# Vulnerabilities published in 2024


- [CVE-2024-6180](https://insights.sbomify.com/CVE-2024-6180/): EventON <= 2.2.15 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting and Plugin Settings Updates (high 7.2)
- [CVE-2024-6179](https://insights.sbomify.com/CVE-2024-6179/): XSS vulnerability in LG SuperSign CMS (medium 4.8)
- [CVE-2024-6178](https://insights.sbomify.com/CVE-2024-6178/): XSS vulnerability in LG SuperSign CMS (medium 4.8)
- [CVE-2024-6177](https://insights.sbomify.com/CVE-2024-6177/): XSS vulnerability in LG SuperSign CMS (medium 4.8)
- [CVE-2024-6176](https://insights.sbomify.com/CVE-2024-6176/): Port scanning vulnerability in LG SuperSign CMS (medium 4.8)
- [CVE-2024-6175](https://insights.sbomify.com/CVE-2024-6175/): Booking Ultra Pro <= 1.1.13 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updates (medium 5.4)
- [CVE-2024-6174](https://insights.sbomify.com/CVE-2024-6174/): Hardcoded credentials in cloud-init (high 8.8)
- [CVE-2024-6173](https://insights.sbomify.com/CVE-2024-6173/): Denial of service in AXIS OS (medium 6.5)
- [CVE-2024-6172](https://insights.sbomify.com/CVE-2024-6172/): SQL injection in Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress (critical 9.8)
- [CVE-2024-6171](https://insights.sbomify.com/CVE-2024-6171/): Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.112 - IP Address Spoofing to Antispam Bypass (medium 5.3)
- [CVE-2024-6170](https://insights.sbomify.com/CVE-2024-6170/): Cross-site scripting in Unlimited Elements For Elementor (medium 6.4)
- [CVE-2024-6169](https://insights.sbomify.com/CVE-2024-6169/): Cross-site scripting in Unlimited Elements For Elementor (medium 6.4)
- [CVE-2024-6168](https://insights.sbomify.com/CVE-2024-6168/): Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actions (medium 4.3)
- [CVE-2024-6167](https://insights.sbomify.com/CVE-2024-6167/): Just Custom Fields <= 3.3.2 - Missing Authorization via AJAX actions (medium 4.3)
- [CVE-2024-6166](https://insights.sbomify.com/CVE-2024-6166/): SQL injection in Unlimited Elements For Elementor (high 8.8)
- [CVE-2024-6165](https://insights.sbomify.com/CVE-2024-6165/): WANotifier < 2.6.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6164](https://insights.sbomify.com/CVE-2024-6164/): Filter & Grids < 2.8.33 - Unauthenticated LFI (critical 9.8)
- [CVE-2024-6163](https://insights.sbomify.com/CVE-2024-6163/): local IP restriction of internal HTTP endpoints (medium 5.3)
- [CVE-2024-6162](https://insights.sbomify.com/CVE-2024-6162/): Undertow: url-encoded request path information can be broken on ajp-listener (high 7.5)
- [CVE-2024-6161](https://insights.sbomify.com/CVE-2024-6161/): Default Thumbnail Plus <= 1.0.2.3 - Authenticated (Contributor+) Arbitrary File Upload (high 8.8)
- [CVE-2024-6160](https://insights.sbomify.com/CVE-2024-6160/): SQL Injection in MegaBIP (critical 9.3)
- [CVE-2024-6159](https://insights.sbomify.com/CVE-2024-6159/): Push Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi (critical 9.8)
- [CVE-2024-6158](https://insights.sbomify.com/CVE-2024-6158/): Category Posts Widget (Free < 4.9.17, Pro < 4.9.13) - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6157](https://insights.sbomify.com/CVE-2024-6157/): Null dereference in RobotWare 6 (medium 5.1)
- [CVE-2024-6156](https://insights.sbomify.com/CVE-2024-6156/): lxd CA certificate sign check bypass (low 3.8)
- [CVE-2024-6155](https://insights.sbomify.com/CVE-2024-6155/): Server-side request forgery in Greenshift – animation and page builder blocks (medium 6.4)
- [CVE-2024-6154](https://insights.sbomify.com/CVE-2024-6154/): Parallels Desktop Toolgate Heap-based Buffer Overflow Local Privilege Escalation Vulnerability (high 8.2)
- [CVE-2024-6153](https://insights.sbomify.com/CVE-2024-6153/): Parallels Desktop Updater Protection Mechanism Failure Software Downgrade Vulnerability (high 7.8)
- [CVE-2024-6152](https://insights.sbomify.com/CVE-2024-6152/): Flipbox Builder <= 1.5 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-6151](https://insights.sbomify.com/CVE-2024-6151/): Local Privilege escalation allows a low-privileged user to gain SYSTEM privileges (high 8.5)
- [CVE-2024-6150](https://insights.sbomify.com/CVE-2024-6150/): Missing authorization in Citrix Provisioning (medium 4.8)
- [CVE-2024-6149](https://insights.sbomify.com/CVE-2024-6149/): Open redirect in Citrix Workspace app for HTML5 (medium 4.8)
- [CVE-2024-6148](https://insights.sbomify.com/CVE-2024-6148/): Security feature bypass in Citrix Workspace app for HTML5 (medium 5.3)
- [CVE-2024-6147](https://insights.sbomify.com/CVE-2024-6147/): Poly Plantronics Hub Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-6146](https://insights.sbomify.com/CVE-2024-6146/): Actiontec WCB6200Q uh_get_postdata_withupload Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-6145](https://insights.sbomify.com/CVE-2024-6145/): Actiontec WCB6200Q Cookie Format String Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-6144](https://insights.sbomify.com/CVE-2024-6144/): Actiontec WCB6200Q Multipart Boundary Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-6143](https://insights.sbomify.com/CVE-2024-6143/): Actiontec WCB6200Q uh_tcp_recv_header Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-6142](https://insights.sbomify.com/CVE-2024-6142/): Actiontec WCB6200Q uh_tcp_recv_content Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-6141](https://insights.sbomify.com/CVE-2024-6141/): Windscribe Directory Traversal Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-6139](https://insights.sbomify.com/CVE-2024-6139/): Path Traversal in parisneo/lollms (high 7.3)
- [CVE-2024-6138](https://insights.sbomify.com/CVE-2024-6138/): Secure Copy Content Protection < 4.0.9 - Admin+ Stored XSS (medium 6.5)
- [CVE-2024-6137](https://insights.sbomify.com/CVE-2024-6137/): BT: Classic: SDP OOB access in get_att_search_list (high 7.6)
- [CVE-2024-6136](https://insights.sbomify.com/CVE-2024-6136/): WP eStore < 8.5.6 - Settings Reset via CSRF (medium 5.4)
- [CVE-2024-6135](https://insights.sbomify.com/CVE-2024-6135/): BT:Classic: Multiple missing buf length checks (high 7.6)
- [CVE-2024-6134](https://insights.sbomify.com/CVE-2024-6134/): WP eStore < 8.5.6 - Reflected XSS in Product Editing (medium 5.4)
- [CVE-2024-6133](https://insights.sbomify.com/CVE-2024-6133/): WP eStore < 8.5.6 - Reflected XSS in Customer Search (medium 6.5)
- [CVE-2024-6132](https://insights.sbomify.com/CVE-2024-6132/): Pexels: Free Stock Photos <= 1.2.2 - Authenticated (Contributor+) Arbitrary File Upload (high 8.8)
- [CVE-2024-6130](https://insights.sbomify.com/CVE-2024-6130/): Form Maker by 10Web < 1.15.26 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6129](https://insights.sbomify.com/CVE-2024-6129/): spa-cartcms Username login observable behavioral discrepancy (medium 6.3)
- [CVE-2024-6128](https://insights.sbomify.com/CVE-2024-6128/): spa-cartcms Checkout Page checkout behavioral workflow (medium 6.9)
- [CVE-2024-6127](https://insights.sbomify.com/CVE-2024-6127/): BC Security Empire Path Traversal RCE (critical 9.8)
- [CVE-2024-6126](https://insights.sbomify.com/CVE-2024-6126/): Cockpit: authenticated user can kill any process when enabling pam_env's user_readenv option (low 3.2)
- [CVE-2024-6125](https://insights.sbomify.com/CVE-2024-6125/): Login with phone number <= 1.7.34 - Insecure Password Reset Mechanism (high 8.1)
- [CVE-2024-6124](https://insights.sbomify.com/CVE-2024-6124/): Reflected XSS in Hubshare via Open Redirect (high 8.5)
- [CVE-2024-6123](https://insights.sbomify.com/CVE-2024-6123/): Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2024-6122](https://insights.sbomify.com/CVE-2024-6122/): Incorrect Default Directory Permissions for NI SystemLink Redis Service (medium 5.5)
- [CVE-2024-6121](https://insights.sbomify.com/CVE-2024-6121/): NI SystemLink Server Ships Out of Date Redis Version (high 7.8)
- [CVE-2024-6120](https://insights.sbomify.com/CVE-2024-6120/): Missing authorization in Sparkle Demo Importer (medium 6.5)
- [CVE-2024-6119](https://insights.sbomify.com/CVE-2024-6119/): Possible denial of service in X.509 name checks (high 7.5)
- [CVE-2024-6118](https://insights.sbomify.com/CVE-2024-6118/): Hamastar MeetingHub Paperless Meetings - Plaintext Storage of a Password (critical 9.3)
- [CVE-2024-6117](https://insights.sbomify.com/CVE-2024-6117/): Hamastar MeetingHub Paperless Meetings - Unrestricted Upload of File with Dangerous Type (critical 9.3)
- [CVE-2024-6116](https://insights.sbomify.com/CVE-2024-6116/): itsourcecode Simple Online Hotel Reservation System edit_room.php unrestricted upload (medium 6.9)
- [CVE-2024-6115](https://insights.sbomify.com/CVE-2024-6115/): itsourcecode Simple Online Hotel Reservation System add_room.php unrestricted upload (medium 6.9)
- [CVE-2024-6114](https://insights.sbomify.com/CVE-2024-6114/): itsourcecode Monbela Tourist Inn Online Reservation System controller.php unrestricted upload (medium 6.9)
- [CVE-2024-6113](https://insights.sbomify.com/CVE-2024-6113/): itsourcecode Monbela Tourist Inn Online Reservation System login.php sql injection (medium 6.9)
- [CVE-2024-6112](https://insights.sbomify.com/CVE-2024-6112/): itsourcecode Pool of Bethesda Online Reservation System index.php sql injection (medium 6.9)
- [CVE-2024-6111](https://insights.sbomify.com/CVE-2024-6111/): itsourcecode Pool of Bethesda Online Reservation System login.php sql injection (medium 6.9)
- [CVE-2024-6110](https://insights.sbomify.com/CVE-2024-6110/): itsourcecode Magbanua Beach Resort Online Reservation System controller.php unrestricted upload (medium 6.9)
- [CVE-2024-6109](https://insights.sbomify.com/CVE-2024-6109/): itsourcecode Tailoring Management System addmeasurement.php sql injection (medium 5.3)
- [CVE-2024-6108](https://insights.sbomify.com/CVE-2024-6108/): Genexis Tilgin Home Gateway Login cross site scripting (medium 6.9)
- [CVE-2024-6107](https://insights.sbomify.com/CVE-2024-6107/): Auth bypass in MAAS (critical 9.6)
- [CVE-2024-6104](https://insights.sbomify.com/CVE-2024-6104/): go-retryablehttp can leak basic auth credentials to log files (medium 6.0)
- [CVE-2024-6103](https://insights.sbomify.com/CVE-2024-6103/): Use after free in Chrome (high 8.8)
- [CVE-2024-6102](https://insights.sbomify.com/CVE-2024-6102/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-6101](https://insights.sbomify.com/CVE-2024-6101/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-6100](https://insights.sbomify.com/CVE-2024-6100/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-6099](https://insights.sbomify.com/CVE-2024-6099/): LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration (medium 5.3)
- [CVE-2024-6098](https://insights.sbomify.com/CVE-2024-6098/): PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling (medium 5.9)
- [CVE-2024-6097](https://insights.sbomify.com/CVE-2024-6097/): Absolute Path Traversal Vulnerability (medium 5.3)
- [CVE-2024-6096](https://insights.sbomify.com/CVE-2024-6096/): Unsafe Deserialization Vulnerability (high 8.8)
- [CVE-2024-6095](https://insights.sbomify.com/CVE-2024-6095/): SSRF and Partial LFI in /models/apply Endpoint in mudler/localai (medium 5.8)
- [CVE-2024-6094](https://insights.sbomify.com/CVE-2024-6094/): WP ULike < 4.7.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6091](https://insights.sbomify.com/CVE-2024-6091/): Shell Command Denylist Bypass in significant-gravitas/autogpt (critical 9.8)
- [CVE-2024-6090](https://insights.sbomify.com/CVE-2024-6090/): Path Traversal Vulnerability in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-6089](https://insights.sbomify.com/CVE-2024-6089/): Rockwell Automation Major nonrecoverable fault in 5015 – AENFTXT (high 8.7)
- [CVE-2024-6088](https://insights.sbomify.com/CVE-2024-6088/): LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Missing Authorization to Unauthenticated User Registration Bypass (medium 5.3)
- [CVE-2024-6087](https://insights.sbomify.com/CVE-2024-6087/): Improper Access Control in lunary-ai/lunary (medium 6.5)
- [CVE-2024-6086](https://insights.sbomify.com/CVE-2024-6086/): Improper Access Control in lunary-ai/lunary (medium 5.3)
- [CVE-2024-6085](https://insights.sbomify.com/CVE-2024-6085/): Path Traversal in parisneo/lollms (high 8.6)
- [CVE-2024-6084](https://insights.sbomify.com/CVE-2024-6084/): itsourcecode Pool of Bethesda Online Reservation System uploadImage unrestricted upload (medium 6.9)
- [CVE-2024-6083](https://insights.sbomify.com/CVE-2024-6083/): PHPVibe Media Upload Page upload-mp3.php unrestricted upload (medium 5.3)
- [CVE-2024-6082](https://insights.sbomify.com/CVE-2024-6082/): PHPVibe Global Options Page functionalities.global.php cross site scripting (medium 5.1)
- [CVE-2024-6080](https://insights.sbomify.com/CVE-2024-6080/): Intelbras InControl incontrolWebcam Service unquoted search path (high 8.5)
- [CVE-2024-6079](https://insights.sbomify.com/CVE-2024-6079/): DLL Hijacking Vulnerability Exists in Rockwell Automation Emulate3D™ (medium 5.4)
- [CVE-2024-6078](https://insights.sbomify.com/CVE-2024-6078/): Rockwell Automation Authentication Bypass Vulnerability in DataMosaix™ (high 8.6)
- [CVE-2024-6077](https://insights.sbomify.com/CVE-2024-6077/): Denial of service in 1756-EN4 (high 8.7)
- [CVE-2024-6076](https://insights.sbomify.com/CVE-2024-6076/): WP eStore < 8.5.5 - Reflected XSS in Category Editing (medium 6.1)
- [CVE-2024-6075](https://insights.sbomify.com/CVE-2024-6075/): WP eStore < 8.5.5 - Coupon Deletion via CSRF (high 8.8)
- [CVE-2024-6074](https://insights.sbomify.com/CVE-2024-6074/): WP eStore < 8.5.5 - Reflected XSS in Customer Editing (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/172/