6.8)
- [CVE-2024-6540](https://insights.sbomify.com/CVE-2024-6540/): Information exlosure in external interface (medium 5.7)
- [CVE-2024-6539](https://insights.sbomify.com/CVE-2024-6539/): heyewei SpringBootCMS Guestbook guestbook cross site scripting (medium 5.3)
- [CVE-2024-6538](https://insights.sbomify.com/CVE-2024-6538/): Openshift-console: openshift console: server-side request forgery (medium 5.3)
- [CVE-2024-6536](https://insights.sbomify.com/CVE-2024-6536/): Zephyr Project Manager < 3.3.99 - Editor+ XSS (medium 5.4)
- [CVE-2024-6535](https://insights.sbomify.com/CVE-2024-6535/): Skupper: potential authentication bypass to skupper console via forged cookies (medium 5.3)
- [CVE-2024-6534](https://insights.sbomify.com/CVE-2024-6534/): Directus 10.13.0 - Insecure object reference via PATH presets (medium 4.3)
- [CVE-2024-6533](https://insights.sbomify.com/CVE-2024-6533/): Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_options (medium 5.4)
- [CVE-2024-6532](https://insights.sbomify.com/CVE-2024-6532/): Cross-site scripting in Sheet to Table Live Sync for Google Sheet (medium 6.4)
- [CVE-2024-6530](https://insights.sbomify.com/CVE-2024-6530/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 7.3)
- [CVE-2024-6529](https://insights.sbomify.com/CVE-2024-6529/): Ultimate Classified Listings < 1.4 - Reflected XSS (high 7.1)
- [CVE-2024-6528](https://insights.sbomify.com/CVE-2024-6528/): Cross-site scripting in Modicon Controllers M241 / M251 (medium 5.4)
- [CVE-2024-6527](https://insights.sbomify.com/CVE-2024-6527/): SQL Injection in MegaBIP (critical 9.3)
- [CVE-2024-6526](https://insights.sbomify.com/CVE-2024-6526/): CodeIgniter Ecommerce-CodeIgniter-Bootstrap cross site scripting (medium 5.3)
- [CVE-2024-6525](https://insights.sbomify.com/CVE-2024-6525/): D-Link DAR-7000 decodmail.php deserialization (medium 5.1)
- [CVE-2024-6524](https://insights.sbomify.com/CVE-2024-6524/): ShopXO Uploader.php server-side request forgery (medium 5.3)
- [CVE-2024-6523](https://insights.sbomify.com/CVE-2024-6523/): ZKTeco BioTime system-group-add cross site scripting (medium 5.3)
- [CVE-2024-6522](https://insights.sbomify.com/CVE-2024-6522/): Modern Events Calendar <= 7.12.1 - Authenticated (Subscriber+) Server Side Request Forgery (high 8.5)
- [CVE-2024-6521](https://insights.sbomify.com/CVE-2024-6521/): Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 4.4)
- [CVE-2024-6520](https://insights.sbomify.com/CVE-2024-6520/): Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 4.4)
- [CVE-2024-6519](https://insights.sbomify.com/CVE-2024-6519/): Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability (high 8.2)
- [CVE-2024-6518](https://insights.sbomify.com/CVE-2024-6518/): Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 4.4)
- [CVE-2024-6517](https://insights.sbomify.com/CVE-2024-6517/): Contact Form 7 Math Captcha <= 2.0.1 - Reflected XSS (medium 6.1)
- [CVE-2024-6516](https://insights.sbomify.com/CVE-2024-6516/): Cross Site Scripting XSS (critical 9.3)
- [CVE-2024-6515](https://insights.sbomify.com/CVE-2024-6515/): unauthorized file access (high 8.7)
- [CVE-2024-6512](https://insights.sbomify.com/CVE-2024-6512/): Missing authorization in Devolutions Server (medium 6.5)
- [CVE-2024-6511](https://insights.sbomify.com/CVE-2024-6511/): y_project RuoYi Content-Type isJsonRequest cross site scripting (medium 5.3)
- [CVE-2024-6510](https://insights.sbomify.com/CVE-2024-6510/): Local privilege escalation vulnerability in AVG Internet Security (high 7.8)
- [CVE-2024-6509](https://insights.sbomify.com/CVE-2024-6509/): Denial of service in AXIS OS (medium 6.5)
- [CVE-2024-6508](https://insights.sbomify.com/CVE-2024-6508/): Openshift-console: oauth2 insufficient state parameter entropy (high 8.0)
- [CVE-2024-6507](https://insights.sbomify.com/CVE-2024-6507/): Deep Lake Kaggle command injection (high 8.1)
- [CVE-2024-6506](https://insights.sbomify.com/CVE-2024-6506/): Information exposure vulnerability in the MRW plug-in (high 8.2)
- [CVE-2024-6505](https://insights.sbomify.com/CVE-2024-6505/): Qemu-kvm: virtio-net: queue index out-of-bounds access in software rss (medium 6.8)
- [CVE-2024-6504](https://insights.sbomify.com/CVE-2024-6504/): Rapid7 InsightVM Protection Mechanism Failure (medium 4.3)
- [CVE-2024-6502](https://insights.sbomify.com/CVE-2024-6502/): Incorrect Provision of Specified Functionality in GitLab (medium 5.7)
- [CVE-2024-6501](https://insights.sbomify.com/CVE-2024-6501/): Networkmanager: denial of service (low 3.1)
- [CVE-2024-6500](https://insights.sbomify.com/CVE-2024-6500/): Missing authorization in InPost PL (critical 10.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/168/