# Vulnerabilities published in 2024


- [CVE-2024-35160](https://insights.sbomify.com/CVE-2024-35160/): IBM Watson Query on Cloud Pak for Data and IBM Db2 Big SQL on Cloud Pak for Data information disclosure (medium 4.3)
- [CVE-2024-3516](https://insights.sbomify.com/CVE-2024-3516/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-35156](https://insights.sbomify.com/CVE-2024-35156/): IBM MQ information disclosure (medium 6.5)
- [CVE-2024-35155](https://insights.sbomify.com/CVE-2024-35155/): IBM MQ information disclosure (medium 6.5)
- [CVE-2024-35154](https://insights.sbomify.com/CVE-2024-35154/): IBM WebSphere Application Server code execution (high 7.2)
- [CVE-2024-35153](https://insights.sbomify.com/CVE-2024-35153/): IBM WebSphere Application Server cross-site scripting (medium 4.8)
- [CVE-2024-35152](https://insights.sbomify.com/CVE-2024-35152/): IBM Db2 denial of service (medium 6.5)
- [CVE-2024-35151](https://insights.sbomify.com/CVE-2024-35151/): IBM OpenPages information disclosure (medium 6.5)
- [CVE-2024-35150](https://insights.sbomify.com/CVE-2024-35150/): IBM Maximo Application Suite log manipulation (medium 5.3)
- [CVE-2024-3515](https://insights.sbomify.com/CVE-2024-3515/): Use after free in Chrome (low 3.7)
- [CVE-2024-35148](https://insights.sbomify.com/CVE-2024-35148/): IBM Maximo Application Suite SQL injection (medium 6.3)
- [CVE-2024-35146](https://insights.sbomify.com/CVE-2024-35146/): IBM Maximo Application Suite cross-site scripting (medium 5.4)
- [CVE-2024-35145](https://insights.sbomify.com/CVE-2024-35145/): IBM Maximo Application Suite cross-site scripting (medium 6.1)
- [CVE-2024-35144](https://insights.sbomify.com/CVE-2024-35144/): IBM Maximo Application Suite information disclosure (medium 5.3)
- [CVE-2024-35143](https://insights.sbomify.com/CVE-2024-35143/): IBM Planning Analytics Local missing authentication (medium 6.7)
- [CVE-2024-35142](https://insights.sbomify.com/CVE-2024-35142/): IBM Security Verify Access privilege escalation (high 8.4)
- [CVE-2024-35141](https://insights.sbomify.com/CVE-2024-35141/): IBM Security Verify Access privilege escalation (high 7.8)
- [CVE-2024-35140](https://insights.sbomify.com/CVE-2024-35140/): IBM Security Verify Access privilege escalation (high 7.7)
- [CVE-2024-35139](https://insights.sbomify.com/CVE-2024-35139/): IBM Security Access Manager Docker information disclosure (medium 6.2)
- [CVE-2024-35138](https://insights.sbomify.com/CVE-2024-35138/): IBM Security Verify Access cross-site request forgery (medium 6.5)
- [CVE-2024-35137](https://insights.sbomify.com/CVE-2024-35137/): IBM Security Access Manager Docker information disclosure (medium 6.2)
- [CVE-2024-35136](https://insights.sbomify.com/CVE-2024-35136/): IBM Db2 denial of service (medium 5.3)
- [CVE-2024-35134](https://insights.sbomify.com/CVE-2024-35134/): IBM Analytics Content Hub information disclosure (medium 5.3)
- [CVE-2024-35133](https://insights.sbomify.com/CVE-2024-35133/): IBM Security Verify Access HTTP open redirect (medium 6.8)
- [CVE-2024-3513](https://insights.sbomify.com/CVE-2024-3513/): Cross-site scripting in Ultimate Blocks – 25+ Gutenberg Blocks for Block Editor (medium 6.4)
- [CVE-2024-35124](https://insights.sbomify.com/CVE-2024-35124/): IBM OpenBMC authentication bypass (high 7.5)
- [CVE-2024-35122](https://insights.sbomify.com/CVE-2024-35122/): IBM i denial of service (low 2.8)
- [CVE-2024-35119](https://insights.sbomify.com/CVE-2024-35119/): IBM InfoSphere Information Server information disclosure (medium 5.3)
- [CVE-2024-35118](https://insights.sbomify.com/CVE-2024-35118/): IBM MaaS360 information disclosure (medium 4.6)
- [CVE-2024-35117](https://insights.sbomify.com/CVE-2024-35117/): IBM OpenPages with Watson information disclosure (medium 4.4)
- [CVE-2024-35116](https://insights.sbomify.com/CVE-2024-35116/): IBM MQ denial of service (medium 5.9)
- [CVE-2024-35114](https://insights.sbomify.com/CVE-2024-35114/): IBM Control Center information disclosure (medium 5.3)
- [CVE-2024-35113](https://insights.sbomify.com/CVE-2024-35113/): IBM Control Center information disclosure (medium 4.3)
- [CVE-2024-35112](https://insights.sbomify.com/CVE-2024-35112/): IBM Control Center cross-site scripting (medium 5.4)
- [CVE-2024-35111](https://insights.sbomify.com/CVE-2024-35111/): IBM Control Center information disclosure (medium 4.3)
- [CVE-2024-35110](https://insights.sbomify.com/CVE-2024-35110/): Cross-site scripting in yzmcms:yzmcms (medium 5.5)
- [CVE-2024-3511](https://insights.sbomify.com/CVE-2024-3511/): Incorrect Authorization in Multiple WSO2 Products Allows Unauthorized Access to Registry Versioned Files (medium 4.3)
- [CVE-2024-35109](https://insights.sbomify.com/CVE-2024-35109/): Cross-site request forgery in idccms:idccms (medium 6.5)
- [CVE-2024-35108](https://insights.sbomify.com/CVE-2024-35108/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-35106](https://insights.sbomify.com/CVE-2024-35106/): NEXTU FLETA AX1500 WIFI6 v1.0.3 was discovered to contain a buffer overflow at /boafrm/formIpQoS. (medium 4.6)
- [CVE-2024-35102](https://insights.sbomify.com/CVE-2024-35102/): Insecure Permissions vulnerability in VITEC AvediaServer (Model avsrv-m8105) 8.6.2-1 allows a remote attacker to escalate privileges via a crafted script. (high 8.8)
- [CVE-2024-35099](https://insights.sbomify.com/CVE-2024-35099/): Memory corruption in totolink:lr350 firmware (critical 9.8)
- [CVE-2024-35091](https://insights.sbomify.com/CVE-2024-35091/): SQL injection in j2eefast:j2eefast (critical 9.8)
- [CVE-2024-35090](https://insights.sbomify.com/CVE-2024-35090/): SQL injection in j2eefast:j2eefast (high 8.2)
- [CVE-2024-3509](https://insights.sbomify.com/CVE-2024-3509/): Stored Cross-Site Scripting (XSS) in Management Console of Multiple WSO2 Products via Rich Text Editor (medium 4.3)
- [CVE-2024-35086](https://insights.sbomify.com/CVE-2024-35086/): SQL injection in j2eefast:j2eefast (critical 9.8)
- [CVE-2024-35085](https://insights.sbomify.com/CVE-2024-35085/): SQL injection in j2eefast:j2eefast (medium 5.4)
- [CVE-2024-35084](https://insights.sbomify.com/CVE-2024-35084/): SQL injection in j2eefast:j2eefast (critical 9.8)
- [CVE-2024-35083](https://insights.sbomify.com/CVE-2024-35083/): SQL injection in j2eefast:j2eefast (high 8.8)
- [CVE-2024-35082](https://insights.sbomify.com/CVE-2024-35082/): SQL injection in j2eefast:j2eefast (medium 6.3)
- [CVE-2024-35081](https://insights.sbomify.com/CVE-2024-35081/): Path traversal in luckyframe:luckyframeweb (high 7.5)
- [CVE-2024-35080](https://insights.sbomify.com/CVE-2024-35080/): File upload in inxedu:inxedu (critical 9.8)
- [CVE-2024-3508](https://insights.sbomify.com/CVE-2024-3508/): Bzip2: compressed content bomb leads to denial of service of bombastic api (medium 4.3)
- [CVE-2024-35079](https://insights.sbomify.com/CVE-2024-35079/): File upload in inxedu:inxedu (critical 9.8)
- [CVE-2024-3507](https://insights.sbomify.com/CVE-2024-3507/): Privilege escalation vulnerability in Lunar (high 7.7)
- [CVE-2024-35061](https://insights.sbomify.com/CVE-2024-35061/): NASA AIT-Core uses unencrypted channels to exchange data over the network (high 7.3)
- [CVE-2024-35060](https://insights.sbomify.com/CVE-2024-35060/): Deserialization in nasa:ait core (high 7.5)
- [CVE-2024-3506](https://insights.sbomify.com/CVE-2024-3506/): Camera Driver possible Buffer Overflow (high 7.3)
- [CVE-2024-35059](https://insights.sbomify.com/CVE-2024-35059/): NASA AIT-Core vulnerable to remote code execution (high 7.5)
- [CVE-2024-35058](https://insights.sbomify.com/CVE-2024-35058/): NASA AIT-Core vulnerable to remote code execution (high 7.5)
- [CVE-2024-35057](https://insights.sbomify.com/CVE-2024-35057/): NASA AIT-Core vulnerable to remote code execution (high 7.5)
- [CVE-2024-35056](https://insights.sbomify.com/CVE-2024-35056/): NASA AIT-Core vulnerable to SQL Injection (critical 9.8)
- [CVE-2024-35050](https://insights.sbomify.com/CVE-2024-35050/): Auth bypass in surveyking:surveyking (high 8.8)
- [CVE-2024-3505](https://insights.sbomify.com/CVE-2024-3505/): JFrog Self-Hosted Artifactory Proxy configuration accessible to low-privilege users (medium 4.3)
- [CVE-2024-35049](https://insights.sbomify.com/CVE-2024-35049/): Auth bypass in surveyking:surveyking (critical 9.1)
- [CVE-2024-35048](https://insights.sbomify.com/CVE-2024-35048/): Auth bypass in surveyking:surveyking (medium 4.3)
- [CVE-2024-3504](https://insights.sbomify.com/CVE-2024-3504/): Improper Access Control in lunary-ai/lunary (high 8.1)
- [CVE-2024-35039](https://insights.sbomify.com/CVE-2024-35039/): Cross-site request forgery in idccms:idccms (low 3.8)
- [CVE-2024-3502](https://insights.sbomify.com/CVE-2024-3502/): Exposure of Sensitive Information in lunary-ai/lunary (critical 9.1)
- [CVE-2024-35012](https://insights.sbomify.com/CVE-2024-35012/): Cross-site request forgery in idccms:idccms (medium 6.3)
- [CVE-2024-35011](https://insights.sbomify.com/CVE-2024-35011/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-35010](https://insights.sbomify.com/CVE-2024-35010/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-3501](https://insights.sbomify.com/CVE-2024-3501/): Exposure of Sensitive Information in lunary-ai/lunary (critical 9.1)
- [CVE-2024-35009](https://insights.sbomify.com/CVE-2024-35009/): Cross-site request forgery in idccms:idccms (high 8.8)
- [CVE-2024-3500](https://insights.sbomify.com/CVE-2024-3500/): Path traversal in ElementsKit Pro (high 8.8)
- [CVE-2024-34997](https://insights.sbomify.com/CVE-2024-34997/): Deserialization in joblib project:joblib (high 7.5)
- [CVE-2024-34995](https://insights.sbomify.com/CVE-2024-34995/): svnWebUI v1.8.3 was discovered to contain an arbitrary file deletion vulnerability via the dirTemps parameter under com.cym.controller.UserController#importOver. (medium 4.3)
- [CVE-2024-34994](https://insights.sbomify.com/CVE-2024-34994/): In the module "Channable" (channable) up to version 3.2.1 from Channable for PrestaShop, a guest can perform SQL injection via `ChannableFee (critical 9.8)
- [CVE-2024-34993](https://insights.sbomify.com/CVE-2024-34993/): In the module "Bulk Export products to Google Merchant-Google Shopping" (bagoogleshopping) up to version 1.0.26 from Buy Addons for PrestaSh (medium 6.3)
- [CVE-2024-34992](https://insights.sbomify.com/CVE-2024-34992/): SQL Injection vulnerability in the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules f (high 8.8)
- [CVE-2024-34991](https://insights.sbomify.com/CVE-2024-34991/): In the module "Axepta" (axepta) before 1.3.4 from Quadra Informatique for PrestaShop, a guest can download partial credit card information ( (high 7.5)
- [CVE-2024-34990](https://insights.sbomify.com/CVE-2024-34990/): In the module "Help Desk - Customer Support Management System" (helpdesk) up to version 2.4.0 from FME Modules for PrestaShop, a customer can upload .php files. (critical 10.0)
- [CVE-2024-3499](https://insights.sbomify.com/CVE-2024-3499/): ElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module (high 8.8)
- [CVE-2024-34989](https://insights.sbomify.com/CVE-2024-34989/): In the module RSI PDF/HTML catalog evolution (prestapdf) <= 7.0.0 from RSI for PrestaShop, a guest can perform SQL injection via `PrestaPDFP (critical 9.8)
- [CVE-2024-34988](https://insights.sbomify.com/CVE-2024-34988/): SQL injection vulnerability in the module "Complete for Create a Quote in Frontend + Backend Pro" (askforaquotemodul) <= 1.0.51 from Buy Add (critical 9.8)
- [CVE-2024-34987](https://insights.sbomify.com/CVE-2024-34987/): SQL injection in phpgurukul:online fire reporting system (critical 9.1)
- [CVE-2024-34982](https://insights.sbomify.com/CVE-2024-34982/): File upload in lylme:lylme spage (critical 9.8)
- [CVE-2024-3498](https://insights.sbomify.com/CVE-2024-3498/): Incorrect Permission Assignment Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-34974](https://insights.sbomify.com/CVE-2024-34974/): Memory corruption in tenda:ac18 firmware (high 8.2)
- [CVE-2024-3497](https://insights.sbomify.com/CVE-2024-3497/): Directory Traversal Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-3496](https://insights.sbomify.com/CVE-2024-3496/): Authentication Bypass Vulnerability (high 8.8)
- [CVE-2024-34959](https://insights.sbomify.com/CVE-2024-34959/): Cross-site scripting in dedecms:dedecms (medium 5.5)
- [CVE-2024-34958](https://insights.sbomify.com/CVE-2024-34958/): Cross-site request forgery in idccms:idccms (medium 6.5)
- [CVE-2024-34957](https://insights.sbomify.com/CVE-2024-34957/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-34955](https://insights.sbomify.com/CVE-2024-34955/): SQL injection in code-projects:budget management (critical 9.8)
- [CVE-2024-34954](https://insights.sbomify.com/CVE-2024-34954/): Cross-site scripting in code-projects:budget management (medium 6.1)
- [CVE-2024-34953](https://insights.sbomify.com/CVE-2024-34953/): An issue in taurusxin ncmdump v1.3.2 allows attackers to cause a Denial of Service (DoS) via memory exhaustion by supplying a crafted .ncm f (high 7.5)
- [CVE-2024-34952](https://insights.sbomify.com/CVE-2024-34952/): taurusxin ncmdump v1.3.2 was discovered to contain a segmentation violation via the NeteaseCrypt::FixMetadata() function at /src/ncmcrypt.cpp. (medium 5.0)
- [CVE-2024-34950](https://insights.sbomify.com/CVE-2024-34950/): Memory corruption in dlink:dir-822\+ firmware (high 7.5)
- [CVE-2024-3495](https://insights.sbomify.com/CVE-2024-3495/): Country State City Dropdown CF7 <= 2.7.2 - Unauthenticated SQL Injection (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/349/