# Vulnerabilities published in 2024


- [CVE-2024-40101](https://insights.sbomify.com/CVE-2024-40101/): Microweber Reflected Cross-site scripting (XSS) vulnerability (high 7.2)
- [CVE-2024-4010](https://insights.sbomify.com/CVE-2024-4010/): Email Subscribers by Icegram Express <= 5.7.19 - Missing Authorization in handle_ajax_request (high 8.8)
- [CVE-2024-40096](https://insights.sbomify.com/CVE-2024-40096/): Information disclosure in rd labs llc:who (low 3.3)
- [CVE-2024-40094](https://insights.sbomify.com/CVE-2024-40094/): GraphQL Java does not properly consider ExecutableNormalizedFields (ENFs) as part of preventing denial of service (medium 5.3)
- [CVE-2024-40091](https://insights.sbomify.com/CVE-2024-40091/): Missing authorization in viloliving:vilo 5 firmware (medium 5.3)
- [CVE-2024-40090](https://insights.sbomify.com/CVE-2024-40090/): Information disclosure in viloliving:vilo 5 firmware (medium 4.3)
- [CVE-2024-4009](https://insights.sbomify.com/CVE-2024-4009/): Replay Attack in KNX Secure Devices (high 7.3)
- [CVE-2024-40089](https://insights.sbomify.com/CVE-2024-40089/): Command injection in viloliving:vilo 5 firmware (critical 9.1)
- [CVE-2024-40088](https://insights.sbomify.com/CVE-2024-40088/): Path traversal in viloliving:vilo 5 firmware (medium 5.3)
- [CVE-2024-40087](https://insights.sbomify.com/CVE-2024-40087/): Auth bypass in viloliving:vilo 5 firmware (critical 9.6)
- [CVE-2024-40086](https://insights.sbomify.com/CVE-2024-40086/): A Buffer Overflow vulnerability in the local_app_set_router_wifi_SSID_PWD function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, un (critical 9.6)
- [CVE-2024-40085](https://insights.sbomify.com/CVE-2024-40085/): A Buffer Overflow vulnerability in the local_app_set_router_wan function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthentica (critical 9.6)
- [CVE-2024-40084](https://insights.sbomify.com/CVE-2024-40084/): Memory corruption in viloliving:vilo 5 firmware (critical 9.6)
- [CVE-2024-40083](https://insights.sbomify.com/CVE-2024-40083/): A Buffer Overflow vulnerabilty in the local_app_set_router_token function of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthentic (critical 9.6)
- [CVE-2024-4008](https://insights.sbomify.com/CVE-2024-4008/): FDSK Leak in KNX Secure Devices (high 7.3)
- [CVE-2024-40075](https://insights.sbomify.com/CVE-2024-40075/): Laravel v11.x was discovered to contain an XML External Entity (XXE) vulnerability. (medium 4.3)
- [CVE-2024-40074](https://insights.sbomify.com/CVE-2024-40074/): Cross-site scripting in oretnom23:online id generator system (medium 4.8)
- [CVE-2024-40073](https://insights.sbomify.com/CVE-2024-40073/): SQL injection in oretnom23:online id generator system (critical 9.8)
- [CVE-2024-40072](https://insights.sbomify.com/CVE-2024-40072/): SQL injection in oretnom23:online id generator system (critical 9.8)
- [CVE-2024-40071](https://insights.sbomify.com/CVE-2024-40071/): File upload in oretnom23:online id generator system (critical 9.8)
- [CVE-2024-40070](https://insights.sbomify.com/CVE-2024-40070/): File upload in oretnom23:online id generator system (medium 5.1)
- [CVE-2024-4007](https://insights.sbomify.com/CVE-2024-4007/): Hard coded default credential contained in install package (high 8.7)
- [CVE-2024-40069](https://insights.sbomify.com/CVE-2024-40069/): Cross-site scripting in oretnom23:online id generator system (medium 5.4)
- [CVE-2024-40068](https://insights.sbomify.com/CVE-2024-40068/): SQL injection in oretnom23:online id generator system (medium 5.9)
- [CVE-2024-40060](https://insights.sbomify.com/CVE-2024-40060/): Denial of service in wcharczuk:go-chart (high 7.5)
- [CVE-2024-4006](https://insights.sbomify.com/CVE-2024-4006/): Incorrect Authorization in GitLab (medium 4.3)
- [CVE-2024-40051](https://insights.sbomify.com/CVE-2024-40051/): Path traversal in ip-guard:ip-guard (high 7.5)
- [CVE-2024-4005](https://insights.sbomify.com/CVE-2024-4005/): Social Pixel <= 2.1 - Admin+ Stored XSS (medium 5.4)
- [CVE-2024-4004](https://insights.sbomify.com/CVE-2024-4004/): Advanced Cron Manager < 2.5.7 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-40039](https://insights.sbomify.com/CVE-2024-40039/): Cross-site request forgery in idccms project:idccms (high 8.8)
- [CVE-2024-40038](https://insights.sbomify.com/CVE-2024-40038/): Cross-site request forgery in idccms:idccms (medium 5.3)
- [CVE-2024-40037](https://insights.sbomify.com/CVE-2024-40037/): Cross-site request forgery in idccms project:idccms (high 8.8)
- [CVE-2024-40036](https://insights.sbomify.com/CVE-2024-40036/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-40035](https://insights.sbomify.com/CVE-2024-40035/): Cross-site request forgery in idccms:idccms (medium 5.9)
- [CVE-2024-40034](https://insights.sbomify.com/CVE-2024-40034/): Cross-site request forgery in idccms project:idccms (high 8.8)
- [CVE-2024-4003](https://insights.sbomify.com/CVE-2024-4003/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-4002](https://insights.sbomify.com/CVE-2024-4002/): Carousel, Slider, Gallery by WP Carousel < 2.6.9 - Editor+ Stored XSS (low 3.5)
- [CVE-2024-4001](https://insights.sbomify.com/CVE-2024-4001/): Cross-site scripting in Download Manager (medium 6.4)
- [CVE-2024-4000](https://insights.sbomify.com/CVE-2024-4000/): Cross-site scripting in Pearl – Header Builder (medium 6.4)
- [CVE-2024-3999](https://insights.sbomify.com/CVE-2024-3999/): EazyDocs < 2.5.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-3998](https://insights.sbomify.com/CVE-2024-3998/): Cross-site scripting in Betheme (medium 6.4)
- [CVE-2024-3997](https://insights.sbomify.com/CVE-2024-3997/): Cross-site scripting in Prime Slider – Addons for Elementor (medium 6.4)
- [CVE-2024-39967](https://insights.sbomify.com/CVE-2024-39967/): Insecure permissions in Aginode GigaSwitch v5 allows attackers to access sensitive information via using the SCP command. (medium 6.5)
- [CVE-2024-39963](https://insights.sbomify.com/CVE-2024-39963/): Command injection in tenda:ax12 firmware (high 8.0)
- [CVE-2024-39962](https://insights.sbomify.com/CVE-2024-39962/): Code injection in dlink:dir-823x firmware (critical 9.8)
- [CVE-2024-3996](https://insights.sbomify.com/CVE-2024-3996/): Post Grid, Post Carousel, & List Category Posts < 2.4.28 - Editor+ Stored XSS (low 3.5)
- [CVE-2024-39954](https://insights.sbomify.com/CVE-2024-39954/): Apache EventMesh Runtime: SSRF (medium 6.3)
- [CVE-2024-39950](https://insights.sbomify.com/CVE-2024-39950/): Memory corruption in NVR4XXX and IPC-HX8XXX (high 8.6)
- [CVE-2024-3995](https://insights.sbomify.com/CVE-2024-3995/): Command Injection in Helix ALM (low 2.0)
- [CVE-2024-39949](https://insights.sbomify.com/CVE-2024-39949/): Denial of service in NVR4XXX (high 7.5)
- [CVE-2024-39948](https://insights.sbomify.com/CVE-2024-39948/): Null dereference in NVR4XXX (high 7.5)
- [CVE-2024-39947](https://insights.sbomify.com/CVE-2024-39947/): Denial of service in NVR4XXX (medium 6.5)
- [CVE-2024-39946](https://insights.sbomify.com/CVE-2024-39946/): Other in NVR4XXX (medium 6.0)
- [CVE-2024-39945](https://insights.sbomify.com/CVE-2024-39945/): Denial of service in NVR4XXX (medium 4.9)
- [CVE-2024-39944](https://insights.sbomify.com/CVE-2024-39944/): Denial of service in IPC-HX8XXX and NVR4XXX (high 7.5)
- [CVE-2024-39943](https://insights.sbomify.com/CVE-2024-39943/): rejetto HFS vulnerable to OS Command Execution by remote authenticated users (critical 9.9)
- [CVE-2024-3994](https://insights.sbomify.com/CVE-2024-3994/): Cross-site scripting in Tutor LMS – eLearning and online course solution (medium 5.4)
- [CVE-2024-39937](https://insights.sbomify.com/CVE-2024-39937/): Path traversal in supos:supos (high 8.6)
- [CVE-2024-39936](https://insights.sbomify.com/CVE-2024-39936/): Race condition in qt:qt (high 8.6)
- [CVE-2024-39935](https://insights.sbomify.com/CVE-2024-39935/): Command injection in jc21:nginx proxy manager (high 8.8)
- [CVE-2024-39934](https://insights.sbomify.com/CVE-2024-39934/): Robotmk before 2.0.1 allows a local user to escalate privileges (e.g., to SYSTEM) if automated Python environment setup is enabled, because (high 7.8)
- [CVE-2024-39933](https://insights.sbomify.com/CVE-2024-39933/): Duplicate Advisory: Gogs allows argument injection during the tagging of a new release (high 7.7)
- [CVE-2024-39932](https://insights.sbomify.com/CVE-2024-39932/): Gogs allows argument injection during the previewing of changes (critical 9.9)
- [CVE-2024-39931](https://insights.sbomify.com/CVE-2024-39931/): Duplicate Advisory: Gogs allows deletion of internal files (critical 9.9)
- [CVE-2024-39930](https://insights.sbomify.com/CVE-2024-39930/): Duplicate Advisory: github.com/gogs/gogs affected by CVE-2024-39930 (critical 9.9)
- [CVE-2024-3993](https://insights.sbomify.com/CVE-2024-3993/): AZAN Plugin <= 0.6 - Stored XSS via CSRF (medium 4.6)
- [CVE-2024-39929](https://insights.sbomify.com/CVE-2024-39929/): Security feature bypass in exim:exim (medium 5.4)
- [CVE-2024-39928](https://insights.sbomify.com/CVE-2024-39928/): Apache Linkis Spark EngineConn: Commons Lang's RandomStringUtils Random string security vulnerability (high 7.5)
- [CVE-2024-39927](https://insights.sbomify.com/CVE-2024-39927/): Memory corruption in IM 460F/460FTL/370/370F (high 8.2)
- [CVE-2024-39926](https://insights.sbomify.com/CVE-2024-39926/): Cross-site scripting in dani-garcia:vaultwarden (medium 5.4)
- [CVE-2024-39925](https://insights.sbomify.com/CVE-2024-39925/): Information disclosure in dani-garcia:vaultwarden (medium 6.5)
- [CVE-2024-39924](https://insights.sbomify.com/CVE-2024-39924/): Privilege escalation in dani-garcia:vaultwarden (high 8.8)
- [CVE-2024-39923](https://insights.sbomify.com/CVE-2024-39923/): Cross-site scripting in mahara:mahara (medium 6.1)
- [CVE-2024-39922](https://insights.sbomify.com/CVE-2024-39922/): Information disclosure in LOGO! 12/24RCE (medium 5.1)
- [CVE-2024-39921](https://insights.sbomify.com/CVE-2024-39921/): Weak cryptography in IPCOM EX2 Series (high 7.5)
- [CVE-2024-39920](https://insights.sbomify.com/CVE-2024-39920/): The TCP protocol in RFC 9293 has a timing side channel that makes it easier for remote attackers to infer the content of one TCP connection (medium 4.3)
- [CVE-2024-3992](https://insights.sbomify.com/CVE-2024-3992/): Amen <= 3.3.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-39919](https://insights.sbomify.com/CVE-2024-39919/): Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-png (low 3.1)
- [CVE-2024-39918](https://insights.sbomify.com/CVE-2024-39918/): Path Traveral in @jmondi/url-to-png (medium 4.3)
- [CVE-2024-39917](https://insights.sbomify.com/CVE-2024-39917/): xrdp allows an ininite number of login attempts (high 7.2)
- [CVE-2024-39916](https://insights.sbomify.com/CVE-2024-39916/): NFS server misconfiguration allows file access outside the exported directory (medium 6.4)
- [CVE-2024-39915](https://insights.sbomify.com/CVE-2024-39915/): Authenticated remote code execution in Thruk (critical 10.0)
- [CVE-2024-39914](https://insights.sbomify.com/CVE-2024-39914/): FOG has a command injection in /fog/management/export.php?filename= (critical 9.8)
- [CVE-2024-39912](https://insights.sbomify.com/CVE-2024-39912/): Enumeration of valid usernames in web-auth/webauthn-lib (medium 5.3)
- [CVE-2024-39911](https://insights.sbomify.com/CVE-2024-39911/): 1Panel SQL injection (critical 10.0)
- [CVE-2024-39910](https://insights.sbomify.com/CVE-2024-39910/): Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor (medium 5.4)
- [CVE-2024-3991](https://insights.sbomify.com/CVE-2024-3991/): Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (medium 6.4)
- [CVE-2024-39909](https://insights.sbomify.com/CVE-2024-39909/): SQL Injection in the KubeClarity REST API (medium 6.5)
- [CVE-2024-39908](https://insights.sbomify.com/CVE-2024-39908/): Denial of service in REXML (medium 4.3)
- [CVE-2024-39907](https://insights.sbomify.com/CVE-2024-39907/): a sqlinjection in 1Panel (critical 9.8)
- [CVE-2024-39906](https://insights.sbomify.com/CVE-2024-39906/): Remote code execution in Haven IndieAuthClient (GHSL-2024-093) (high 8.4)
- [CVE-2024-39905](https://insights.sbomify.com/CVE-2024-39905/): Red-DiscordBot vulnerable to Incorrect Authorization in commands API (medium 5.3)
- [CVE-2024-39904](https://insights.sbomify.com/CVE-2024-39904/): Code Execution Vulnerability via Local File Path Traversal in Vnote (high 8.8)
- [CVE-2024-39903](https://insights.sbomify.com/CVE-2024-39903/): Local File Inclusion in Solara (high 8.6)
- [CVE-2024-39902](https://insights.sbomify.com/CVE-2024-39902/): Tuleap's recursive permissions to document manager folder are not properly applied (medium 4.8)
- [CVE-2024-39901](https://insights.sbomify.com/CVE-2024-39901/): OpenSearch Observability does not properly restrict access to private tenant resources (medium 4.2)
- [CVE-2024-39900](https://insights.sbomify.com/CVE-2024-39900/): OpenSearch Dashboards Reports does not properly restrict access to private tenant resources (medium 5.4)
- [CVE-2024-3990](https://insights.sbomify.com/CVE-2024-3990/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 6.4)
- [CVE-2024-39899](https://insights.sbomify.com/CVE-2024-39899/): PrivateBin allows shortening of URLs for other domains (medium 5.3)
- [CVE-2024-39897](https://insights.sbomify.com/CVE-2024-39897/): Cache driver GetBlob() allows read access to any blob without access control check (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/308/