# Vulnerabilities published in 2024


- [CVE-2024-48032](https://insights.sbomify.com/CVE-2024-48032/): Cross-site scripting in Featured Posts with Multiple Custom Groups (FPMCG) (high 7.1)
- [CVE-2024-48031](https://insights.sbomify.com/CVE-2024-48031/): Cross-site request forgery in Featured Posts with Multiple Custom Groups (FPMCG) (medium 6.5)
- [CVE-2024-48030](https://insights.sbomify.com/CVE-2024-48030/): WordPress Telecash Ricaricaweb plugin <= 2.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-4803](https://insights.sbomify.com/CVE-2024-4803/): Kashipara College Management System submit_admin.php sql injection (medium 5.3)
- [CVE-2024-48029](https://insights.sbomify.com/CVE-2024-48029/): WordPress SB Random Posts Widget plugin <= 1.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-48028](https://insights.sbomify.com/CVE-2024-48028/): WordPress IP Loc8 plugin <= 1.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-48027](https://insights.sbomify.com/CVE-2024-48027/): WordPress External featured image from bing plugin <= 1.0.2 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2024-48026](https://insights.sbomify.com/CVE-2024-48026/): WordPress Disc Golf Manager plugin <= 1.0.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-48025](https://insights.sbomify.com/CVE-2024-48025/): WordPress Simple Baseball Scoreboard plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-48024](https://insights.sbomify.com/CVE-2024-48024/): WordPress Keep Backup Daily plugin <= 2.1.3 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-48023](https://insights.sbomify.com/CVE-2024-48023/): WordPress Restaurant Reservations Widget plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-48022](https://insights.sbomify.com/CVE-2024-48022/): WordPress Shortcode For Elementor Templates plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-48021](https://insights.sbomify.com/CVE-2024-48021/): WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-48020](https://insights.sbomify.com/CVE-2024-48020/): WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.21 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-4802](https://insights.sbomify.com/CVE-2024-4802/): Kashipara College Management System submit_extracurricular_activity.php sql injection (medium 5.3)
- [CVE-2024-48019](https://insights.sbomify.com/CVE-2024-48019/): Apache Doris: allows admin users to read arbitrary files through the REST API (medium 5.4)
- [CVE-2024-48017](https://insights.sbomify.com/CVE-2024-48017/): Command injection in SmartFabric OS10 Software (medium 6.5)
- [CVE-2024-48016](https://insights.sbomify.com/CVE-2024-48016/): Weak cryptography in Secure Connect Gateway (SCG) 5.0 Appliance - SRS (medium 4.6)
- [CVE-2024-48015](https://insights.sbomify.com/CVE-2024-48015/): Command injection in SmartFabric OS10 Software (medium 6.7)
- [CVE-2024-48014](https://insights.sbomify.com/CVE-2024-48014/): Memory corruption in BSAFE Micro Edition Suite (high 7.5)
- [CVE-2024-48013](https://insights.sbomify.com/CVE-2024-48013/): Privilege escalation in SmartFabric OS10 Software (high 8.8)
- [CVE-2024-48011](https://insights.sbomify.com/CVE-2024-48011/): Information disclosure in PowerProtect DD (low 3.1)
- [CVE-2024-48010](https://insights.sbomify.com/CVE-2024-48010/): Privilege escalation in PowerProtect DD (medium 6.5)
- [CVE-2024-4801](https://insights.sbomify.com/CVE-2024-4801/): Kashipara College Management System submit_new_faculty.php sql injection (medium 5.3)
- [CVE-2024-48008](https://insights.sbomify.com/CVE-2024-48008/): Command injection in RecoverPoint for Virtual Machines (medium 5.3)
- [CVE-2024-48007](https://insights.sbomify.com/CVE-2024-48007/): Hardcoded credentials in RecoverPoint for Virtual Machines (medium 5.3)
- [CVE-2024-4800](https://insights.sbomify.com/CVE-2024-4800/): Kashipara College Management System submit_student.php sql injection (medium 5.3)
- [CVE-2024-4799](https://insights.sbomify.com/CVE-2024-4799/): Kashipara College Management System view_each_faculty.php sql injection (medium 5.3)
- [CVE-2024-47984](https://insights.sbomify.com/CVE-2024-47984/): Denial of service in RecoverPoint for Virtual Machines (medium 4.4)
- [CVE-2024-4798](https://insights.sbomify.com/CVE-2024-4798/): SourceCodester Online Computer and Laptop Store manage_brand.php sql injection (medium 5.3)
- [CVE-2024-47978](https://insights.sbomify.com/CVE-2024-47978/): Privilege escalation in NativeEdge (high 7.8)
- [CVE-2024-47977](https://insights.sbomify.com/CVE-2024-47977/): SQL injection in Avamar (high 7.1)
- [CVE-2024-47976](https://insights.sbomify.com/CVE-2024-47976/): Security feature bypass in D5-P4320 (medium 6.7)
- [CVE-2024-47975](https://insights.sbomify.com/CVE-2024-47975/): Missing authorization in D5-P4320 (high 7.0)
- [CVE-2024-47974](https://insights.sbomify.com/CVE-2024-47974/): Race condition in D7-P5500 (medium 4.4)
- [CVE-2024-47973](https://insights.sbomify.com/CVE-2024-47973/): Information disclosure in D3-S4510 (medium 5.1)
- [CVE-2024-47972](https://insights.sbomify.com/CVE-2024-47972/): Denial of service in D5-P5316 (medium 4.0)
- [CVE-2024-47971](https://insights.sbomify.com/CVE-2024-47971/): Denial of service in D5-P5316 (medium 6.5)
- [CVE-2024-4797](https://insights.sbomify.com/CVE-2024-4797/): Campcodes Online Laundry Management System ajax.php cross site scripting (medium 5.3)
- [CVE-2024-47969](https://insights.sbomify.com/CVE-2024-47969/): Denial of service in D5-P4320 (medium 6.2)
- [CVE-2024-47968](https://insights.sbomify.com/CVE-2024-47968/): Race condition in D5-P4320 (medium 4.4)
- [CVE-2024-47967](https://insights.sbomify.com/CVE-2024-47967/): Denial of service in D7-P5500 (medium 4.4)
- [CVE-2024-47966](https://insights.sbomify.com/CVE-2024-47966/): Use of Uninitialized Variable vulnerability in Delta Electronics CNCSoft-G2 (high 8.4)
- [CVE-2024-47965](https://insights.sbomify.com/CVE-2024-47965/): Out-of-bounds Read vulnerability in Delta Electronics CNCSoft-G2 (high 8.4)
- [CVE-2024-47964](https://insights.sbomify.com/CVE-2024-47964/): Heap-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 (high 8.4)
- [CVE-2024-47963](https://insights.sbomify.com/CVE-2024-47963/): Out-of-bounds Write vulnerability in Delta Electronics CNCSoft-G2 (high 8.4)
- [CVE-2024-47962](https://insights.sbomify.com/CVE-2024-47962/): Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 (high 8.4)
- [CVE-2024-4796](https://insights.sbomify.com/CVE-2024-4796/): Campcodes Online Laundry Management System manage_inv.php sql injection (medium 5.3)
- [CVE-2024-47951](https://insights.sbomify.com/CVE-2024-47951/): Cross-site scripting in TeamCity (low 3.5)
- [CVE-2024-47950](https://insights.sbomify.com/CVE-2024-47950/): Cross-site scripting in TeamCity (low 3.5)
- [CVE-2024-4795](https://insights.sbomify.com/CVE-2024-4795/): Campcodes Online Laundry Management System manage_user.php sql injection (medium 5.3)
- [CVE-2024-47949](https://insights.sbomify.com/CVE-2024-47949/): Path traversal in TeamCity (medium 4.9)
- [CVE-2024-47948](https://insights.sbomify.com/CVE-2024-47948/): Path traversal in TeamCity (medium 4.9)
- [CVE-2024-47947](https://insights.sbomify.com/CVE-2024-47947/): Stored cross site scripting (medium 4.7)
- [CVE-2024-47946](https://insights.sbomify.com/CVE-2024-47946/): OS Command Execution through Arbitrary File Upload (high 7.2)
- [CVE-2024-47945](https://insights.sbomify.com/CVE-2024-47945/): Predictable Session ID (critical 9.1)
- [CVE-2024-47944](https://insights.sbomify.com/CVE-2024-47944/): Missing Protection Mechanism for Alternate Hardware Interface (medium 6.8)
- [CVE-2024-47943](https://insights.sbomify.com/CVE-2024-47943/): Improper signature verification of firmware upgrade files (critical 9.8)
- [CVE-2024-47942](https://insights.sbomify.com/CVE-2024-47942/): Other in Solid Edge SE2024 (high 7.0)
- [CVE-2024-47941](https://insights.sbomify.com/CVE-2024-47941/): Memory corruption in Solid Edge SE2024 (high 7.3)
- [CVE-2024-47940](https://insights.sbomify.com/CVE-2024-47940/): Memory corruption in Solid Edge SE2024 (high 7.3)
- [CVE-2024-4794](https://insights.sbomify.com/CVE-2024-4794/): Campcodes Online Laundry Management System manage_receiving.php sql injection (medium 5.3)
- [CVE-2024-47939](https://insights.sbomify.com/CVE-2024-47939/): Memory corruption in Multiple MFPs which implement Web Image Monitor (high 7.7)
- [CVE-2024-47935](https://insights.sbomify.com/CVE-2024-47935/): Privilege escalation in Safe Lock (medium 5.4)
- [CVE-2024-47934](https://insights.sbomify.com/CVE-2024-47934/): TXOne Networks Portable Inspector Management Program Improper Input Validation Vulnerability (medium 6.9)
- [CVE-2024-4793](https://insights.sbomify.com/CVE-2024-4793/): Campcodes Online Laundry Management System manage_laundry.php sql injection (medium 5.3)
- [CVE-2024-47926](https://insights.sbomify.com/CVE-2024-47926/): Tecnick TCExam – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (critical 9.8)
- [CVE-2024-47925](https://insights.sbomify.com/CVE-2024-47925/): Tecnick TCExam – Multiple CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (high 7.5)
- [CVE-2024-47924](https://insights.sbomify.com/CVE-2024-47924/): Boa web server – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (high 7.5)
- [CVE-2024-47923](https://insights.sbomify.com/CVE-2024-47923/): Mashov – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (medium 5.3)
- [CVE-2024-47922](https://insights.sbomify.com/CVE-2024-47922/): Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (high 7.5)
- [CVE-2024-47921](https://insights.sbomify.com/CVE-2024-47921/): Smadar SPS – CWE-327: Use of a Broken or Risky Cryptographic Algorithm (high 8.4)
- [CVE-2024-47920](https://insights.sbomify.com/CVE-2024-47920/): Tiki Wiki CMS – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (high 7.5)
- [CVE-2024-4792](https://insights.sbomify.com/CVE-2024-4792/): Campcodes Online Laundry Management System admin_class.php sql injection (medium 5.3)
- [CVE-2024-47919](https://insights.sbomify.com/CVE-2024-47919/): Tiki Wiki CMS – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (critical 9.8)
- [CVE-2024-47918](https://insights.sbomify.com/CVE-2024-47918/): Tiki Wiki CMS – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (medium 6.1)
- [CVE-2024-47917](https://insights.sbomify.com/CVE-2024-47917/): Mobotix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (high 7.5)
- [CVE-2024-47916](https://insights.sbomify.com/CVE-2024-47916/): Boa web server - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (high 7.5)
- [CVE-2024-47915](https://insights.sbomify.com/CVE-2024-47915/): VaeMendis - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (high 7.5)
- [CVE-2024-47914](https://insights.sbomify.com/CVE-2024-47914/): VaeMendis - CWE-352: Cross-Site Request Forgery (CSRF) (medium 4.5)
- [CVE-2024-47913](https://insights.sbomify.com/CVE-2024-47913/): Improper permissions handling in MediaWiki AbuseFilter (medium 5.3)
- [CVE-2024-47912](https://insights.sbomify.com/CVE-2024-47912/): Missing authorization in mitel:micollab (high 8.2)
- [CVE-2024-47911](https://insights.sbomify.com/CVE-2024-47911/): SQL injection in sonarsource:sonarqube (medium 6.7)
- [CVE-2024-47910](https://insights.sbomify.com/CVE-2024-47910/): An issue was discovered in SonarSource SonarQube before 9.9.5 LTA and 10.x before 10.5. (high 7.2)
- [CVE-2024-4791](https://insights.sbomify.com/CVE-2024-4791/): Contemporary Control System BASrouter BACnet BASRT-B Application Protocol Data Unit denial of service (high 8.7)
- [CVE-2024-47909](https://insights.sbomify.com/CVE-2024-47909/): Memory corruption in Connect Secure (medium 4.9)
- [CVE-2024-47908](https://insights.sbomify.com/CVE-2024-47908/): Command injection in Cloud Services Application (critical 9.1)
- [CVE-2024-47907](https://insights.sbomify.com/CVE-2024-47907/): Memory corruption in Connect Secure (high 7.5)
- [CVE-2024-47906](https://insights.sbomify.com/CVE-2024-47906/): Privilege escalation in Connect Secure (high 7.8)
- [CVE-2024-47905](https://insights.sbomify.com/CVE-2024-47905/): Memory corruption in Connect Secure (medium 4.9)
- [CVE-2024-47904](https://insights.sbomify.com/CVE-2024-47904/): Privilege escalation in InterMesh 7177 Hybrid 2.0 Subscriber (high 8.5)
- [CVE-2024-47903](https://insights.sbomify.com/CVE-2024-47903/): Path traversal in InterMesh 7177 Hybrid 2.0 Subscriber (medium 6.9)
- [CVE-2024-47902](https://insights.sbomify.com/CVE-2024-47902/): Missing authorization in InterMesh 7177 Hybrid 2.0 Subscriber (medium 6.9)
- [CVE-2024-47901](https://insights.sbomify.com/CVE-2024-47901/): Command injection in InterMesh 7177 Hybrid 2.0 Subscriber (critical 10.0)
- [CVE-2024-47900](https://insights.sbomify.com/CVE-2024-47900/): GPU DDK - Multiple integer overflow in DmaTransfer PMR_DevPhysAddr functions leading to OOB writes (high 7.8)
- [CVE-2024-4790](https://insights.sbomify.com/CVE-2024-4790/): DedeCMS path traversal (medium 5.3)
- [CVE-2024-47899](https://insights.sbomify.com/CVE-2024-47899/): GPU DDK - PVRSRVDeviceServicesOpen use-after-free condition (high 7.8)
- [CVE-2024-47898](https://insights.sbomify.com/CVE-2024-47898/): GPU DDK - PVRSRVDeviceSyncOpen use-after-free condition (high 7.8)
- [CVE-2024-47897](https://insights.sbomify.com/CVE-2024-47897/): GPU DDK - PVRSRVRGXGetEnabledHWPerfBlocksKM off-by-one OOB write (high 8.8)
- [CVE-2024-47896](https://insights.sbomify.com/CVE-2024-47896/): GPU DDK - rgxfw_hwr_log_info OOB write via psHWRInfoBuf->ui32WriteIndex (low 3.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/247/