# Vulnerabilities published in 2024


- [CVE-2024-52564](https://insights.sbomify.com/CVE-2024-52564/): Security feature bypass in UD-LT1 (high 7.5)
- [CVE-2024-52561](https://insights.sbomify.com/CVE-2024-52561/): Privilege escalation in Parallels Desktop for Mac (high 7.8)
- [CVE-2024-52560](https://insights.sbomify.com/CVE-2024-52560/): fs/ntfs3: Mark inode as bad as soon as error detected in mi_enum_attr() (high 7.8)
- [CVE-2024-5256](https://insights.sbomify.com/CVE-2024-5256/): Sonos Era 100 SMB2 Message Handling Integer Underflow Information Disclosure Vulnerability (medium 4.3)
- [CVE-2024-52559](https://insights.sbomify.com/CVE-2024-52559/): drm/msm/gem: prevent integer overflow in msm_ioctl_gem_submit() (high 7.8)
- [CVE-2024-52558](https://insights.sbomify.com/CVE-2024-52558/): Planet Technology Planet WGS-804HPT Integer Underflow (medium 6.9)
- [CVE-2024-52557](https://insights.sbomify.com/CVE-2024-52557/): drm: zynqmp_dp: Fix integer overflow in zynqmp_dp_rate_get() (medium 5.5)
- [CVE-2024-52555](https://insights.sbomify.com/CVE-2024-52555/): Code injection in WebStorm (medium 6.3)
- [CVE-2024-52554](https://insights.sbomify.com/CVE-2024-52554/): Script security bypass vulnerability in Jenkins Shared Library Version Override Plugin (high 8.8)
- [CVE-2024-52553](https://insights.sbomify.com/CVE-2024-52553/): Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin (high 8.8)
- [CVE-2024-52552](https://insights.sbomify.com/CVE-2024-52552/): Stored XSS vulnerability in Jenkins Authorize Project Plugin (high 8.0)
- [CVE-2024-52551](https://insights.sbomify.com/CVE-2024-52551/): Restarting a run with revoked script approval allowed by Jenkins Pipeline: Declarative Plugin (high 8.0)
- [CVE-2024-52550](https://insights.sbomify.com/CVE-2024-52550/): Rebuilding a run with revoked script approval allowed by Jenkins Pipeline: Groovy Plugin (high 8.0)
- [CVE-2024-5255](https://insights.sbomify.com/CVE-2024-5255/): Cross-site scripting in Ultimate Addons for WPBakery (medium 6.4)
- [CVE-2024-52549](https://insights.sbomify.com/CVE-2024-52549/): Missing permission check in Jenkins Script Security Plugin (medium 4.3)
- [CVE-2024-52548](https://insights.sbomify.com/CVE-2024-52548/): Lorex 2K Indoor Wi-Fi Security Camera - Code signing bypass (medium 6.7)
- [CVE-2024-52547](https://insights.sbomify.com/CVE-2024-52547/): Lorex 2K Indoor Wi-Fi Security Camera - Stack buffer overflow (high 7.2)
- [CVE-2024-52546](https://insights.sbomify.com/CVE-2024-52546/): Lorex 2K Indoor Wi-Fi Security Camera - Null pointer dereference (medium 5.3)
- [CVE-2024-52545](https://insights.sbomify.com/CVE-2024-52545/): Lorex 2K Indoor Wi-Fi Security Camera - Out of bounds heap read (medium 6.5)
- [CVE-2024-52544](https://insights.sbomify.com/CVE-2024-52544/): Lorex 2K Indoor Wi-Fi Security Camera - Stack buffer overflow (critical 9.8)
- [CVE-2024-52543](https://insights.sbomify.com/CVE-2024-52543/): Information disclosure in NativeEdge (medium 6.5)
- [CVE-2024-52542](https://insights.sbomify.com/CVE-2024-52542/): Path traversal in AppSync (medium 4.4)
- [CVE-2024-52541](https://insights.sbomify.com/CVE-2024-52541/): Auth bypass in Dell Client Platform BIOS (high 8.2)
- [CVE-2024-5254](https://insights.sbomify.com/CVE-2024-5254/): Cross-site scripting in Ultimate Addons for WPBakery (medium 6.4)
- [CVE-2024-52538](https://insights.sbomify.com/CVE-2024-52538/): SQL injection in Avamar (high 7.6)
- [CVE-2024-52537](https://insights.sbomify.com/CVE-2024-52537/): Privilege escalation in Dell Client Platform BIOS (medium 6.3)
- [CVE-2024-52535](https://insights.sbomify.com/CVE-2024-52535/): Privilege escalation in SupportAssist for Business PCs (high 7.1)
- [CVE-2024-52534](https://insights.sbomify.com/CVE-2024-52534/): Auth bypass in ECS (medium 5.4)
- [CVE-2024-52533](https://insights.sbomify.com/CVE-2024-52533/): Memory corruption in debian:debian linux (critical 9.8)
- [CVE-2024-52532](https://insights.sbomify.com/CVE-2024-52532/): Denial of service in gnome:libsoup (high 7.5)
- [CVE-2024-52531](https://insights.sbomify.com/CVE-2024-52531/): Memory corruption in libsoup (medium 6.5)
- [CVE-2024-52530](https://insights.sbomify.com/CVE-2024-52530/): Other in gnome:libsoup (high 7.5)
- [CVE-2024-5253](https://insights.sbomify.com/CVE-2024-5253/): Cross-site scripting in Ultimate Addons for WPBakery (medium 6.4)
- [CVE-2024-52529](https://insights.sbomify.com/CVE-2024-52529/): Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium (medium 5.8)
- [CVE-2024-52528](https://insights.sbomify.com/CVE-2024-52528/): Auth Token can be passed dummy or wrong the middleware response is 200 OK (critical 9.3)
- [CVE-2024-52526](https://insights.sbomify.com/CVE-2024-52526/): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/services.inc.php (medium 4.8)
- [CVE-2024-52525](https://insights.sbomify.com/CVE-2024-52525/): Nextcloud Server User password is available in memory of the PHP process (low 1.8)
- [CVE-2024-52524](https://insights.sbomify.com/CVE-2024-52524/): ReDoS in Giskard Scan text perturbation (medium 6.9)
- [CVE-2024-52523](https://insights.sbomify.com/CVE-2024-52523/): Nextcloud Server Custom defined credentials of external storages are sent back to the frontend (medium 4.6)
- [CVE-2024-52522](https://insights.sbomify.com/CVE-2024-52522/): Rclone Improper Permission and Ownership Handling on Symlink Targets with --links and --metadata (medium 5.4)
- [CVE-2024-52521](https://insights.sbomify.com/CVE-2024-52521/): Nextcloud Server has a potential hash collision for background jobs could skip queuing them (low 2.6)
- [CVE-2024-52520](https://insights.sbomify.com/CVE-2024-52520/): Nextcloud Server's link reference provider can be tricked into downloading bigger files than intended (medium 5.7)
- [CVE-2024-5252](https://insights.sbomify.com/CVE-2024-5252/): Cross-site scripting in Ultimate Addons for WPBakery (medium 6.4)
- [CVE-2024-52519](https://insights.sbomify.com/CVE-2024-52519/): Nextcloud Server's OAuth2 client secrets were stored in a recoverable way (low 2.7)
- [CVE-2024-52518](https://insights.sbomify.com/CVE-2024-52518/): Nextcloud Server is missing password confirmation when changing external storage options (medium 4.4)
- [CVE-2024-52517](https://insights.sbomify.com/CVE-2024-52517/): Nextcloud Server's global credentials of external storages are sent back to the frontend (medium 4.6)
- [CVE-2024-52516](https://insights.sbomify.com/CVE-2024-52516/): Business logic in security-advisories (low 3.0)
- [CVE-2024-52515](https://insights.sbomify.com/CVE-2024-52515/): Nextcloud Server has incomplete sanitization of SVG files allows to embed other images into previews (medium 5.7)
- [CVE-2024-52514](https://insights.sbomify.com/CVE-2024-52514/): Nextcloud Server allows users to copy folder that contain files that are blocked by the files access control (medium 4.1)
- [CVE-2024-52513](https://insights.sbomify.com/CVE-2024-52513/): Nextcloud Server's Attachments folder for Text app is accessible on "Files drop" and "Password protected" shares (low 2.6)
- [CVE-2024-52512](https://insights.sbomify.com/CVE-2024-52512/): Nextcloud User OIDC has an open redirection when logging in with User OIDC (low 3.3)
- [CVE-2024-52511](https://insights.sbomify.com/CVE-2024-52511/): Nextcloud Tables has an Authorization Bypass Through User-Controlled Key in Tables (medium 6.3)
- [CVE-2024-52510](https://insights.sbomify.com/CVE-2024-52510/): Nextcloud Desktop client behaves incorrectly if the initial end-to-end-encryption signature is empty (medium 4.2)
- [CVE-2024-5251](https://insights.sbomify.com/CVE-2024-5251/): Cross-site scripting in Ultimate Addons for WPBakery (medium 6.4)
- [CVE-2024-52509](https://insights.sbomify.com/CVE-2024-52509/): Nextcloud Mail app does not respect download permissions in shares (low 3.5)
- [CVE-2024-52508](https://insights.sbomify.com/CVE-2024-52508/): Nextcloud Mail auto configurator can be tricked into sending account information to wrong servers (high 8.2)
- [CVE-2024-52507](https://insights.sbomify.com/CVE-2024-52507/): Share information of the Nextcloud Tables app is not limited to affected users (low 3.5)
- [CVE-2024-52506](https://insights.sbomify.com/CVE-2024-52506/): Graylog can leak other users' reports via concurrent PDF report rendering (high 7.1)
- [CVE-2024-52505](https://insights.sbomify.com/CVE-2024-52505/): matrix-appservice-irc allows IRC Command injection in provisioning API (medium 5.4)
- [CVE-2024-52504](https://insights.sbomify.com/CVE-2024-52504/): Denial of service in SIPROTEC 4 6MD61 (high 8.7)
- [CVE-2024-52503](https://insights.sbomify.com/CVE-2024-52503/): WordPress Tailored Tools plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52502](https://insights.sbomify.com/CVE-2024-52502/): WordPress ImbaChat plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52501](https://insights.sbomify.com/CVE-2024-52501/): WordPress Office Locator plugin <= 1.3.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-52500](https://insights.sbomify.com/CVE-2024-52500/): WordPress Monetag Official Plugin plugin <= 1.1.3 - Broken Access Control vulnerability (high 7.2)
- [CVE-2024-5250](https://insights.sbomify.com/CVE-2024-5250/): Overly Verbose Errors in SAML Integration (low 3.5)
- [CVE-2024-52499](https://insights.sbomify.com/CVE-2024-52499/): WordPress Pricing table addon for elementor plugin <= 1.0.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-52498](https://insights.sbomify.com/CVE-2024-52498/): WordPress SP Blog Designer plugin <= 1.0.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-52497](https://insights.sbomify.com/CVE-2024-52497/): WordPress Shopready plugin <= 3.6 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-52496](https://insights.sbomify.com/CVE-2024-52496/): WordPress Absolute Addons For Elementor plugin <= 1.0.14 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-52495](https://insights.sbomify.com/CVE-2024-52495/): WordPress Distance Based Shipping Calculator plugin <= 2.0.23 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-52494](https://insights.sbomify.com/CVE-2024-52494/): WordPress Dynamic To Top plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-52493](https://insights.sbomify.com/CVE-2024-52493/): WordPress Meteor Slides plugin <= 1.5.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-52492](https://insights.sbomify.com/CVE-2024-52492/): WordPress Image horizontal reel scroll slideshow plugin <= 13.4 - Stored Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-52491](https://insights.sbomify.com/CVE-2024-52491/): WordPress Sticky Social Icons plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-52490](https://insights.sbomify.com/CVE-2024-52490/): WordPress Pathomation plugin <= 2.5.1 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-5249](https://insights.sbomify.com/CVE-2024-5249/): SAML Replay in Akana (medium 5.4)
- [CVE-2024-52489](https://insights.sbomify.com/CVE-2024-52489/): WordPress Add Chat App Button plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-52488](https://insights.sbomify.com/CVE-2024-52488/): WordPress Grip theme <= 1.0.9 - Arbitrary Plugin Activation/Deactivation to RCE vulnerability (critical 9.9)
- [CVE-2024-52487](https://insights.sbomify.com/CVE-2024-52487/): WordPress Ultimate Classified Listings plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52486](https://insights.sbomify.com/CVE-2024-52486/): WordPress Elementor Portfolio Builder plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52485](https://insights.sbomify.com/CVE-2024-52485/): WordPress WP Menu Image plugin <= 2.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-52484](https://insights.sbomify.com/CVE-2024-52484/): WordPress Wc Recently viewed products plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52483](https://insights.sbomify.com/CVE-2024-52483/): WordPress LeanPress plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52482](https://insights.sbomify.com/CVE-2024-52482/): WordPress Ortto plugin <= 1.0.19 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52481](https://insights.sbomify.com/CVE-2024-52481/): WordPress Jobify theme < 4.3.0 - Unauthenticated Arbitrary File Read vulnerability (high 7.5)
- [CVE-2024-52480](https://insights.sbomify.com/CVE-2024-52480/): WordPress Jobify plugin < 4.3.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-5248](https://insights.sbomify.com/CVE-2024-5248/): Improper Access Control in lunary-ai/lunary (medium 6.5)
- [CVE-2024-52479](https://insights.sbomify.com/CVE-2024-52479/): WordPress Jobify plugin < 4.3.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-52478](https://insights.sbomify.com/CVE-2024-52478/): WordPress Jobify theme < 4.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-52477](https://insights.sbomify.com/CVE-2024-52477/): WordPress Document & Data Automation plugin <= 1.6.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-52476](https://insights.sbomify.com/CVE-2024-52476/): WordPress Fediverse Embeds plugin <= 1.5.3 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-52475](https://insights.sbomify.com/CVE-2024-52475/): WordPress Wawp plugin < 3.0.18 - Account Takeover vulnerability (critical 9.8)
- [CVE-2024-52474](https://insights.sbomify.com/CVE-2024-52474/): WordPress Express Payments plugin <= 1.1.8 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-52473](https://insights.sbomify.com/CVE-2024-52473/): WordPress HTML5 Lyrics Karaoke Player plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52472](https://insights.sbomify.com/CVE-2024-52472/): WordPress Weather Atlas Widget plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52471](https://insights.sbomify.com/CVE-2024-52471/): WordPress Extensions for Elementor plugin <= 2.0.37 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52470](https://insights.sbomify.com/CVE-2024-52470/): WordPress Dynamic URL SEO plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5247](https://insights.sbomify.com/CVE-2024-5247/): NETGEAR ProSAFE Network Management System UpLoadServlet Unrestricted File Upload Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-52469](https://insights.sbomify.com/CVE-2024-52469/): WordPress WooCommerce Price Alert plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-52468](https://insights.sbomify.com/CVE-2024-52468/): WordPress LeadBoxer plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/213/