# Vulnerabilities published in 2024


- [CVE-2024-5355](https://insights.sbomify.com/CVE-2024-5355/): anji-plus AJ-Report IGroovyHandler command injection (medium 5.3)
- [CVE-2024-53544](https://insights.sbomify.com/CVE-2024-53544/): NovaCHRON Zeitsysteme GmbH & Co. (critical 9.8)
- [CVE-2024-53543](https://insights.sbomify.com/CVE-2024-53543/): NovaCHRON Zeitsysteme GmbH & Co. (medium 5.4)
- [CVE-2024-53542](https://insights.sbomify.com/CVE-2024-53542/): Incorrect access control in the component /iclock/Settings?restartNCS=1 of NovaCHRON Zeitsysteme GmbH & Co. (medium 6.5)
- [CVE-2024-5354](https://insights.sbomify.com/CVE-2024-5354/): anji-plus AJ-Report detailByCode information disclosure (medium 5.3)
- [CVE-2024-53537](https://insights.sbomify.com/CVE-2024-53537/): Path traversal in openpanel:openpanel (critical 9.1)
- [CVE-2024-5353](https://insights.sbomify.com/CVE-2024-5353/): anji-plus AJ-Report ZIP File decompress path traversal (medium 5.3)
- [CVE-2024-53526](https://insights.sbomify.com/CVE-2024-53526/): Composio Command Execution vulnerability (medium 6.4)
- [CVE-2024-53523](https://insights.sbomify.com/CVE-2024-53523/): JSFinder commit d70ab9bc5221e016c08cffaf0d9ac79646c90645 is vulnerable to Directory Traversal in the find_by_file function. (high 7.5)
- [CVE-2024-53522](https://insights.sbomify.com/CVE-2024-53522/): Bangkok Medical Software HOSxP XE v4.64.11.3 was discovered to contain a hardcoded IDEA Key-IV pair in the HOSxPXE4.exe and HOS-WIN32.INI components. (high 7.5)
- [CVE-2024-5352](https://insights.sbomify.com/CVE-2024-5352/): anji-plus AJ-Report validationRules deserialization (medium 5.3)
- [CVE-2024-5351](https://insights.sbomify.com/CVE-2024-5351/): anji-plus AJ-Report Javascript getValueFromJs deserialization (medium 5.3)
- [CVE-2024-53507](https://insights.sbomify.com/CVE-2024-53507/): SQL injection in b3log:siyuan (critical 9.8)
- [CVE-2024-53506](https://insights.sbomify.com/CVE-2024-53506/): SQL injection in b3log:siyuan (critical 9.8)
- [CVE-2024-53505](https://insights.sbomify.com/CVE-2024-53505/): SQL injection in b3log:siyuan (critical 9.8)
- [CVE-2024-53504](https://insights.sbomify.com/CVE-2024-53504/): SQL injection in b3log:siyuan (critical 9.8)
- [CVE-2024-53502](https://insights.sbomify.com/CVE-2024-53502/): SQL injection in sem-cms:semcms (low 3.8)
- [CVE-2024-5350](https://insights.sbomify.com/CVE-2024-5350/): anji-plus AJ-Report pageList sql injection (medium 5.3)
- [CVE-2024-53499](https://insights.sbomify.com/CVE-2024-53499/): SQL injection in jeewms:jeewms (critical 9.8)
- [CVE-2024-53496](https://insights.sbomify.com/CVE-2024-53496/): Auth bypass in winterchens:my-site (critical 9.8)
- [CVE-2024-53495](https://insights.sbomify.com/CVE-2024-53495/): Auth bypass in winterchens:my-site (high 7.5)
- [CVE-2024-53494](https://insights.sbomify.com/CVE-2024-53494/): Incorrect access control in the preHandle function of SpringBootBlog v1.0.0 allows attackers to access sensitive components without authentication. (high 7.5)
- [CVE-2024-53490](https://insights.sbomify.com/CVE-2024-53490/): Favorites-web 1.3.0 favorites-web has a directory traversal vulnerability in SecurityFilter.java. (high 7.5)
- [CVE-2024-5349](https://insights.sbomify.com/CVE-2024-5349/): LA-Studio Element Kit for Elementor <= 1.3.8.1 - Authenticated (Contributor+) Local File Inclusion (high 8.8)
- [CVE-2024-53484](https://insights.sbomify.com/CVE-2024-53484/): Ever Traduora 0.20.0 and below is vulnerable to Privilege Escalation due to the use of a hard-coded JWT signing key. (high 8.8)
- [CVE-2024-53481](https://insights.sbomify.com/CVE-2024-53481/): Cross-site scripting in phpgurukul:beauty parlour management system (medium 6.1)
- [CVE-2024-53480](https://insights.sbomify.com/CVE-2024-53480/): SQL injection in phpgurukul:beauty parlour management system (critical 9.8)
- [CVE-2024-5348](https://insights.sbomify.com/CVE-2024-5348/): Elements For Elementor <= 2.1 - Authenticated (Contributor+) Local File Inclusion via Multiple Widget Attributes (high 8.8)
- [CVE-2024-53477](https://insights.sbomify.com/CVE-2024-53477/): Deserialization in jflyfox:jfinal cms (critical 9.8)
- [CVE-2024-53476](https://insights.sbomify.com/CVE-2024-53476/): A race condition vulnerability in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f allows attackers to bypass inventory rest (medium 5.9)
- [CVE-2024-53473](https://insights.sbomify.com/CVE-2024-53473/): Missing authorization in wegia:wegia (high 7.5)
- [CVE-2024-53472](https://insights.sbomify.com/CVE-2024-53472/): Cross-site request forgery in wegia:wegia (high 8.8)
- [CVE-2024-53471](https://insights.sbomify.com/CVE-2024-53471/): Cross-site scripting in wegia:wegia (medium 6.1)
- [CVE-2024-53470](https://insights.sbomify.com/CVE-2024-53470/): Cross-site scripting in wegia:wegia (medium 6.1)
- [CVE-2024-5347](https://insights.sbomify.com/CVE-2024-5347/): Cross-site scripting in Happy Addons for Elementor (medium 6.4)
- [CVE-2024-5346](https://insights.sbomify.com/CVE-2024-5346/): Cross-site scripting in Flatsome (medium 6.4)
- [CVE-2024-53459](https://insights.sbomify.com/CVE-2024-53459/): Cross-site scripting in sysax:multi server (medium 6.1)
- [CVE-2024-53458](https://insights.sbomify.com/CVE-2024-53458/): Denial of service in sysax:multi server (high 7.5)
- [CVE-2024-53457](https://insights.sbomify.com/CVE-2024-53457/): LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section (medium 5.4)
- [CVE-2024-53450](https://insights.sbomify.com/CVE-2024-53450/): Missing authorization in infiniflow:ragflow (high 7.5)
- [CVE-2024-5345](https://insights.sbomify.com/CVE-2024-5345/): Responsive Owl Carousel for Elementor <= 1.2.0 - Local File Inclusion (high 8.8)
- [CVE-2024-53442](https://insights.sbomify.com/CVE-2024-53442/): whapa v1.59 is vulnerable to Command Injection via a crafted filename to the HTML reports component. (critical 9.8)
- [CVE-2024-53441](https://insights.sbomify.com/CVE-2024-53441/): Bit flip attack vulnerability in cookie-encrypter (critical 9.1)
- [CVE-2024-5344](https://insights.sbomify.com/CVE-2024-5344/): The Plus Addons for Elementor Page Builder <= 5.5.6 - Reflected Cross-Site Scripting via WP Login and Register Widget (medium 6.1)
- [CVE-2024-53438](https://insights.sbomify.com/CVE-2024-53438/): SQL injection in churchcrm:churchcrm (critical 9.8)
- [CVE-2024-53432](https://insights.sbomify.com/CVE-2024-53432/): While parsing certain malformed PLY files, PCL version 1.14.1 crashes due to an uncaught std::out_of_range exception in PCLPointCloud2::at. (high 7.5)
- [CVE-2024-5343](https://insights.sbomify.com/CVE-2024-5343/): Cross-site request forgery in Robo Gallery – Photo & Image Slider (high 8.8)
- [CVE-2024-53429](https://insights.sbomify.com/CVE-2024-53429/): Open62541 v1.4.6 is has an assertion failure in fuzz_binary_decode, which leads to a crash. (high 7.5)
- [CVE-2024-53427](https://insights.sbomify.com/CVE-2024-53427/): Memory corruption in jq (high 8.1)
- [CVE-2024-53426](https://insights.sbomify.com/CVE-2024-53426/): A heap-buffer-overflow vulnerability has been identified in ntopng 6.2 in the Flow::dissectMDNS function. (medium 6.2)
- [CVE-2024-53425](https://insights.sbomify.com/CVE-2024-53425/): Memory corruption in assimp:assimp (medium 6.2)
- [CVE-2024-53423](https://insights.sbomify.com/CVE-2024-53423/): Denial of service in opennetworking:onos (medium 5.6)
- [CVE-2024-5342](https://insights.sbomify.com/CVE-2024-5342/): Simple Image Popup Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-53412](https://insights.sbomify.com/CVE-2024-53412/): NietThijmen ShoppingCart: Command injection in the connect function (high 8.4)
- [CVE-2024-5341](https://insights.sbomify.com/CVE-2024-5341/): Cross-site scripting in The Plus Addons for Elementor Page Builder Pro (medium 6.4)
- [CVE-2024-53408](https://insights.sbomify.com/CVE-2024-53408/): AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability. (medium 5.4)
- [CVE-2024-53407](https://insights.sbomify.com/CVE-2024-53407/): Code injection in phiewer:phiewer (low 3.3)
- [CVE-2024-53406](https://insights.sbomify.com/CVE-2024-53406/): Auth bypass in espressif:esp-idf (high 8.8)
- [CVE-2024-5340](https://insights.sbomify.com/CVE-2024-5340/): Ruijie RG-UAC sub_commit.php os command injection (medium 5.1)
- [CVE-2024-5339](https://insights.sbomify.com/CVE-2024-5339/): Ruijie RG-UAC online_check.php os command injection (medium 5.1)
- [CVE-2024-53388](https://insights.sbomify.com/CVE-2024-53388/): mavo DOM Clobbering vulnerability (high 8.8)
- [CVE-2024-53387](https://insights.sbomify.com/CVE-2024-53387/): Cross-site scripting in umeditor project:umeditor (high 8.8)
- [CVE-2024-53386](https://insights.sbomify.com/CVE-2024-53386/): Stage.js DOM Clobbering vulnerabilty (medium 4.9)
- [CVE-2024-53384](https://insights.sbomify.com/CVE-2024-53384/): tsup DOM Clobbering vulnerability (medium 5.1)
- [CVE-2024-53382](https://insights.sbomify.com/CVE-2024-53382/): PrismJS DOM Clobbering vulnerability (medium 4.9)
- [CVE-2024-5338](https://insights.sbomify.com/CVE-2024-5338/): Ruijie RG-UAC online.php os command injection (medium 5.1)
- [CVE-2024-53379](https://insights.sbomify.com/CVE-2024-53379/): Heap buffer overflow in the server site handshake implementation in Real Time Logic LLC's SharkSSL version (from 05/05/24) commit 64808a5e12 (high 7.5)
- [CVE-2024-53376](https://insights.sbomify.com/CVE-2024-53376/): Command injection in cyberpanel:cyberpanel (high 8.8)
- [CVE-2024-53375](https://insights.sbomify.com/CVE-2024-53375/): An Authenticated Remote Code Execution (RCE) vulnerability affects the TP-Link Archer router series. (high 8.0)
- [CVE-2024-5337](https://insights.sbomify.com/CVE-2024-5337/): Ruijie RG-UAC user_commit.php os command injection (medium 5.1)
- [CVE-2024-53365](https://insights.sbomify.com/CVE-2024-53365/): Cross-site scripting in phpgurukul:vehicle parking management system (medium 6.1)
- [CVE-2024-53364](https://insights.sbomify.com/CVE-2024-53364/): SQL injection in phpgurukul:vehicle parking management system (medium 5.4)
- [CVE-2024-5336](https://insights.sbomify.com/CVE-2024-5336/): Ruijie RG-UAC vlan_add_commit.php addVlan os command injection (medium 5.1)
- [CVE-2024-53359](https://insights.sbomify.com/CVE-2024-53359/): Information disclosure in zalo:zalo (high 7.5)
- [CVE-2024-53357](https://insights.sbomify.com/CVE-2024-53357/): SQL injection in easyvirt:co2scope (high 7.5)
- [CVE-2024-53356](https://insights.sbomify.com/CVE-2024-53356/): Hardcoded credentials in easyvirt:co2scope (critical 9.8)
- [CVE-2024-53355](https://insights.sbomify.com/CVE-2024-53355/): Missing authorization in easyvirt:co2scope (high 8.8)
- [CVE-2024-53354](https://insights.sbomify.com/CVE-2024-53354/): SQL injection in easyvirt:co2scope (medium 6.5)
- [CVE-2024-53351](https://insights.sbomify.com/CVE-2024-53351/): PipeCD Vulnerable to Privilege Escalation (critical 9.8)
- [CVE-2024-53350](https://insights.sbomify.com/CVE-2024-53350/): Privilege escalation in kubeslice:kubeslice (high 7.4)
- [CVE-2024-5335](https://insights.sbomify.com/CVE-2024-5335/): Deserialization in Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor (critical 9.8)
- [CVE-2024-53349](https://insights.sbomify.com/CVE-2024-53349/): Misconfiguration in linuxfoundation:kuadrant (high 7.4)
- [CVE-2024-53348](https://insights.sbomify.com/CVE-2024-53348/): Missing authorization in loxilb:loxilb (high 7.4)
- [CVE-2024-53345](https://insights.sbomify.com/CVE-2024-53345/): An authenticated arbitrary file upload vulnerability in Car Rental Management System v1.0 to v1.3 allows attackers to execute arbitrary code (high 8.8)
- [CVE-2024-5334](https://insights.sbomify.com/CVE-2024-5334/): Local File Read in stitionai/devika (high 7.5)
- [CVE-2024-53335](https://insights.sbomify.com/CVE-2024-53335/): Memory corruption in totolink:a810r firmware (high 7.8)
- [CVE-2024-53334](https://insights.sbomify.com/CVE-2024-53334/): Memory corruption in totolink:a810r firmware (high 8.8)
- [CVE-2024-53333](https://insights.sbomify.com/CVE-2024-53333/): Command injection in totolink:ex200 firmware (medium 6.3)
- [CVE-2024-5333](https://insights.sbomify.com/CVE-2024-5333/): The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure (medium 5.3)
- [CVE-2024-53326](https://insights.sbomify.com/CVE-2024-53326/): LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code execution. (high 7.3)
- [CVE-2024-53320](https://insights.sbomify.com/CVE-2024-53320/): Qualisys C++ SDK commit a32a21a was discovered to contain multiple stack buffer overflows via the GetCurrentFrame, SaveCapture, and LoadProject functions. (critical 9.8)
- [CVE-2024-5332](https://insights.sbomify.com/CVE-2024-5332/): Exclusive Addons for Elementor <= 2.6.9.8 - Authenticated (Contibutor+) Stored Cross-Site Scripting via Card Widget (medium 6.4)
- [CVE-2024-53319](https://insights.sbomify.com/CVE-2024-53319/): A heap buffer overflow in the XML Text Escaping component of Qualisys C++ SDK commit a32a21a allows attackers to cause Denial of Service (Do (high 7.5)
- [CVE-2024-53311](https://insights.sbomify.com/CVE-2024-53311/): A Stack buffer overflow in the arguments parameter in Immunity Inc. (medium 5.5)
- [CVE-2024-53310](https://insights.sbomify.com/CVE-2024-53310/): A Structured Exception Handler based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 whe (medium 5.5)
- [CVE-2024-5331](https://insights.sbomify.com/CVE-2024-5331/): Breakdance <= 1.7.2 - Missing Authorization (medium 4.3)
- [CVE-2024-53309](https://insights.sbomify.com/CVE-2024-53309/): A stack-based buffer overflow vulnerability exists in Effectmatrix Total Video Converter Command Line (TVCC) 2.50 when an overly long string (medium 5.5)
- [CVE-2024-53307](https://insights.sbomify.com/CVE-2024-53307/): Cross-site scripting in evisions:maps (medium 5.4)
- [CVE-2024-53305](https://insights.sbomify.com/CVE-2024-53305/): Whoogle allows attackers to execute arbitrary code via supplying a crafted search query (high 7.3)
- [CVE-2024-53304](https://insights.sbomify.com/CVE-2024-53304/): An issue in LRQA Nettitude PoshC2 after commit 09ee2cf allows unauthenticated attackers to connect to the C2 server and execute arbitrary co (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/206/