# Vulnerabilities published in 2024


- [CVE-2024-39069](https://insights.sbomify.com/CVE-2024-39069/): An issue in ifood Order Manager v3.35.5 'Gestor de Peddios.exe' allows attackers to execute arbitrary code via a DLL hijacking attack. (high 7.8)
- [CVE-2024-39063](https://insights.sbomify.com/CVE-2024-39063/): Cross-site request forgery in limesurvey:limesurvey (high 8.8)
- [CVE-2024-3906](https://insights.sbomify.com/CVE-2024-3906/): Tenda AC500 QuickIndex formQuickIndex stack-based overflow (high 8.8)
- [CVE-2024-3905](https://insights.sbomify.com/CVE-2024-3905/): Tenda AC500 execCommand R7WebsSecurityHandler stack-based overflow (high 8.8)
- [CVE-2024-3904](https://insights.sbomify.com/CVE-2024-3904/): Misconfiguration in MELIPC Series MI5122-VW (high 8.8)
- [CVE-2024-39037](https://insights.sbomify.com/CVE-2024-39037/): SQL injection in airc:mynet (medium 6.5)
- [CVE-2024-39036](https://insights.sbomify.com/CVE-2024-39036/): Path traversal in seacms:seacms (medium 6.5)
- [CVE-2024-39033](https://insights.sbomify.com/CVE-2024-39033/): In Newgensoft OmniDocs 11.0_SP1_03_006, Insecure Direct Object Reference (IDOR) in the getuserproperty function allows user's configuration and PII to be stolen. (high 7.5)
- [CVE-2024-39031](https://insights.sbomify.com/CVE-2024-39031/): Silverpeas Core Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2024-3903](https://insights.sbomify.com/CVE-2024-3903/): Add Custom CSS and JS <= 1.20 - Stored XSS via CSRF (high 7.1)
- [CVE-2024-39028](https://insights.sbomify.com/CVE-2024-39028/): Command injection in seacms:seacms (critical 9.8)
- [CVE-2024-39027](https://insights.sbomify.com/CVE-2024-39027/): SQL injection in seacms:seacms (high 7.5)
- [CVE-2024-39025](https://insights.sbomify.com/CVE-2024-39025/): Letta (previously MemGPT) incorrect access control vulnerability (high 7.5)
- [CVE-2024-39024](https://insights.sbomify.com/CVE-2024-39024/): In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. (high 8.8)
- [CVE-2024-39023](https://insights.sbomify.com/CVE-2024-39023/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-39022](https://insights.sbomify.com/CVE-2024-39022/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-39021](https://insights.sbomify.com/CVE-2024-39021/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-39020](https://insights.sbomify.com/CVE-2024-39020/): Cross-site request forgery in idccms:idccms (medium 6.3)
- [CVE-2024-39019](https://insights.sbomify.com/CVE-2024-39019/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-39018](https://insights.sbomify.com/CVE-2024-39018/): @cat5th/key-serializer Prototype Pollution vulnerability (medium 6.3)
- [CVE-2024-39017](https://insights.sbomify.com/CVE-2024-39017/): agreejs shared v0.0.1 was discovered to contain a prototype pollution via the function mergeInternalComponents. (critical 9.8)
- [CVE-2024-39016](https://insights.sbomify.com/CVE-2024-39016/): che3vinci c3/utils-1 1.0.131 was discovered to contain a prototype pollution via the function assign. (high 8.1)
- [CVE-2024-39015](https://insights.sbomify.com/CVE-2024-39015/): cafebazaar hod v0.4.14 was discovered to contain a prototype pollution via the function request. (critical 9.8)
- [CVE-2024-39014](https://insights.sbomify.com/CVE-2024-39014/): ahilfoley cahil/utils v2.3.2 was discovered to contain a prototype pollution via the function set. (critical 9.8)
- [CVE-2024-39013](https://insights.sbomify.com/CVE-2024-39013/): 2o3t-utility v0.1.2 was discovered to contain a prototype pollution via the function extend. (critical 9.8)
- [CVE-2024-39012](https://insights.sbomify.com/CVE-2024-39012/): Code injection in ais:strategyen (critical 9.8)
- [CVE-2024-39011](https://insights.sbomify.com/CVE-2024-39011/): Code injection in chargeover:chargeover\/redoc (critical 9.8)
- [CVE-2024-39010](https://insights.sbomify.com/CVE-2024-39010/): Code injection in chasemoskal:snapstate (critical 9.8)
- [CVE-2024-3901](https://insights.sbomify.com/CVE-2024-3901/): Genesis Blocks <= 3.1.3 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2024-39008](https://insights.sbomify.com/CVE-2024-39008/): robinweser fast-loops vulnerable to prototype pollution (critical 10.0)
- [CVE-2024-39003](https://insights.sbomify.com/CVE-2024-39003/): Code injection in amoyjs:common (high 7.3)
- [CVE-2024-39002](https://insights.sbomify.com/CVE-2024-39002/): Code injection in richardrodger:jsonic (medium 6.3)
- [CVE-2024-39001](https://insights.sbomify.com/CVE-2024-39001/): ag-grid packages vulnerable to Prototype Pollution (medium 6.3)
- [CVE-2024-39000](https://insights.sbomify.com/CVE-2024-39000/): Code injection in swiperjs:swiper (medium 6.5)
- [CVE-2024-3900](https://insights.sbomify.com/CVE-2024-3900/): Out-of-bounds stack array write in Xpdf 4.05 due to missing zero check (low 2.9)
- [CVE-2024-38999](https://insights.sbomify.com/CVE-2024-38999/): jrburke requirejs vulnerable to prototype pollution (critical 10.0)
- [CVE-2024-38997](https://insights.sbomify.com/CVE-2024-38997/): adolph_dudu ratio-swiper was discovered to contain a prototype pollution via the function extendDefaults (medium 6.5)
- [CVE-2024-38996](https://insights.sbomify.com/CVE-2024-38996/): Prototype pollution in ag-grid-community via the _.mergeDeep function (critical 9.8)
- [CVE-2024-38994](https://insights.sbomify.com/CVE-2024-38994/): @amoy/common v was discovered to contain a prototype pollution via the function extend (high 7.3)
- [CVE-2024-38993](https://insights.sbomify.com/CVE-2024-38993/): Code injection in richardrodger:jsonic (critical 9.8)
- [CVE-2024-38992](https://insights.sbomify.com/CVE-2024-38992/): frappejs was discovered to contain a prototype pollution via the function registerView (high 8.8)
- [CVE-2024-38991](https://insights.sbomify.com/CVE-2024-38991/): akbr patch-into was discovered to contain a prototype pollution via the function patchInto (high 8.8)
- [CVE-2024-38990](https://insights.sbomify.com/CVE-2024-38990/): Tada5hi sp-common v0.5.4 was discovered to contain a prototype pollution via the function mergeDeep. (medium 6.3)
- [CVE-2024-3899](https://insights.sbomify.com/CVE-2024-3899/): Envira Gallery < 1.8.15 - Author+ Stored XSS (medium 4.8)
- [CVE-2024-38989](https://insights.sbomify.com/CVE-2024-38989/): Prototype pollution in izatop bunt (critical 9.8)
- [CVE-2024-38988](https://insights.sbomify.com/CVE-2024-38988/): @alizeait/unflatto Prototype Pollution (critical 9.8)
- [CVE-2024-38987](https://insights.sbomify.com/CVE-2024-38987/): @aofl/cli-lib Prototype Pollution vulnerability (medium 6.3)
- [CVE-2024-38986](https://insights.sbomify.com/CVE-2024-38986/): @75lb/deep-merge Prototype Pollution vulnerability (critical 9.8)
- [CVE-2024-38985](https://insights.sbomify.com/CVE-2024-38985/): depath and cool-path vulnerable to Prototype Pollution via `set()` Method (critical 9.8)
- [CVE-2024-38984](https://insights.sbomify.com/CVE-2024-38984/): Code injection in lukebond:json-override (critical 9.8)
- [CVE-2024-38983](https://insights.sbomify.com/CVE-2024-38983/): Code injection in alykoshin:mini-deep-assign (critical 9.8)
- [CVE-2024-38972](https://insights.sbomify.com/CVE-2024-38972/): Cross-site scripting in netbox:netbox (medium 6.1)
- [CVE-2024-38971](https://insights.sbomify.com/CVE-2024-38971/): Cross-site scripting in vaethink:vaethink (medium 5.4)
- [CVE-2024-38970](https://insights.sbomify.com/CVE-2024-38970/): Information disclosure in vaethink:vaethink (medium 4.9)
- [CVE-2024-3897](https://insights.sbomify.com/CVE-2024-3897/): Popup Box – Best WordPress Popup Plugin <= 4.3.6 - Missing Authorization to Information Exposure (medium 5.3)
- [CVE-2024-38963](https://insights.sbomify.com/CVE-2024-38963/): Cross-site scripting in nopcommerce:nopcommerce (medium 6.1)
- [CVE-2024-3896](https://insights.sbomify.com/CVE-2024-3896/): Cross-site scripting in Robo Gallery – Photo & Image Slider (medium 6.4)
- [CVE-2024-38959](https://insights.sbomify.com/CVE-2024-38959/): Cross-site scripting in creativeitem:academy lms (medium 6.1)
- [CVE-2024-38953](https://insights.sbomify.com/CVE-2024-38953/): Cross-site scripting in phpok:phpok (medium 6.1)
- [CVE-2024-38952](https://insights.sbomify.com/CVE-2024-38952/): Memory corruption in dronecode:px4 drone autopilot (high 7.5)
- [CVE-2024-38951](https://insights.sbomify.com/CVE-2024-38951/): Memory corruption in dronecode:px4 drone autopilot (medium 6.5)
- [CVE-2024-38950](https://insights.sbomify.com/CVE-2024-38950/): Memory corruption in struktur:libde265 (medium 6.5)
- [CVE-2024-3895](https://insights.sbomify.com/CVE-2024-3895/): WP Datepicker <= 2.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2024-38949](https://insights.sbomify.com/CVE-2024-38949/): Memory corruption in struktur:libde265 (medium 6.5)
- [CVE-2024-38944](https://insights.sbomify.com/CVE-2024-38944/): An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the /cgi-bin/generateFo (critical 9.8)
- [CVE-2024-3894](https://insights.sbomify.com/CVE-2024-3894/): Cross-site scripting in Robo Gallery – Photo & Image Slider (medium 6.4)
- [CVE-2024-3893](https://insights.sbomify.com/CVE-2024-3893/): Missing authorization in Classified Listing – AI-Powered Classified ads & Business Directory Plugin (medium 4.3)
- [CVE-2024-38927](https://insights.sbomify.com/CVE-2024-38927/): Use after free in openrobotics:robot operating system (critical 9.1)
- [CVE-2024-38926](https://insights.sbomify.com/CVE-2024-38926/): Use after free in openrobotics:robot operating system (critical 9.1)
- [CVE-2024-38925](https://insights.sbomify.com/CVE-2024-38925/): Use after free in openrobotics:robot operating system (critical 9.1)
- [CVE-2024-38924](https://insights.sbomify.com/CVE-2024-38924/): Use after free in openrobotics:robot operating system (critical 9.1)
- [CVE-2024-38923](https://insights.sbomify.com/CVE-2024-38923/): Use after free in openrobotics:robot operating system (critical 9.1)
- [CVE-2024-38922](https://insights.sbomify.com/CVE-2024-38922/): Memory corruption in openrobotics:robot operating system (high 8.8)
- [CVE-2024-38921](https://insights.sbomify.com/CVE-2024-38921/): Use after free in openrobotics:robot operating system (critical 9.8)
- [CVE-2024-38920](https://insights.sbomify.com/CVE-2024-38920/): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a use-after-free via the nav2_amcl process. (critical 9.1)
- [CVE-2024-3892](https://insights.sbomify.com/CVE-2024-3892/): Local code execution vulnerability in Telerik UI for WinForms (high 7.2)
- [CVE-2024-38910](https://insights.sbomify.com/CVE-2024-38910/): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble version was discovered to contain a use-after-free in the nav2_amcl process. (high 7.5)
- [CVE-2024-3891](https://insights.sbomify.com/CVE-2024-3891/): Happy Addons for Elementor <= 3.10.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (medium 6.4)
- [CVE-2024-38909](https://insights.sbomify.com/CVE-2024-38909/): Studio 42 elFinder vulnerable to Incorrect Access Control (critical 9.8)
- [CVE-2024-38903](https://insights.sbomify.com/CVE-2024-38903/): Command injection in h3c:magic r230 firmware (medium 4.1)
- [CVE-2024-38902](https://insights.sbomify.com/CVE-2024-38902/): Hardcoded credentials in h3c:magic r230 firmware (critical 9.8)
- [CVE-2024-3890](https://insights.sbomify.com/CVE-2024-3890/): Happy Addons for Elementor <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Calendly Widget (medium 6.4)
- [CVE-2024-38897](https://insights.sbomify.com/CVE-2024-38897/): Information disclosure in wavlink:wn551k1 firmware (medium 5.3)
- [CVE-2024-38896](https://insights.sbomify.com/CVE-2024-38896/): Command injection in wavlink:wn551k1 firmware (medium 5.3)
- [CVE-2024-38895](https://insights.sbomify.com/CVE-2024-38895/): Information disclosure in wavlink:wn551k1 firmware (medium 5.3)
- [CVE-2024-38894](https://insights.sbomify.com/CVE-2024-38894/): Command injection in wavlink:wn551k1 firmware (medium 5.3)
- [CVE-2024-38892](https://insights.sbomify.com/CVE-2024-38892/): Information disclosure in wavlink:wn551k1 firmware (medium 6.5)
- [CVE-2024-38891](https://insights.sbomify.com/CVE-2024-38891/): Information disclosure in horizoncloud:caterease (critical 9.1)
- [CVE-2024-38890](https://insights.sbomify.com/CVE-2024-38890/): Auth bypass in horizoncloud:caterease (high 8.4)
- [CVE-2024-3889](https://insights.sbomify.com/CVE-2024-3889/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2024-38889](https://insights.sbomify.com/CVE-2024-38889/): SQL injection in horizoncloud:caterease (critical 9.6)
- [CVE-2024-38888](https://insights.sbomify.com/CVE-2024-38888/): Auth bypass in horizoncloud:caterease (medium 6.8)
- [CVE-2024-38887](https://insights.sbomify.com/CVE-2024-38887/): Command injection in horizoncloud:caterease (critical 9.8)
- [CVE-2024-38886](https://insights.sbomify.com/CVE-2024-38886/): Other in horizoncloud:caterease (critical 9.8)
- [CVE-2024-38885](https://insights.sbomify.com/CVE-2024-38885/): Hardcoded credentials in horizoncloud:caterease (high 7.5)
- [CVE-2024-38884](https://insights.sbomify.com/CVE-2024-38884/): Auth bypass in horizoncloud:caterease (high 7.8)
- [CVE-2024-38883](https://insights.sbomify.com/CVE-2024-38883/): Weak cryptography in horizoncloud:caterease (critical 9.1)
- [CVE-2024-38882](https://insights.sbomify.com/CVE-2024-38882/): Command injection in horizoncloud:caterease (critical 9.8)
- [CVE-2024-38881](https://insights.sbomify.com/CVE-2024-38881/): Weak cryptography in horizoncloud:caterease (high 7.5)
- [CVE-2024-3888](https://insights.sbomify.com/CVE-2024-3888/): tagDiv Composer <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via button Shortcode (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/316/