# Vulnerabilities published in 2024


- [CVE-2024-34590](https://insights.sbomify.com/CVE-2024-34590/): Denial of service in Samsung Mobile Devices (medium 5.3)
- [CVE-2024-3459](https://insights.sbomify.com/CVE-2024-3459/): Security feature bypass in Kioware (high 8.4)
- [CVE-2024-34589](https://insights.sbomify.com/CVE-2024-34589/): Denial of service in Samsung Mobile Devices (medium 5.3)
- [CVE-2024-34588](https://insights.sbomify.com/CVE-2024-34588/): Denial of service in Samsung Mobile Devices (medium 5.3)
- [CVE-2024-34587](https://insights.sbomify.com/CVE-2024-34587/): Memory corruption in Samsung Mobile Devices (high 7.5)
- [CVE-2024-34586](https://insights.sbomify.com/CVE-2024-34586/): Missing authorization in Samsung Mobile Devices (medium 5.9)
- [CVE-2024-34585](https://insights.sbomify.com/CVE-2024-34585/): Missing authorization in Samsung Mobile Devices (high 7.8)
- [CVE-2024-34583](https://insights.sbomify.com/CVE-2024-34583/): Missing authorization in Samsung Mobile Devices (medium 4.0)
- [CVE-2024-34582](https://insights.sbomify.com/CVE-2024-34582/): Sunhillo SureLine through 8.10.0 on RICI 5000 devices allows cgi/usrPasswd.cgi userid_change XSS within the Forgot Password feature. (medium 6.1)
- [CVE-2024-34581](https://insights.sbomify.com/CVE-2024-34581/): The W3C XML Signature Syntax and Processing (XMLDsig) specification, starting with 1.0, was originally published with a "RetrievalMethod is a URI ... (high 7.3)
- [CVE-2024-34580](https://insights.sbomify.com/CVE-2024-34580/): Apache XML Security for C++ through 2.0.4 implements the XML Signature Syntax and Processing (XMLDsig) specification without protection agai (medium 5.3)
- [CVE-2024-3458](https://insights.sbomify.com/CVE-2024-3458/): Netentsec NS-ASG Application Security Gateway add_ikev2.php sql injection (medium 6.3)
- [CVE-2024-34579](https://insights.sbomify.com/CVE-2024-34579/): Fuji Electric Alpha5 SMART Stack-Based Buffer Overflow (high 8.5)
- [CVE-2024-34577](https://insights.sbomify.com/CVE-2024-34577/): Cross-site scripting in WRC-X3000GS2-B (medium 4.6)
- [CVE-2024-34575](https://insights.sbomify.com/CVE-2024-34575/): WordPress DethemeKit For Elementor plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34574](https://insights.sbomify.com/CVE-2024-34574/): WordPress Table Maker plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34573](https://insights.sbomify.com/CVE-2024-34573/): WordPress Pootle Pagebuilder plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34572](https://insights.sbomify.com/CVE-2024-34572/): WordPress Fancy Elementor Flipbox plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34571](https://insights.sbomify.com/CVE-2024-34571/): WordPress Himalayas theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34570](https://insights.sbomify.com/CVE-2024-34570/): WordPress Xpro Elementor Addons plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3457](https://insights.sbomify.com/CVE-2024-3457/): Netentsec NS-ASG Application Security Gateway config_ISCGroupNoCache.php sql injection (medium 6.3)
- [CVE-2024-34569](https://insights.sbomify.com/CVE-2024-34569/): WordPress Zotpress plugin <= 7.3.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34568](https://insights.sbomify.com/CVE-2024-34568/): WordPress LetterPress Newsletter plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34567](https://insights.sbomify.com/CVE-2024-34567/): WordPress Easy Notify Lite plugin <= 1.1.29 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34566](https://insights.sbomify.com/CVE-2024-34566/): WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34565](https://insights.sbomify.com/CVE-2024-34565/): WordPress Debug Info plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34564](https://insights.sbomify.com/CVE-2024-34564/): WordPress Counter Up plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34563](https://insights.sbomify.com/CVE-2024-34563/): WordPress Gold Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34562](https://insights.sbomify.com/CVE-2024-34562/): WordPress Move Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34561](https://insights.sbomify.com/CVE-2024-34561/): WordPress Real3D Flipbook PDF Viewer Lite plugin <= 3.71 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34560](https://insights.sbomify.com/CVE-2024-34560/): WordPress gee Search Plus plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3456](https://insights.sbomify.com/CVE-2024-3456/): Netentsec NS-ASG Application Security Gateway config_Anticrack.php sql injection (medium 6.3)
- [CVE-2024-34559](https://insights.sbomify.com/CVE-2024-34559/): WordPress Ghost plugin <= 1.4.0 - Sensitive Data Exposure via Log File vulnerability (high 7.5)
- [CVE-2024-34558](https://insights.sbomify.com/CVE-2024-34558/): WordPress WOLF plugin <= 1.0.8.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34557](https://insights.sbomify.com/CVE-2024-34557/): Cross-site request forgery in Barcode Scanner with Inventory & Order Manager (medium 4.3)
- [CVE-2024-34556](https://insights.sbomify.com/CVE-2024-34556/): Information disclosure in Barcode Scanner with Inventory & Order Manager (medium 5.3)
- [CVE-2024-34555](https://insights.sbomify.com/CVE-2024-34555/): WordPress Z-Downloads plugin <= 1.11.3 - Auth. Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-34554](https://insights.sbomify.com/CVE-2024-34554/): WordPress Stockholm Core plugin <= 2.4.1 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-34553](https://insights.sbomify.com/CVE-2024-34553/): WordPress Stockholm Core plugin <= 2.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-34552](https://insights.sbomify.com/CVE-2024-34552/): WordPress Stockholm theme <= 9.6 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-34551](https://insights.sbomify.com/CVE-2024-34551/): WordPress Stockholm theme <= 9.6 - Unauthenticated Local File Inclusion vulnerability (critical 9.0)
- [CVE-2024-34550](https://insights.sbomify.com/CVE-2024-34550/): WordPress Dynamics 365 Integration plugin <= 1.3.17 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-3455](https://insights.sbomify.com/CVE-2024-3455/): Netentsec NS-ASG Application Security Gateway add_postlogin.php sql injection (medium 6.3)
- [CVE-2024-34549](https://insights.sbomify.com/CVE-2024-34549/): WordPress WP Job Manager plugin <= 2.2.2 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-34548](https://insights.sbomify.com/CVE-2024-34548/): WordPress All-in-One Addons for Elementor – WidgetKit plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34547](https://insights.sbomify.com/CVE-2024-34547/): WordPress Magical Addons For Elementor plugin <= 1.1.34 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34546](https://insights.sbomify.com/CVE-2024-34546/): WordPress Sticky Social Link plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34545](https://insights.sbomify.com/CVE-2024-34545/): Information disclosure in Intel(R) RAID Web Console software (medium 5.2)
- [CVE-2024-34544](https://insights.sbomify.com/CVE-2024-34544/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-34543](https://insights.sbomify.com/CVE-2024-34543/): Privilege escalation in Intel(R) RAID Web Console software (medium 6.7)
- [CVE-2024-34542](https://insights.sbomify.com/CVE-2024-34542/): Advantech ADAM-5630 Weak Encoding for Password (medium 6.9)
- [CVE-2024-3454](https://insights.sbomify.com/CVE-2024-3454/): In-Fabric Matter Cluster Attribute Disclosure (low 3.5)
- [CVE-2024-34539](https://insights.sbomify.com/CVE-2024-34539/): Hardcoded credentials in TerraMaster TOS firmware through 5.1 allow a remote attacker to successfully login to the mail or webmail server. (critical 9.4)
- [CVE-2024-34538](https://insights.sbomify.com/CVE-2024-34538/): Mateso PasswordSafe through 8.13.9.26689 has Weak Cryptography. (high 7.5)
- [CVE-2024-34537](https://insights.sbomify.com/CVE-2024-34537/): Denial of Service in TYPO3 Bookmark Toolbar (medium 4.9)
- [CVE-2024-34535](https://insights.sbomify.com/CVE-2024-34535/): Security feature bypass in joinmastodon:mastodon (medium 5.9)
- [CVE-2024-34534](https://insights.sbomify.com/CVE-2024-34534/): A SQL injection vulnerability in Cybrosys Techno Solutions Text Commander module (aka text_commander) 16.0 through 16.0.1 allows a remote at (high 7.3)
- [CVE-2024-34533](https://insights.sbomify.com/CVE-2024-34533/): A SQL injection vulnerability in ZI PT Solusi Usaha Mudah Analytic Data Query module (aka izi_data) 11.0 through 17.x before 17.0.3 allows a (high 7.3)
- [CVE-2024-34532](https://insights.sbomify.com/CVE-2024-34532/): A SQL injection vulnerability in Yvan Dotet PostgreSQL Query Deluxe module (aka query_deluxe) 17.x before 17.0.0.4 allows a remote attacker (critical 9.8)
- [CVE-2024-34529](https://insights.sbomify.com/CVE-2024-34529/): Nebari prints temporary Keycloak root password (medium 4.8)
- [CVE-2024-34528](https://insights.sbomify.com/CVE-2024-34528/): WordOps has TOCTOU race condition (high 7.7)
- [CVE-2024-34527](https://insights.sbomify.com/CVE-2024-34527/): spaces_plugin/app.py in SolidUI 0.4.0 has an unnecessary print statement for an OpenAI key. (high 7.5)
- [CVE-2024-34525](https://insights.sbomify.com/CVE-2024-34525/): Information disclosure in lanol:filecodebox (medium 5.3)
- [CVE-2024-34524](https://insights.sbomify.com/CVE-2024-34524/): In XLANG OpenAgents through fe73ac4, the allowed_file protection mechanism can be bypassed by using an incorrect file extension for the natu (critical 9.1)
- [CVE-2024-34523](https://insights.sbomify.com/CVE-2024-34523/): AChecker 1.5 allows remote attackers to read the contents of arbitrary files via the download.php path parameter by using Unauthenticated Path Traversal. (high 7.5)
- [CVE-2024-34521](https://insights.sbomify.com/CVE-2024-34521/): A directory traversal vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows a (low 3.5)
- [CVE-2024-34520](https://insights.sbomify.com/CVE-2024-34520/): An authorization bypass vulnerability exists in the Mavenir SCE Application Provisioning Portal, version PORTAL-LBS-R_1_0_24_0, which allows (high 8.8)
- [CVE-2024-34519](https://insights.sbomify.com/CVE-2024-34519/): Avantra Server 24.x before 24.0.7 and 24.1.x before 24.1.1 mishandles the security of dashboards, aka XAN-5367. (medium 6.8)
- [CVE-2024-34517](https://insights.sbomify.com/CVE-2024-34517/): Neo4j Cypher component mishandles IMMUTABLE privileges (medium 6.5)
- [CVE-2024-34515](https://insights.sbomify.com/CVE-2024-34515/): image-optimizer allows PHAR deserialization (high 8.8)
- [CVE-2024-34510](https://insights.sbomify.com/CVE-2024-34510/): Gradio allows credential leakage on Windows (high 7.5)
- [CVE-2024-34509](https://insights.sbomify.com/CVE-2024-34509/): Denial of service in debian:debian linux (medium 5.3)
- [CVE-2024-34508](https://insights.sbomify.com/CVE-2024-34508/): Null dereference in debian:debian linux (medium 4.3)
- [CVE-2024-34507](https://insights.sbomify.com/CVE-2024-34507/): Cross-site scripting in fedoraproject:fedora (high 7.4)
- [CVE-2024-34506](https://insights.sbomify.com/CVE-2024-34506/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2024-34502](https://insights.sbomify.com/CVE-2024-34502/): Cross-site request forgery in fedoraproject:fedora (critical 9.8)
- [CVE-2024-34500](https://insights.sbomify.com/CVE-2024-34500/): MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-34490](https://insights.sbomify.com/CVE-2024-34490/): In Maxima through 5.47.0 before 51704c, the plotting facilities make use of predictable names under /tmp. (medium 5.1)
- [CVE-2024-34489](https://insights.sbomify.com/CVE-2024-34489/): Ryu Infinite Loop vulnerability (high 7.5)
- [CVE-2024-34488](https://insights.sbomify.com/CVE-2024-34488/): Ryu Infinite Loop vulnerability (high 7.5)
- [CVE-2024-34487](https://insights.sbomify.com/CVE-2024-34487/): Ryu Infinite Loop vulnerability (high 7.5)
- [CVE-2024-34486](https://insights.sbomify.com/CVE-2024-34486/): Ryu Infinite Loop vulnerability (high 7.5)
- [CVE-2024-34484](https://insights.sbomify.com/CVE-2024-34484/): Ryu Infinite Loop vulnerability (medium 5.3)
- [CVE-2024-34483](https://insights.sbomify.com/CVE-2024-34483/): Ryu Infinite Loop vulnerability (high 7.5)
- [CVE-2024-34481](https://insights.sbomify.com/CVE-2024-34481/): Cross-site scripting in kontextwork:drupal wiki (medium 6.1)
- [CVE-2024-34480](https://insights.sbomify.com/CVE-2024-34480/): SQL injection in oretnom23:computer laboratory management system (critical 9.8)
- [CVE-2024-3448](https://insights.sbomify.com/CVE-2024-3448/): Improper Access Control Leads to Server-Side Request Forgery in Mautic (medium 5.0)
- [CVE-2024-34479](https://insights.sbomify.com/CVE-2024-34479/): SQL injection in oretnom23:computer laboratory management system (critical 9.8)
- [CVE-2024-34478](https://insights.sbomify.com/CVE-2024-34478/): btcd susceptible to consensus failures (high 7.5)
- [CVE-2024-34477](https://insights.sbomify.com/CVE-2024-34477/): Privilege escalation in fogproject:fogproject (high 7.8)
- [CVE-2024-34476](https://insights.sbomify.com/CVE-2024-34476/): Denial of service in open5gs:open5gs (medium 5.3)
- [CVE-2024-34475](https://insights.sbomify.com/CVE-2024-34475/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2024-34474](https://insights.sbomify.com/CVE-2024-34474/): Clario through 2024-04-11 for Desktop has weak permissions for %PROGRAMDATA%\Clario and tries to load DLLs from there as SYSTEM. (high 7.8)
- [CVE-2024-34473](https://insights.sbomify.com/CVE-2024-34473/): An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. (medium 5.3)
- [CVE-2024-34472](https://insights.sbomify.com/CVE-2024-34472/): SQL injection in hsclabs:mailinspector (medium 5.5)
- [CVE-2024-34471](https://insights.sbomify.com/CVE-2024-34471/): Path traversal in hsclabs:mailinspector (medium 5.4)
- [CVE-2024-34470](https://insights.sbomify.com/CVE-2024-34470/): Path traversal in hsclabs:mailinspector (high 8.6)
- [CVE-2024-3447](https://insights.sbomify.com/CVE-2024-3447/): Qemu: sdhci: heap buffer overflow in sdhci_write_dataport() (medium 6.0)
- [CVE-2024-34469](https://insights.sbomify.com/CVE-2024-34469/): Cross-site scripting in rukovoditel:rukovoditel (high 7.1)
- [CVE-2024-34468](https://insights.sbomify.com/CVE-2024-34468/): Cross-site scripting in rukovoditel:rukovoditel (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/353/