# Vulnerabilities published in 2024


- [CVE-2024-40465](https://insights.sbomify.com/CVE-2024-40465/): Beego privilege escalation vulnerability (high 8.8)
- [CVE-2024-40464](https://insights.sbomify.com/CVE-2024-40464/): Beego privilege escalation vulnerability (high 8.8)
- [CVE-2024-40462](https://insights.sbomify.com/CVE-2024-40462/): Privilege escalation in ocuco:innovation (high 7.8)
- [CVE-2024-40461](https://insights.sbomify.com/CVE-2024-40461/): Privilege escalation in ocuco:innovation (high 7.8)
- [CVE-2024-40460](https://insights.sbomify.com/CVE-2024-40460/): Privilege escalation in ocuco:innovation (high 7.8)
- [CVE-2024-4046](https://insights.sbomify.com/CVE-2024-4046/): Other in EMUI (medium 6.4)
- [CVE-2024-40459](https://insights.sbomify.com/CVE-2024-40459/): Privilege escalation in ocuco:innovation (high 7.8)
- [CVE-2024-40458](https://insights.sbomify.com/CVE-2024-40458/): Privilege escalation in ocuco:innovation (high 7.8)
- [CVE-2024-40457](https://insights.sbomify.com/CVE-2024-40457/): No-IP Dynamic Update Client (DUC) v3.x uses cleartext credentials that may occur on a command line or in a file. (critical 9.1)
- [CVE-2024-40456](https://insights.sbomify.com/CVE-2024-40456/): SQL injection in thinksaas:thinksaas (critical 9.8)
- [CVE-2024-40455](https://insights.sbomify.com/CVE-2024-40455/): Cross-site request forgery in thinksaas:thinksaas (low 2.7)
- [CVE-2024-40453](https://insights.sbomify.com/CVE-2024-40453/): squirrelly Code Injection vulnerability (critical 9.8)
- [CVE-2024-4045](https://insights.sbomify.com/CVE-2024-4045/): Cross-site scripting in Popup Builder & Popup Maker for WordPress – OptinMonster Email Marketing and Lead Generation (medium 6.4)
- [CVE-2024-40446](https://insights.sbomify.com/CVE-2024-40446/): Code injection in ctan:mimetex (critical 9.8)
- [CVE-2024-40445](https://insights.sbomify.com/CVE-2024-40445/): Path traversal in ctan:mimetex (high 7.3)
- [CVE-2024-40443](https://insights.sbomify.com/CVE-2024-40443/): SQL injection in oretnom23:computer laboratory management system (medium 4.3)
- [CVE-2024-40442](https://insights.sbomify.com/CVE-2024-40442/): An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to ann (high 7.2)
- [CVE-2024-40441](https://insights.sbomify.com/CVE-2024-40441/): An issue in Doccano Open source annotation tools for machine learning practitioners v.1.8.4 and Doccano Auto Labeling Pipeline module to ann (medium 6.6)
- [CVE-2024-4044](https://insights.sbomify.com/CVE-2024-4044/): Deserialization of Untrusted Data Vulnerability in FlexLogger and InstrumentStudio (high 7.8)
- [CVE-2024-40433](https://insights.sbomify.com/CVE-2024-40433/): Privilege escalation in tencent:wechat (high 8.8)
- [CVE-2024-40432](https://insights.sbomify.com/CVE-2024-40432/): A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SFFDISK_DEVICE_C (medium 6.5)
- [CVE-2024-40431](https://insights.sbomify.com/CVE-2024-40431/): A lack of input validation in Realtek SD card reader driver before 10.0.26100.21374 through the implementation of the IOCTL_SCSI_PASS_THROUG (high 8.8)
- [CVE-2024-4043](https://insights.sbomify.com/CVE-2024-4043/): WP Ultimate Post Grid <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode (medium 6.4)
- [CVE-2024-40427](https://insights.sbomify.com/CVE-2024-40427/): Memory corruption in dronecode:px4 drone autopilot (high 7.9)
- [CVE-2024-40425](https://insights.sbomify.com/CVE-2024-40425/): File upload in sparkshop:sparkshop (critical 9.8)
- [CVE-2024-40422](https://insights.sbomify.com/CVE-2024-40422/): Path traversal in stitionai:devika (critical 9.1)
- [CVE-2024-4042](https://insights.sbomify.com/CVE-2024-4042/): Cross-site scripting in Post Grid (medium 6.4)
- [CVE-2024-40417](https://insights.sbomify.com/CVE-2024-40417/): Memory corruption in tenda:ax1806 firmware (medium 6.5)
- [CVE-2024-40416](https://insights.sbomify.com/CVE-2024-40416/): Memory corruption in tenda:ax1806 firmware (medium 6.5)
- [CVE-2024-40415](https://insights.sbomify.com/CVE-2024-40415/): Memory corruption in tenda:ax1806 firmware (critical 9.8)
- [CVE-2024-40414](https://insights.sbomify.com/CVE-2024-40414/): Memory corruption in tenda:ax1806 firmware (critical 9.6)
- [CVE-2024-40412](https://insights.sbomify.com/CVE-2024-40412/): Memory corruption in tenda:ax12 firmware (medium 6.8)
- [CVE-2024-40410](https://insights.sbomify.com/CVE-2024-40410/): Hardcoded credentials in cybelesoft:thinfinity workspace (medium 4.8)
- [CVE-2024-4041](https://insights.sbomify.com/CVE-2024-4041/): Yoast SEO <= 22.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-40408](https://insights.sbomify.com/CVE-2024-40408/): Missing authorization in cybelesoft:thinfinity workspace (high 7.3)
- [CVE-2024-40407](https://insights.sbomify.com/CVE-2024-40407/): Information disclosure in cybelesoft:thinfinity workspace (high 7.5)
- [CVE-2024-40405](https://insights.sbomify.com/CVE-2024-40405/): Auth bypass in cybelesoft:thinfinity workspace (high 8.1)
- [CVE-2024-40404](https://insights.sbomify.com/CVE-2024-40404/): Missing authorization in cybelesoft:thinfinity workspace (critical 9.8)
- [CVE-2024-40402](https://insights.sbomify.com/CVE-2024-40402/): SQL injection in nikhil-bhalerao:simple library management system (medium 6.3)
- [CVE-2024-40400](https://insights.sbomify.com/CVE-2024-40400/): Automad arbitrary file upload vulnerability (high 8.8)
- [CVE-2024-4040](https://insights.sbomify.com/CVE-2024-4040/): CrushFTP VFS Sandbox Escape (critical 9.8, exploited in the wild)
- [CVE-2024-40395](https://insights.sbomify.com/CVE-2024-40395/): Missing authorization in ptc:thingworx (medium 6.5)
- [CVE-2024-40394](https://insights.sbomify.com/CVE-2024-40394/): File upload in oretnom23:simple library management system (critical 9.8)
- [CVE-2024-40393](https://insights.sbomify.com/CVE-2024-40393/): SQL injection in angeljudesuarez:online clinic management system (critical 9.8)
- [CVE-2024-40392](https://insights.sbomify.com/CVE-2024-40392/): SQL injection in fkgeo:pharmacy\/medical store point of sale system (critical 9.8)
- [CVE-2024-4039](https://insights.sbomify.com/CVE-2024-4039/): Orders Tracking for WooCommerce <= 1.2.10 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-4038](https://insights.sbomify.com/CVE-2024-4038/): Code injection in Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro (medium 6.5)
- [CVE-2024-4037](https://insights.sbomify.com/CVE-2024-4037/): WP Photo Album Plus <= 8.7.02.003 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-4036](https://insights.sbomify.com/CVE-2024-4036/): Sydney Toolbox <= 1.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-4035](https://insights.sbomify.com/CVE-2024-4035/): Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.21 - Authenticated (Author+) Cross-Site Scripting (medium 6.4)
- [CVE-2024-40348](https://insights.sbomify.com/CVE-2024-40348/): Path traversal in bazarr:bazarr (high 8.2)
- [CVE-2024-40347](https://insights.sbomify.com/CVE-2024-40347/): Cross-site scripting in hyland:alfresco content services (medium 6.1)
- [CVE-2024-4034](https://insights.sbomify.com/CVE-2024-4034/): Virtue <= 3.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Author (medium 6.4)
- [CVE-2024-40336](https://insights.sbomify.com/CVE-2024-40336/): Cross-site scripting in idccms:idccms (medium 6.1)
- [CVE-2024-40334](https://insights.sbomify.com/CVE-2024-40334/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-40333](https://insights.sbomify.com/CVE-2024-40333/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-40332](https://insights.sbomify.com/CVE-2024-40332/): Cross-site request forgery in idccms:idccms (medium 6.8)
- [CVE-2024-40331](https://insights.sbomify.com/CVE-2024-40331/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-4033](https://insights.sbomify.com/CVE-2024-4033/): All-in-One Video Gallery <= 3.6.4 - Authenticated (Contributor+) Arbitrary File Upload via featured image (high 8.8)
- [CVE-2024-40329](https://insights.sbomify.com/CVE-2024-40329/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-40328](https://insights.sbomify.com/CVE-2024-40328/): Cross-site request forgery in idccms:idccms (medium 6.3)
- [CVE-2024-40324](https://insights.sbomify.com/CVE-2024-40324/): Other in datex-soft:e-staff (critical 9.8)
- [CVE-2024-40322](https://insights.sbomify.com/CVE-2024-40322/): SQL injection in jfinalcms project:jfinalcms (medium 6.3)
- [CVE-2024-4032](https://insights.sbomify.com/CVE-2024-4032/): Incorrect IPv4 and IPv6 private ranges (high 7.5)
- [CVE-2024-40318](https://insights.sbomify.com/CVE-2024-40318/): File upload in webkul:qloapps (high 7.2)
- [CVE-2024-40317](https://insights.sbomify.com/CVE-2024-40317/): Cross-site scripting in airc:mynet (medium 6.1)
- [CVE-2024-4031](https://insights.sbomify.com/CVE-2024-4031/): MEVO WEBCAM APP Windows Unquoted Service Path Vulnerability (medium 4.4)
- [CVE-2024-4030](https://insights.sbomify.com/CVE-2024-4030/): tempfile.mkdtemp() may be readable and writeable by all users on Windows (high 7.1)
- [CVE-2024-4029](https://insights.sbomify.com/CVE-2024-4029/): Wildfly: no timeout for eap management interface may lead to denial of service (dos) (medium 4.1)
- [CVE-2024-4028](https://insights.sbomify.com/CVE-2024-4028/): Keycloak-core: stored xss in keycloak when creating a items in admin console (low 3.8)
- [CVE-2024-4027](https://insights.sbomify.com/CVE-2024-4027/): Undertow: outofmemoryerror in httpservletrequestimpl.getparameternames() can cause remote dos attacks (high 7.5)
- [CVE-2024-4026](https://insights.sbomify.com/CVE-2024-4026/): Cross-Site Scripting in the Holded application (medium 4.6)
- [CVE-2024-4025](https://insights.sbomify.com/CVE-2024-4025/): Inefficient Regular Expression Complexity in GitLab (medium 6.5)
- [CVE-2024-40240](https://insights.sbomify.com/CVE-2024-40240/): Auth bypass in homeserve:homeserve (medium 6.1)
- [CVE-2024-4024](https://insights.sbomify.com/CVE-2024-4024/): Authentication Bypass by Assumed-Immutable Data in GitLab (high 7.3)
- [CVE-2024-40239](https://insights.sbomify.com/CVE-2024-40239/): Auth bypass in hitbytes:life (medium 6.1)
- [CVE-2024-4023](https://insights.sbomify.com/CVE-2024-4023/): Stored XSS in flatpressblog/flatpress (high 8.1)
- [CVE-2024-4022](https://insights.sbomify.com/CVE-2024-4022/): Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Version Data version.js information disclosure (medium 5.3)
- [CVE-2024-4021](https://insights.sbomify.com/CVE-2024-4021/): Keenetic KN-1010/KN-1410/KN-1711/KN-1810/KN-1910 Configuration Setting ndmComponents.js information disclosure (medium 5.3)
- [CVE-2024-4020](https://insights.sbomify.com/CVE-2024-4020/): Tenda FH1206 addressNat fromAddressNat buffer overflow (high 8.8)
- [CVE-2024-4019](https://insights.sbomify.com/CVE-2024-4019/): Byzoro Smart S80 Management Platform importhtml.php deserialization (medium 6.3)
- [CVE-2024-4018](https://insights.sbomify.com/CVE-2024-4018/): Privilege Escalation in U-Series Appliance (high 8.8)
- [CVE-2024-4017](https://insights.sbomify.com/CVE-2024-4017/): Privilege Escalation in U-Series Appliance (high 8.8)
- [CVE-2024-4014](https://insights.sbomify.com/CVE-2024-4014/): hCaptcha for WordPress <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cf7-hcaptcha Shortcode (medium 6.4)
- [CVE-2024-40137](https://insights.sbomify.com/CVE-2024-40137/): Dolibarr ERP CRM vulnerable to remote code execution (RCE) (medium 5.5)
- [CVE-2024-40130](https://insights.sbomify.com/CVE-2024-40130/): Memory corruption in open5gs:open5gs (critical 9.8)
- [CVE-2024-4013](https://insights.sbomify.com/CVE-2024-4013/): Failure to update BT Mesh Replay Protection List (medium 5.6)
- [CVE-2024-40129](https://insights.sbomify.com/CVE-2024-40129/): Memory corruption in open5gs:open5gs (high 8.6)
- [CVE-2024-40125](https://insights.sbomify.com/CVE-2024-40125/): File upload in closed-loop:cless server (critical 9.8)
- [CVE-2024-40124](https://insights.sbomify.com/CVE-2024-40124/): Cross-site scripting in pydio:pydio (medium 5.4)
- [CVE-2024-40120](https://insights.sbomify.com/CVE-2024-40120/): SeaweedFS Vulnerable to SQL Injection (medium 6.5)
- [CVE-2024-40119](https://insights.sbomify.com/CVE-2024-40119/): Nepstech Wifi Router xpon (terminal) model NTPL-Xpon1GFEVN v.1.0 Firmware V2.0.1 contains a Cross-Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2024-40117](https://insights.sbomify.com/CVE-2024-40117/): Incorrect access control in Solar-Log 1000 before v2.8.2 and build 52- 23.04.2013 allows attackers to obtain Administrative privileges via c (critical 9.8)
- [CVE-2024-40116](https://insights.sbomify.com/CVE-2024-40116/): An issue in Solar-Log 1000 before v2.8.2 and build 52-23.04.2013 was discovered to store plaintext passwords in the export.html, email.html, (high 8.1)
- [CVE-2024-40114](https://insights.sbomify.com/CVE-2024-40114/): Cross-site scripting in sitecom:wlx-2006 firmware (medium 6.1)
- [CVE-2024-40113](https://insights.sbomify.com/CVE-2024-40113/): Hardcoded credentials in sitecom:wlx-2006 firmware (medium 6.5)
- [CVE-2024-40112](https://insights.sbomify.com/CVE-2024-40112/): Path traversal in sitecom:wlx-2006 firmware (medium 5.9)
- [CVE-2024-40111](https://insights.sbomify.com/CVE-2024-40111/): Cross-site scripting in automad:automad (medium 4.8)
- [CVE-2024-40110](https://insights.sbomify.com/CVE-2024-40110/): Command injection in nikhil-bhalerao:poultry farm management system (critical 9.8)
- [CVE-2024-4011](https://insights.sbomify.com/CVE-2024-4011/): Improper Access Control in GitLab (low 3.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/307/