# Vulnerabilities published in 2024


- [CVE-2024-55972](https://insights.sbomify.com/CVE-2024-55972/): WordPress eTemplates plugin <= 0.2.1 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-55971](https://insights.sbomify.com/CVE-2024-55971/): SQL Injection vulnerability in the default configuration of the Logitime WebClock application <= 5.43.0 allows an unauthenticated user to ru (critical 10.0)
- [CVE-2024-55970](https://insights.sbomify.com/CVE-2024-55970/): File Manager in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 has a traversal issue that is related to the request parameter, aka I644734. (high 7.5)
- [CVE-2024-5597](https://insights.sbomify.com/CVE-2024-5597/): Fuji Electric Monitouch V-SFT Type Confusion (high 8.5)
- [CVE-2024-55969](https://insights.sbomify.com/CVE-2024-55969/): DocIO in Syncfusion Essential Studio for ASP.NET MVC before 27.1.55 throws XMLException during the resaving of a DOCX document with an exter (critical 9.1)
- [CVE-2024-55968](https://insights.sbomify.com/CVE-2024-55968/): An issue was discovered in DTEX DEC-M (DTEX Forwarder) 6.1.1. (high 8.8)
- [CVE-2024-55965](https://insights.sbomify.com/CVE-2024-55965/): Missing authorization in appsmith:appsmith (medium 6.5)
- [CVE-2024-55964](https://insights.sbomify.com/CVE-2024-55964/): Code injection in appsmith:appsmith (critical 9.8)
- [CVE-2024-55963](https://insights.sbomify.com/CVE-2024-55963/): Missing authorization in appsmith:appsmith (medium 6.5)
- [CVE-2024-5596](https://insights.sbomify.com/CVE-2024-5596/): ARMember Premium <= 6.7 - Cross-Site Request Forgery via multiple functions (medium 6.3)
- [CVE-2024-55959](https://insights.sbomify.com/CVE-2024-55959/): Northern.tech Mender Client 4.x before 4.0.5 has Insecure Permissions. (critical 9.1)
- [CVE-2024-55958](https://insights.sbomify.com/CVE-2024-55958/): Northern.tech CFEngine Enterprise Mission Portal 3.24.0, 3.21.5, and below allows XSS. (medium 4.8)
- [CVE-2024-55957](https://insights.sbomify.com/CVE-2024-55957/): In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control Software (ICSW) before 3.1 SP10, the driver pac (high 7.8)
- [CVE-2024-55956](https://insights.sbomify.com/CVE-2024-55956/): Cleo Multiple Products Unauthenticated File Upload (critical 9.8, exploited in the wild)
- [CVE-2024-55955](https://insights.sbomify.com/CVE-2024-55955/): Privilege escalation in Trend Micro Deep Security (medium 6.7)
- [CVE-2024-55954](https://insights.sbomify.com/CVE-2024-55954/): OpenObserve Improper Authorization Allows Admin User to Remove Root User (high 8.7)
- [CVE-2024-55953](https://insights.sbomify.com/CVE-2024-55953/): Dataease Mysql JDBC Connection Parameters Not Verified Leads to Deserialization and Arbitrary File Read Vulnerability (high 8.6)
- [CVE-2024-55952](https://insights.sbomify.com/CVE-2024-55952/): Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability (high 8.6)
- [CVE-2024-55951](https://insights.sbomify.com/CVE-2024-55951/): Metabase sandboxed users could see filter values from other sandboxed users (medium 4.8)
- [CVE-2024-55950](https://insights.sbomify.com/CVE-2024-55950/): Tabby has a TCC Bypass via Unnecessary Permissive Entitlements in Tabby (high 8.6)
- [CVE-2024-5595](https://insights.sbomify.com/CVE-2024-5595/): Essential Blocks < 4.7.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-55949](https://insights.sbomify.com/CVE-2024-55949/): Privilege escalation in IAM import API in MinIO (critical 9.3)
- [CVE-2024-55948](https://insights.sbomify.com/CVE-2024-55948/): Anonymous cache poisoning via XHR requests in Discourse (high 8.2)
- [CVE-2024-55947](https://insights.sbomify.com/CVE-2024-55947/): Gogs has a Path Traversal in file update API (high 8.7)
- [CVE-2024-55946](https://insights.sbomify.com/CVE-2024-55946/): Playloom Engine Data Storage Vulnerability (high 8.7)
- [CVE-2024-55945](https://insights.sbomify.com/CVE-2024-55945/): Cross-Site Request Forgery in DB Check Module in TYPO3 (medium 4.3)
- [CVE-2024-5594](https://insights.sbomify.com/CVE-2024-5594/): Other in OpenVPN (critical 9.1)
- [CVE-2024-55931](https://insights.sbomify.com/CVE-2024-55931/): Token stored in session storage (medium 6.5)
- [CVE-2024-55930](https://insights.sbomify.com/CVE-2024-55930/): Weak default folder permissions (medium 6.7)
- [CVE-2024-55929](https://insights.sbomify.com/CVE-2024-55929/): Mail spoofing (medium 5.3)
- [CVE-2024-55928](https://insights.sbomify.com/CVE-2024-55928/): Clear text secrets returned & Remote system secrets in clear text (medium 6.5)
- [CVE-2024-55927](https://insights.sbomify.com/CVE-2024-55927/): Flawed token generation implementation & Hard-coded key implementation (high 7.6)
- [CVE-2024-55926](https://insights.sbomify.com/CVE-2024-55926/): Arbitrary file upload, deletion and read through header manipulation (high 7.6)
- [CVE-2024-55925](https://insights.sbomify.com/CVE-2024-55925/): API Security bypass through header manipulation (high 7.5)
- [CVE-2024-55924](https://insights.sbomify.com/CVE-2024-55924/): Cross-Site Request Forgery in Scheduler Module in TYPO3 (high 8.0)
- [CVE-2024-55923](https://insights.sbomify.com/CVE-2024-55923/): Cross-Site Request Forgery in Indexed Search Module in TYPO3 (medium 4.3)
- [CVE-2024-55922](https://insights.sbomify.com/CVE-2024-55922/): Cross-Site Request Forgery in Form Framework Module in TYPO3 (medium 5.4)
- [CVE-2024-55921](https://insights.sbomify.com/CVE-2024-55921/): Cross-Site Request Forgery in Extension Manager Module in TYPO3 (high 7.5)
- [CVE-2024-55920](https://insights.sbomify.com/CVE-2024-55920/): Cross-Site Request Forgery in Dashboard Module in TYPO3 (medium 4.3)
- [CVE-2024-55918](https://insights.sbomify.com/CVE-2024-55918/): An issue was discovered in the Graphics::ColorNames package before 3.2.0 for Perl. (medium 5.3)
- [CVE-2024-55917](https://insights.sbomify.com/CVE-2024-55917/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2024-55916](https://insights.sbomify.com/CVE-2024-55916/): Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet (medium 5.5)
- [CVE-2024-55913](https://insights.sbomify.com/CVE-2024-55913/): IBM Concert Software path traversal (medium 5.3)
- [CVE-2024-55912](https://insights.sbomify.com/CVE-2024-55912/): IBM Concert Software information disclosure (medium 5.9)
- [CVE-2024-55910](https://insights.sbomify.com/CVE-2024-55910/): IBM Concert Software server-side request forgery (medium 6.5)
- [CVE-2024-5591](https://insights.sbomify.com/CVE-2024-5591/): IBM Jazz Foundation information disclosure (medium 4.3)
- [CVE-2024-55909](https://insights.sbomify.com/CVE-2024-55909/): IBM Concert Software denial of service (medium 6.5)
- [CVE-2024-55907](https://insights.sbomify.com/CVE-2024-55907/): IBM Cognos Mobile information disclosure (low 2.0)
- [CVE-2024-55904](https://insights.sbomify.com/CVE-2024-55904/): IBM DevOps Deploy / IBM UrbanCode Deploy command injection (high 7.2)
- [CVE-2024-5590](https://insights.sbomify.com/CVE-2024-5590/): Netentsec NS-ASG Application Security Gateway JSON Content uploadiscuser.php sql injection (medium 5.3)
- [CVE-2024-55898](https://insights.sbomify.com/CVE-2024-55898/): IBM i privilege escalation (high 8.5)
- [CVE-2024-55897](https://insights.sbomify.com/CVE-2024-55897/): IBM PowerHA SystemMirror for i information disclosure (medium 4.3)
- [CVE-2024-55896](https://insights.sbomify.com/CVE-2024-55896/): IBM PowerHA SystemMirror for i clickjacking (medium 5.4)
- [CVE-2024-55895](https://insights.sbomify.com/CVE-2024-55895/): IBM InfoSphere Information Server information disclosure (low 2.7)
- [CVE-2024-55894](https://insights.sbomify.com/CVE-2024-55894/): TYPO3 Cross-Site Request Forgery in Backend User Module (medium 4.3)
- [CVE-2024-55893](https://insights.sbomify.com/CVE-2024-55893/): TYPO3 Cross-Site Request Forgery in Log Module (medium 4.3)
- [CVE-2024-55892](https://insights.sbomify.com/CVE-2024-55892/): Potential Open Redirect via Parsing Differences in TYPO3 (medium 4.8)
- [CVE-2024-55891](https://insights.sbomify.com/CVE-2024-55891/): Information Disclosure via Exception Handling/Logger in TYPO3 (low 3.1)
- [CVE-2024-55890](https://insights.sbomify.com/CVE-2024-55890/): D-Tale allows Remote Code Execution through the Custom Filter Input (medium 6.9)
- [CVE-2024-5589](https://insights.sbomify.com/CVE-2024-5589/): Netentsec NS-ASG Application Security Gateway sql injection (medium 5.3)
- [CVE-2024-55889](https://insights.sbomify.com/CVE-2024-55889/): phpMyFAQ Vulnerable to Unintended File Download Triggered by Embedded Frames (medium 4.9)
- [CVE-2024-55888](https://insights.sbomify.com/CVE-2024-55888/): Content Security Policy appears to be missing in software and production setup (high 7.1)
- [CVE-2024-55887](https://insights.sbomify.com/CVE-2024-55887/): Ucum-java has an XXE vulnerability in XML parsing (high 8.6)
- [CVE-2024-55886](https://insights.sbomify.com/CVE-2024-55886/): OpenTelemetry Logs source may lack authentication with some custom plugins (medium 6.9)
- [CVE-2024-55885](https://insights.sbomify.com/CVE-2024-55885/): Beego Vulnerable to Collision Hazards of MD5 in Cache Key Filenames (medium 6.9)
- [CVE-2024-55884](https://insights.sbomify.com/CVE-2024-55884/): In the Mullvad VPN client 2024.6 (Desktop), 2024.8 (iOS), and 2024.8-beta1 (Android), the exception-handling alternate stack can be exhauste (critical 9.0)
- [CVE-2024-55881](https://insights.sbomify.com/CVE-2024-55881/): KVM: x86: Play nice with protected guests in complete_hypercall_exit() (medium 5.5)
- [CVE-2024-5588](https://insights.sbomify.com/CVE-2024-5588/): itsourcecode Learning Management System processscore.php sql injection (medium 5.3)
- [CVE-2024-55879](https://insights.sbomify.com/CVE-2024-55879/): XWiki allows RCE from script right in configurable sections (critical 9.1)
- [CVE-2024-55878](https://insights.sbomify.com/CVE-2024-55878/): Cross-site Scripting vulnerability in SimpleXLSXEx::readXfs and SimpeXLSX::toHTMLEx (medium 6.8)
- [CVE-2024-55877](https://insights.sbomify.com/CVE-2024-55877/): XWiki allows remote code execution from account through macro descriptions and XWiki.XWikiSyntaxMacrosList (critical 10.0)
- [CVE-2024-55876](https://insights.sbomify.com/CVE-2024-55876/): XWiki's scheduler in subwiki allows scheduling operations for any main wiki user (medium 5.4)
- [CVE-2024-55875](https://insights.sbomify.com/CVE-2024-55875/): http4k has a potential XXE (XML External Entity Injection) vulnerability (critical 9.8)
- [CVE-2024-5587](https://insights.sbomify.com/CVE-2024-5587/): Casdoor Configuration File app.conf file access (medium 6.9)
- [CVE-2024-55864](https://insights.sbomify.com/CVE-2024-55864/): Cross-site scripting in My WP Customize Admin/Frontend (medium 4.8)
- [CVE-2024-5586](https://insights.sbomify.com/CVE-2024-5586/): SQL Injection (high 8.3)
- [CVE-2024-5585](https://insights.sbomify.com/CVE-2024-5585/): Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix) (high 7.7)
- [CVE-2024-5584](https://insights.sbomify.com/CVE-2024-5584/): Cross-site scripting in Online Scheduling and Appointment Booking System – Bookly (medium 6.4)
- [CVE-2024-5583](https://insights.sbomify.com/CVE-2024-5583/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2024-5582](https://insights.sbomify.com/CVE-2024-5582/): Cross-site scripting in Schema & Structured Data for WP & AMP (medium 6.4)
- [CVE-2024-5581](https://insights.sbomify.com/CVE-2024-5581/): Allegra unzipFile Directory Traversal Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-5580](https://insights.sbomify.com/CVE-2024-5580/): Allegra loadFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-5579](https://insights.sbomify.com/CVE-2024-5579/): Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-5578](https://insights.sbomify.com/CVE-2024-5578/): Table of Contents Plus <= 2408 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-5577](https://insights.sbomify.com/CVE-2024-5577/): Where I Was, Where I Will Be <= 1.1.1 - Unauthenticated Remote File Inclusion (critical 9.8)
- [CVE-2024-5576](https://insights.sbomify.com/CVE-2024-5576/): Cross-site scripting in Tutor LMS Elementor Addons (medium 6.4)
- [CVE-2024-5575](https://insights.sbomify.com/CVE-2024-5575/): Ditty < 3.1.43 - Author+ Stored XSS (medium 4.7)
- [CVE-2024-5574](https://insights.sbomify.com/CVE-2024-5574/): WP Magazine Modules Lite <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion (high 7.5)
- [CVE-2024-5573](https://insights.sbomify.com/CVE-2024-5573/): Easy Table of Contents < 2.0.66 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-5571](https://insights.sbomify.com/CVE-2024-5571/): Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more (medium 6.4)
- [CVE-2024-5570](https://insights.sbomify.com/CVE-2024-5570/): Simple Photoswipe <= 0.1 - Subscriber+ Arbitrary Settings Update (medium 6.5)
- [CVE-2024-5569](https://insights.sbomify.com/CVE-2024-5569/): Denial of Service via crafted zip file in jaraco/zipp (medium 6.2)
- [CVE-2024-5567](https://insights.sbomify.com/CVE-2024-5567/): Cross-site scripting in Betheme (medium 6.4)
- [CVE-2024-55663](https://insights.sbomify.com/CVE-2024-55663/): XWiki Platform has an SQL injection in getdocuments.vm with sort parameter (high 8.6)
- [CVE-2024-55662](https://insights.sbomify.com/CVE-2024-55662/): XWiki allows remote code execution through the extension sheet (critical 10.0)
- [CVE-2024-55661](https://insights.sbomify.com/CVE-2024-55661/): Laravel Pulse Allows Remote Code Execution via Unprotected Query Method (high 8.7)
- [CVE-2024-55660](https://insights.sbomify.com/CVE-2024-55660/): SiYuan has an SSTI via /api/template/renderSprig (medium 6.9)
- [CVE-2024-5566](https://insights.sbomify.com/CVE-2024-5566/): Improper Privilege Management allows for access to unauthorized repository content during migration (medium 5.8)
- [CVE-2024-55659](https://insights.sbomify.com/CVE-2024-55659/): SiYuan has an arbitrary file write in the host via /api/asset/upload (high 8.7)
- [CVE-2024-55658](https://insights.sbomify.com/CVE-2024-55658/): SiYuan has an arbitrary file read and path traversal via /api/export/exportResources (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/192/