# Vulnerabilities published in 2024


- [CVE-2024-52281](https://insights.sbomify.com/CVE-2024-52281/): Stored Cross-site Scripting vulnerability in Rancher UI (high 8.9)
- [CVE-2024-52280](https://insights.sbomify.com/CVE-2024-52280/): Users can issue watch commands for arbitrary resources (high 7.7)
- [CVE-2024-5228](https://insights.sbomify.com/CVE-2024-5228/): TP-Link Omada ER605 Comexe DDNS Response Handling Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-52279](https://insights.sbomify.com/CVE-2024-52279/): Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string (high 7.5)
- [CVE-2024-52277](https://insights.sbomify.com/CVE-2024-52277/): PDF Document Spoofing in DocuSeal (high 8.2)
- [CVE-2024-52276](https://insights.sbomify.com/CVE-2024-52276/): PDF Document Spoofing in DocuSign (high 8.2)
- [CVE-2024-52275](https://insights.sbomify.com/CVE-2024-52275/): Denial of Service on Tenda AC6V2 Due To Stack Overflow (high 8.3)
- [CVE-2024-52274](https://insights.sbomify.com/CVE-2024-52274/): Denial of Service on Tenda AC6V2 Due To Stack Overflow (high 8.3)
- [CVE-2024-52273](https://insights.sbomify.com/CVE-2024-52273/): Denial of Service on Tenda AC6V2 Due To Stack Overflow (high 8.3)
- [CVE-2024-52272](https://insights.sbomify.com/CVE-2024-52272/): Denial of Service on Tenda AC6V2 Due To Stack Overflow (high 8.3)
- [CVE-2024-52271](https://insights.sbomify.com/CVE-2024-52271/): PDF Document Spoofing in Documenso (high 8.2)
- [CVE-2024-52270](https://insights.sbomify.com/CVE-2024-52270/): PDF Document Spoofing in DropBox Sign(HelloSign) (high 8.2)
- [CVE-2024-5227](https://insights.sbomify.com/CVE-2024-5227/): TP-Link Omada ER605 PPTP VPN username Command Injection Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-52269](https://insights.sbomify.com/CVE-2024-52269/): AI Assistant PDF Document Spoofing in DocuSign (high 8.2)
- [CVE-2024-52268](https://insights.sbomify.com/CVE-2024-52268/): Cross-site scripting in VK All in One Expansion Unit (medium 4.8)
- [CVE-2024-5226](https://insights.sbomify.com/CVE-2024-5226/): Fuse Social Floating Sidebar <= 5.4.10 - Authenticated (Author+) Stored Cross-Site Scripting via File Upload (medium 6.4)
- [CVE-2024-5225](https://insights.sbomify.com/CVE-2024-5225/): SQL Injection in berriai/litellm (medium 6.4)
- [CVE-2024-5224](https://insights.sbomify.com/CVE-2024-5224/): Cross-site scripting in Easy Social Like Box – Popup – Sidebar Widget (medium 6.4)
- [CVE-2024-5223](https://insights.sbomify.com/CVE-2024-5223/): Cross-site scripting in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX (medium 6.4)
- [CVE-2024-5222](https://insights.sbomify.com/CVE-2024-5222/): Cross-site scripting in Responsive Plus – Elementor Templates & Starter Sites (medium 6.4)
- [CVE-2024-5221](https://insights.sbomify.com/CVE-2024-5221/): Qi Blocks <= 1.2.9 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-5220](https://insights.sbomify.com/CVE-2024-5220/): ND Shortcodes <= 7.5 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-5219](https://insights.sbomify.com/CVE-2024-5219/): Easy Google Maps <= 1.11.15 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-5218](https://insights.sbomify.com/CVE-2024-5218/): Reviews and Rating – Google Reviews <= 5.2 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-5217](https://insights.sbomify.com/CVE-2024-5217/): ServiceNow Incomplete List of Disallowed Inputs (critical 9.2, exploited in the wild)
- [CVE-2024-5216](https://insights.sbomify.com/CVE-2024-5216/): Denial of Service in mintplex-labs/anything-llm (high 7.5)
- [CVE-2024-5215](https://insights.sbomify.com/CVE-2024-5215/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 6.4)
- [CVE-2024-5213](https://insights.sbomify.com/CVE-2024-5213/): Exposure of Sensitive Information in mintplex-labs/anything-llm (medium 5.3)
- [CVE-2024-5212](https://insights.sbomify.com/CVE-2024-5212/): tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] (medium 6.1)
- [CVE-2024-5211](https://insights.sbomify.com/CVE-2024-5211/): Path traversal in mintplex-labs/anything-llm (critical 9.1)
- [CVE-2024-5210](https://insights.sbomify.com/CVE-2024-5210/): Denial of service in Printers (medium 6.5)
- [CVE-2024-5209](https://insights.sbomify.com/CVE-2024-5209/): Denial of service in Printers (medium 6.5)
- [CVE-2024-5208](https://insights.sbomify.com/CVE-2024-5208/): Uncontrolled Resource Consumption in mintplex-labs/anything-llm (medium 6.5)
- [CVE-2024-5207](https://insights.sbomify.com/CVE-2024-5207/): SQL injection in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App (high 7.2)
- [CVE-2024-52067](https://insights.sbomify.com/CVE-2024-52067/): Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log (medium 6.9)
- [CVE-2024-52066](https://insights.sbomify.com/CVE-2024-52066/): Potential stack corruption in Routing Service when using a malicious XML configuration document (high 8.3)
- [CVE-2024-52065](https://insights.sbomify.com/CVE-2024-52065/): Memory corruption in Connext Professional (medium 6.9)
- [CVE-2024-52064](https://insights.sbomify.com/CVE-2024-52064/): Potential stack buffer write overflow in Connext applications while parsing malicious license file (medium 6.9)
- [CVE-2024-52063](https://insights.sbomify.com/CVE-2024-52063/): Potential stack buffer write overflow in Connext applications while parsing malicious XML types document (high 8.3)
- [CVE-2024-52062](https://insights.sbomify.com/CVE-2024-52062/): Potential stack buffer write overflow in Connext applications while parsing malicious XML types document (medium 6.9)
- [CVE-2024-52061](https://insights.sbomify.com/CVE-2024-52061/): Potential stack buffer overflow when parsing an XML type (high 8.3)
- [CVE-2024-52060](https://insights.sbomify.com/CVE-2024-52060/): Potential stack overflow when using XML configuration file referencing environment variables (high 8.3)
- [CVE-2024-5206](https://insights.sbomify.com/CVE-2024-5206/): Sensitive Data Leakage in sklearn.feature_extraction.text.TfidfVectorizer in scikit-learn/scikit-learn (medium 4.7)
- [CVE-2024-52059](https://insights.sbomify.com/CVE-2024-52059/): Memory corruption in Connext Professional (medium 6.9)
- [CVE-2024-52058](https://insights.sbomify.com/CVE-2024-52058/): Potential arbitrary command execution in System Designer while parsing malicious HTTP/REST requests (high 8.6)
- [CVE-2024-52057](https://insights.sbomify.com/CVE-2024-52057/): SQL injection in Connext Professional (critical 9.1)
- [CVE-2024-52056](https://insights.sbomify.com/CVE-2024-52056/): Application Delete Path Traversal in Wowza Streaming Engine (medium 6.9)
- [CVE-2024-52055](https://insights.sbomify.com/CVE-2024-52055/): Application Copy Path Traversal in Wowza Streaming Engine (high 8.2)
- [CVE-2024-52054](https://insights.sbomify.com/CVE-2024-52054/): Application Creation Path Traversal in Wowza Streaming Engine (medium 5.1)
- [CVE-2024-52053](https://insights.sbomify.com/CVE-2024-52053/): Stored Cross-Site Scripting in Wowza Streaming Engine (high 8.7)
- [CVE-2024-52052](https://insights.sbomify.com/CVE-2024-52052/): Stream Target Remote Code Execution in Wowza Streaming Engine (critical 9.4)
- [CVE-2024-52051](https://insights.sbomify.com/CVE-2024-52051/): Command injection in SIMATIC S7-PLCSIM V17 (high 7.0)
- [CVE-2024-52050](https://insights.sbomify.com/CVE-2024-52050/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2024-5205](https://insights.sbomify.com/CVE-2024-5205/): Videojs HTML5 Player <= 1.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via videojs_video Shortcode (medium 6.4)
- [CVE-2024-52049](https://insights.sbomify.com/CVE-2024-52049/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2024-52048](https://insights.sbomify.com/CVE-2024-52048/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2024-52047](https://insights.sbomify.com/CVE-2024-52047/): Code injection in Trend Micro Apex One (high 7.5)
- [CVE-2024-52046](https://insights.sbomify.com/CVE-2024-52046/): Apache MINA: MINA applications using unbounded deserialization may allow RCE (critical 10.0)
- [CVE-2024-52043](https://insights.sbomify.com/CVE-2024-52043/): User enumeration in HubHub (medium 6.9)
- [CVE-2024-5204](https://insights.sbomify.com/CVE-2024-5204/): Swiss Toolkit For WP <= 1.0.7 - Authenticated (Contributor+) Authentication Bypass (high 8.8)
- [CVE-2024-52035](https://insights.sbomify.com/CVE-2024-52035/): Integer overflow in catdoc (high 8.4)
- [CVE-2024-52034](https://insights.sbomify.com/CVE-2024-52034/): mySCADA myPRO OS Command Injection (critical 10.0)
- [CVE-2024-52033](https://insights.sbomify.com/CVE-2024-52033/): Information disclosure in Rakuten Turbo 5G (medium 5.3)
- [CVE-2024-52032](https://insights.sbomify.com/CVE-2024-52032/): Private channel names leaking when Elasticsearch is enabled (medium 4.3)
- [CVE-2024-52030](https://insights.sbomify.com/CVE-2024-52030/): Memory corruption in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-52029](https://insights.sbomify.com/CVE-2024-52029/): Memory corruption in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-52028](https://insights.sbomify.com/CVE-2024-52028/): Memory corruption in netgear:r7000p firmware (medium 5.7)
- [CVE-2024-52026](https://insights.sbomify.com/CVE-2024-52026/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-52025](https://insights.sbomify.com/CVE-2024-52025/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-52024](https://insights.sbomify.com/CVE-2024-52024/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-52023](https://insights.sbomify.com/CVE-2024-52023/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-52022](https://insights.sbomify.com/CVE-2024-52022/): Command injection in netgear:r6400v2 firmware (high 8.0)
- [CVE-2024-52021](https://insights.sbomify.com/CVE-2024-52021/): Command injection in netgear:r8500 firmware (high 8.0)
- [CVE-2024-52020](https://insights.sbomify.com/CVE-2024-52020/): Command injection in netgear:r8500 firmware (high 8.0)
- [CVE-2024-5202](https://insights.sbomify.com/CVE-2024-5202/): Dimensions RM - Arbitrary File Read (high 7.7)
- [CVE-2024-52019](https://insights.sbomify.com/CVE-2024-52019/): Command injection in netgear:r8500 firmware (high 8.0)
- [CVE-2024-52018](https://insights.sbomify.com/CVE-2024-52018/): Command injection in netgear:xr300 firmware (high 8.0)
- [CVE-2024-52017](https://insights.sbomify.com/CVE-2024-52017/): Memory corruption in netgear:xr300 firmware (medium 5.7)
- [CVE-2024-52016](https://insights.sbomify.com/CVE-2024-52016/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-52015](https://insights.sbomify.com/CVE-2024-52015/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-52014](https://insights.sbomify.com/CVE-2024-52014/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-52013](https://insights.sbomify.com/CVE-2024-52013/): Memory corruption in netgear:r6400v2 firmware (medium 5.7)
- [CVE-2024-52012](https://insights.sbomify.com/CVE-2024-52012/): Apache Solr: Configset upload on Windows allows arbitrary path write-access (medium 5.4)
- [CVE-2024-52011](https://insights.sbomify.com/CVE-2024-52011/): launch-editor vulnerable to command injection via the crafted request on Windows (high 7.5)
- [CVE-2024-52010](https://insights.sbomify.com/CVE-2024-52010/): Zoraxy has an authenticated command injection in the Web SSH feature (high 8.6)
- [CVE-2024-5201](https://insights.sbomify.com/CVE-2024-5201/): Dimensions RM - Privilege Escalation (high 8.8)
- [CVE-2024-52009](https://insights.sbomify.com/CVE-2024-52009/): Git credentials are exposed in atlantis logs (high 8.5)
- [CVE-2024-52008](https://insights.sbomify.com/CVE-2024-52008/): Password Policy Bypass Vulnerability in Fides Webserver (low 2.0)
- [CVE-2024-52007](https://insights.sbomify.com/CVE-2024-52007/): XXE vulnerability in XSLT parsing in `org.hl7.fhir.core` (high 8.6)
- [CVE-2024-52006](https://insights.sbomify.com/CVE-2024-52006/): Newline confusion in credential helpers can lead to credential exfiltration in git (low 2.1)
- [CVE-2024-52005](https://insights.sbomify.com/CVE-2024-52005/): The sideband payload is passed unfiltered to the terminal in git (high 7.5)
- [CVE-2024-52004](https://insights.sbomify.com/CVE-2024-52004/): Remote code execution vulnerabilities in MediaCMS (high 8.7)
- [CVE-2024-52003](https://insights.sbomify.com/CVE-2024-52003/): X-Forwarded-Prefix Header still allows for Open Redirect in traefik (medium 6.3)
- [CVE-2024-52002](https://insights.sbomify.com/CVE-2024-52002/): Cross-Site Request Forgery (CSRF) in several iTop pages (high 7.6)
- [CVE-2024-52001](https://insights.sbomify.com/CVE-2024-52001/): Portal user is able to access forbidden services information in Combodo iTop (medium 4.3)
- [CVE-2024-52000](https://insights.sbomify.com/CVE-2024-52000/): Reflected Cross-site Scripting exploit in Combodo iTop (high 8.1)
- [CVE-2024-5200](https://insights.sbomify.com/CVE-2024-5200/): Postie < 1.9.71 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-51998](https://insights.sbomify.com/CVE-2024-51998/): Path traversal using file URI scheme without supplying hostname in changedetection.io (high 8.6)
- [CVE-2024-51997](https://insights.sbomify.com/CVE-2024-51997/): The Attestation Results Token can be arbitrarily modified without being detected in Trustee (high 8.1)
- [CVE-2024-51996](https://insights.sbomify.com/CVE-2024-51996/): Symphony has an Authentication Bypass via RememberMe (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/216/