# Vulnerabilities published in 2024 - [CVE-2024-52791](https://insights.sbomify.com/CVE-2024-52791/): Denial of service through memory exhaustion in Matrix Media Repo (medium 5.3) - [CVE-2024-5279](https://insights.sbomify.com/CVE-2024-5279/): Qiwen Netdisk File Rename cross site scripting (medium 5.3) - [CVE-2024-52789](https://insights.sbomify.com/CVE-2024-52789/): Hardcoded credentials in tenda:w30e firmware (high 8.0) - [CVE-2024-52788](https://insights.sbomify.com/CVE-2024-52788/): Hardcoded credentials in tenda:w9 firmware (high 8.0) - [CVE-2024-52787](https://insights.sbomify.com/CVE-2024-52787/): libre-chat Path Traversal vulnerability (critical 9.1) - [CVE-2024-52786](https://insights.sbomify.com/CVE-2024-52786/): An authentication bypass vulnerability in anji-plus AJ-Report up to v1.4.2 allows unauthenticated attackers to execute arbitrary code via a crafted URL. (critical 9.8) - [CVE-2024-52783](https://insights.sbomify.com/CVE-2024-52783/): Insecure permissions in the XNetSocketClient component of XINJE XDPPro.exe v3.2.2 to v3.7.17c allows attackers to execute arbitrary code via (medium 5.1) - [CVE-2024-52782](https://insights.sbomify.com/CVE-2024-52782/): Code injection in dcnetworks:dcme-320-l firmware (critical 9.8) - [CVE-2024-52781](https://insights.sbomify.com/CVE-2024-52781/): Code injection in dcnetworks:dcme-320-l firmware (critical 9.8) - [CVE-2024-52780](https://insights.sbomify.com/CVE-2024-52780/): Code injection in dcnetworks:dcme-320-l firmware (critical 9.8) - [CVE-2024-5278](https://insights.sbomify.com/CVE-2024-5278/): Unrestricted File Upload leading to RCE in gaizhenbiao/chuanhuchatgpt (medium 6.5) - [CVE-2024-52779](https://insights.sbomify.com/CVE-2024-52779/): Code injection in dcnetworks:dcme-320-l firmware (critical 9.8) - [CVE-2024-52778](https://insights.sbomify.com/CVE-2024-52778/): Code injection in dcnetworks:dcme-320-l firmware (critical 9.8) - [CVE-2024-52777](https://insights.sbomify.com/CVE-2024-52777/): Code injection in dcnetworks:dcme-320-l firmware (critical 9.8) - [CVE-2024-52771](https://insights.sbomify.com/CVE-2024-52771/): Path traversal in dedebiz:dedebiz (critical 9.1) - [CVE-2024-52770](https://insights.sbomify.com/CVE-2024-52770/): File upload in dedebiz:dedebiz (critical 9.8) - [CVE-2024-5277](https://insights.sbomify.com/CVE-2024-5277/): Weak Password Recovery Mechanism in lunary-ai/lunary (medium 6.4) - [CVE-2024-52769](https://insights.sbomify.com/CVE-2024-52769/): File upload in dedebiz:dedebiz (high 7.2) - [CVE-2024-52765](https://insights.sbomify.com/CVE-2024-52765/): Code injection in h3c:gr-1800ax firmware (critical 9.8) - [CVE-2024-52763](https://insights.sbomify.com/CVE-2024-52763/): Cross-site scripting in ganglia:ganglia-web (medium 6.1) - [CVE-2024-52762](https://insights.sbomify.com/CVE-2024-52762/): Cross-site scripting in ganglia:ganglia-web (medium 6.1) - [CVE-2024-5276](https://insights.sbomify.com/CVE-2024-5276/): SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier) (critical 9.8) - [CVE-2024-52759](https://insights.sbomify.com/CVE-2024-52759/): Memory corruption in dlink:di-8003 firmware (low 3.5) - [CVE-2024-52757](https://insights.sbomify.com/CVE-2024-52757/): Memory corruption in dlink:di-8003 firmware (low 3.5) - [CVE-2024-52755](https://insights.sbomify.com/CVE-2024-52755/): Memory corruption in dlink:di-8003 firmware (low 3.5) - [CVE-2024-52754](https://insights.sbomify.com/CVE-2024-52754/): Memory corruption in dlink:di-8003 firmware (low 3.5) - [CVE-2024-5275](https://insights.sbomify.com/CVE-2024-5275/): Hardcoded credentials in FileCatalyst Direct (high 7.8) - [CVE-2024-5274](https://insights.sbomify.com/CVE-2024-5274/): Google Chromium V8 Type Confusion (high 8.3, exploited in the wild) - [CVE-2024-52739](https://insights.sbomify.com/CVE-2024-52739/): Command injection in dlink:di-8400 firmware (high 8.0) - [CVE-2024-52732](https://insights.sbomify.com/CVE-2024-52732/): Incorrect access control in wms-Warehouse management system-zeqp v2.20.9.1 due to the token value of the zeqp system being reused. (critical 9.1) - [CVE-2024-5273](https://insights.sbomify.com/CVE-2024-5273/): Jenkins Report Info Plugin Path Traversal vulnerability (medium 4.3) - [CVE-2024-52726](https://insights.sbomify.com/CVE-2024-52726/): Path traversal in crmeb:crmeb (high 7.5) - [CVE-2024-52725](https://insights.sbomify.com/CVE-2024-52725/): SQL injection in sem-cms:semcms (medium 4.9) - [CVE-2024-52724](https://insights.sbomify.com/CVE-2024-52724/): SQL injection in zzcms:zzcms (critical 9.8) - [CVE-2024-52723](https://insights.sbomify.com/CVE-2024-52723/): Command injection in totolink:x6000r firmware (critical 9.8) - [CVE-2024-5272](https://insights.sbomify.com/CVE-2024-5272/): Run Details leak to guest via webhook event "custom_playbooks_playbook_run_updated" (medium 4.3) - [CVE-2024-52714](https://insights.sbomify.com/CVE-2024-52714/): Memory corruption in tenda:ac6 firmware (high 8.1) - [CVE-2024-52711](https://insights.sbomify.com/CVE-2024-52711/): Memory corruption in dlink:di-8100 firmware (medium 5.7) - [CVE-2024-5271](https://insights.sbomify.com/CVE-2024-5271/): Fuji Electric Monitouch V-SFT Access of Resource Using Incompatible Type ('Type Confusion') (high 8.5) - [CVE-2024-52702](https://insights.sbomify.com/CVE-2024-52702/): Cross-site scripting in mybb:mybb (medium 6.1) - [CVE-2024-52701](https://insights.sbomify.com/CVE-2024-52701/): Cross-site scripting in piwigo:piwigo (medium 5.4) - [CVE-2024-5270](https://insights.sbomify.com/CVE-2024-5270/): SAML to email switch possible when email signin is disabled (medium 4.3) - [CVE-2024-5269](https://insights.sbomify.com/CVE-2024-5269/): Sonos Era 100 SMB2 Message Handling Use-After-Free Remote Code Execution Vulnerability (high 8.8) - [CVE-2024-52680](https://insights.sbomify.com/CVE-2024-52680/): Cross-site scripting in eyoucms:eyoucms (medium 6.1) - [CVE-2024-5268](https://insights.sbomify.com/CVE-2024-5268/): Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Read Information Disclosure Vulnerability (medium 4.3) - [CVE-2024-52677](https://insights.sbomify.com/CVE-2024-52677/): File upload in hkcms:hkcms (critical 9.8) - [CVE-2024-52676](https://insights.sbomify.com/CVE-2024-52676/): Cross-site scripting in emiloimagtolis:online discussion forum (medium 5.4) - [CVE-2024-52675](https://insights.sbomify.com/CVE-2024-52675/): SQL injection in oretnom23:sentiment based movie rating system (critical 9.8) - [CVE-2024-5267](https://insights.sbomify.com/CVE-2024-5267/): Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution Vulnerability (high 8.8) - [CVE-2024-5266](https://insights.sbomify.com/CVE-2024-5266/): Download Manager <= 3.2.92 - Authenticated (Author+) Stored Cross-Site Scripting via Multiple Shortcodes (medium 6.4) - [CVE-2024-5265](https://insights.sbomify.com/CVE-2024-5265/): Cross-site scripting in WPBakery Page Builder (medium 6.4) - [CVE-2024-5264](https://insights.sbomify.com/CVE-2024-5264/): Network Key Transfer with AES KHT vulnerability in Luna EFT (medium 5.9) - [CVE-2024-5263](https://insights.sbomify.com/CVE-2024-5263/): Cross-site scripting in ElementsKit Pro (medium 6.4) - [CVE-2024-5262](https://insights.sbomify.com/CVE-2024-5262/): ProjectDiscovery Interactsh - Files or Directories Accessible to External Parties (critical 9.3) - [CVE-2024-52616](https://insights.sbomify.com/CVE-2024-52616/): Avahi: avahi wide-area dns predictable transaction ids (medium 5.3) - [CVE-2024-52615](https://insights.sbomify.com/CVE-2024-52615/): Avahi: avahi wide-area dns uses constant source port (medium 5.3) - [CVE-2024-52614](https://insights.sbomify.com/CVE-2024-52614/): Hardcoded credentials in Kura Sushi Official App Produced by EPARK (medium 4.0) - [CVE-2024-52613](https://insights.sbomify.com/CVE-2024-52613/): Memory corruption in justdan96:tsmuxer (medium 5.5) - [CVE-2024-52612](https://insights.sbomify.com/CVE-2024-52612/): SolarWinds Platform Reflected Cross-Site Scripting Vulnerability (medium 6.8) - [CVE-2024-52611](https://insights.sbomify.com/CVE-2024-52611/): SolarWinds Platform Information Disclosure Vulnerability (low 3.5) - [CVE-2024-5261](https://insights.sbomify.com/CVE-2024-5261/): TLS certificate are not properly verified when utilizing LibreOfficeKit (critical 10.0) - [CVE-2024-52606](https://insights.sbomify.com/CVE-2024-52606/): SolarWinds Platform Server-Side Request Forgery Vulnerability (low 3.5) - [CVE-2024-52602](https://insights.sbomify.com/CVE-2024-52602/): Server-Side Request Forgery (SSRF) on redirects and federation in Matrix Media Repo (medium 5.0) - [CVE-2024-52601](https://insights.sbomify.com/CVE-2024-52601/): iTop portal Insecure Direct Object Reference vulnerability (medium 6.5) - [CVE-2024-52600](https://insights.sbomify.com/CVE-2024-52600/): Statamic CMS has Path Traversal in Asset Upload (medium 5.3) - [CVE-2024-5260](https://insights.sbomify.com/CVE-2024-5260/): Cross-site scripting in Sina Extension for Elementor (medium 6.4) - [CVE-2024-52599](https://insights.sbomify.com/CVE-2024-52599/): Tuleap vulnerable to XSS in the Gantt chart of the tracker plugin (medium 5.4) - [CVE-2024-52598](https://insights.sbomify.com/CVE-2024-52598/): 2FAuth vulnerable to Server Side Request Forgery + URI validation bypass in 2fauth /api/v1/twofaccounts/preview (high 7.5) - [CVE-2024-52597](https://insights.sbomify.com/CVE-2024-52597/): 2FAuth vulnerable to stored cross-site scripting via SVG upload and direct access render (medium 6.1) - [CVE-2024-52596](https://insights.sbomify.com/CVE-2024-52596/): SimpleSAMLphp xml-common XXE vulnerability (high 8.8) - [CVE-2024-52595](https://insights.sbomify.com/CVE-2024-52595/): HTML Cleaner allows crafted scripts in special contexts like svg or math to pass through (high 7.7) - [CVE-2024-52594](https://insights.sbomify.com/CVE-2024-52594/): Server-Side Request Forgery (SSRF) on redirects and federation in gomatrixserverlib (medium 4.3) - [CVE-2024-52593](https://insights.sbomify.com/CVE-2024-52593/): Missing validation allows spoofed "origin" links in Misskey (medium 5.1) - [CVE-2024-52592](https://insights.sbomify.com/CVE-2024-52592/): Missing validation allows spoofed poll updates in Misskey (medium 6.9) - [CVE-2024-52591](https://insights.sbomify.com/CVE-2024-52591/): Missing validation allows spoofed profiles and notes in Misskey (high 8.8) - [CVE-2024-52590](https://insights.sbomify.com/CVE-2024-52590/): Missing validation allows spoofed profiles in Misskey (high 8.8) - [CVE-2024-5259](https://insights.sbomify.com/CVE-2024-5259/): Cross-site scripting in MultiVendorX – WooCommerce Multivendor Marketplace Solutions (medium 6.4) - [CVE-2024-52589](https://insights.sbomify.com/CVE-2024-52589/): Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse (low 2.2) - [CVE-2024-52588](https://insights.sbomify.com/CVE-2024-52588/): Strapi allows Server-Side Request Forgery in Webhook function (medium 4.9) - [CVE-2024-52587](https://insights.sbomify.com/CVE-2024-52587/): Harden-Runner has command injection weaknesses in `setup.ts` and `arc-runner.ts` (low 2.7) - [CVE-2024-52586](https://insights.sbomify.com/CVE-2024-52586/): eLabFTW MFA bypass (medium 5.4) - [CVE-2024-52585](https://insights.sbomify.com/CVE-2024-52585/): Autolab has HTML Injection Vulnerability (low 1.2) - [CVE-2024-52584](https://insights.sbomify.com/CVE-2024-52584/): Autolab has vulnerable submission endpoints (medium 4.9) - [CVE-2024-52583](https://insights.sbomify.com/CVE-2024-52583/): WesHacks code includes links to Leostop tracking spyware infested files (high 8.2) - [CVE-2024-52582](https://insights.sbomify.com/CVE-2024-52582/): cachi2 allows traceback prints locals (medium 4.7) - [CVE-2024-52581](https://insights.sbomify.com/CVE-2024-52581/): Litestar allows unbounded resource consumption (DoS vulnerability) (high 8.2) - [CVE-2024-5258](https://insights.sbomify.com/CVE-2024-5258/): Authorization Bypass Through User-Controlled Key in GitLab (medium 4.4) - [CVE-2024-52579](https://insights.sbomify.com/CVE-2024-52579/): Server-Side Request Forgery vulnerability in various APIs in Misskey (medium 6.4) - [CVE-2024-52577](https://insights.sbomify.com/CVE-2024-52577/): Apache Ignite: Possible RCE when deserializing incoming messages by the server node (critical 9.5) - [CVE-2024-52574](https://insights.sbomify.com/CVE-2024-52574/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3) - [CVE-2024-52573](https://insights.sbomify.com/CVE-2024-52573/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3) - [CVE-2024-52572](https://insights.sbomify.com/CVE-2024-52572/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3) - [CVE-2024-52571](https://insights.sbomify.com/CVE-2024-52571/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3) - [CVE-2024-52570](https://insights.sbomify.com/CVE-2024-52570/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3) - [CVE-2024-5257](https://insights.sbomify.com/CVE-2024-5257/): Improper Access Control in GitLab (medium 4.9) - [CVE-2024-52569](https://insights.sbomify.com/CVE-2024-52569/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3) - [CVE-2024-52568](https://insights.sbomify.com/CVE-2024-52568/): Use after free in Teamcenter Visualization V14.2 (high 7.3) - [CVE-2024-52567](https://insights.sbomify.com/CVE-2024-52567/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3) - [CVE-2024-52566](https://insights.sbomify.com/CVE-2024-52566/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3) - [CVE-2024-52565](https://insights.sbomify.com/CVE-2024-52565/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3) --- From sbomify Insights: https://insights.sbomify.com/years/2024/page/212/