# Vulnerabilities published in 2024


- [CVE-2024-6073](https://insights.sbomify.com/CVE-2024-6073/): WP eStore < 8.5.5 - Reflected XSS in Discount Editing (medium 4.7)
- [CVE-2024-6072](https://insights.sbomify.com/CVE-2024-6072/): WP eStore < 8.5.5 - Reflected XSS via $_SERVER['REQUEST_URI'] (medium 6.1)
- [CVE-2024-6071](https://insights.sbomify.com/CVE-2024-6071/): PTC Creo Elements/Direct License Server Missing Authorization (critical 10.0)
- [CVE-2024-6070](https://insights.sbomify.com/CVE-2024-6070/): if-so < 1.8.0.4 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6069](https://insights.sbomify.com/CVE-2024-6069/): Pie Register - Basic <= 3.8.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation (high 8.8)
- [CVE-2024-6068](https://insights.sbomify.com/CVE-2024-6068/): Input Validation Vulnerability exists in Arena® Input Analyzer (high 7.0)
- [CVE-2024-6067](https://insights.sbomify.com/CVE-2024-6067/): SourceCodester Music Class Enrollment System sql injection (medium 5.3)
- [CVE-2024-6066](https://insights.sbomify.com/CVE-2024-6066/): SourceCodester Best House Rental Management System payment_report.php sql injection (medium 5.3)
- [CVE-2024-6065](https://insights.sbomify.com/CVE-2024-6065/): itsourcecode Bakery Online Ordering System index.php sql injection (medium 6.9)
- [CVE-2024-6064](https://insights.sbomify.com/CVE-2024-6064/): GPAC MP4Box loader_xmt.c xmt_node_end use after free (medium 4.8)
- [CVE-2024-6063](https://insights.sbomify.com/CVE-2024-6063/): GPAC MP4Box dmx_m2ts.c m2tsdmx_on_event null pointer dereference (medium 4.8)
- [CVE-2024-6062](https://insights.sbomify.com/CVE-2024-6062/): GPAC MP4Box load_text.c swf_svg_add_iso_sample null pointer dereference (medium 4.8)
- [CVE-2024-6061](https://insights.sbomify.com/CVE-2024-6061/): GPAC MP4Box isoffin_read.c isoffin_process infinite loop (medium 4.8)
- [CVE-2024-6060](https://insights.sbomify.com/CVE-2024-6060/): Information disclosure in Webscopes (critical 9.3)
- [CVE-2024-6059](https://insights.sbomify.com/CVE-2024-6059/): Ingenico Estate Manager News Feed messages cross site scripting (medium 5.1)
- [CVE-2024-6058](https://insights.sbomify.com/CVE-2024-6058/): LabVantage LIMS cross site scripting (medium 5.3)
- [CVE-2024-6057](https://insights.sbomify.com/CVE-2024-6057/): Auth bypass in Remote Desktop Manager (critical 9.8)
- [CVE-2024-6056](https://insights.sbomify.com/CVE-2024-6056/): nasirkhan Laravel Starter Password Reset forgot-password observable response discrepancy (medium 6.3)
- [CVE-2024-6055](https://insights.sbomify.com/CVE-2024-6055/): Information disclosure in Remote Desktop Manager (medium 4.7)
- [CVE-2024-6054](https://insights.sbomify.com/CVE-2024-6054/): Auto Featured Image <= 1.2 - Authenticated (Contributor+) Arbitrary File Upload (high 8.8)
- [CVE-2024-6053](https://insights.sbomify.com/CVE-2024-6053/): Improper access control in the clipboard synchronization feature (medium 4.3)
- [CVE-2024-6052](https://insights.sbomify.com/CVE-2024-6052/): XSS in SQL check parameters (medium 6.5)
- [CVE-2024-6051](https://insights.sbomify.com/CVE-2024-6051/): Cross Application Scripting in Redlink SDK (medium 4.3)
- [CVE-2024-6050](https://insights.sbomify.com/CVE-2024-6050/): Reflected XSS in SOWA OPAC (medium 5.3)
- [CVE-2024-6049](https://insights.sbomify.com/CVE-2024-6049/): Unauthenticated Path Traversal (high 7.5)
- [CVE-2024-6048](https://insights.sbomify.com/CVE-2024-6048/): Openfind MailGates and MailAudit - OS Command Injection (critical 9.8)
- [CVE-2024-6047](https://insights.sbomify.com/CVE-2024-6047/): GeoVision Devices OS Command Injection (critical 9.8, exploited in the wild)
- [CVE-2024-6045](https://insights.sbomify.com/CVE-2024-6045/): D-Link router - Hidden Backdoor (high 8.8)
- [CVE-2024-6044](https://insights.sbomify.com/CVE-2024-6044/): D-Link router - Arbitrary File Reading (medium 6.5)
- [CVE-2024-6043](https://insights.sbomify.com/CVE-2024-6043/): SourceCodester Best House Rental Management System admin_class.php login sql injection (medium 6.9)
- [CVE-2024-6042](https://insights.sbomify.com/CVE-2024-6042/): itsourcecode Real Estate Management System property-detail.php sql injection (medium 6.9)
- [CVE-2024-6041](https://insights.sbomify.com/CVE-2024-6041/): itsourcecode Gym Management System manage_user.php sql injection (medium 5.3)
- [CVE-2024-6040](https://insights.sbomify.com/CVE-2024-6040/): Missing client_id in parisneo/lollms-webui (medium 4.4)
- [CVE-2024-6039](https://insights.sbomify.com/CVE-2024-6039/): Feng Office Workspaces sql injection (medium 5.3)
- [CVE-2024-6038](https://insights.sbomify.com/CVE-2024-6038/): ReDoS Vulnerability in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-6037](https://insights.sbomify.com/CVE-2024-6037/): Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-6036](https://insights.sbomify.com/CVE-2024-6036/): Denial of Service in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-6035](https://insights.sbomify.com/CVE-2024-6035/): Stored XSS in gaizhenbiao/chuanhuchatgpt (high 7.4)
- [CVE-2024-6033](https://insights.sbomify.com/CVE-2024-6033/): Missing authorization in Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) (medium 4.3)
- [CVE-2024-6032](https://insights.sbomify.com/CVE-2024-6032/): Tesla Model S Iris Modem ql_atfwd Command Injection Code Execution Vulnerability (high 7.8)
- [CVE-2024-6031](https://insights.sbomify.com/CVE-2024-6031/): Tesla Model S oFono AT Command Heap-based Buffer Overflow Code Execution Vulnerability (high 7.8)
- [CVE-2024-6030](https://insights.sbomify.com/CVE-2024-6030/): Tesla Model S oFono Unnecessary Privileges Sandbox Escape Vulnerability (high 7.0)
- [CVE-2024-6029](https://insights.sbomify.com/CVE-2024-6029/): Tesla Model S Iris Modem Race Condition Firewall Bypass Vulnerability (medium 5.0)
- [CVE-2024-6028](https://insights.sbomify.com/CVE-2024-6028/): Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter (critical 9.8)
- [CVE-2024-6027](https://insights.sbomify.com/CVE-2024-6027/): Themify - WooCommerce Product Filter <= 1.4.9 - Unauthenticated SQL Injection via conditions Parameter (critical 9.8)
- [CVE-2024-6026](https://insights.sbomify.com/CVE-2024-6026/): Slider by 10Web < 1.2.56 - Editor+ Stored XSS (medium 6.1)
- [CVE-2024-6025](https://insights.sbomify.com/CVE-2024-6025/): Quiz and Survey Master < 9.0.5 - Contributor+ Stored XSS (medium 6.5)
- [CVE-2024-6024](https://insights.sbomify.com/CVE-2024-6024/): ContentLock <= 1.0.3 - Groups/Emails Deletion via CSRF (high 8.8)
- [CVE-2024-6023](https://insights.sbomify.com/CVE-2024-6023/): ContentLock <= 1.0.3 - Email Adding via CSRF (high 8.8)
- [CVE-2024-6022](https://insights.sbomify.com/CVE-2024-6022/): ContentLock <= 1.0.3 - Settings Update via CSRF (high 8.8)
- [CVE-2024-6021](https://insights.sbomify.com/CVE-2024-6021/): Donation Block for PayPal <= 2.1.0 - Unauthenticated Stored XSS (medium 6.8)
- [CVE-2024-6020](https://insights.sbomify.com/CVE-2024-6020/): Sign-up Sheets < 2.2.13 - Reflected XSS (medium 6.1)
- [CVE-2024-6019](https://insights.sbomify.com/CVE-2024-6019/): Music Request Manager <= 1.3 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-6018](https://insights.sbomify.com/CVE-2024-6018/): Music Request Manager <= 1.3 - Reflected XSS (medium 6.1)
- [CVE-2024-6017](https://insights.sbomify.com/CVE-2024-6017/): Music Request Manager <= 1.3 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-6016](https://insights.sbomify.com/CVE-2024-6016/): itsourcecode Online Laundry Management System admin_class.php sql injection (medium 5.3)
- [CVE-2024-6015](https://insights.sbomify.com/CVE-2024-6015/): itsourcecode Online House Rental System manage_user.php sql injection (medium 5.3)
- [CVE-2024-6014](https://insights.sbomify.com/CVE-2024-6014/): itsourcecode Document Management System edithis.php sql injection (medium 5.3)
- [CVE-2024-6013](https://insights.sbomify.com/CVE-2024-6013/): itsourcecode Online Book Store admin_delete.php sql injection (medium 5.3)
- [CVE-2024-6012](https://insights.sbomify.com/CVE-2024-6012/): Cost Calculator Builder <= 3.2.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Creation (medium 4.3)
- [CVE-2024-6011](https://insights.sbomify.com/CVE-2024-6011/): Cost Calculator Builder <= 3.2.12 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-6010](https://insights.sbomify.com/CVE-2024-6010/): Cost Calculator Builder PRO <= 3.2.1 - Unauthenticated Price Manipulation (medium 5.3)
- [CVE-2024-6009](https://insights.sbomify.com/CVE-2024-6009/): itsourcecode Event Calendar process.php regDelete sql injection (medium 5.3)
- [CVE-2024-6008](https://insights.sbomify.com/CVE-2024-6008/): itsourcecode Online Book Store edit_book.php sql injection (medium 5.3)
- [CVE-2024-6007](https://insights.sbomify.com/CVE-2024-6007/): Netentsec NS-ASG Application Security Gateway deleteiscgwrouteconf.php sql injection (medium 5.3)
- [CVE-2024-6006](https://insights.sbomify.com/CVE-2024-6006/): ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting (medium 5.1)
- [CVE-2024-6005](https://insights.sbomify.com/CVE-2024-6005/): ZKTeco ZKBio CVSecurity V5000 Department Section cross site scripting (medium 5.1)
- [CVE-2024-6004](https://insights.sbomify.com/CVE-2024-6004/): Denial of service in Printers (medium 6.5)
- [CVE-2024-6003](https://insights.sbomify.com/CVE-2024-6003/): Guangdong Baolun Electronics IP Network Broadcasting Service Platform maps sql injection (medium 6.9)
- [CVE-2024-6001](https://insights.sbomify.com/CVE-2024-6001/): Security feature bypass in Accessories and Display Manager (high 8.1)
- [CVE-2024-6000](https://insights.sbomify.com/CVE-2024-6000/): FooEvents for WooCommerce <= 1.19.20 - Improper Authorization to (Contributor+) Arbitrary File Upload (high 7.1)
- [CVE-2024-5998](https://insights.sbomify.com/CVE-2024-5998/): Deserialization of Untrusted Data in langchain-ai/langchain (medium 5.2)
- [CVE-2024-5997](https://insights.sbomify.com/CVE-2024-5997/): Duplica <= 0.6 - Authenticated (Subscriber+) Missing Authorization to Users/Posts Duplicates Creation (medium 4.3)
- [CVE-2024-5995](https://insights.sbomify.com/CVE-2024-5995/): Soar Cloud HR Portal - Insufficient Session Expiration (high 8.8)
- [CVE-2024-5994](https://insights.sbomify.com/CVE-2024-5994/): WP Go Maps (formerly WP Google Maps) <= 9.0.38 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-5993](https://insights.sbomify.com/CVE-2024-5993/): Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Authorized (Subscriber+) Chatbot Settings Update (medium 5.4)
- [CVE-2024-5992](https://insights.sbomify.com/CVE-2024-5992/): Cliengo - Chatbot <= 3.0.2 - Missing Authorization to Unauthenticated Chatbot Settings Update (medium 6.5)
- [CVE-2024-5991](https://insights.sbomify.com/CVE-2024-5991/): Buffer overread in domain name matching (critical 10.0)
- [CVE-2024-5990](https://insights.sbomify.com/CVE-2024-5990/): ThinManager® ThinServer™ Improper Input Validation Vulnerability (high 8.7)
- [CVE-2024-5989](https://insights.sbomify.com/CVE-2024-5989/): Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability (critical 9.3)
- [CVE-2024-5988](https://insights.sbomify.com/CVE-2024-5988/): Rockwell Automation ThinManager® ThinServer™ Improper Input Validation Vulnerability (critical 9.3)
- [CVE-2024-5987](https://insights.sbomify.com/CVE-2024-5987/): WP Accessibility Helper <= 0.6.2.8 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update (medium 5.4)
- [CVE-2024-5986](https://insights.sbomify.com/CVE-2024-5986/): Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3 (critical 9.1)
- [CVE-2024-5985](https://insights.sbomify.com/CVE-2024-5985/): SourceCodester Best Online News Portal index.php sql injection (medium 5.3)
- [CVE-2024-5984](https://insights.sbomify.com/CVE-2024-5984/): itsourcecode Online Bookstore book.php sql injection (medium 6.9)
- [CVE-2024-5983](https://insights.sbomify.com/CVE-2024-5983/): itsourcecode Online Bookstore bookPerPub.php sql injection (medium 6.9)
- [CVE-2024-5982](https://insights.sbomify.com/CVE-2024-5982/): Path Traversal in gaizhenbiao/chuanhuchatgpt (critical 9.1)
- [CVE-2024-5981](https://insights.sbomify.com/CVE-2024-5981/): itsourcecode Online House Rental System manage_user.php sql injection (medium 5.3)
- [CVE-2024-5980](https://insights.sbomify.com/CVE-2024-5980/): Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightning (critical 9.1)
- [CVE-2024-5979](https://insights.sbomify.com/CVE-2024-5979/): Denial of Service via Invalid Argument in h2oai/h2o-3 (high 7.5)
- [CVE-2024-5977](https://insights.sbomify.com/CVE-2024-5977/): Missing authorization in GiveWP – Donation Plugin and Fundraising Platform (medium 5.4)
- [CVE-2024-5976](https://insights.sbomify.com/CVE-2024-5976/): SourceCodester Employee and Visitor Gate Pass Logging System log_employee sql injection (medium 6.9)
- [CVE-2024-5975](https://insights.sbomify.com/CVE-2024-5975/): CZ Loan Management <= 1.1 - Unauthenticated SQLi (critical 9.1)
- [CVE-2024-5974](https://insights.sbomify.com/CVE-2024-5974/): Firebox Authenticated Buffer Overflow Vulnerability (high 8.6)
- [CVE-2024-5973](https://insights.sbomify.com/CVE-2024-5973/): MasterStudy LMS < 3.3.24 - Privilege Escalation to Instructor (critical 9.1)
- [CVE-2024-5971](https://insights.sbomify.com/CVE-2024-5971/): Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket (high 7.5)
- [CVE-2024-5970](https://insights.sbomify.com/CVE-2024-5970/): MaxGalleria <= 6.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via maxgallery_thumb Shortcode (medium 6.4)
- [CVE-2024-5969](https://insights.sbomify.com/CVE-2024-5969/): AIomatic - Automatic AI Content Writer <= 2.0.5 - Unauthenticated Arbitrary Email Sending (medium 5.8)
- [CVE-2024-5968](https://insights.sbomify.com/CVE-2024-5968/): Photo Gallery by 10Web <= 1.8.27 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-5967](https://insights.sbomify.com/CVE-2024-5967/): Keycloak: leak of configured ldap bind credentials through the keycloak admin console (low 2.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/173/