# Vulnerabilities published in 2024


- [CVE-2024-39287](https://insights.sbomify.com/CVE-2024-39287/): Dorsett Controls InfoScan Exposure of Sensitive Information To An Unauthorized Actor (medium 6.9)
- [CVE-2024-39286](https://insights.sbomify.com/CVE-2024-39286/): Misconfiguration in Intel(R) 800 Series Ethernet Driver (low 2.0)
- [CVE-2024-39285](https://insights.sbomify.com/CVE-2024-39285/): Missing authorization in Intel(R) Server M20NTP Family (medium 5.6)
- [CVE-2024-39284](https://insights.sbomify.com/CVE-2024-39284/): Privilege escalation in Intel(R) Advisor software (medium 5.4)
- [CVE-2024-39283](https://insights.sbomify.com/CVE-2024-39283/): Privilege escalation in Intel(R) TDX module software (high 8.5)
- [CVE-2024-39282](https://insights.sbomify.com/CVE-2024-39282/): net: wwan: t7xx: Fix FSM command timeout issue (high 7.8)
- [CVE-2024-39281](https://insights.sbomify.com/CVE-2024-39281/): Unbounded allocation in ctl(4) CAM Target Layer (medium 5.3)
- [CVE-2024-39280](https://insights.sbomify.com/CVE-2024-39280/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-3928](https://insights.sbomify.com/CVE-2024-3928/): Dromara open-capacity-platform auth-server heapdump information disclosure (medium 4.3)
- [CVE-2024-39279](https://insights.sbomify.com/CVE-2024-39279/): Missing authorization in Intel(R) processors (medium 6.8)
- [CVE-2024-39278](https://insights.sbomify.com/CVE-2024-39278/): Hughes Network Systems Insufficiently Protected Credentials (medium 4.1)
- [CVE-2024-39277](https://insights.sbomify.com/CVE-2024-39277/): dma-mapping: benchmark: handle NUMA_NO_NODE correctly (high 7.8)
- [CVE-2024-39276](https://insights.sbomify.com/CVE-2024-39276/): ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (medium 5.5)
- [CVE-2024-39275](https://insights.sbomify.com/CVE-2024-39275/): Advantech ADAM-5630 Use of Persistent Cookies Containing Sensitive Information (high 8.5)
- [CVE-2024-39274](https://insights.sbomify.com/CVE-2024-39274/): Malicious remote can add users to arbitrary teams and channels (high 8.7)
- [CVE-2024-39273](https://insights.sbomify.com/CVE-2024-39273/): Missing authorization in Wavlink AC3000 (critical 9.0)
- [CVE-2024-39272](https://insights.sbomify.com/CVE-2024-39272/): Cross-site scripting in ClearML (critical 9.0)
- [CVE-2024-39271](https://insights.sbomify.com/CVE-2024-39271/): Information disclosure in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software (low 2.0)
- [CVE-2024-3927](https://insights.sbomify.com/CVE-2024-3927/): Security feature bypass in Element Pack – Widgets, Templates & Addons for Elementor (medium 5.3)
- [CVE-2024-3926](https://insights.sbomify.com/CVE-2024-3926/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-39251](https://insights.sbomify.com/CVE-2024-39251/): An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive (critical 10.0)
- [CVE-2024-39250](https://insights.sbomify.com/CVE-2024-39250/): SQL injection in efrotech:timetrax (critical 9.8)
- [CVE-2024-3925](https://insights.sbomify.com/CVE-2024-3925/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-39249](https://insights.sbomify.com/CVE-2024-39249/): Async <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function. (high 7.5)
- [CVE-2024-39248](https://insights.sbomify.com/CVE-2024-39248/): Cross-site scripting in fikeulous:simpcms (medium 5.4)
- [CVE-2024-39243](https://insights.sbomify.com/CVE-2024-39243/): Code injection in skycaiji:skycaiji (critical 9.8)
- [CVE-2024-39242](https://insights.sbomify.com/CVE-2024-39242/): Cross-site scripting in skycaiji:skycaiji (medium 6.1)
- [CVE-2024-39241](https://insights.sbomify.com/CVE-2024-39241/): Cross-site scripting in skycaiji:skycaiji (medium 6.1)
- [CVE-2024-3924](https://insights.sbomify.com/CVE-2024-3924/): Code Injection in huggingface/text-generation-inference (medium 4.4)
- [CVE-2024-39236](https://insights.sbomify.com/CVE-2024-39236/): Withdrawn Advisory: Gradio was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py (critical 9.8)
- [CVE-2024-3923](https://insights.sbomify.com/CVE-2024-3923/): Beaver Builder – WordPress Page Builder <= 2.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-39229](https://insights.sbomify.com/CVE-2024-39229/): Security feature bypass in gl-inet:a1300 firmware (medium 6.5)
- [CVE-2024-39228](https://insights.sbomify.com/CVE-2024-39228/): Command injection in gl-inet:a1300 firmware (critical 9.8)
- [CVE-2024-39227](https://insights.sbomify.com/CVE-2024-39227/): Code injection in gl-inet:a1300 firmware (critical 9.8)
- [CVE-2024-39226](https://insights.sbomify.com/CVE-2024-39226/): Command injection in gl-inet:a1300 firmware (medium 4.3)
- [CVE-2024-39225](https://insights.sbomify.com/CVE-2024-39225/): Auth bypass in gl-inet:a1300 firmware (critical 9.8)
- [CVE-2024-39223](https://insights.sbomify.com/CVE-2024-39223/): Missing key verification in gost (critical 9.8)
- [CVE-2024-39220](https://insights.sbomify.com/CVE-2024-39220/): BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV- (medium 6.5)
- [CVE-2024-3922](https://insights.sbomify.com/CVE-2024-3922/): Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection (critical 10.0)
- [CVE-2024-39219](https://insights.sbomify.com/CVE-2024-39219/): An issue in Aginode GigaSwitch V5 before version 7.06G allows authenticated attackers with Administrator privileges to upload an earlier fir (high 8.8)
- [CVE-2024-39211](https://insights.sbomify.com/CVE-2024-39211/): Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_emai (medium 5.3)
- [CVE-2024-39210](https://insights.sbomify.com/CVE-2024-39210/): Path traversal in mayurik:best house rental management system (high 7.5)
- [CVE-2024-3921](https://insights.sbomify.com/CVE-2024-3921/): Gianism <= 5.1.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-39209](https://insights.sbomify.com/CVE-2024-39209/): luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter. (medium 6.3)
- [CVE-2024-39208](https://insights.sbomify.com/CVE-2024-39208/): luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials. (critical 9.8)
- [CVE-2024-39207](https://insights.sbomify.com/CVE-2024-39207/): lua-shmem v1.0-1 was discovered to contain a buffer overflow via the shmem_write function. (high 8.2)
- [CVE-2024-39206](https://insights.sbomify.com/CVE-2024-39206/): An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due (high 7.5)
- [CVE-2024-39205](https://insights.sbomify.com/CVE-2024-39205/): pyload-ng vulnerable to RCE with js2py sandbox escape (critical 9.8)
- [CVE-2024-39203](https://insights.sbomify.com/CVE-2024-39203/): Cross-site scripting in zblogcn:z-blogphp (medium 6.1)
- [CVE-2024-39202](https://insights.sbomify.com/CVE-2024-39202/): Command injection in dlink:dir-823x ax3000 firmware (high 7.6)
- [CVE-2024-3920](https://insights.sbomify.com/CVE-2024-3920/): Flattr <= 1.2.2 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-3919](https://insights.sbomify.com/CVE-2024-3919/): OpenPGP Form Encryption for WordPress < 1.5.1 - Contributor+ Stored XSS (medium 4.6)
- [CVE-2024-39182](https://insights.sbomify.com/CVE-2024-39182/): An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an (high 7.5)
- [CVE-2024-39181](https://insights.sbomify.com/CVE-2024-39181/): Memory corruption in szlbt:lbt-t300-t400 firmware (medium 6.5)
- [CVE-2024-3918](https://insights.sbomify.com/CVE-2024-3918/): Pet Manager <= 1.4 - Contributor+ Stored XSS (medium 4.8)
- [CVE-2024-39178](https://insights.sbomify.com/CVE-2024-39178/): MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uuid. (medium 5.4)
- [CVE-2024-39174](https://insights.sbomify.com/CVE-2024-39174/): Cross-site scripting in yzmcms:yzmcms (medium 6.1)
- [CVE-2024-39173](https://insights.sbomify.com/CVE-2024-39173/): calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculator.js. (critical 9.8)
- [CVE-2024-39171](https://insights.sbomify.com/CVE-2024-39171/): Path traversal in phpvibe:phpvibe (high 8.8)
- [CVE-2024-3917](https://insights.sbomify.com/CVE-2024-3917/): Pet Manager <= 1.4 - Reflected XSS (medium 6.1)
- [CVE-2024-39165](https://insights.sbomify.com/CVE-2024-39165/): QR/demoapp/qr_image.php in Asial JpGraph Professional through 4.2.6-pro allows remote attackers to execute arbitrary code via a PHP payload (critical 9.8)
- [CVE-2024-39163](https://insights.sbomify.com/CVE-2024-39163/): pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints (high 8.8)
- [CVE-2024-39162](https://insights.sbomify.com/CVE-2024-39162/): pyspider Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-3916](https://insights.sbomify.com/CVE-2024-3916/): Swift Framework <= 2.7.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes (medium 6.4)
- [CVE-2024-39158](https://insights.sbomify.com/CVE-2024-39158/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-39157](https://insights.sbomify.com/CVE-2024-39157/): Cross-site request forgery in idccms:idccms (low 3.8)
- [CVE-2024-39156](https://insights.sbomify.com/CVE-2024-39156/): Cross-site request forgery in idccms:idccms (low 3.8)
- [CVE-2024-39155](https://insights.sbomify.com/CVE-2024-39155/): Cross-site request forgery in idccms:idccms (medium 6.8)
- [CVE-2024-39154](https://insights.sbomify.com/CVE-2024-39154/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-39153](https://insights.sbomify.com/CVE-2024-39153/): Cross-site request forgery in idccms:idccms (medium 4.7)
- [CVE-2024-39150](https://insights.sbomify.com/CVE-2024-39150/): Path traversal in b3log:vditor (medium 5.9)
- [CVE-2024-3915](https://insights.sbomify.com/CVE-2024-3915/): Swift Framework <= 2.7.31 - Missing Authorization to Unauthenticated Arbitrary Content Update (medium 5.3)
- [CVE-2024-39148](https://insights.sbomify.com/CVE-2024-39148/): Command injection in kerlink:keros (high 8.1)
- [CVE-2024-39143](https://insights.sbomify.com/CVE-2024-39143/): Cross-site scripting in coderberg:residencecms (medium 5.4)
- [CVE-2024-3914](https://insights.sbomify.com/CVE-2024-3914/): Use after free in Chrome (high 8.8)
- [CVE-2024-39134](https://insights.sbomify.com/CVE-2024-39134/): Memory corruption in gdraheim:zziplib (high 7.5)
- [CVE-2024-39133](https://insights.sbomify.com/CVE-2024-39133/): Memory corruption in zziplib project:zziplib (medium 4.3)
- [CVE-2024-39132](https://insights.sbomify.com/CVE-2024-39132/): A NULL Pointer Dereference vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function VerifyComma (medium 6.5)
- [CVE-2024-39130](https://insights.sbomify.com/CVE-2024-39130/): A NULL Pointer Dereference discovered in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function DumpOneStream( (high 7.5)
- [CVE-2024-3913](https://insights.sbomify.com/CVE-2024-3913/): Phoenix Contact: Start sequence allows attack during the boot process (medium 5.9)
- [CVE-2024-39129](https://insights.sbomify.com/CVE-2024-39129/): Heap Buffer Overflow vulnerability in DumpTS v0.1.0-nightly allows attackers to cause a denial of service via the function PushTSBuf() at /src/PayloadBuf.cpp. (medium 5.3)
- [CVE-2024-39126](https://insights.sbomify.com/CVE-2024-39126/): Roundup Cross-site Scripting Vulnerability (medium 5.4)
- [CVE-2024-39125](https://insights.sbomify.com/CVE-2024-39125/): Roundup Cross-site Scripting Vulnerability (medium 5.4)
- [CVE-2024-39124](https://insights.sbomify.com/CVE-2024-39124/): Roundup Cross-site Scripting Vulnerability (medium 6.1)
- [CVE-2024-39123](https://insights.sbomify.com/CVE-2024-39123/): Calibre-Web Cross Site Scripting (XSS) (medium 5.4)
- [CVE-2024-3912](https://insights.sbomify.com/CVE-2024-3912/): ASUS Router - Upload arbitrary firmware (critical 9.8)
- [CVE-2024-39119](https://insights.sbomify.com/CVE-2024-39119/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-39118](https://insights.sbomify.com/CVE-2024-39118/): Memory corruption in mommyheather:advanced backups (medium 5.5)
- [CVE-2024-3911](https://insights.sbomify.com/CVE-2024-3911/): Welotec: Clickjacking Vulnerability in WebUI (medium 6.5)
- [CVE-2024-3910](https://insights.sbomify.com/CVE-2024-3910/): Tenda AC500 DhcpListClient fromDhcpListClient stack-based overflow (high 8.8)
- [CVE-2024-39097](https://insights.sbomify.com/CVE-2024-39097/): Open redirect in sir:gnuboard (medium 6.1)
- [CVE-2024-39094](https://insights.sbomify.com/CVE-2024-39094/): Cross-site scripting in friendica:friendica (medium 5.4)
- [CVE-2024-39091](https://insights.sbomify.com/CVE-2024-39091/): Command injection in annke:crater 2 firmware (high 8.8)
- [CVE-2024-39090](https://insights.sbomify.com/CVE-2024-39090/): Cross-site request forgery in phpgurukul:online shopping portal (medium 6.1)
- [CVE-2024-3909](https://insights.sbomify.com/CVE-2024-3909/): Tenda AC500 execCommand formexeCommand stack-based overflow (high 8.8)
- [CVE-2024-39081](https://insights.sbomify.com/CVE-2024-39081/): Security feature bypass in jktyre:smart tyre car \& bike (medium 4.2)
- [CVE-2024-3908](https://insights.sbomify.com/CVE-2024-3908/): Tenda AC500 WriteFacMac formWriteFacMac command injection (medium 6.3)
- [CVE-2024-39072](https://insights.sbomify.com/CVE-2024-39072/): SQL injection in amttgroup:hibos (medium 5.5)
- [CVE-2024-39071](https://insights.sbomify.com/CVE-2024-39071/): Fujian Kelixun <=7.6.6.4391 is vulnerable to SQL Injection in send_event.php. (critical 9.8)
- [CVE-2024-3907](https://insights.sbomify.com/CVE-2024-3907/): Tenda AC500 setcfm formSetCfm stack-based overflow (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/315/