# Vulnerabilities published in 2024


- [CVE-2024-36730](https://insights.sbomify.com/CVE-2024-36730/): Denial of service in oneflow:oneflow (high 7.5)
- [CVE-2024-3673](https://insights.sbomify.com/CVE-2024-3673/): Web Directory Free < 1.7.3 - Unauthenticated LFI (critical 9.1)
- [CVE-2024-36729](https://insights.sbomify.com/CVE-2024-36729/): Memory corruption in trendnet:tew-827dru firmware (medium 6.3)
- [CVE-2024-36728](https://insights.sbomify.com/CVE-2024-36728/): Memory corruption in trendnet:tew-827dru firmware (high 8.1)
- [CVE-2024-3672](https://insights.sbomify.com/CVE-2024-3672/): BA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-3671](https://insights.sbomify.com/CVE-2024-3671/): Print-O-Matic <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-36702](https://insights.sbomify.com/CVE-2024-36702/): Memory corruption in mz-automation:libiec61850 (high 7.4)
- [CVE-2024-3670](https://insights.sbomify.com/CVE-2024-3670/): Cross-site scripting in Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) (medium 6.4)
- [CVE-2024-36697](https://insights.sbomify.com/CVE-2024-36697/): A cross-site scripting (XSS) vulnerability in the Admin Login page of Allworx System Software v9.1.9.12 allows attackers to execute arbitrar (medium 6.1)
- [CVE-2024-36694](https://insights.sbomify.com/CVE-2024-36694/): openCart Server-Side Template Injection (SSTI) vulnerability (high 7.2)
- [CVE-2024-36691](https://insights.sbomify.com/CVE-2024-36691/): Insecure permissions in the AdminController.AjaxSave() method of PPGo_Jobs v2.8.0 allows authenticated attackers to arbitrarily modify users (medium 6.3)
- [CVE-2024-3669](https://insights.sbomify.com/CVE-2024-3669/): Web Directory Free < 1.7.2 - Reflected XSS (medium 6.8)
- [CVE-2024-36684](https://insights.sbomify.com/CVE-2024-36684/): SQL injection in prestashop:pk customlinks (critical 9.8)
- [CVE-2024-36683](https://insights.sbomify.com/CVE-2024-36683/): SQL injection vulnerability in the module "Products Alert" (productsalert) before 1.7.4 from Smart Modules for PrestaShop allows attackers t (high 7.3)
- [CVE-2024-36682](https://insights.sbomify.com/CVE-2024-36682/): In the module "Theme settings" (pk_themesettings) <= 1.8.8 from Promokit.eu for PrestaShop, a guest can download all email collected while S (high 7.5)
- [CVE-2024-36681](https://insights.sbomify.com/CVE-2024-36681/): SQL Injection vulnerability in the module "Isotope" (pk_isotope) <=1.7.3 from Promokit.eu for PrestaShop allows attackers to obtain sensitiv (critical 9.8)
- [CVE-2024-36680](https://insights.sbomify.com/CVE-2024-36680/): In the module "Facebook" (pkfacebook) <=1.0.1 from Promokit.eu for PrestaShop, a guest can perform SQL injection. (high 7.5)
- [CVE-2024-3668](https://insights.sbomify.com/CVE-2024-3668/): PowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation (high 8.8)
- [CVE-2024-36679](https://insights.sbomify.com/CVE-2024-36679/): In the module "Module Live Chat Pro (All in One Messaging)" (livechatpro) <=8.4.0, a guest can perform PHP Code injection. (critical 10.0)
- [CVE-2024-36678](https://insights.sbomify.com/CVE-2024-36678/): SQL injection in promokit:pk themesettings (critical 9.8)
- [CVE-2024-36677](https://insights.sbomify.com/CVE-2024-36677/): In the module "Login as customer PRO" (loginascustomerpro) <1.2.7 from Weblir for PrestaShop, a guest can access direct link to connect to e (high 7.5)
- [CVE-2024-36676](https://insights.sbomify.com/CVE-2024-36676/): BookStack Incorrect Access Control vulnerability (high 7.5)
- [CVE-2024-36675](https://insights.sbomify.com/CVE-2024-36675/): Server-side request forgery in lylme:lylme spage (critical 9.1)
- [CVE-2024-36674](https://insights.sbomify.com/CVE-2024-36674/): Cross-site scripting in lylme:lylme spage (medium 6.1)
- [CVE-2024-36673](https://insights.sbomify.com/CVE-2024-36673/): SQL injection in pharmacy\/medical store point of sale system project:pharmacy\/medical store point of sale system (critical 9.8)
- [CVE-2024-36671](https://insights.sbomify.com/CVE-2024-36671/): nodemcu before v3.0.0-release_20240225 was discovered to contain an integer overflow via the getnum function at /modules/struct.c. (critical 9.8)
- [CVE-2024-36670](https://insights.sbomify.com/CVE-2024-36670/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-3667](https://insights.sbomify.com/CVE-2024-3667/): Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL (high 7.4)
- [CVE-2024-36669](https://insights.sbomify.com/CVE-2024-36669/): Cross-site request forgery in idccms project:idccms (medium 5.4)
- [CVE-2024-36668](https://insights.sbomify.com/CVE-2024-36668/): Cross-site request forgery in idccms project:idccms (medium 5.4)
- [CVE-2024-36667](https://insights.sbomify.com/CVE-2024-36667/): Cross-site request forgery in idccms project:idccms (medium 5.4)
- [CVE-2024-3666](https://insights.sbomify.com/CVE-2024-3666/): Cross-site scripting in Opal Estate Pro – Property Management and Submission (medium 6.4)
- [CVE-2024-36656](https://insights.sbomify.com/CVE-2024-36656/): Cross-site scripting in minthcm:minthcm (medium 6.1)
- [CVE-2024-36650](https://insights.sbomify.com/CVE-2024-36650/): Memory corruption in totolink:a3100r firmware (high 7.5)
- [CVE-2024-3665](https://insights.sbomify.com/CVE-2024-3665/): Cross-site scripting in Rank Math SEO – AI SEO Tools to Dominate SEO Rankings (medium 6.4)
- [CVE-2024-36647](https://insights.sbomify.com/CVE-2024-36647/): Cross-site scripting in churchcrm:churchcrm (medium 5.4)
- [CVE-2024-3664](https://insights.sbomify.com/CVE-2024-3664/): Missing authorization in Quick Featured Images (medium 4.3)
- [CVE-2024-3663](https://insights.sbomify.com/CVE-2024-3663/): WP Scraper <= 5.7 - Missing Authorization to Arbitrary Page/Post Creation (medium 4.3)
- [CVE-2024-36626](https://insights.sbomify.com/CVE-2024-36626/): Null dereference in prestashop:prestashop (medium 5.3)
- [CVE-2024-36625](https://insights.sbomify.com/CVE-2024-36625/): Cross-site scripting in zulip:zulip (medium 6.1)
- [CVE-2024-36624](https://insights.sbomify.com/CVE-2024-36624/): Cross-site scripting in zulip:zulip (medium 6.1)
- [CVE-2024-36623](https://insights.sbomify.com/CVE-2024-36623/): Moby Race Condition vulnerability (high 8.1)
- [CVE-2024-36622](https://insights.sbomify.com/CVE-2024-36622/): Command injection in raspap:raspap-webgui (critical 9.8)
- [CVE-2024-36621](https://insights.sbomify.com/CVE-2024-36621/): Moby Race Condition vulnerability (medium 6.5)
- [CVE-2024-36620](https://insights.sbomify.com/CVE-2024-36620/): NULL Pointer Dereference on moby image history (medium 6.5)
- [CVE-2024-3662](https://insights.sbomify.com/CVE-2024-3662/): Missing authorization in WPZOOM Social Feed Widget & Block (medium 4.3)
- [CVE-2024-36619](https://insights.sbomify.com/CVE-2024-36619/): Integer overflow in ffmpeg:ffmpeg (medium 5.3)
- [CVE-2024-36618](https://insights.sbomify.com/CVE-2024-36618/): Integer overflow in ffmpeg:ffmpeg (medium 6.2)
- [CVE-2024-36617](https://insights.sbomify.com/CVE-2024-36617/): Integer overflow in ffmpeg:ffmpeg (medium 6.2)
- [CVE-2024-36616](https://insights.sbomify.com/CVE-2024-36616/): Integer overflow in ffmpeg:ffmpeg (medium 6.5)
- [CVE-2024-36615](https://insights.sbomify.com/CVE-2024-36615/): Race condition in ffmpeg:ffmpeg (medium 5.9)
- [CVE-2024-36613](https://insights.sbomify.com/CVE-2024-36613/): Integer overflow in ffmpeg:ffmpeg (medium 6.2)
- [CVE-2024-36612](https://insights.sbomify.com/CVE-2024-36612/): Denial of service in zulip:zulip server (high 7.5)
- [CVE-2024-36611](https://insights.sbomify.com/CVE-2024-36611/): In Symfony v7.07, a security vulnerability was identified in the FormLoginAuthenticator component, where it failed to adequately handle case (high 7.5)
- [CVE-2024-3661](https://insights.sbomify.com/CVE-2024-3661/): DHCP routing options can manipulate interface-based VPN traffic (high 7.6)
- [CVE-2024-36604](https://insights.sbomify.com/CVE-2024-36604/): Command injection in tenda:o3 firmware (critical 9.8)
- [CVE-2024-36600](https://insights.sbomify.com/CVE-2024-36600/): Memory corruption in gnu:libcdio (high 8.4)
- [CVE-2024-3660](https://insights.sbomify.com/CVE-2024-3660/): Arbitrary code injection vulnerability in Keras framework < 2.13 (critical 9.8)
- [CVE-2024-36599](https://insights.sbomify.com/CVE-2024-36599/): Cross-site scripting in aegon:life insurance management system (medium 6.1)
- [CVE-2024-36598](https://insights.sbomify.com/CVE-2024-36598/): An arbitrary file upload vulnerability in Aegon Life v1.0 allows attackers to execute arbitrary code via uploading a crafted image file. (high 8.1)
- [CVE-2024-36597](https://insights.sbomify.com/CVE-2024-36597/): SQL injection in projectworlds:life insurance management system (high 8.8)
- [CVE-2024-3659](https://insights.sbomify.com/CVE-2024-3659/): Command injection in KAON AR2140 routers (critical 10.0)
- [CVE-2024-36589](https://insights.sbomify.com/CVE-2024-36589/): An issue in Annonshop.app DecentralizeJustice/anonymousLocker commit 2b2b4 to ba9fd and DecentralizeJustice/anonBackend commit 57837 to cd81 (medium 4.3)
- [CVE-2024-36588](https://insights.sbomify.com/CVE-2024-36588/): An issue in Annonshop.app DecentralizeJustice/ anonymousLocker commit 2b2b4 allows attackers to send messages erroneously attributed to arbi (medium 6.5)
- [CVE-2024-36587](https://insights.sbomify.com/CVE-2024-36587/): Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting (high 7.8)
- [CVE-2024-36586](https://insights.sbomify.com/CVE-2024-36586/): AdGuardHome privilege escalation vulnerability (high 8.8)
- [CVE-2024-36583](https://insights.sbomify.com/CVE-2024-36583/): A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index. (high 8.1)
- [CVE-2024-36582](https://insights.sbomify.com/CVE-2024-36582/): object-deep-assign Prototype Pollution (critical 9.8)
- [CVE-2024-36581](https://insights.sbomify.com/CVE-2024-36581/): Badger Database Prototype Pollution (high 7.6)
- [CVE-2024-36580](https://insights.sbomify.com/CVE-2024-36580/): @cdr0/sg Prototype Pollution (critical 9.8)
- [CVE-2024-36578](https://insights.sbomify.com/CVE-2024-36578/): @akbr/update Prototype Pollution (medium 5.9)
- [CVE-2024-36577](https://insights.sbomify.com/CVE-2024-36577/): Object Resolver Prototype Pollution (high 8.3)
- [CVE-2024-36575](https://insights.sbomify.com/CVE-2024-36575/): A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor. (critical 9.8)
- [CVE-2024-36574](https://insights.sbomify.com/CVE-2024-36574/): flatten-json Prototype Pollution (medium 6.3)
- [CVE-2024-36573](https://insights.sbomify.com/CVE-2024-36573/): obx Prototype Pollution (critical 9.8)
- [CVE-2024-36572](https://insights.sbomify.com/CVE-2024-36572/): Code injection in allpro:formmanager data handler (critical 9.8)
- [CVE-2024-3657](https://insights.sbomify.com/CVE-2024-3657/): 389-ds-base: potential denial of service via specially crafted kerberos as-req request (high 7.5)
- [CVE-2024-36569](https://insights.sbomify.com/CVE-2024-36569/): Code injection in mayurik:gas agency management system (high 8.1)
- [CVE-2024-36568](https://insights.sbomify.com/CVE-2024-36568/): SQL injection in mayurik:gas agency management system (critical 9.8)
- [CVE-2024-3656](https://insights.sbomify.com/CVE-2024-3656/): Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities (high 8.1)
- [CVE-2024-36558](https://insights.sbomify.com/CVE-2024-36558/): Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Informatio (high 7.5)
- [CVE-2024-36557](https://insights.sbomify.com/CVE-2024-36557/): The device ID is based on IMEI in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call (medium 6.6)
- [CVE-2024-36556](https://insights.sbomify.com/CVE-2024-36556/): Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h, and Forever KidsWatch Call Me 2 KW60 R36CW_YDE_S4_A29_2_V1. (critical 9.1)
- [CVE-2024-36555](https://insights.sbomify.com/CVE-2024-36555/): Built-in SMS-configuration command in Forever KidsWatch Call Me KW50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch (critical 9.8)
- [CVE-2024-36554](https://insights.sbomify.com/CVE-2024-36554/): Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h and Forever KidsWatch Call Me KW-60 R36CW_YDE_S4_A29_2_V1.0 (critical 9.8)
- [CVE-2024-36553](https://insights.sbomify.com/CVE-2024-36553/): Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack. (high 8.1)
- [CVE-2024-36550](https://insights.sbomify.com/CVE-2024-36550/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-3655](https://insights.sbomify.com/CVE-2024-3655/): Mali GPU Kernel Driver allows improper GPU memory processing operations (high 7.8)
- [CVE-2024-36549](https://insights.sbomify.com/CVE-2024-36549/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-36548](https://insights.sbomify.com/CVE-2024-36548/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-36547](https://insights.sbomify.com/CVE-2024-36547/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-36543](https://insights.sbomify.com/CVE-2024-36543/): STRIMZI incorrect access control (critical 9.8)
- [CVE-2024-36542](https://insights.sbomify.com/CVE-2024-36542/): Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. (high 8.8)
- [CVE-2024-36541](https://insights.sbomify.com/CVE-2024-36541/): Misconfiguration in kube-logging:logging-operator (high 8.8)
- [CVE-2024-36540](https://insights.sbomify.com/CVE-2024-36540/): Misconfiguration in external-secrets:external secrets operator (critical 9.8)
- [CVE-2024-3654](https://insights.sbomify.com/CVE-2024-3654/): Cross-Site Scripting Vulnerability in Teixo by Teimas Global (medium 6.3)
- [CVE-2024-36539](https://insights.sbomify.com/CVE-2024-36539/): Misconfiguration in projectcontour:contour (critical 9.8)
- [CVE-2024-36538](https://insights.sbomify.com/CVE-2024-36538/): Misconfiguration in chaos-mesh:chaos mesh (high 8.8)
- [CVE-2024-36537](https://insights.sbomify.com/CVE-2024-36537/): Misconfiguration in cert-manager:cert-manager (high 7.2)
- [CVE-2024-36536](https://insights.sbomify.com/CVE-2024-36536/): fabedge has insecure permissions (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/336/