# Vulnerabilities published in 2024


- [CVE-2024-58304](https://insights.sbomify.com/CVE-2024-58304/): SPA-CART CMS < 2.0.0 Stored Cross-Site Scripting (medium 5.3)
- [CVE-2024-58303](https://insights.sbomify.com/CVE-2024-58303/): FoF Pretty Mail 1.1.2 Server Side Template Injection via Email Template Settings (high 8.6)
- [CVE-2024-58302](https://insights.sbomify.com/CVE-2024-58302/): FoF Pretty Mail 1.1.2 Local File Inclusion via Email Template Settings (medium 6.9)
- [CVE-2024-58301](https://insights.sbomify.com/CVE-2024-58301/): Purei CMS 1.0 SQL Injection via Multiple Vulnerable Endpoints (critical 9.3)
- [CVE-2024-58300](https://insights.sbomify.com/CVE-2024-58300/): Siklu MultiHaul TG Series <= 2.0.0 Unauthenticated Credential Disclosure Vulnerability (high 8.7)
- [CVE-2024-5830](https://insights.sbomify.com/CVE-2024-5830/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-58299](https://insights.sbomify.com/CVE-2024-58299/): PCMan FTP Server 2.0 Remote Buffer Overflow via 'pwd' Command (critical 9.3)
- [CVE-2024-58298](https://insights.sbomify.com/CVE-2024-58298/): Compuware iStrobe Web 20.13 Pre-Auth Remote Code Execution via File Upload (critical 9.2)
- [CVE-2024-58297](https://insights.sbomify.com/CVE-2024-58297/): PyroCMS v3.0.1 Stored Cross-Site Scripting via Admin Redirects (medium 5.3)
- [CVE-2024-58296](https://insights.sbomify.com/CVE-2024-58296/): CE Phoenix v1.0.8.20 Stored Cross-Site Scripting via admin/currencies.php (medium 5.3)
- [CVE-2024-58295](https://insights.sbomify.com/CVE-2024-58295/): ElkArte Forum 1.1.9 Authenticated Remote Code Execution via Theme Upload (high 8.6)
- [CVE-2024-58294](https://insights.sbomify.com/CVE-2024-58294/): FreePBX 16 Authenticated Remote Code Execution via API Module (high 8.7)
- [CVE-2024-58293](https://insights.sbomify.com/CVE-2024-58293/): Akaunting 3.1.8 Server-Side Template Injection via Multiple Form Fields (high 8.6)
- [CVE-2024-58292](https://insights.sbomify.com/CVE-2024-58292/): XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates (medium 5.3)
- [CVE-2024-58291](https://insights.sbomify.com/CVE-2024-58291/): Flatboard 3.2 Authenticated Stored Cross-Site Scripting via Forum Information Field (medium 5.3)
- [CVE-2024-58290](https://insights.sbomify.com/CVE-2024-58290/): Xhibiter NFT Marketplace 1.10.2 SQL Injection via Collections Endpoint (critical 9.3)
- [CVE-2024-5829](https://insights.sbomify.com/CVE-2024-5829/): smallweigit Avue avueUeditor cross site scripting (medium 5.3)
- [CVE-2024-58289](https://insights.sbomify.com/CVE-2024-58289/): Microweber 2.0.15 Stored Cross-Site Scripting via User Profile Fields (medium 5.3)
- [CVE-2024-58288](https://insights.sbomify.com/CVE-2024-58288/): Genexus Protection Server 9.7.2.10 Unquoted Service Path Privilege Escalation (high 8.7)
- [CVE-2024-58287](https://insights.sbomify.com/CVE-2024-58287/): reNgine 2.2.0 Authenticated Command Injection via Scan Engine Configuration (high 8.7)
- [CVE-2024-58286](https://insights.sbomify.com/CVE-2024-58286/): dizqueTV 1.5.3 Remote Code Execution via FFMPEG Executable Path (critical 9.3)
- [CVE-2024-58285](https://insights.sbomify.com/CVE-2024-58285/): Chyrp 2.5.2 Stored Cross-Site Scripting Vulnerability via Post Title (medium 5.3)
- [CVE-2024-58284](https://insights.sbomify.com/CVE-2024-58284/): PopojiCMS 2.0.1 Remote Command Execution via Authenticated Metadata Settings (high 8.6)
- [CVE-2024-58283](https://insights.sbomify.com/CVE-2024-58283/): WBCE CMS 1.6.2 Remote Code Execution via Elfinder File Upload (high 8.7)
- [CVE-2024-58282](https://insights.sbomify.com/CVE-2024-58282/): Serendipity 2.5.0 Remote Code Execution via Authenticated Media Upload (high 8.6)
- [CVE-2024-58281](https://insights.sbomify.com/CVE-2024-58281/): Dotclear 2.29 Remote Code Execution via Authenticated File Upload (high 8.7)
- [CVE-2024-58280](https://insights.sbomify.com/CVE-2024-58280/): CMSimple 5.15 Remote Command Execution via Extensions Configuration (high 8.6)
- [CVE-2024-5828](https://insights.sbomify.com/CVE-2024-5828/): EL Injection Vulnerability in Hitachi Tuning Manager (high 8.6)
- [CVE-2024-58279](https://insights.sbomify.com/CVE-2024-58279/): appRain CMF 4.0.5 Authenticated Remote Code Execution via Filemanager Upload (high 8.6)
- [CVE-2024-58278](https://insights.sbomify.com/CVE-2024-58278/): IndigoSTAR Software - perl2exe <= V30.10C - Arbitrary Code Execution (high 8.5)
- [CVE-2024-58277](https://insights.sbomify.com/CVE-2024-58277/): R Radio Network FM Transmitter 1.07 System Settings Disclosure (high 8.7)
- [CVE-2024-58276](https://insights.sbomify.com/CVE-2024-58276/): Obi08-Enrollment System 1.0 get_subject.php SQL Injection (high 8.7)
- [CVE-2024-58275](https://insights.sbomify.com/CVE-2024-58275/): Easywall 0.3.1 - Authenticated Command Injection in /ports-save Endpoint (high 8.7)
- [CVE-2024-58274](https://insights.sbomify.com/CVE-2024-58274/): Command injection in CSMP iSecure Center (high 8.3)
- [CVE-2024-58273](https://insights.sbomify.com/CVE-2024-58273/): Nagios Log Server < 2024R1.0.2 LPE from Apache/Backend Shell User to Root (high 8.5)
- [CVE-2024-5827](https://insights.sbomify.com/CVE-2024-5827/): Arbitrary File Write by Prompt Injection via DuckDB SQL in vanna-ai/vanna (critical 9.8)
- [CVE-2024-58269](https://insights.sbomify.com/CVE-2024-58269/): Rancher exposes sensitive information through audit logs (medium 4.3)
- [CVE-2024-58267](https://insights.sbomify.com/CVE-2024-58267/): Rancher CLI SAML authentication is vulnerable to phishing attacks (high 8.0)
- [CVE-2024-58266](https://insights.sbomify.com/CVE-2024-58266/): Multiple issues involving quote API in shlex (low 3.2)
- [CVE-2024-58265](https://insights.sbomify.com/CVE-2024-58265/): Unauthenticated Nonce Increment in snow (low 3.1)
- [CVE-2024-58264](https://insights.sbomify.com/CVE-2024-58264/): serde-json-wasm stack overflow during recursive JSON parsing (low 3.2)
- [CVE-2024-58263](https://insights.sbomify.com/CVE-2024-58263/): CosmWasm affected by arithmetic overflows (low 3.7)
- [CVE-2024-58262](https://insights.sbomify.com/CVE-2024-58262/): curve25519-dalek has timing variability in `curve25519-dalek`'s `Scalar29::sub`/`Scalar52::sub` (low 2.9)
- [CVE-2024-58261](https://insights.sbomify.com/CVE-2024-58261/): Low severity (DoS) vulnerability in sequoia-openpgp (low 2.9)
- [CVE-2024-58260](https://insights.sbomify.com/CVE-2024-58260/): Rancher update on users can deny the service to the admin (high 7.6)
- [CVE-2024-5826](https://insights.sbomify.com/CVE-2024-5826/): Remote Code Execution via Prompt Injection in vanna-ai/vanna (critical 9.8)
- [CVE-2024-58259](https://insights.sbomify.com/CVE-2024-58259/): Rancher affected by unauthenticated Denial of Service (high 8.2)
- [CVE-2024-58258](https://insights.sbomify.com/CVE-2024-58258/): Server-side request forgery in SugarCRM (high 7.2)
- [CVE-2024-58257](https://insights.sbomify.com/CVE-2024-58257/): Command injection in EnzoH-W5611T (medium 5.7)
- [CVE-2024-58256](https://insights.sbomify.com/CVE-2024-58256/): Command injection in EnzoH-W5611T (medium 4.5)
- [CVE-2024-58255](https://insights.sbomify.com/CVE-2024-58255/): Command injection in EnzoH-W5611T (medium 5.0)
- [CVE-2024-58253](https://insights.sbomify.com/CVE-2024-58253/): obfstr Type Confusion vulnerability (low 2.9)
- [CVE-2024-58252](https://insights.sbomify.com/CVE-2024-58252/): Information disclosure in HarmonyOS (medium 6.2)
- [CVE-2024-58251](https://insights.sbomify.com/CVE-2024-58251/): Denial of service in BusyBox (low 2.5)
- [CVE-2024-58250](https://insights.sbomify.com/CVE-2024-58250/): Privilege escalation in ppp (critical 9.3)
- [CVE-2024-58249](https://insights.sbomify.com/CVE-2024-58249/): Denial of service in wxWidgets (low 3.7)
- [CVE-2024-58248](https://insights.sbomify.com/CVE-2024-58248/): Race condition in nopCommerce (low 3.5)
- [CVE-2024-58241](https://insights.sbomify.com/CVE-2024-58241/): Bluetooth: hci_core: Disable works on hci_unregister_dev (high 7.8)
- [CVE-2024-58240](https://insights.sbomify.com/CVE-2024-58240/): tls: separate no-async decryption request handling from async (critical 9.8)
- [CVE-2024-5824](https://insights.sbomify.com/CVE-2024-5824/): Path Traversal in parisneo/lollms (high 7.4)
- [CVE-2024-58239](https://insights.sbomify.com/CVE-2024-58239/): tls: stop recv() if initial process_rx_list gave us non-DATA (high 8.2)
- [CVE-2024-58238](https://insights.sbomify.com/CVE-2024-58238/): Bluetooth: btnxpuart: Resolve TX timeout error in power save stress test (high 7.1)
- [CVE-2024-58237](https://insights.sbomify.com/CVE-2024-58237/): bpf: consider that tail calls invalidate packet pointers (high 7.8)
- [CVE-2024-5823](https://insights.sbomify.com/CVE-2024-5823/): File Overwrite Vulnerability in gaizhenbiao/chuanhuchatgpt (medium 6.5)
- [CVE-2024-5822](https://insights.sbomify.com/CVE-2024-5822/): Server-Side Request Forgery (SSRF) in gaizhenbiao/ChuanhuChatGPT (high 7.3)
- [CVE-2024-5821](https://insights.sbomify.com/CVE-2024-5821/): Local File Inclusion (LFI) in stitionai/devika (medium 6.2)
- [CVE-2024-5820](https://insights.sbomify.com/CVE-2024-5820/): Unprotected WebSocket in stitionai/devika (high 7.6)
- [CVE-2024-5819](https://insights.sbomify.com/CVE-2024-5819/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-5818](https://insights.sbomify.com/CVE-2024-5818/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2024-5817](https://insights.sbomify.com/CVE-2024-5817/): Improper authorization allows read access to issue content in GitHub Enterprise Server (medium 5.9)
- [CVE-2024-5816](https://insights.sbomify.com/CVE-2024-5816/): Improper authorization allows persistent access in GitHub Enterprise Server (medium 6.9)
- [CVE-2024-5815](https://insights.sbomify.com/CVE-2024-5815/): Cross Site Request Forgery was identified in GitHub Enterprise Server that allowed write in a user owned repository (medium 6.8)
- [CVE-2024-5814](https://insights.sbomify.com/CVE-2024-5814/): Unverifed Ciphersuite used on a client-side TLS1.3 Downgrade (medium 5.1)
- [CVE-2024-58136](https://insights.sbomify.com/CVE-2024-58136/): Yiiframework Yii Improper Protection of Alternate Path (critical 9.0, exploited in the wild)
- [CVE-2024-58135](https://insights.sbomify.com/CVE-2024-58135/): Weak cryptography in Mojolicious (medium 5.3)
- [CVE-2024-58134](https://insights.sbomify.com/CVE-2024-58134/): Weak cryptography in Mojolicious (high 8.1)
- [CVE-2024-58133](https://insights.sbomify.com/CVE-2024-58133/): Race condition in chainmaker-go (medium 4.0)
- [CVE-2024-58132](https://insights.sbomify.com/CVE-2024-58132/): Race condition in chainmaker-go (medium 4.0)
- [CVE-2024-58131](https://insights.sbomify.com/CVE-2024-58131/): Race condition in FISCO-BCOS (medium 4.0)
- [CVE-2024-58130](https://insights.sbomify.com/CVE-2024-58130/): Cross-site scripting in MISP (high 7.2)
- [CVE-2024-5813](https://insights.sbomify.com/CVE-2024-5813/): SSH Private Key Leak in BeyondInsight PasswordSafe (medium 5.9)
- [CVE-2024-58129](https://insights.sbomify.com/CVE-2024-58129/): Cross-site scripting in MISP (medium 5.5)
- [CVE-2024-58128](https://insights.sbomify.com/CVE-2024-58128/): Cross-site scripting in MISP (medium 5.5)
- [CVE-2024-58127](https://insights.sbomify.com/CVE-2024-58127/): Auth bypass in EMUI (high 8.4)
- [CVE-2024-58126](https://insights.sbomify.com/CVE-2024-58126/): Auth bypass in EMUI (high 8.4)
- [CVE-2024-58125](https://insights.sbomify.com/CVE-2024-58125/): Auth bypass in EMUI (high 8.4)
- [CVE-2024-58124](https://insights.sbomify.com/CVE-2024-58124/): Auth bypass in EMUI (high 8.4)
- [CVE-2024-5812](https://insights.sbomify.com/CVE-2024-5812/): Smart Rule Overwrite Bypass in BeyondInsight PasswordSafe (low 3.3)
- [CVE-2024-58117](https://insights.sbomify.com/CVE-2024-58117/): Memory corruption in HarmonyOS (medium 4.0)
- [CVE-2024-58116](https://insights.sbomify.com/CVE-2024-58116/): Memory corruption in HarmonyOS (medium 4.0)
- [CVE-2024-58115](https://insights.sbomify.com/CVE-2024-58115/): Memory corruption in HarmonyOS (medium 4.0)
- [CVE-2024-58114](https://insights.sbomify.com/CVE-2024-58114/): Denial of service in HarmonyOS (medium 4.0)
- [CVE-2024-58113](https://insights.sbomify.com/CVE-2024-58113/): Denial of service in HarmonyOS (medium 5.3)
- [CVE-2024-58112](https://insights.sbomify.com/CVE-2024-58112/): Denial of service in HarmonyOS (high 7.5)
- [CVE-2024-58111](https://insights.sbomify.com/CVE-2024-58111/): Denial of service in HarmonyOS (high 7.5)
- [CVE-2024-58110](https://insights.sbomify.com/CVE-2024-58110/): Memory corruption in HarmonyOS (medium 4.6)
- [CVE-2024-5811](https://insights.sbomify.com/CVE-2024-5811/): Simple Video Directory < 1.4.4 - Contributor+ Stored XSS (medium 6.1)
- [CVE-2024-58109](https://insights.sbomify.com/CVE-2024-58109/): Memory corruption in HarmonyOS (medium 4.6)
- [CVE-2024-58108](https://insights.sbomify.com/CVE-2024-58108/): Memory corruption in HarmonyOS (medium 4.6)
- [CVE-2024-58107](https://insights.sbomify.com/CVE-2024-58107/): Memory corruption in HarmonyOS (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/176/