# Vulnerabilities published in 2024


- [CVE-2024-5372](https://insights.sbomify.com/CVE-2024-5372/): Kashipara College Management System submit_extracurricular_activity.php cross site scripting (medium 5.3)
- [CVE-2024-53719](https://insights.sbomify.com/CVE-2024-53719/): WordPress Zajax – Ajax Navigation plugin <= 0.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-53718](https://insights.sbomify.com/CVE-2024-53718/): WordPress Multi Feed Reader plugin <= 2.2.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-53717](https://insights.sbomify.com/CVE-2024-53717/): WordPress yPHPlista plugin <= 1.1.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-53716](https://insights.sbomify.com/CVE-2024-53716/): WordPress wp auto top plugin <= 2.9.3 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-53715](https://insights.sbomify.com/CVE-2024-53715/): WordPress Simple Travel Map plugin <= 0.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-53714](https://insights.sbomify.com/CVE-2024-53714/): WordPress Continue Shopping From Cart plugin <= 1.3 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-53713](https://insights.sbomify.com/CVE-2024-53713/): WordPress Silverlight Video Player plugin <= 1.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-53712](https://insights.sbomify.com/CVE-2024-53712/): WordPress Kevin's plugin <= 2.0.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-53711](https://insights.sbomify.com/CVE-2024-53711/): WordPress Hotlink2Watermark plugin <= 0.3.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-53710](https://insights.sbomify.com/CVE-2024-53710/): WordPress ITERAS plugin <= 1.8.0 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-5371](https://insights.sbomify.com/CVE-2024-5371/): Kashipara College Management System submit_enroll_student.php cross site scripting (medium 5.3)
- [CVE-2024-53709](https://insights.sbomify.com/CVE-2024-53709/): WordPress Generic Elements plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-53708](https://insights.sbomify.com/CVE-2024-53708/): WordPress AI Quiz plugin <= 1.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-53707](https://insights.sbomify.com/CVE-2024-53707/): WordPress Ahmeti Wp Güzel Sözler plugin <= 4.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-53706](https://insights.sbomify.com/CVE-2024-53706/): Privilege escalation in SonicOS (high 7.8)
- [CVE-2024-53705](https://insights.sbomify.com/CVE-2024-53705/): Server-side request forgery in SonicOS (high 7.5)
- [CVE-2024-53704](https://insights.sbomify.com/CVE-2024-53704/): SonicWall SonicOS SSLVPN Improper Authentication (high 8.2, exploited in the wild)
- [CVE-2024-53703](https://insights.sbomify.com/CVE-2024-53703/): Memory corruption in SMA100 (high 8.1)
- [CVE-2024-53702](https://insights.sbomify.com/CVE-2024-53702/): Weak cryptography in SMA100 (medium 5.3)
- [CVE-2024-53701](https://insights.sbomify.com/CVE-2024-53701/): Auth bypass in arrows N F-51C (low 3.1)
- [CVE-2024-53700](https://insights.sbomify.com/CVE-2024-53700/): QHora (medium 5.1)
- [CVE-2024-5370](https://insights.sbomify.com/CVE-2024-5370/): Kashipara College Management System submit_enroll_staff.php cross site scripting (medium 5.3)
- [CVE-2024-53699](https://insights.sbomify.com/CVE-2024-53699/): QTS, QuTS hero (low 2.1)
- [CVE-2024-53698](https://insights.sbomify.com/CVE-2024-53698/): QTS, QuTS hero (low 2.1)
- [CVE-2024-53697](https://insights.sbomify.com/CVE-2024-53697/): QTS, QuTS hero (low 2.1)
- [CVE-2024-53696](https://insights.sbomify.com/CVE-2024-53696/): QuLog Center (medium 5.1)
- [CVE-2024-53695](https://insights.sbomify.com/CVE-2024-53695/): HBS 3 Hybrid Backup Sync (medium 6.3)
- [CVE-2024-53694](https://insights.sbomify.com/CVE-2024-53694/): QVPN Device Client, Qsync, Qfinder Pro (high 8.6)
- [CVE-2024-53693](https://insights.sbomify.com/CVE-2024-53693/): QTS, QuTS hero (high 7.1)
- [CVE-2024-53692](https://insights.sbomify.com/CVE-2024-53692/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-53691](https://insights.sbomify.com/CVE-2024-53691/): QTS, QuTS hero (high 8.7)
- [CVE-2024-53690](https://insights.sbomify.com/CVE-2024-53690/): nilfs2: prevent use of deleted inode (medium 5.5)
- [CVE-2024-5369](https://insights.sbomify.com/CVE-2024-5369/): Kashipara College Management System submit_admin.php cross site scripting (medium 5.3)
- [CVE-2024-53688](https://insights.sbomify.com/CVE-2024-53688/): Command injection in AE1021 (high 7.2)
- [CVE-2024-53687](https://insights.sbomify.com/CVE-2024-53687/): riscv: Fix IPIs usage in kfence_protect_page() (medium 5.5)
- [CVE-2024-53685](https://insights.sbomify.com/CVE-2024-53685/): ceph: give up on paths longer than PATH_MAX (medium 5.5)
- [CVE-2024-53684](https://insights.sbomify.com/CVE-2024-53684/): Cross-site request forgery in DIRIS Digiware M-70 (high 7.5)
- [CVE-2024-53683](https://insights.sbomify.com/CVE-2024-53683/): Ossur Mobile Logic Application Exposure of Sensitive System Information to an Unauthorized Control Sphere (medium 5.6)
- [CVE-2024-53682](https://insights.sbomify.com/CVE-2024-53682/): regulator: axp20x: AXP717: set ramp_delay (medium 5.5)
- [CVE-2024-53681](https://insights.sbomify.com/CVE-2024-53681/): nvmet: Don't overflow subsysnqn (medium 5.5)
- [CVE-2024-53680](https://insights.sbomify.com/CVE-2024-53680/): ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() (medium 5.5)
- [CVE-2024-5368](https://insights.sbomify.com/CVE-2024-5368/): Kashipara College Management System delete_faculty.php cross site scripting (medium 5.3)
- [CVE-2024-53679](https://insights.sbomify.com/CVE-2024-53679/): Apache VCL: XSS vulnerability in User Lookup impacting user privileges (high 8.4)
- [CVE-2024-53678](https://insights.sbomify.com/CVE-2024-53678/): Apache VCL: SQL injection vulnerability in New Block Allocation form (medium 5.1)
- [CVE-2024-53677](https://insights.sbomify.com/CVE-2024-53677/): Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks (critical 9.5)
- [CVE-2024-53676](https://insights.sbomify.com/CVE-2024-53676/): Path traversal in HPE Insight Remote Support (critical 9.8)
- [CVE-2024-53675](https://insights.sbomify.com/CVE-2024-53675/): XML external entity in HPE Insight Remote Support (high 7.3)
- [CVE-2024-53674](https://insights.sbomify.com/CVE-2024-53674/): XML external entity in HPE Insight Remote Support (high 7.3)
- [CVE-2024-53673](https://insights.sbomify.com/CVE-2024-53673/): Deserialization in Insight Remote Support (high 8.1)
- [CVE-2024-53672](https://insights.sbomify.com/CVE-2024-53672/): Authenticated Remote Command Injection in HPE Aruba Networking ClearPass Policy Manager Web-Based Management Interface (medium 4.7)
- [CVE-2024-5367](https://insights.sbomify.com/CVE-2024-5367/): Kashipara College Management System each_extracurricula_activities.php cross site scripting (medium 5.3)
- [CVE-2024-5366](https://insights.sbomify.com/CVE-2024-5366/): SourceCodester Best House Rental Management System edit-cate.php sql injection (medium 5.3)
- [CVE-2024-53651](https://insights.sbomify.com/CVE-2024-53651/): Information disclosure in SIPROTEC 5 6MD84 (CP300) (medium 5.1)
- [CVE-2024-5365](https://insights.sbomify.com/CVE-2024-5365/): SourceCodester Best House Rental Management System manage_payment.php sql injection (medium 5.3)
- [CVE-2024-53649](https://insights.sbomify.com/CVE-2024-53649/): Information disclosure in SIPROTEC 5 6MD84 (CP300) (high 7.1)
- [CVE-2024-53648](https://insights.sbomify.com/CVE-2024-53648/): Other in SIPROTEC 5 6MD84 (CP300) (high 7.0)
- [CVE-2024-53647](https://insights.sbomify.com/CVE-2024-53647/): Denial of service in Trend Micro ID Security (medium 6.5)
- [CVE-2024-5364](https://insights.sbomify.com/CVE-2024-5364/): SourceCodester Best House Rental Management System manage_tenant.php sql injection (medium 5.3)
- [CVE-2024-53636](https://insights.sbomify.com/CVE-2024-53636/): File upload in Academia Student Information System (medium 6.4)
- [CVE-2024-53635](https://insights.sbomify.com/CVE-2024-53635/): Cross-site scripting in phpgurukul:covid19 testing management system (medium 4.8)
- [CVE-2024-5363](https://insights.sbomify.com/CVE-2024-5363/): SourceCodester Best House Rental Management System manage_user.php sql injection (medium 5.3)
- [CVE-2024-53623](https://insights.sbomify.com/CVE-2024-53623/): Incorrect access control in the component l_0_0.xml of TP-Link ARCHER-C7 v5 allows attackers to access sensitive information. (high 7.5)
- [CVE-2024-53621](https://insights.sbomify.com/CVE-2024-53621/): A buffer overflow in the formSetCfm() function of Tenda AC1206 1200M 11ac US_AC1206V1.0RTL_V15.03.06.23_multi_TD01 allows attackers to cause (high 7.5)
- [CVE-2024-53620](https://insights.sbomify.com/CVE-2024-53620/): Cross-site scripting in spip:spip (medium 4.8)
- [CVE-2024-5362](https://insights.sbomify.com/CVE-2024-5362/): SourceCodester Online Hospital Management System departmentDoctor.php sql injection (medium 6.9)
- [CVE-2024-53619](https://insights.sbomify.com/CVE-2024-53619/): File upload in spip:spip (medium 6.3)
- [CVE-2024-53617](https://insights.sbomify.com/CVE-2024-53617/): A Cross Site Scripting vulnerability in LibrePhotos before commit 32237 allows attackers to takeover any account via uploading an HTML file (medium 4.8)
- [CVE-2024-53615](https://insights.sbomify.com/CVE-2024-53615/): files.photo.gallery command injection (medium 6.5)
- [CVE-2024-53614](https://insights.sbomify.com/CVE-2024-53614/): A hardcoded decryption key in Thinkware Cloud APK v4.3.46 allows attackers to access sensitive data and execute arbitrary commands with elevated privileges. (medium 6.5)
- [CVE-2024-5361](https://insights.sbomify.com/CVE-2024-5361/): PHPGurukul Zoo Management System normal-bwdates-reports-details.php sql injection (medium 5.3)
- [CVE-2024-53605](https://insights.sbomify.com/CVE-2024-53605/): Incorrect access control in the component content://com.handcent.messaging.provider.MessageProvider/ of Handcent NextSMS v10.9.9.7 allows at (high 7.5)
- [CVE-2024-53604](https://insights.sbomify.com/CVE-2024-53604/): SQL injection in phpgurukul:covid19 testing management system (critical 9.8)
- [CVE-2024-53603](https://insights.sbomify.com/CVE-2024-53603/): SQL injection in phpgurukul:covid19 testing management system (high 7.3)
- [CVE-2024-5360](https://insights.sbomify.com/CVE-2024-5360/): PHPGurukul Zoo Management System foreigner-bwdates-reports-details.php sql injection (medium 5.3)
- [CVE-2024-53599](https://insights.sbomify.com/CVE-2024-53599/): A cross-site scripting (XSS) vulnerability in the /scroll.php endpoint of LafeLabs Chaos v0.0.1 allows attackers to execute arbitrary web sc (medium 6.1)
- [CVE-2024-53597](https://insights.sbomify.com/CVE-2024-53597/): masterstack_imgcap v0.0.1 was discovered to contain a SQL injection vulnerability via the endpoint /submit. (medium 6.3)
- [CVE-2024-53591](https://insights.sbomify.com/CVE-2024-53591/): Auth bypass in seclore:seclore (critical 9.8)
- [CVE-2024-5359](https://insights.sbomify.com/CVE-2024-5359/): PHPGurukul Zoo Management System foreigner-search.php sql injection (medium 5.3)
- [CVE-2024-53589](https://insights.sbomify.com/CVE-2024-53589/): GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files. (high 8.4)
- [CVE-2024-53588](https://insights.sbomify.com/CVE-2024-53588/): A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \Pro (high 7.8)
- [CVE-2024-53586](https://insights.sbomify.com/CVE-2024-53586/): An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request. (medium 5.3)
- [CVE-2024-53584](https://insights.sbomify.com/CVE-2024-53584/): Command injection in openpanel:openpanel (critical 9.8)
- [CVE-2024-53582](https://insights.sbomify.com/CVE-2024-53582/): Path traversal in openpanel:openpanel (high 7.5)
- [CVE-2024-53580](https://insights.sbomify.com/CVE-2024-53580/): Null dereference in es:iperf3 (high 7.5)
- [CVE-2024-5358](https://insights.sbomify.com/CVE-2024-5358/): PHPGurukul Zoo Management System normal-search.php sql injection (medium 5.3)
- [CVE-2024-53573](https://insights.sbomify.com/CVE-2024-53573/): Missing authorization in changeweb:unifiedtransform (critical 9.8)
- [CVE-2024-5357](https://insights.sbomify.com/CVE-2024-5357/): PHPGurukul Zoo Management System forgot-password.php sql injection (medium 6.9)
- [CVE-2024-53569](https://insights.sbomify.com/CVE-2024-53569/): A stored cross-site scripting (XSS) vulnerability in the New Goal Creation section of Volmarg Personal Management System v1.4.65 allows auth (medium 5.4)
- [CVE-2024-53568](https://insights.sbomify.com/CVE-2024-53568/): A stored cross-site scripting (XSS) vulnerability in the Image Upload section of Volmarg Personal Management System v1.4.65 allows authentic (medium 5.4)
- [CVE-2024-53566](https://insights.sbomify.com/CVE-2024-53566/): Path traversal in debian:debian linux (medium 5.5)
- [CVE-2024-53564](https://insights.sbomify.com/CVE-2024-53564/): File upload in FreePBX (low 2.2)
- [CVE-2024-53563](https://insights.sbomify.com/CVE-2024-53563/): A stored cross-site scripting (XSS) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web (medium 5.4)
- [CVE-2024-53561](https://insights.sbomify.com/CVE-2024-53561/): A remote code execution (RCE) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary code via a crafted request. (high 8.7)
- [CVE-2024-5356](https://insights.sbomify.com/CVE-2024-5356/): anji-plus AJ-Report testTransform;swagger-ui sql injection (medium 5.3)
- [CVE-2024-53556](https://insights.sbomify.com/CVE-2024-53556/): An Open Redirect vulnerability in Taiga v6.8.1 allows attackers to redirect users to arbitrary websites via appending a crafted link to /log (medium 6.1)
- [CVE-2024-53555](https://insights.sbomify.com/CVE-2024-53555/): A CSV injection vulnerability in Taiga v6.8.1 allows attackers to execute arbitrary code via uploading a crafted CSV file. (high 8.8)
- [CVE-2024-53554](https://insights.sbomify.com/CVE-2024-53554/): A Client-Side Template Injection (CSTI) vulnerability in the component /project/new/scrum of Taiga v 8.6.1 allows remote attackers to execut (high 8.0)
- [CVE-2024-53553](https://insights.sbomify.com/CVE-2024-53553/): Auth bypass in opexustech:foiaxpress public access link (critical 9.1)
- [CVE-2024-53552](https://insights.sbomify.com/CVE-2024-53552/): Auth bypass in crushftp:crushftp (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/205/