# Vulnerabilities published in 2024


- [CVE-2024-5714](https://insights.sbomify.com/CVE-2024-5714/): Improper Access Control in lunary-ai/lunary (high 7.4)
- [CVE-2024-5713](https://insights.sbomify.com/CVE-2024-5713/): if-so < 1.8.0.4 - Reflected XSS (medium 5.4)
- [CVE-2024-5712](https://insights.sbomify.com/CVE-2024-5712/): CSRF Vulnerability in stitionai/devika (high 8.1)
- [CVE-2024-5711](https://insights.sbomify.com/CVE-2024-5711/): Stored XSS in stitionai/devika (high 8.1)
- [CVE-2024-5710](https://insights.sbomify.com/CVE-2024-5710/): Improper Access Control in Team Management in berriai/litellm (medium 5.3)
- [CVE-2024-57099](https://insights.sbomify.com/CVE-2024-57099/): Code injection in classcms:classcms (critical 9.8)
- [CVE-2024-57098](https://insights.sbomify.com/CVE-2024-57098/): SQL injection in deep-project:moss (critical 9.8)
- [CVE-2024-57097](https://insights.sbomify.com/CVE-2024-57097/): Cross-site scripting in classcms:classcms (medium 4.8)
- [CVE-2024-57096](https://insights.sbomify.com/CVE-2024-57096/): Information disclosure in kingsoft:wps office (medium 5.5)
- [CVE-2024-57095](https://insights.sbomify.com/CVE-2024-57095/): SQL injection in go-admin:go-cms (medium 6.8)
- [CVE-2024-5709](https://insights.sbomify.com/CVE-2024-5709/): WPBakery <= 7.7 - Authenticated (Author+) Local File Inclusion (high 8.8)
- [CVE-2024-57086](https://insights.sbomify.com/CVE-2024-57086/): node-opcua-alarm-condition prototype pollution vulnerability (high 7.5)
- [CVE-2024-57085](https://insights.sbomify.com/CVE-2024-57085/): @stryker-mutator/util vulnerable to Prototype Pollution (high 7.5)
- [CVE-2024-57084](https://insights.sbomify.com/CVE-2024-57084/): A prototype pollution in the function lib.parse of dot-properties v1.0.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (high 7.5)
- [CVE-2024-57083](https://insights.sbomify.com/CVE-2024-57083/): Redoc Prototype Pollution via `Module.mergeObjects` Component (high 7.5)
- [CVE-2024-57082](https://insights.sbomify.com/CVE-2024-57082/): @rpldy/uploader prototype pollution (medium 6.5)
- [CVE-2024-57081](https://insights.sbomify.com/CVE-2024-57081/): A prototype pollution in the lib.fromQuery function of underscore-contrib v0.3.0 allows attackers to cause a Denial of Service (DoS) via sup (high 7.5)
- [CVE-2024-57080](https://insights.sbomify.com/CVE-2024-57080/): vxe-table prototype pollution (high 7.5)
- [CVE-2024-5708](https://insights.sbomify.com/CVE-2024-5708/): WPBakery <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-57079](https://insights.sbomify.com/CVE-2024-57079/): @zag-js/core prototype pollution (high 7.5)
- [CVE-2024-57078](https://insights.sbomify.com/CVE-2024-57078/): A prototype pollution in the lib.merge function of cli-util v1.1.27 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (high 7.5)
- [CVE-2024-57077](https://insights.sbomify.com/CVE-2024-57077/): utils-extend Prototype Pollution (critical 9.1)
- [CVE-2024-57076](https://insights.sbomify.com/CVE-2024-57076/): A prototype pollution in the lib.post function of ajax-request v1.2.3 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (high 7.5)
- [CVE-2024-57075](https://insights.sbomify.com/CVE-2024-57075/): eazy-logger prototype pollution (high 7.5)
- [CVE-2024-57074](https://insights.sbomify.com/CVE-2024-57074/): A prototype pollution in the lib.merge function of xe-utils v3.5.31 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (high 7.5)
- [CVE-2024-57072](https://insights.sbomify.com/CVE-2024-57072/): module-from-string prototype pollution (high 7.5)
- [CVE-2024-57071](https://insights.sbomify.com/CVE-2024-57071/): A prototype pollution in the lib.combine function of php-parser v3.2.1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (high 7.5)
- [CVE-2024-57069](https://insights.sbomify.com/CVE-2024-57069/): A prototype pollution in the lib function of expand-object v0.4.2 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (high 7.5)
- [CVE-2024-57068](https://insights.sbomify.com/CVE-2024-57068/): @tanstack/form-core prototype pollution (high 7.5)
- [CVE-2024-57067](https://insights.sbomify.com/CVE-2024-57067/): A prototype pollution in the lib.parse function of dot-qs v0.2.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (high 7.5)
- [CVE-2024-57066](https://insights.sbomify.com/CVE-2024-57066/): @ndhoule/defaults prototype pollution (high 7.5)
- [CVE-2024-57065](https://insights.sbomify.com/CVE-2024-57065/): A prototype pollution in the lib.createPath function of utile v0.3.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (high 7.5)
- [CVE-2024-57064](https://insights.sbomify.com/CVE-2024-57064/): A prototype pollution in the lib.setValue function of @syncfusion/ej2-spreadsheet v27.2.2 allows attackers to cause a Denial of Service (DoS (high 7.5)
- [CVE-2024-57063](https://insights.sbomify.com/CVE-2024-57063/): A prototype pollution in the lib function of php-date-formatter v1.3.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (high 7.5)
- [CVE-2024-57062](https://insights.sbomify.com/CVE-2024-57062/): Privilege escalation in soundcloud:soundcloud (medium 6.7)
- [CVE-2024-57061](https://insights.sbomify.com/CVE-2024-57061/): An issue in Termius Version 9.9.0 through v.9.16.0 allows a physically proximate attacker to execute arbitrary code via the insecure Electro (critical 9.8)
- [CVE-2024-5706](https://insights.sbomify.com/CVE-2024-5706/): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') (high 8.8)
- [CVE-2024-57056](https://insights.sbomify.com/CVE-2024-57056/): Incorrect cookie session handling in WombatDialer before 25.02 results in the full session identity being written to system logs and could b (medium 5.4)
- [CVE-2024-57055](https://insights.sbomify.com/CVE-2024-57055/): Server-Side Access Control Bypass vulnerability in WombatDialer before 25.02 could allow unauthorized users to potentially call certain serv (medium 5.0)
- [CVE-2024-57052](https://insights.sbomify.com/CVE-2024-57052/): Auth bypass in youdiancms:youdiancms (critical 9.8)
- [CVE-2024-5705](https://insights.sbomify.com/CVE-2024-5705/): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (high 8.8)
- [CVE-2024-57046](https://insights.sbomify.com/CVE-2024-57046/): Auth bypass in netgear:dgn2200 firmware (high 8.8)
- [CVE-2024-57045](https://insights.sbomify.com/CVE-2024-57045/): Auth bypass in dlink:dir-859 a3 firmware (critical 9.8)
- [CVE-2024-57041](https://insights.sbomify.com/CVE-2024-57041/): NodeBB Cross-site scripting (XSS) vulnerability (medium 4.6)
- [CVE-2024-57040](https://insights.sbomify.com/CVE-2024-57040/): Hardcoded credentials in tp-link:tl-wr845n firmware (critical 9.8)
- [CVE-2024-5704](https://insights.sbomify.com/CVE-2024-5704/): Missing authorization in Happy WooCommerce FAQs – Ultimate Product FAQ Plugin (medium 4.3)
- [CVE-2024-57036](https://insights.sbomify.com/CVE-2024-57036/): Command injection in totolink:a810r firmware (high 8.1)
- [CVE-2024-57035](https://insights.sbomify.com/CVE-2024-57035/): SQL injection in wegia:wegia (critical 9.8)
- [CVE-2024-57034](https://insights.sbomify.com/CVE-2024-57034/): SQL injection in wegia:wegia (critical 9.8)
- [CVE-2024-57033](https://insights.sbomify.com/CVE-2024-57033/): Cross-site scripting in wegia:wegia (medium 6.1)
- [CVE-2024-57032](https://insights.sbomify.com/CVE-2024-57032/): Auth bypass in wegia:wegia (critical 9.8)
- [CVE-2024-57031](https://insights.sbomify.com/CVE-2024-57031/): SQL injection in wegia:wegia (critical 9.8)
- [CVE-2024-57030](https://insights.sbomify.com/CVE-2024-57030/): Cross-site scripting in wegia:wegia (high 8.1)
- [CVE-2024-5703](https://insights.sbomify.com/CVE-2024-5703/): Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.26 - Missing Authorization (medium 4.3)
- [CVE-2024-57026](https://insights.sbomify.com/CVE-2024-57026/): Cross-site scripting in tawk:tawk.to (medium 6.1)
- [CVE-2024-57025](https://insights.sbomify.com/CVE-2024-57025/): Command injection in totolink:x5000r firmware (medium 6.8)
- [CVE-2024-57024](https://insights.sbomify.com/CVE-2024-57024/): Command injection in totolink:x5000r firmware (medium 6.8)
- [CVE-2024-57023](https://insights.sbomify.com/CVE-2024-57023/): Command injection in totolink:x5000r firmware (medium 6.8)
- [CVE-2024-57022](https://insights.sbomify.com/CVE-2024-57022/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-57021](https://insights.sbomify.com/CVE-2024-57021/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-57020](https://insights.sbomify.com/CVE-2024-57020/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-5702](https://insights.sbomify.com/CVE-2024-5702/): Use after free in Firefox (high 7.5)
- [CVE-2024-57019](https://insights.sbomify.com/CVE-2024-57019/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-57018](https://insights.sbomify.com/CVE-2024-57018/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-57017](https://insights.sbomify.com/CVE-2024-57017/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-57016](https://insights.sbomify.com/CVE-2024-57016/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-57015](https://insights.sbomify.com/CVE-2024-57015/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-57014](https://insights.sbomify.com/CVE-2024-57014/): Command injection in totolink:x5000r firmware (high 7.8)
- [CVE-2024-57013](https://insights.sbomify.com/CVE-2024-57013/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-57012](https://insights.sbomify.com/CVE-2024-57012/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-57011](https://insights.sbomify.com/CVE-2024-57011/): Command injection in totolink:x5000r firmware (high 8.8)
- [CVE-2024-5701](https://insights.sbomify.com/CVE-2024-5701/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-57004](https://insights.sbomify.com/CVE-2024-57004/): Cross-site scripting in roundcube:webmail (medium 6.1)
- [CVE-2024-5700](https://insights.sbomify.com/CVE-2024-5700/): Memory corruption in Firefox (high 7.0)
- [CVE-2024-56998](https://insights.sbomify.com/CVE-2024-56998/): Cross-site scripting in phpgurukul:hospital management system (medium 4.2)
- [CVE-2024-56997](https://insights.sbomify.com/CVE-2024-56997/): Cross-site scripting in phpgurukul:hospital management system (medium 4.2)
- [CVE-2024-56990](https://insights.sbomify.com/CVE-2024-56990/): Cross-site scripting in phpgurukul:hospital management system (medium 4.5)
- [CVE-2024-5699](https://insights.sbomify.com/CVE-2024-5699/): Security feature bypass in Firefox (critical 9.8)
- [CVE-2024-5698](https://insights.sbomify.com/CVE-2024-5698/): Other in Firefox (medium 5.4)
- [CVE-2024-56975](https://insights.sbomify.com/CVE-2024-56975/): File upload in invoiceplane:invoiceplane (critical 9.8)
- [CVE-2024-56973](https://insights.sbomify.com/CVE-2024-56973/): Insecure Permissions vulnerability in Alvaria, Inc Unified IP Unified Director before v.7.2SP2 allows a remote attacker to execute arbitrary (critical 9.8)
- [CVE-2024-56972](https://insights.sbomify.com/CVE-2024-56972/): An issue in Midea Group Co., Ltd Midea Home iOS 9.3.12 allows attackers to access sensitive user information via supplying a crafted link. (medium 6.5)
- [CVE-2024-56971](https://insights.sbomify.com/CVE-2024-56971/): An issue in Zhiyuan Yuedu (Guangzhou) Literature Information Technology Co., Ltd Shuqi Novel iOS 5.3.8 allows attackers to access sensitive (medium 6.5)
- [CVE-2024-5697](https://insights.sbomify.com/CVE-2024-5697/): Information disclosure in Firefox (medium 5.3)
- [CVE-2024-56969](https://insights.sbomify.com/CVE-2024-56969/): An issue in Pixocial Technology (Singapore) Pte. (medium 6.5)
- [CVE-2024-56968](https://insights.sbomify.com/CVE-2024-56968/): An issue in Shenzhen Intellirocks Tech Co. (medium 6.5)
- [CVE-2024-56967](https://insights.sbomify.com/CVE-2024-56967/): An issue in Cloud Whale Interactive Technology LLC. (medium 6.5)
- [CVE-2024-56966](https://insights.sbomify.com/CVE-2024-56966/): An issue in Shanghai Xuan Ting Entertainment Information & Technology Co., Ltd Qidian Reader iOS 5.9.384 allows attackers to access sensitiv (medium 6.5)
- [CVE-2024-56965](https://insights.sbomify.com/CVE-2024-56965/): An issue in Shanghai Shizhi Information Technology Co., Ltd Shihuo iOS 8.16.0 allows attackers to access sensitive user information via supplying a crafted link. (medium 6.5)
- [CVE-2024-56964](https://insights.sbomify.com/CVE-2024-56964/): An issue in Che Hao Duo Used Automobile Agency (Beijing) Co., Ltd Guazi Used Car iOS 10.15.1 allows attackers to access sensitive user infor (medium 6.5)
- [CVE-2024-56963](https://insights.sbomify.com/CVE-2024-56963/): An issue in Beijing Sogou Technology Development Co., Ltd Sogou Input iOS 12.2.0 allows attackers to access sensitive user information via s (medium 6.5)
- [CVE-2024-56962](https://insights.sbomify.com/CVE-2024-56962/): An issue in Tencent Technology (Shanghai) Co., Ltd WeSing iOS v9.3.39 allows attackers to access sensitive user information via supplying a crafted link. (medium 6.5)
- [CVE-2024-56960](https://insights.sbomify.com/CVE-2024-56960/): An issue in Tianjin Xiaowu Information technology Co., Ltd BeiKe Holdings iOS 1.3.50 allows attackers to access sensitive user information v (medium 6.5)
- [CVE-2024-5696](https://insights.sbomify.com/CVE-2024-5696/): Memory corruption in Firefox (high 8.6)
- [CVE-2024-56959](https://insights.sbomify.com/CVE-2024-56959/): An issue in Mashang Consumer Finance Co., Ltd Anyihua iOS 3.6.2 allows attackers to access sensitive user information via supplying a crafted link. (medium 6.5)
- [CVE-2024-56957](https://insights.sbomify.com/CVE-2024-56957/): An issue in Kingsoft Office Software Corporation Limited WPS Office iOS 12.20.0 allows attackers to access sensitive user information via su (medium 6.5)
- [CVE-2024-56955](https://insights.sbomify.com/CVE-2024-56955/): An issue in Tencent Technology (Shenzhen) Company Limited QQMail iOS 6.6.4 allows attackers to access sensitive user information via supplying a crafted link. (medium 6.5)
- [CVE-2024-56954](https://insights.sbomify.com/CVE-2024-56954/): An issue in Beijing Baidu Netcom Science & Technology Co Ltd Haokan Video iOS 7.70.0 allows attackers to access sensitive user information v (medium 6.5)
- [CVE-2024-56953](https://insights.sbomify.com/CVE-2024-56953/): An issue in Baidu (China) Co Ltd Baidu Input Method (iOS version) v12.6.13 allows attackers to access user information via supplying a crafted link. (medium 6.5)
- [CVE-2024-56952](https://insights.sbomify.com/CVE-2024-56952/): An issue in Beijing Baidu Netcom Science & Technology Co Ltd Baidu Lite app (iOS version) 6.40.0 allows attackers to access user information (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/183/