# Vulnerabilities published in 2024


- [CVE-2024-53934](https://insights.sbomify.com/CVE-2024-53934/): The com.windymob.callscreen.ringtone.callcolor.colorphone (aka Color Phone Call Screen Themes) application through 1.1.2 for Android enables (high 7.7)
- [CVE-2024-53933](https://insights.sbomify.com/CVE-2024-53933/): The com.callerscreen.colorphone.themes.callflash (aka Color Call Theme & Call Screen) application through 1.0.7 for Android enables any appl (medium 6.3)
- [CVE-2024-53932](https://insights.sbomify.com/CVE-2024-53932/): The com.remi.colorphone.callscreen.calltheme.callerscreen (aka Color Phone: Call Screen Theme) application through 21.1.9 for Android enable (critical 9.1)
- [CVE-2024-53931](https://insights.sbomify.com/CVE-2024-53931/): The com.glitter.caller.screen (aka iCaller, Caller Theme & Dialer) application through 1.1 for Android enables any application (with no perm (critical 9.1)
- [CVE-2024-53930](https://insights.sbomify.com/CVE-2024-53930/): WikiDocs before 1.0.65 allows stored XSS by authenticated users via data that comes after $$\\, which is mishandled by a KaTeX parser. (medium 6.1)
- [CVE-2024-5393](https://insights.sbomify.com/CVE-2024-5393/): itsourcecode Online Student Enrollment System listofcourse.php sql injection (medium 5.3)
- [CVE-2024-53924](https://insights.sbomify.com/CVE-2024-53924/): Pycel allows code injection via a crafted formula (critical 9.8)
- [CVE-2024-53923](https://insights.sbomify.com/CVE-2024-53923/): SQL injection in centreon:centreon web (critical 9.1)
- [CVE-2024-53922](https://insights.sbomify.com/CVE-2024-53922/): Denial of service in Exynos 8890 firmware (medium 5.7)
- [CVE-2024-53921](https://insights.sbomify.com/CVE-2024-53921/): Privilege escalation in samsung:magician (low 2.8)
- [CVE-2024-53920](https://insights.sbomify.com/CVE-2024-53920/): Code injection in gnu:emacs (high 7.8)
- [CVE-2024-5392](https://insights.sbomify.com/CVE-2024-5392/): itsourcecode Online Student Enrollment System editSubject.php sql injection (medium 5.3)
- [CVE-2024-53919](https://insights.sbomify.com/CVE-2024-53919/): An injection vulnerability in Barco ClickShare CX-30/20, C-5/10, and ClickShare Bar Pro and Core models, running firmware before 2.21.1, all (high 7.6)
- [CVE-2024-53916](https://insights.sbomify.com/CVE-2024-53916/): OpenStack Neutron can use an incorrect ID during policy enforcement (high 7.5)
- [CVE-2024-53915](https://insights.sbomify.com/CVE-2024-53915/): Deserialization in veritas:enterprise vault (critical 9.8)
- [CVE-2024-53914](https://insights.sbomify.com/CVE-2024-53914/): Deserialization in veritas:enterprise vault (critical 9.8)
- [CVE-2024-53913](https://insights.sbomify.com/CVE-2024-53913/): Deserialization in veritas:enterprise vault (critical 9.8)
- [CVE-2024-53912](https://insights.sbomify.com/CVE-2024-53912/): Deserialization in veritas:enterprise vault (critical 9.8)
- [CVE-2024-53911](https://insights.sbomify.com/CVE-2024-53911/): Deserialization in veritas:enterprise vault (critical 9.8)
- [CVE-2024-53910](https://insights.sbomify.com/CVE-2024-53910/): Deserialization in veritas:enterprise vault (critical 9.8)
- [CVE-2024-5391](https://insights.sbomify.com/CVE-2024-5391/): itsourcecode Online Student Enrollment System listofsubject.php sql injection (medium 5.3)
- [CVE-2024-53909](https://insights.sbomify.com/CVE-2024-53909/): Deserialization in veritas:enterprise vault (critical 9.8)
- [CVE-2024-53908](https://insights.sbomify.com/CVE-2024-53908/): Django SQL injection in HasKey(lhs, rhs) on Oracle (critical 9.8)
- [CVE-2024-53907](https://insights.sbomify.com/CVE-2024-53907/): Django denial-of-service in django.utils.html.strip_tags() (high 7.5)
- [CVE-2024-53901](https://insights.sbomify.com/CVE-2024-53901/): Memory corruption in tonycoz:imager (medium 5.5)
- [CVE-2024-53900](https://insights.sbomify.com/CVE-2024-53900/): Mongoose search injection vulnerability (critical 9.1)
- [CVE-2024-5390](https://insights.sbomify.com/CVE-2024-5390/): itsourcecode Online Student Enrollment System listofstudent.php sql injection (medium 5.3)
- [CVE-2024-53899](https://insights.sbomify.com/CVE-2024-53899/): virtualenv allows command injection through activation scripts for a virtual environment (high 8.4)
- [CVE-2024-5389](https://insights.sbomify.com/CVE-2024-5389/): Insufficient Access Control in lunary-ai/lunary (medium 5.7)
- [CVE-2024-53881](https://insights.sbomify.com/CVE-2024-53881/): Denial of service in NVIDIA vGPU software (medium 5.5)
- [CVE-2024-53880](https://insights.sbomify.com/CVE-2024-53880/): Integer overflow in Triton Inference Server (medium 4.9)
- [CVE-2024-53879](https://insights.sbomify.com/CVE-2024-53879/): Denial of service in CUDA Toolkit (low 2.8)
- [CVE-2024-53878](https://insights.sbomify.com/CVE-2024-53878/): Denial of service in CUDA Toolkit (low 2.8)
- [CVE-2024-53877](https://insights.sbomify.com/CVE-2024-53877/): Null dereference in CUDA Toolkit (low 3.3)
- [CVE-2024-53876](https://insights.sbomify.com/CVE-2024-53876/): Memory corruption in CUDA Toolkit (low 3.3)
- [CVE-2024-53875](https://insights.sbomify.com/CVE-2024-53875/): Memory corruption in CUDA Toolkit (low 3.3)
- [CVE-2024-53874](https://insights.sbomify.com/CVE-2024-53874/): Memory corruption in CUDA Toolkit (low 3.3)
- [CVE-2024-53873](https://insights.sbomify.com/CVE-2024-53873/): Memory corruption in CUDA Toolkit (low 3.3)
- [CVE-2024-53872](https://insights.sbomify.com/CVE-2024-53872/): Memory corruption in CUDA Toolkit (low 3.3)
- [CVE-2024-53871](https://insights.sbomify.com/CVE-2024-53871/): Memory corruption in CUDA Toolkit (low 3.3)
- [CVE-2024-53870](https://insights.sbomify.com/CVE-2024-53870/): Memory corruption in CUDA Toolkit (low 3.3)
- [CVE-2024-53869](https://insights.sbomify.com/CVE-2024-53869/): Information disclosure in NVIDIA GPU Display Driver, vGPU software (medium 5.5)
- [CVE-2024-53868](https://insights.sbomify.com/CVE-2024-53868/): Apache Traffic Server: Malformed chunked message body allows request smuggling (high 7.5)
- [CVE-2024-53867](https://insights.sbomify.com/CVE-2024-53867/): Synapse Matrix has a partial room state leak via Sliding Sync (medium 4.3)
- [CVE-2024-53866](https://insights.sbomify.com/CVE-2024-53866/): pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion (medium 5.8)
- [CVE-2024-53865](https://insights.sbomify.com/CVE-2024-53865/): Python package "zhmcclient" has passwords in clear text in its HMC and API logs (high 8.3)
- [CVE-2024-53864](https://insights.sbomify.com/CVE-2024-53864/): Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui (medium 5.3)
- [CVE-2024-53863](https://insights.sbomify.com/CVE-2024-53863/): Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders (high 8.2)
- [CVE-2024-53862](https://insights.sbomify.com/CVE-2024-53862/): Argo Workflows Allows Access to Archived Workflows with Fake Token in `client` mode (medium 6.3)
- [CVE-2024-53861](https://insights.sbomify.com/CVE-2024-53861/): Issuer field partial matches allowed in pyjwt (low 2.2)
- [CVE-2024-53860](https://insights.sbomify.com/CVE-2024-53860/): Potential Abuse for Sending Arbitrary Emails in sp-php-email-handler (high 8.6)
- [CVE-2024-5386](https://insights.sbomify.com/CVE-2024-5386/): Account Hijacking via Password Reset Token Leak in lunary-ai/lunary (critical 9.6)
- [CVE-2024-53859](https://insights.sbomify.com/CVE-2024-53859/): go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace (medium 6.5)
- [CVE-2024-53858](https://insights.sbomify.com/CVE-2024-53858/): Recursive repository cloning can leak authentication tokens to non-GitHub submodule hosts in the gh cli (medium 6.5)
- [CVE-2024-53857](https://insights.sbomify.com/CVE-2024-53857/): rPGP Potential Resource Exhaustion when handling Untrusted Messages (high 7.5)
- [CVE-2024-53856](https://insights.sbomify.com/CVE-2024-53856/): rPGP Panics on Malformed Untrusted Input (high 7.5)
- [CVE-2024-53855](https://insights.sbomify.com/CVE-2024-53855/): User can view tickets from organizations they're not apart of in centurion_erp (low 1.9)
- [CVE-2024-53851](https://insights.sbomify.com/CVE-2024-53851/): Partial denial of service via inline oneboxes in Discourse (medium 4.3)
- [CVE-2024-53850](https://insights.sbomify.com/CVE-2024-53850/): The Addressing GLPI plugin allows data enumeration through uncontrolled object instantiation (high 8.2)
- [CVE-2024-5385](https://insights.sbomify.com/CVE-2024-5385/): oretnom23 Online Car Wash Booking System cross site scripting (medium 5.1)
- [CVE-2024-53849](https://insights.sbomify.com/CVE-2024-53849/): Several stack buffer overflows and pointer overflows in editorconfig-core-c (medium 4.8)
- [CVE-2024-53848](https://insights.sbomify.com/CVE-2024-53848/): check-jsonschema default caching for remote schemas allows for cache confusion (high 7.1)
- [CVE-2024-53847](https://insights.sbomify.com/CVE-2024-53847/): Trix vulnerable to Cross-site Scripting on copy & paste (medium 5.1)
- [CVE-2024-53846](https://insights.sbomify.com/CVE-2024-53846/): ssl fails to validate incorrect extened key usage (medium 5.5)
- [CVE-2024-53845](https://insights.sbomify.com/CVE-2024-53845/): AES/CBC Constant IV Vulnerability in ESPTouch v2 (medium 6.6)
- [CVE-2024-53844](https://insights.sbomify.com/CVE-2024-53844/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in labsai/eddi (medium 6.3)
- [CVE-2024-53843](https://insights.sbomify.com/CVE-2024-53843/): Reflected XSS Vulnerability in Authentication Flow URL Handling in @dapperduckling/keycloak-connector-server (high 8.1)
- [CVE-2024-53842](https://insights.sbomify.com/CVE-2024-53842/): Memory corruption in Android (critical 9.8)
- [CVE-2024-53841](https://insights.sbomify.com/CVE-2024-53841/): Privilege escalation in Android (high 7.8)
- [CVE-2024-53840](https://insights.sbomify.com/CVE-2024-53840/): Security feature bypass in Android (high 7.8)
- [CVE-2024-5384](https://insights.sbomify.com/CVE-2024-5384/): SourceCodester Facebook News Feed Like index.php sql injection (medium 6.9)
- [CVE-2024-53839](https://insights.sbomify.com/CVE-2024-53839/): Memory corruption in Android (medium 5.5)
- [CVE-2024-53838](https://insights.sbomify.com/CVE-2024-53838/): Memory corruption in Android (high 7.8)
- [CVE-2024-53837](https://insights.sbomify.com/CVE-2024-53837/): Integer overflow in Android (high 7.8)
- [CVE-2024-53836](https://insights.sbomify.com/CVE-2024-53836/): Memory corruption in Android (medium 6.7)
- [CVE-2024-53835](https://insights.sbomify.com/CVE-2024-53835/): Security feature bypass in Android (high 7.8)
- [CVE-2024-53834](https://insights.sbomify.com/CVE-2024-53834/): Memory corruption in Android (high 7.5)
- [CVE-2024-53833](https://insights.sbomify.com/CVE-2024-53833/): Memory corruption in Android (high 7.8)
- [CVE-2024-53832](https://insights.sbomify.com/CVE-2024-53832/): Information disclosure in CPCI85 Central Processing/Communication (medium 5.1)
- [CVE-2024-5383](https://insights.sbomify.com/CVE-2024-5383/): lakernote EasyAdmin upload cross site scripting (medium 5.3)
- [CVE-2024-53829](https://insights.sbomify.com/CVE-2024-53829/): Cross-Site Request Forgery in CodeChecker API (high 8.2)
- [CVE-2024-53828](https://insights.sbomify.com/CVE-2024-53828/): Ericsson Packet Core Controller (PCC) - Improper Handling of Syntactically Invalid Structure Vulnerability (medium 5.3)
- [CVE-2024-53827](https://insights.sbomify.com/CVE-2024-53827/): Ericsson Packet Core Controller (PCC) - Improper Input Validation Vulnerability (high 7.5)
- [CVE-2024-53826](https://insights.sbomify.com/CVE-2024-53826/): WordPress WPCasa plugin <= 1.2.13 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2024-53825](https://insights.sbomify.com/CVE-2024-53825/): WordPress FileBird Lite plugin <= 6.3.2 - Broken Access Control vulnerability (medium 4.7)
- [CVE-2024-53824](https://insights.sbomify.com/CVE-2024-53824/): WordPress All Bootstrap Blocks plugin <= 1.3.20 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-53823](https://insights.sbomify.com/CVE-2024-53823/): WordPress The Plus Addons for Elementor plugin <= 5.6.14 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-53822](https://insights.sbomify.com/CVE-2024-53822/): WordPress Pie Register Premium plugin < 3.8.3.3 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-53821](https://insights.sbomify.com/CVE-2024-53821/): WordPress Pie Register Premium plugin < 3.8.3.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-53820](https://insights.sbomify.com/CVE-2024-53820/): WordPress Captivate Sync plugin <= 2.0.22 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5382](https://insights.sbomify.com/CVE-2024-5382/): Missing authorization in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits (medium 6.5)
- [CVE-2024-53819](https://insights.sbomify.com/CVE-2024-53819/): WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.0 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2024-53818](https://insights.sbomify.com/CVE-2024-53818/): WordPress PostX plugin <= 4.1.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-53817](https://insights.sbomify.com/CVE-2024-53817/): WordPress Acowebs Product Labels For Woocommerce plugin <= 1.5.8 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-53816](https://insights.sbomify.com/CVE-2024-53816/): WordPress Tutor LMS Elementor Addons plugin <= 2.1.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-53815](https://insights.sbomify.com/CVE-2024-53815/): WordPress Pinpoint Booking System plugin <= 2.9.9.5.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-53814](https://insights.sbomify.com/CVE-2024-53814/): WordPress Analytify plugin <= 5.4.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-53813](https://insights.sbomify.com/CVE-2024-53813/): WordPress WP Travel plugin <= 9.6.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-53812](https://insights.sbomify.com/CVE-2024-53812/): WordPress WP GeoNames plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-53811](https://insights.sbomify.com/CVE-2024-53811/): WordPress WDesignKit plugin <= 1.0.40 - Arbitrary File Upload vulnerability (medium 6.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/203/