# Vulnerabilities published in 2024


- [CVE-2024-6387](https://insights.sbomify.com/CVE-2024-6387/): Openssh: regresshion - race condition in ssh allows rce/dos (high 8.1)
- [CVE-2024-6386](https://insights.sbomify.com/CVE-2024-6386/): Code injection in WPML (critical 9.9)
- [CVE-2024-6385](https://insights.sbomify.com/CVE-2024-6385/): Improper Access Control in GitLab (critical 9.6)
- [CVE-2024-6384](https://insights.sbomify.com/CVE-2024-6384/): Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server (medium 5.3)
- [CVE-2024-6383](https://insights.sbomify.com/CVE-2024-6383/): MongoDB C Driver bson_string_append may be vulnerable to a buffer overflow (medium 5.3)
- [CVE-2024-6382](https://insights.sbomify.com/CVE-2024-6382/): Adversarial unsanitized input may cause MongoDB Rust Driver to issue unintended commands. (medium 6.4)
- [CVE-2024-6381](https://insights.sbomify.com/CVE-2024-6381/): MongoDB C Driver bson_strfreev may be susceptible to integer overflow (medium 4.0)
- [CVE-2024-6380](https://insights.sbomify.com/CVE-2024-6380/): Cross-site scripting in ENOVIA Collaborative Industry Innovator (high 8.7)
- [CVE-2024-6379](https://insights.sbomify.com/CVE-2024-6379/): Cross-site scripting in 3DSwymer (high 7.7)
- [CVE-2024-6378](https://insights.sbomify.com/CVE-2024-6378/): Cross-site scripting in ENOVIA Collaborative Industry Innovator (high 8.7)
- [CVE-2024-6377](https://insights.sbomify.com/CVE-2024-6377/): Open redirect in 3DSwymer (high 8.1)
- [CVE-2024-6376](https://insights.sbomify.com/CVE-2024-6376/): ejson shell parser in MongoDB Compass maybe bypassed (high 7.0)
- [CVE-2024-6375](https://insights.sbomify.com/CVE-2024-6375/): Missing authorization check may lead to shard key refinement (medium 5.4)
- [CVE-2024-6374](https://insights.sbomify.com/CVE-2024-6374/): lahirudanushka School Management System Subject Page subject.php cross site scripting (medium 5.3)
- [CVE-2024-6373](https://insights.sbomify.com/CVE-2024-6373/): itsourcecode Online Food Ordering System addproduct.php unrestricted upload (medium 6.9)
- [CVE-2024-6372](https://insights.sbomify.com/CVE-2024-6372/): itsourcecode Tailoring Management System customeradd.php sql injection (medium 5.3)
- [CVE-2024-6371](https://insights.sbomify.com/CVE-2024-6371/): itsourcecode Pool of Bethesda Online Reservation System controller.php sql injection (medium 6.9)
- [CVE-2024-6370](https://insights.sbomify.com/CVE-2024-6370/): LabVantage LIMS POST Request cross site scripting (medium 5.3)
- [CVE-2024-6369](https://insights.sbomify.com/CVE-2024-6369/): LabVantage LIMS POST Request cross site scripting (medium 5.3)
- [CVE-2024-6368](https://insights.sbomify.com/CVE-2024-6368/): LabVantage LIMS POST Request cross site scripting (medium 5.3)
- [CVE-2024-6367](https://insights.sbomify.com/CVE-2024-6367/): LabVantage LIMS POST Request cross site scripting (medium 5.3)
- [CVE-2024-6366](https://insights.sbomify.com/CVE-2024-6366/): User Profile Builder < 3.11.8 - Unauthenticated Media Upload (critical 9.1)
- [CVE-2024-6365](https://insights.sbomify.com/CVE-2024-6365/): Product Table by WBW <= 2.0.1 - Unauthenticated Remote Code Execution (critical 9.8)
- [CVE-2024-6364](https://insights.sbomify.com/CVE-2024-6364/): Server Identity Validation Bypass in Absolute Persistence® (medium 6.9)
- [CVE-2024-6363](https://insights.sbomify.com/CVE-2024-6363/): Stock Ticker <= 3.24.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock_ticker Shortcode (medium 6.4)
- [CVE-2024-6362](https://insights.sbomify.com/CVE-2024-6362/): Ultimate Blocks < 3.2.0 - Contributor+ Stored XSS (medium 4.6)
- [CVE-2024-6361](https://insights.sbomify.com/CVE-2024-6361/): Improper Neutralization vulnerability (XSS) has been discovered in OpenText™ ALM Octane product. (high 7.3)
- [CVE-2024-6360](https://insights.sbomify.com/CVE-2024-6360/): Incorrect Permission Assignment for Critical Resource vulnerability has been discovered in OpenText™ Vertica. (medium 6.9)
- [CVE-2024-6359](https://insights.sbomify.com/CVE-2024-6359/): Privilege escalation vulnerability (medium 6.4)
- [CVE-2024-6358](https://insights.sbomify.com/CVE-2024-6358/): Incorrect Authorization vulnerability (medium 6.3)
- [CVE-2024-6357](https://insights.sbomify.com/CVE-2024-6357/): Insecure Direct Object Reference vulnerability (medium 6.3)
- [CVE-2024-6356](https://insights.sbomify.com/CVE-2024-6356/): Incorrect User Management in GitLab (medium 4.4)
- [CVE-2024-6355](https://insights.sbomify.com/CVE-2024-6355/): Genexis Tilgin Fiber Home Gateway HG1522 cross site scripting (medium 6.9)
- [CVE-2024-6354](https://insights.sbomify.com/CVE-2024-6354/): Missing authorization in Remote Desktop Manager (high 7.2)
- [CVE-2024-6353](https://insights.sbomify.com/CVE-2024-6353/): Wallet for WooCommerce <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'search[value]' (high 8.8)
- [CVE-2024-6352](https://insights.sbomify.com/CVE-2024-6352/): Malformed packet leads to denial of service in APS layer (medium 4.3)
- [CVE-2024-6351](https://insights.sbomify.com/CVE-2024-6351/): Malformed packet leads to denial of service in NWK/APS layer (medium 4.3)
- [CVE-2024-6350](https://insights.sbomify.com/CVE-2024-6350/): EmberZNet malformed MAC layer packet leads to denial of service (medium 6.5)
- [CVE-2024-6348](https://insights.sbomify.com/CVE-2024-6348/): Predictable seed generation after ECU reset (medium 5.3)
- [CVE-2024-6347](https://insights.sbomify.com/CVE-2024-6347/): Unauthorized access to ECU functionality (medium 5.3)
- [CVE-2024-6346](https://insights.sbomify.com/CVE-2024-6346/): Cross-site scripting in Post Grid (medium 6.4)
- [CVE-2024-6345](https://insights.sbomify.com/CVE-2024-6345/): Remote Code Execution in pypa/setuptools (high 8.8)
- [CVE-2024-6344](https://insights.sbomify.com/CVE-2024-6344/): ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting (medium 4.8)
- [CVE-2024-6343](https://insights.sbomify.com/CVE-2024-6343/): Memory corruption in ATP series firmware (medium 4.9)
- [CVE-2024-6342](https://insights.sbomify.com/CVE-2024-6342/): Command injection in NAS326 firmware (critical 9.8)
- [CVE-2024-6340](https://insights.sbomify.com/CVE-2024-6340/): Premium Addons for Elementor <= 4.10.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (medium 6.4)
- [CVE-2024-6339](https://insights.sbomify.com/CVE-2024-6339/): Phlox PRO <= 5.16.4 - Reflected Cross-Site Scripting via Search Parameters (medium 6.1)
- [CVE-2024-6338](https://insights.sbomify.com/CVE-2024-6338/): FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter (high 8.8)
- [CVE-2024-6337](https://insights.sbomify.com/CVE-2024-6337/): Incorrect Authorization allows read access to issues in GitHub Enterprise Server (medium 5.9)
- [CVE-2024-6336](https://insights.sbomify.com/CVE-2024-6336/): Security misconfiguration was identified in GitHub Enterprise Server that allowed sensitive data exposure (medium 6.9)
- [CVE-2024-6335](https://insights.sbomify.com/CVE-2024-6335/): Tracking Code Manager < 2.3.0- Admin+ Stored Cross-Site Scripting (medium 4.8)
- [CVE-2024-6334](https://insights.sbomify.com/CVE-2024-6334/): Easy Table of Contents < 2.0.67 - Editor+ Stored XSS (medium 6.1)
- [CVE-2024-6333](https://insights.sbomify.com/CVE-2024-6333/): Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products (high 7.2)
- [CVE-2024-6332](https://insights.sbomify.com/CVE-2024-6332/): Missing authorization in Booking for Appointments and Events Calendar – Amelia (medium 6.5)
- [CVE-2024-6331](https://insights.sbomify.com/CVE-2024-6331/): Injection by Prompt Injection in stitionai/devika (high 7.5)
- [CVE-2024-6330](https://insights.sbomify.com/CVE-2024-6330/): GEO my WordPress < 4.4.0.2 - Unauthenticated RCE via LFI (critical 9.8)
- [CVE-2024-6329](https://insights.sbomify.com/CVE-2024-6329/): Improper Encoding or Escaping of Output in GitLab (medium 5.7)
- [CVE-2024-6328](https://insights.sbomify.com/CVE-2024-6328/): MStore API – Create Native Android & iOS Apps On The Cloud <= 4.14.7 - Authentication Bypass (critical 9.8)
- [CVE-2024-6327](https://insights.sbomify.com/CVE-2024-6327/): Progress Telerik Report Server Deserialization (critical 9.9)
- [CVE-2024-6326](https://insights.sbomify.com/CVE-2024-6326/): Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services (low 1.8)
- [CVE-2024-6325](https://insights.sbomify.com/CVE-2024-6325/): Rockwell Automation Unsecured Private Keys in FactoryTalk® System Services (medium 6.0)
- [CVE-2024-6324](https://insights.sbomify.com/CVE-2024-6324/): Inefficient Algorithmic Complexity in GitLab (medium 4.3)
- [CVE-2024-6323](https://insights.sbomify.com/CVE-2024-6323/): Improper Isolation or Compartmentalization in GitLab (high 7.5)
- [CVE-2024-6322](https://insights.sbomify.com/CVE-2024-6322/): Grafana plugin data sources vulnerable to access control bypass (medium 4.4)
- [CVE-2024-6321](https://insights.sbomify.com/CVE-2024-6321/): ScrollTo Bottom <= 1.1.1 - Cross-Site Request Forgery to Arbitrary File Upload (high 8.8)
- [CVE-2024-6320](https://insights.sbomify.com/CVE-2024-6320/): ScrollTo Top <= 1.2.2 - Cross-Site Request Forgery to Arbitrary File Upload (high 8.8)
- [CVE-2024-6319](https://insights.sbomify.com/CVE-2024-6319/): IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload' (high 8.8)
- [CVE-2024-6318](https://insights.sbomify.com/CVE-2024-6318/): IMGspider <= 2.3.10 - Authenticated (Contributor+) Arbitrary File Upload via 'upload_img_file' (high 8.8)
- [CVE-2024-6317](https://insights.sbomify.com/CVE-2024-6317/): Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion (high 8.8)
- [CVE-2024-6316](https://insights.sbomify.com/CVE-2024-6316/): Generate PDF using Contact Form 7 <= 4.1.2 - Cross-Site Request Forgery to Arbitrary File Upload (high 8.8)
- [CVE-2024-6315](https://insights.sbomify.com/CVE-2024-6315/): Blox Page Builder <= 1.0.65 - Authenticated (Contributor+) Arbitrary File Upload (high 8.8)
- [CVE-2024-6314](https://insights.sbomify.com/CVE-2024-6314/): IQ Testimonials <= 2.2.7 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-6313](https://insights.sbomify.com/CVE-2024-6313/): Gutenberg Forms <= 2.2.9 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-6312](https://insights.sbomify.com/CVE-2024-6312/): Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Deletion (medium 6.5)
- [CVE-2024-6311](https://insights.sbomify.com/CVE-2024-6311/): Funnelforms Free <= 3.7.3.2 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2024-6310](https://insights.sbomify.com/CVE-2024-6310/): Advanced AJAX Page Loader <= 2.7.7 - Cross-Site Request Forgery to Arbitrary File Upload (high 8.8)
- [CVE-2024-6309](https://insights.sbomify.com/CVE-2024-6309/): Attachment File Icons (AF Icons) <= 1.3 - Cross-Site Request Forgery to Arbitrary File Upload (high 8.8)
- [CVE-2024-6308](https://insights.sbomify.com/CVE-2024-6308/): itsourcecode Simple Online Hotel Reservation System index.php sql injection (medium 6.9)
- [CVE-2024-6307](https://insights.sbomify.com/CVE-2024-6307/): WordPress Core < 6.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML API (medium 6.4)
- [CVE-2024-6303](https://insights.sbomify.com/CVE-2024-6303/): Missing Authorization in Conduit (critical 9.9)
- [CVE-2024-6302](https://insights.sbomify.com/CVE-2024-6302/): Improper Handling of Insufficient Permissions or Privileges in Conduit (high 8.1)
- [CVE-2024-6301](https://insights.sbomify.com/CVE-2024-6301/): Origin Validation Error in Conduit (medium 5.3)
- [CVE-2024-6300](https://insights.sbomify.com/CVE-2024-6300/): Incomplete Cleanup in Conduit (low 3.7)
- [CVE-2024-6299](https://insights.sbomify.com/CVE-2024-6299/): Use of a Key Past its Expiration Date in Conduit (medium 4.8)
- [CVE-2024-6298](https://insights.sbomify.com/CVE-2024-6298/): remote code execution (critical 9.4)
- [CVE-2024-6297](https://insights.sbomify.com/CVE-2024-6297/): Several WordPress.org Plugins <= Various Versions - Injected Backdoor (critical 10.0)
- [CVE-2024-6296](https://insights.sbomify.com/CVE-2024-6296/): Cross-site scripting in Stackable – Page Builder Gutenberg Blocks (medium 6.4)
- [CVE-2024-6295](https://insights.sbomify.com/CVE-2024-6295/): udn News App - Insecure Data Storage (low 3.9)
- [CVE-2024-6294](https://insights.sbomify.com/CVE-2024-6294/): udn News App - Sensitive Information Exposure (low 3.9)
- [CVE-2024-6293](https://insights.sbomify.com/CVE-2024-6293/): Use after free in Chrome (high 7.5)
- [CVE-2024-6292](https://insights.sbomify.com/CVE-2024-6292/): Use after free in Chrome (high 7.5)
- [CVE-2024-6291](https://insights.sbomify.com/CVE-2024-6291/): Use after free in Chrome (high 7.5)
- [CVE-2024-6290](https://insights.sbomify.com/CVE-2024-6290/): Use after free in Chrome (high 7.5)
- [CVE-2024-6289](https://insights.sbomify.com/CVE-2024-6289/): WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure (medium 6.1)
- [CVE-2024-6288](https://insights.sbomify.com/CVE-2024-6288/): Cross-site scripting in Conversios: Google Analytics (GA4), Google Ads, Conversion and Analytics Tracking for Multi-Channels (medium 4.7)
- [CVE-2024-6287](https://insights.sbomify.com/CVE-2024-6287/): Incorrect Address Range Calculations (high 7.5)
- [CVE-2024-6286](https://insights.sbomify.com/CVE-2024-6286/): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (high 8.5)
- [CVE-2024-6285](https://insights.sbomify.com/CVE-2024-6285/): Integer Underflow in Memory Range Check in Renesas RCAR (high 7.5)
- [CVE-2024-6284](https://insights.sbomify.com/CVE-2024-6284/): Improper IPv4 and IPv6 byte order storage in github.com/google/nftables (medium 6.3)
- [CVE-2024-6283](https://insights.sbomify.com/CVE-2024-6283/): Cross-site scripting in DethemeKit for Elementor (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/170/