# Vulnerabilities published in 2024


- [CVE-2024-5966](https://insights.sbomify.com/CVE-2024-5966/): Grey Opaque <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Download-Button Shortcode (medium 6.4)
- [CVE-2024-5965](https://insights.sbomify.com/CVE-2024-5965/): Mosaic <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-5964](https://insights.sbomify.com/CVE-2024-5964/): Zenon Lite <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-5963](https://insights.sbomify.com/CVE-2024-5963/): An unquoted executable path exists in Hitachi Device Manager (medium 6.7)
- [CVE-2024-5962](https://insights.sbomify.com/CVE-2024-5962/): Cross-site scripting in WSO2 API Manager (medium 6.1)
- [CVE-2024-5961](https://insights.sbomify.com/CVE-2024-5961/): Reflected XSS in 2ClickPortal (medium 5.3)
- [CVE-2024-5960](https://insights.sbomify.com/CVE-2024-5960/): Plaintext Storage of a Password in Eliz Software's Panel (critical 9.8)
- [CVE-2024-5959](https://insights.sbomify.com/CVE-2024-5959/): Stored XSS in Eliz Software's Panel (critical 9.3)
- [CVE-2024-5958](https://insights.sbomify.com/CVE-2024-5958/): SQLi in Eliz Software's Panel (critical 9.4)
- [CVE-2024-5957](https://insights.sbomify.com/CVE-2024-5957/): Auth bypass in Intrusion Prevention System (IPS) Manager (medium 6.3)
- [CVE-2024-5956](https://insights.sbomify.com/CVE-2024-5956/): Auth bypass in Intrusion Prevention System (IPS) Manager (medium 6.5)
- [CVE-2024-5955](https://insights.sbomify.com/CVE-2024-5955/): Cross-site scripting in ePO Onprem Sp1 Update4 (medium 5.4)
- [CVE-2024-5953](https://insights.sbomify.com/CVE-2024-5953/): 389-ds-base: malformed userpassword hash may cause denial of service (medium 5.7)
- [CVE-2024-5952](https://insights.sbomify.com/CVE-2024-5952/): Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability (medium 4.3)
- [CVE-2024-5951](https://insights.sbomify.com/CVE-2024-5951/): Deep Sea Electronics DSE855 Factory Reset Missing Authentication Denial-of-Service Vulnerability (high 7.1)
- [CVE-2024-5950](https://insights.sbomify.com/CVE-2024-5950/): Deep Sea Electronics DSE855 Multipart Value Handling Stack-Based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-5949](https://insights.sbomify.com/CVE-2024-5949/): Deep Sea Electronics DSE855 Multipart Boundary Infinite Loop Denial-of-Service Vulnerability (medium 4.3)
- [CVE-2024-5948](https://insights.sbomify.com/CVE-2024-5948/): Deep Sea Electronics DSE855 Multipart Boundary Stack-Based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-5947](https://insights.sbomify.com/CVE-2024-5947/): Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability (medium 6.5)
- [CVE-2024-5946](https://insights.sbomify.com/CVE-2024-5946/): Cross-site scripting in Squelch Tabs and Accordions Shortcodes (medium 6.4)
- [CVE-2024-5945](https://insights.sbomify.com/CVE-2024-5945/): WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG (medium 6.4)
- [CVE-2024-5943](https://insights.sbomify.com/CVE-2024-5943/): Nested Pages <= 3.2.7 - Cross-Site Request Forgery to Local File Inclusion (high 8.8)
- [CVE-2024-5942](https://insights.sbomify.com/CVE-2024-5942/): Page and Post Clone <= 6.0 - Insecure Direct Object Reference to Authenticated (Author+) Sensitive Information Exposure (medium 4.3)
- [CVE-2024-5941](https://insights.sbomify.com/CVE-2024-5941/): Missing authorization in GiveWP – Donation Plugin and Fundraising Platform (medium 5.4)
- [CVE-2024-5940](https://insights.sbomify.com/CVE-2024-5940/): Missing authorization in GiveWP – Donation Plugin and Fundraising Platform (medium 6.5)
- [CVE-2024-5939](https://insights.sbomify.com/CVE-2024-5939/): GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Missing Authorization to Limited Information Exposure (medium 5.3)
- [CVE-2024-5938](https://insights.sbomify.com/CVE-2024-5938/): Boot Store <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-5937](https://insights.sbomify.com/CVE-2024-5937/): Simple Alert Boxes <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Alert Shortcode (medium 6.4)
- [CVE-2024-5936](https://insights.sbomify.com/CVE-2024-5936/): Open Redirect in imartinez/privategpt (medium 4.3)
- [CVE-2024-5935](https://insights.sbomify.com/CVE-2024-5935/): CSRF Vulnerability in imartinez/privategpt (medium 5.4)
- [CVE-2024-5933](https://insights.sbomify.com/CVE-2024-5933/): Cross-site Scripting (XSS) in parisneo/lollms-webui (medium 6.1)
- [CVE-2024-5932](https://insights.sbomify.com/CVE-2024-5932/): Deserialization in GiveWP – Donation Plugin and Fundraising Platform (critical 10.0)
- [CVE-2024-5931](https://insights.sbomify.com/CVE-2024-5931/): BT: Unchecked user input in bap_broadcast_assistant (medium 6.3)
- [CVE-2024-5930](https://insights.sbomify.com/CVE-2024-5930/): VIPRE Advanced Security Incorrect Permission Assignment Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-5929](https://insights.sbomify.com/CVE-2024-5929/): VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-5928](https://insights.sbomify.com/CVE-2024-5928/): VIPRE Advanced Security PMAgent Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-5926](https://insights.sbomify.com/CVE-2024-5926/): Path Traversal in stitionai/devika (critical 9.1)
- [CVE-2024-5925](https://insights.sbomify.com/CVE-2024-5925/): Theron Lite <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-5924](https://insights.sbomify.com/CVE-2024-5924/): Dropbox Desktop Folder Sharing Mark-of-the-Web Bypass Vulnerability (high 8.8)
- [CVE-2024-5922](https://insights.sbomify.com/CVE-2024-5922/): Scylla lite <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-5921](https://insights.sbomify.com/CVE-2024-5921/): GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation (medium 6.0)
- [CVE-2024-5920](https://insights.sbomify.com/CVE-2024-5920/): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in PAN-OS Enables Impersonation of a Legitimate Administrator (medium 4.6)
- [CVE-2024-5919](https://insights.sbomify.com/CVE-2024-5919/): PAN-OS: Authenticated XML External Entities (XXE) Injection Vulnerability (medium 5.1)
- [CVE-2024-5918](https://insights.sbomify.com/CVE-2024-5918/): PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User (medium 5.3)
- [CVE-2024-5917](https://insights.sbomify.com/CVE-2024-5917/): PAN-OS: Server-Side Request Forgery in WildFire (low 2.1)
- [CVE-2024-5916](https://insights.sbomify.com/CVE-2024-5916/): PAN-OS: Cleartext Exposure of External System Secrets (medium 6.0)
- [CVE-2024-5915](https://insights.sbomify.com/CVE-2024-5915/): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (medium 5.2)
- [CVE-2024-5914](https://insights.sbomify.com/CVE-2024-5914/): Cortex XSOAR: Command Injection in CommonScripts Pack (high 7.0)
- [CVE-2024-5913](https://insights.sbomify.com/CVE-2024-5913/): PAN-OS: Improper Input Validation Vulnerability in PAN-OS (medium 6.1)
- [CVE-2024-5912](https://insights.sbomify.com/CVE-2024-5912/): Cortex XDR Agent: Improper File Signature Verification Checks (medium 6.8)
- [CVE-2024-5911](https://insights.sbomify.com/CVE-2024-5911/): PAN-OS: File Upload Vulnerability in the Panorama Web Interface (high 7.0)
- [CVE-2024-5910](https://insights.sbomify.com/CVE-2024-5910/): Palo Alto Networks Expedition Missing Authentication (critical 9.3, exploited in the wild)
- [CVE-2024-5909](https://insights.sbomify.com/CVE-2024-5909/): Cortex XDR Agent: Local Windows User Can Disable the Agent (medium 6.8)
- [CVE-2024-5908](https://insights.sbomify.com/CVE-2024-5908/): GlobalProtect App: Encrypted Credential Exposure via Log Files (medium 5.5)
- [CVE-2024-5907](https://insights.sbomify.com/CVE-2024-5907/): Cortex XDR Agent: Local Privilege Escalation (PE) Vulnerability (medium 5.2)
- [CVE-2024-5906](https://insights.sbomify.com/CVE-2024-5906/): Prisma Cloud Compute: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (medium 4.8)
- [CVE-2024-5905](https://insights.sbomify.com/CVE-2024-5905/): Cortex XDR Agent: Local Windows User Can Disrupt Functionality of the Agent (low 2.0)
- [CVE-2024-5902](https://insights.sbomify.com/CVE-2024-5902/): UserFeedback Lite <= 1.0.15 - Unauthenticated Stored Cross-Site Scripting via Name Parameter (high 7.2)
- [CVE-2024-5901](https://insights.sbomify.com/CVE-2024-5901/): SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget (medium 6.4)
- [CVE-2024-5899](https://insights.sbomify.com/CVE-2024-5899/): Improper trust check in Bazel Build intellij plugin (low 1.0)
- [CVE-2024-5898](https://insights.sbomify.com/CVE-2024-5898/): itsourcecode Payroll Management System print_payroll.php sql injection (medium 5.3)
- [CVE-2024-5897](https://insights.sbomify.com/CVE-2024-5897/): SourceCodester Employee and Visitor Gate Pass Logging System cross site scripting (medium 6.9)
- [CVE-2024-5896](https://insights.sbomify.com/CVE-2024-5896/): SourceCodester Employee and Visitor Gate Pass Logging System save_users sql injection (medium 6.9)
- [CVE-2024-5895](https://insights.sbomify.com/CVE-2024-5895/): SourceCodester Employee and Visitor Gate Pass Logging System delete_users sql injection (medium 5.3)
- [CVE-2024-5894](https://insights.sbomify.com/CVE-2024-5894/): SourceCodester Online Eyewear Shop manage_product.php sql injection (medium 6.9)
- [CVE-2024-5893](https://insights.sbomify.com/CVE-2024-5893/): SourceCodester Cab Management System sql injection (medium 5.3)
- [CVE-2024-5892](https://insights.sbomify.com/CVE-2024-5892/): Cross-site scripting in Divi Torque Lite – Divi Theme, Divi Builder & Extra Theme (medium 6.4)
- [CVE-2024-5891](https://insights.sbomify.com/CVE-2024-5891/): Quay: unauthorized user may authenticate via oauth application token (medium 4.2)
- [CVE-2024-5890](https://insights.sbomify.com/CVE-2024-5890/): HTML Injection in the Assessment plugin (medium 5.1)
- [CVE-2024-5889](https://insights.sbomify.com/CVE-2024-5889/): Events Manager <= 6.4.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-5888](https://insights.sbomify.com/CVE-2024-5888/): Stored XSS in Rest Services API for a Toolbox published as GP Service (medium 4.8)
- [CVE-2024-5885](https://insights.sbomify.com/CVE-2024-5885/): Server-Side Request Forgery (SSRF) in stangirard/quivr (high 8.6)
- [CVE-2024-5884](https://insights.sbomify.com/CVE-2024-5884/): Beauty <= 1.1.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via tpl_featured_cat_id Parameter (medium 6.4)
- [CVE-2024-5883](https://insights.sbomify.com/CVE-2024-5883/): Ultimate Classified Listings < 1.3 - Reflected XSS (medium 4.7)
- [CVE-2024-5882](https://insights.sbomify.com/CVE-2024-5882/): Ultimate Classified Listings < 1.3 - Unauthenticated LFI (high 7.5)
- [CVE-2024-5881](https://insights.sbomify.com/CVE-2024-5881/): Cross-site scripting in Webico Slider Flatsome Addons (medium 6.4)
- [CVE-2024-5880](https://insights.sbomify.com/CVE-2024-5880/): Hide My Site <= 2.2 - Unauthenticated Information Exposure (medium 4.3)
- [CVE-2024-5879](https://insights.sbomify.com/CVE-2024-5879/): Cross-site scripting in HubSpot All-In-One Marketing – Forms, Popups, Live Chat (medium 6.4)
- [CVE-2024-5878](https://insights.sbomify.com/CVE-2024-5878/): Cross-site scripting in Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery (medium 6.4)
- [CVE-2024-5877](https://insights.sbomify.com/CVE-2024-5877/): IrfanView PIC File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-5876](https://insights.sbomify.com/CVE-2024-5876/): IrfanView PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-5875](https://insights.sbomify.com/CVE-2024-5875/): IrfanView SHP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-5874](https://insights.sbomify.com/CVE-2024-5874/): IrfanView PNT File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-5872](https://insights.sbomify.com/CVE-2024-5872/): Other in EOS (medium 6.5)
- [CVE-2024-5871](https://insights.sbomify.com/CVE-2024-5871/): WooCommerce - Social Login <= 2.6.2 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2024-5870](https://insights.sbomify.com/CVE-2024-5870/): Tweaker5 <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-5869](https://insights.sbomify.com/CVE-2024-5869/): Neighborly <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-5868](https://insights.sbomify.com/CVE-2024-5868/): WooCommerce - Social Login <= 2.6.2 - Email Verification due to Insufficient Randomness (medium 6.5)
- [CVE-2024-5867](https://insights.sbomify.com/CVE-2024-5867/): Delicate <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Shortcode (medium 6.4)
- [CVE-2024-5866](https://insights.sbomify.com/CVE-2024-5866/): Arbitrary Directory Listing in Centrify PAS (medium 5.0)
- [CVE-2024-5865](https://insights.sbomify.com/CVE-2024-5865/): Arbitrary File Reading in Centrify PAS (high 7.7)
- [CVE-2024-5864](https://insights.sbomify.com/CVE-2024-5864/): Easy Affiliate Links <= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (medium 4.3)
- [CVE-2024-5863](https://insights.sbomify.com/CVE-2024-5863/): Easy Image Collage <= 1.13.5 - Missing Authorization to Authenticated (Contributor+) Data Clearance (medium 5.4)
- [CVE-2024-5862](https://insights.sbomify.com/CVE-2024-5862/): User Enumeration in Mia Technology's Mia-Med Health Aplication (high 7.5)
- [CVE-2024-5861](https://insights.sbomify.com/CVE-2024-5861/): WP Easy Pay (Free) <= 4.2.3 - Missing Authorization to Unauthenticated Service Disconnection (medium 5.3)
- [CVE-2024-5860](https://insights.sbomify.com/CVE-2024-5860/): Tickera <= 3.5.2.8 - Missing Authorization to Authenticated (Susbcriber+) Ticket Deletion (medium 4.3)
- [CVE-2024-5859](https://insights.sbomify.com/CVE-2024-5859/): Appointment Booking and Online Scheduling <= 4.4.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-5858](https://insights.sbomify.com/CVE-2024-5858/): Infographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update (medium 4.3)
- [CVE-2024-5857](https://insights.sbomify.com/CVE-2024-5857/): Missing authorization in Interactive Contact Form and Multi Step Form Builder with Drag & Drop Editor – Funnelforms Free (medium 5.3)
- [CVE-2024-5856](https://insights.sbomify.com/CVE-2024-5856/): Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/174/