# Vulnerabilities published in 2024


- [CVE-2024-32022](https://insights.sbomify.com/CVE-2024-32022/): Kohya_ss is vulnerable to a command injection in basic_caption_gui.py (GHSL-2024-019) (critical 9.1)
- [CVE-2024-32021](https://insights.sbomify.com/CVE-2024-32021/): Local Git clone may hardlink arbitrary user-readable files into the new repository's "objects/" directory (low 3.9)
- [CVE-2024-32020](https://insights.sbomify.com/CVE-2024-32020/): Other in git (low 3.9)
- [CVE-2024-3202](https://insights.sbomify.com/CVE-2024-3202/): codelyfe Stupid Simple CMS Login Page excessive authentication (low 3.7)
- [CVE-2024-32019](https://insights.sbomify.com/CVE-2024-32019/): ndsudo: local privilege escalation via untrusted search path (high 8.8)
- [CVE-2024-32018](https://insights.sbomify.com/CVE-2024-32018/): Ineffective size check due to assert() and buffer overflow in RIOT (high 8.8)
- [CVE-2024-32017](https://insights.sbomify.com/CVE-2024-32017/): Buffer overflows in RIOT (critical 9.8)
- [CVE-2024-32014](https://insights.sbomify.com/CVE-2024-32014/): Privilege escalation in Spectrum Power 4 (medium 5.6)
- [CVE-2024-32011](https://insights.sbomify.com/CVE-2024-32011/): Command injection in Spectrum Power 4 (high 8.7)
- [CVE-2024-32010](https://insights.sbomify.com/CVE-2024-32010/): Information disclosure in Spectrum Power 4 (high 8.5)
- [CVE-2024-3201](https://insights.sbomify.com/CVE-2024-3201/): WP DSGVO Tools (GDPR) <= 3.1.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-32009](https://insights.sbomify.com/CVE-2024-32009/): Privilege escalation in Spectrum Power 4 (high 8.5)
- [CVE-2024-32008](https://insights.sbomify.com/CVE-2024-32008/): Privilege escalation in Spectrum Power 4 (high 8.5)
- [CVE-2024-32007](https://insights.sbomify.com/CVE-2024-32007/): Apache CXF Denial of Service vulnerability in JOSE (high 7.5)
- [CVE-2024-32006](https://insights.sbomify.com/CVE-2024-32006/): Auth bypass in SINEMA Remote Connect Client (medium 5.3)
- [CVE-2024-32005](https://insights.sbomify.com/CVE-2024-32005/): Local File Inclusion in NiceGUI leaflet component (high 8.2)
- [CVE-2024-32004](https://insights.sbomify.com/CVE-2024-32004/): Git vulnerable to Remote Code Execution while cloning special-crafted local repositories (high 8.2)
- [CVE-2024-32003](https://insights.sbomify.com/CVE-2024-32003/): Dusk plugin may allow unfettered user authentication in misconfigured installs (high 8.8)
- [CVE-2024-32002](https://insights.sbomify.com/CVE-2024-32002/): Git's recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution (critical 9.1)
- [CVE-2024-32001](https://insights.sbomify.com/CVE-2024-32001/): SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used (low 2.2)
- [CVE-2024-32000](https://insights.sbomify.com/CVE-2024-32000/): Truncated content of messages can be leaked from matrix-appservice-irc (medium 4.3)
- [CVE-2024-3200](https://insights.sbomify.com/CVE-2024-3200/): wpForo Forum <= 2.3.3 - Authenticated (Contributor+) SQL Injection (critical 9.9)
- [CVE-2024-31999](https://insights.sbomify.com/CVE-2024-31999/): @fastify/secure-session: Reuse of destroyed secure session cookie (high 7.4)
- [CVE-2024-31998](https://insights.sbomify.com/CVE-2024-31998/): CSRF security issue on CSV import in Combodo iTop (high 8.8)
- [CVE-2024-31997](https://insights.sbomify.com/CVE-2024-31997/): XWiki Platform remote code execution from account through UIExtension parameters (critical 10.0)
- [CVE-2024-31996](https://insights.sbomify.com/CVE-2024-31996/): XWiki Commons missing escaping of `{` in Velocity escapetool allows remote code execution (critical 10.0)
- [CVE-2024-31995](https://insights.sbomify.com/CVE-2024-31995/): zcap has incomplete expiration checks in capability chains. (medium 4.3)
- [CVE-2024-31994](https://insights.sbomify.com/CVE-2024-31994/): Mealie vulnerable to a DoS in recipe image importer (GHSL-2023-228) (medium 6.5)
- [CVE-2024-31993](https://insights.sbomify.com/CVE-2024-31993/): Mealie vulnerable to a GET-based SSRF in recipe image importer (GHSL-2023-227) (medium 6.2)
- [CVE-2024-31992](https://insights.sbomify.com/CVE-2024-31992/): Mealie contains a DoS vulnerability in recipe importer (medium 6.5)
- [CVE-2024-31991](https://insights.sbomify.com/CVE-2024-31991/): Mealie vulnerable to a GET-based SSRF in recipe importer (GHSL-2023-225) (medium 4.1)
- [CVE-2024-31990](https://insights.sbomify.com/CVE-2024-31990/): Argo CD' API server does not enforce project sourceNamespaces (medium 4.8)
- [CVE-2024-3199](https://insights.sbomify.com/CVE-2024-3199/): The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (medium 6.4)
- [CVE-2024-31989](https://insights.sbomify.com/CVE-2024-31989/): ArgoCD Vulnerable to Use of Risky or Missing Cryptographic Algorithms in Redis Cache (critical 9.1)
- [CVE-2024-31988](https://insights.sbomify.com/CVE-2024-31988/): XWiki Platform CSRF remote code execution through the realtime HTML Converter API (critical 9.7)
- [CVE-2024-31987](https://insights.sbomify.com/CVE-2024-31987/): XWiki Platform remote code execution from account via custom skins support (critical 10.0)
- [CVE-2024-31986](https://insights.sbomify.com/CVE-2024-31986/): XWiki Platform CSRF remote code execution through scheduler job's document reference (critical 9.1)
- [CVE-2024-31985](https://insights.sbomify.com/CVE-2024-31985/): XWiki Platform CSRF in the job scheduler (medium 5.4)
- [CVE-2024-31984](https://insights.sbomify.com/CVE-2024-31984/): XWiki Platform: Remote code execution through space title and Solr space facet (critical 10.0)
- [CVE-2024-31983](https://insights.sbomify.com/CVE-2024-31983/): XWiki Platform: Remote code execution from edit in multilingual wikis via translations (critical 10.0)
- [CVE-2024-31982](https://insights.sbomify.com/CVE-2024-31982/): XWiki Platform: Remote code execution as guest via DatabaseSearch (critical 10.0)
- [CVE-2024-31981](https://insights.sbomify.com/CVE-2024-31981/): XWiki Platform: Privilege escalation (PR) from user registration through PDFClass (critical 10.0)
- [CVE-2024-31980](https://insights.sbomify.com/CVE-2024-31980/): Memory corruption in Parasolid V35.1 (high 7.8)
- [CVE-2024-3198](https://insights.sbomify.com/CVE-2024-3198/): WP Font Awesome Share Icons <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-31979](https://insights.sbomify.com/CVE-2024-31979/): Apache StreamPipes: Possibility of SSRF in pipeline element installation process (high 7.5)
- [CVE-2024-31978](https://insights.sbomify.com/CVE-2024-31978/): Path traversal in SINEC NMS (high 7.6)
- [CVE-2024-31977](https://insights.sbomify.com/CVE-2024-31977/): Command injection in adtran:834-5 firmware (high 8.0)
- [CVE-2024-31976](https://insights.sbomify.com/CVE-2024-31976/): Command injection in engeniustech:ews356-fir firmware (high 8.0)
- [CVE-2024-31975](https://insights.sbomify.com/CVE-2024-31975/): Cross-site scripting in engeniustech:ews356-fit firmware (medium 4.8)
- [CVE-2024-31974](https://insights.sbomify.com/CVE-2024-31974/): The com.solarized.firedown (aka Solarized FireDown Browser & Downloader) application 1.0.76 for Android allows a remote attacker to execute (medium 6.3)
- [CVE-2024-31973](https://insights.sbomify.com/CVE-2024-31973/): Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via the 'Ne (medium 5.2)
- [CVE-2024-31972](https://insights.sbomify.com/CVE-2024-31972/): EnGenius ESR580 A8J-EMR5000 devices allow a remote attacker to conduct stored XSS attacks that could lead to arbitrary JavaScript code execu (medium 4.3)
- [CVE-2024-31971](https://insights.sbomify.com/CVE-2024-31971/): Cross-site scripting in adtran:netvanta 3120 firmware (medium 6.1)
- [CVE-2024-31970](https://insights.sbomify.com/CVE-2024-31970/): Hardcoded credentials in adtran:sdg smartos (high 7.2)
- [CVE-2024-3197](https://insights.sbomify.com/CVE-2024-3197/): The Plus Addons for Elementor <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes (medium 6.4)
- [CVE-2024-31967](https://insights.sbomify.com/CVE-2024-31967/): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (critical 9.1)
- [CVE-2024-31966](https://insights.sbomify.com/CVE-2024-31966/): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (medium 6.2)
- [CVE-2024-31965](https://insights.sbomify.com/CVE-2024-31965/): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (medium 4.2)
- [CVE-2024-31964](https://insights.sbomify.com/CVE-2024-31964/): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (high 7.5)
- [CVE-2024-31963](https://insights.sbomify.com/CVE-2024-31963/): A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conferen (medium 6.4)
- [CVE-2024-31961](https://insights.sbomify.com/CVE-2024-31961/): A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbitrary SQL commands vi (critical 9.8)
- [CVE-2024-31960](https://insights.sbomify.com/CVE-2024-31960/): Use after free in samsung:exynos 1480 firmware (high 7.8)
- [CVE-2024-3196](https://insights.sbomify.com/CVE-2024-3196/): MailCleaner SOAP Service dumpConfiguration os command injection (medium 6.7)
- [CVE-2024-31959](https://insights.sbomify.com/CVE-2024-31959/): Memory corruption in samsung:exynos 1480 firmware (high 8.4)
- [CVE-2024-31958](https://insights.sbomify.com/CVE-2024-31958/): Memory corruption in samsung:exynos 1480 firmware (medium 6.8)
- [CVE-2024-31957](https://insights.sbomify.com/CVE-2024-31957/): Denial of service in samsung:exynos 2200 firmware (medium 6.2)
- [CVE-2024-31956](https://insights.sbomify.com/CVE-2024-31956/): Memory corruption in samsung:exynos 1480 firmware (high 8.4)
- [CVE-2024-31955](https://insights.sbomify.com/CVE-2024-31955/): An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. (medium 4.9)
- [CVE-2024-31954](https://insights.sbomify.com/CVE-2024-31954/): An issue was discovered in the installer in Samsung Portable SSD for T5 1.6.10 on Windows. (high 7.3)
- [CVE-2024-31953](https://insights.sbomify.com/CVE-2024-31953/): Privilege escalation in samsung:magician (medium 6.7)
- [CVE-2024-31952](https://insights.sbomify.com/CVE-2024-31952/): Privilege escalation in samsung:magician (medium 6.7)
- [CVE-2024-31951](https://insights.sbomify.com/CVE-2024-31951/): Memory corruption in frrouting:frrouting (medium 6.5)
- [CVE-2024-31950](https://insights.sbomify.com/CVE-2024-31950/): Memory corruption in frrouting:frrouting (medium 6.5)
- [CVE-2024-3195](https://insights.sbomify.com/CVE-2024-3195/): MailCleaner Admin Endpoints path traversal (medium 4.7)
- [CVE-2024-31949](https://insights.sbomify.com/CVE-2024-31949/): Denial of service in frrouting:frrouting (medium 6.5)
- [CVE-2024-31948](https://insights.sbomify.com/CVE-2024-31948/): Denial of service in frrouting:frrouting (medium 6.5)
- [CVE-2024-31947](https://insights.sbomify.com/CVE-2024-31947/): Path traversal in stonefly:storage concentrator (medium 6.5)
- [CVE-2024-31946](https://insights.sbomify.com/CVE-2024-31946/): An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.41, 3.10.0 through 3.11.29, 4.0 through 4.3.24, and 4.4.0 through 4.7.4. (medium 4.2)
- [CVE-2024-31944](https://insights.sbomify.com/CVE-2024-31944/): WordPress WooCommerce UPS Shipping plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31943](https://insights.sbomify.com/CVE-2024-31943/): WordPress USPS Shipping for WooCommerce plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31942](https://insights.sbomify.com/CVE-2024-31942/): WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31941](https://insights.sbomify.com/CVE-2024-31941/): WordPress CP Media Player plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31940](https://insights.sbomify.com/CVE-2024-31940/): Cross-site request forgery in Extra Product Options Builder for WooCommerce (medium 4.3)
- [CVE-2024-3194](https://insights.sbomify.com/CVE-2024-3194/): MailCleaner Log File Endpoint cross site scripting (medium 4.3)
- [CVE-2024-31939](https://insights.sbomify.com/CVE-2024-31939/): WordPress Import any XML or CSV File to WordPress plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31938](https://insights.sbomify.com/CVE-2024-31938/): WordPress NewsXpress theme <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31937](https://insights.sbomify.com/CVE-2024-31937/): WordPress TWIPLA (Visitor Analytics IO) plugin <= 1.2.0 - Cross-Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31936](https://insights.sbomify.com/CVE-2024-31936/): WordPress UsersWP plugin < 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31935](https://insights.sbomify.com/CVE-2024-31935/): WordPress Simple Post Notes plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31934](https://insights.sbomify.com/CVE-2024-31934/): WordPress Link Whisper Free plugin <= 0.6.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31933](https://insights.sbomify.com/CVE-2024-31933/): WordPress Page Builder: Live Composer plugin <= 1.5.35 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31932](https://insights.sbomify.com/CVE-2024-31932/): WordPress Blocksy Companion plugin <= 2.0.28 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31931](https://insights.sbomify.com/CVE-2024-31931/): WordPress Save as Image plugin by Pdfcrowd plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31930](https://insights.sbomify.com/CVE-2024-31930/): WordPress Save as PDF by Pdfcrowd plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3193](https://insights.sbomify.com/CVE-2024-3193/): MailCleaner Admin Endpoints os command injection (high 8.8)
- [CVE-2024-31929](https://insights.sbomify.com/CVE-2024-31929/): WordPress Intagrate Lite plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31928](https://insights.sbomify.com/CVE-2024-31928/): WordPress Top Bar plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31927](https://insights.sbomify.com/CVE-2024-31927/): WordPress WP Login and Logout Redirect plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31926](https://insights.sbomify.com/CVE-2024-31926/): WordPress Advanced Cron Manager – debug & control plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31925](https://insights.sbomify.com/CVE-2024-31925/): WordPress F4 Improvements plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/373/