# Vulnerabilities published in 2024


- [CVE-2024-3152](https://insights.sbomify.com/CVE-2024-3152/): Privilege Escalation and Local File Inclusion in mintplex-labs/anything-llm (high 8.8)
- [CVE-2024-31510](https://insights.sbomify.com/CVE-2024-31510/): Weak cryptography in openquantumsafe:liboqs (critical 9.8)
- [CVE-2024-3151](https://insights.sbomify.com/CVE-2024-3151/): Bdtask Multi-Store Inventory Management System Stock Movement Page cross-site request forgery (medium 4.3)
- [CVE-2024-31507](https://insights.sbomify.com/CVE-2024-31507/): SQL injection in tamparongj03:online graduate tracer system (high 8.6)
- [CVE-2024-31506](https://insights.sbomify.com/CVE-2024-31506/): SQL injection in tamparongj03:online graduate tracer system (medium 4.9)
- [CVE-2024-31504](https://insights.sbomify.com/CVE-2024-31504/): Memory corruption in embedded-solutions:freemodbus (high 7.5)
- [CVE-2024-31503](https://insights.sbomify.com/CVE-2024-31503/): Dolibarr vulnerable to Cross-Site Request Forgery (high 7.5)
- [CVE-2024-31502](https://insights.sbomify.com/CVE-2024-31502/): An issue in Insurance Management System v.1.0.0 and before allows a remote attacker to escalate privileges via a crafted POST request to /admin/core/new_staff. (high 8.1)
- [CVE-2024-3150](https://insights.sbomify.com/CVE-2024-3150/): Privilege Escalation in mintplex-labs/anything-llm (high 8.1)
- [CVE-2024-31498](https://insights.sbomify.com/CVE-2024-31498/): Yubico ykman-gui (aka YubiKey Manager GUI) before 1.2.6 on Windows, when Edge is not used, allows privilege escalation because browser windo (high 8.8)
- [CVE-2024-31497](https://insights.sbomify.com/CVE-2024-31497/): Weak cryptography in fedoraproject:fedora (medium 5.9)
- [CVE-2024-31496](https://insights.sbomify.com/CVE-2024-31496/): Memory corruption in FortiAnalyzer (medium 6.3)
- [CVE-2024-31495](https://insights.sbomify.com/CVE-2024-31495/): SQL injection in FortiPortal (low 3.9)
- [CVE-2024-31493](https://insights.sbomify.com/CVE-2024-31493/): Information disclosure in FortiSOAR (medium 6.0)
- [CVE-2024-31492](https://insights.sbomify.com/CVE-2024-31492/): Code injection in FortiClientMac (high 7.8)
- [CVE-2024-31491](https://insights.sbomify.com/CVE-2024-31491/): Security feature bypass in FortiSandbox (high 8.6)
- [CVE-2024-31490](https://insights.sbomify.com/CVE-2024-31490/): Information disclosure in FortiSandbox (medium 4.2)
- [CVE-2024-3149](https://insights.sbomify.com/CVE-2024-3149/): SSRF in mintplex-labs/anything-llm (critical 9.6)
- [CVE-2024-31489](https://insights.sbomify.com/CVE-2024-31489/): Security feature bypass in FortiClientEMS (medium 6.4)
- [CVE-2024-31488](https://insights.sbomify.com/CVE-2024-31488/): Cross-site scripting in FortiNAC (medium 6.1)
- [CVE-2024-31487](https://insights.sbomify.com/CVE-2024-31487/): Path traversal in FortiSandbox (medium 5.8)
- [CVE-2024-31486](https://insights.sbomify.com/CVE-2024-31486/): Information disclosure in OPUPI0 AMQP/MQTT (medium 6.0)
- [CVE-2024-31485](https://insights.sbomify.com/CVE-2024-31485/): Command injection in CPCI85 Central Processing/Communication (high 8.6)
- [CVE-2024-31484](https://insights.sbomify.com/CVE-2024-31484/): Memory corruption in CPC80 Central Processing/Communication (high 7.3)
- [CVE-2024-31483](https://insights.sbomify.com/CVE-2024-31483/): Information disclosure in AOS-8 Instant and AOS-10 AP (medium 4.9)
- [CVE-2024-31482](https://insights.sbomify.com/CVE-2024-31482/): Denial of service in AOS-8 Instant and AOS-10 AP (medium 5.3)
- [CVE-2024-31481](https://insights.sbomify.com/CVE-2024-31481/): Denial of service in AOS-8 Instant and AOS-10 AP (medium 5.3)
- [CVE-2024-31480](https://insights.sbomify.com/CVE-2024-31480/): Command injection in AOS-8 Instant and AOS-10 AP (medium 5.3)
- [CVE-2024-3148](https://insights.sbomify.com/CVE-2024-3148/): DedeCMS makehtml_archives_action.php sql injection (medium 6.3)
- [CVE-2024-31479](https://insights.sbomify.com/CVE-2024-31479/): Denial of service in AOS-8 Instant and AOS-10 AP (medium 5.3)
- [CVE-2024-31478](https://insights.sbomify.com/CVE-2024-31478/): Denial of service in AOS-8 Instant and AOS-10 AP (medium 5.3)
- [CVE-2024-31477](https://insights.sbomify.com/CVE-2024-31477/): Command injection in AOS-8 Instant and AOS-10 AP (high 7.2)
- [CVE-2024-31476](https://insights.sbomify.com/CVE-2024-31476/): Command injection in AOS-8 Instant and AOS-10 AP (high 7.2)
- [CVE-2024-31475](https://insights.sbomify.com/CVE-2024-31475/): Other in AOS-8 Instant and AOS-10 AP (high 8.2)
- [CVE-2024-31474](https://insights.sbomify.com/CVE-2024-31474/): Path traversal in AOS-8 Instant and AOS-10 AP (high 8.2)
- [CVE-2024-31473](https://insights.sbomify.com/CVE-2024-31473/): Command injection in AOS-8 Instant and AOS-10 AP (critical 9.8)
- [CVE-2024-31472](https://insights.sbomify.com/CVE-2024-31472/): Command injection in AOS-8 Instant and AOS-10 AP (critical 9.8)
- [CVE-2024-31471](https://insights.sbomify.com/CVE-2024-31471/): Command injection in AOS-8 Instant and AOS-10 AP (critical 9.8)
- [CVE-2024-31470](https://insights.sbomify.com/CVE-2024-31470/): Memory corruption in AOS-8 Instant and AOS-10 AP (critical 9.8)
- [CVE-2024-3147](https://insights.sbomify.com/CVE-2024-3147/): DedeCMS makehtml_map.php cross-site request forgery (medium 4.3)
- [CVE-2024-31469](https://insights.sbomify.com/CVE-2024-31469/): Memory corruption in AOS-8 Instant and AOS-10 AP (critical 9.8)
- [CVE-2024-31468](https://insights.sbomify.com/CVE-2024-31468/): Memory corruption in AOS-8 Instant and AOS-10 AP (critical 9.8)
- [CVE-2024-31467](https://insights.sbomify.com/CVE-2024-31467/): Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2024-31466](https://insights.sbomify.com/CVE-2024-31466/): Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol (critical 9.8)
- [CVE-2024-31465](https://insights.sbomify.com/CVE-2024-31465/): XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet (critical 10.0)
- [CVE-2024-31464](https://insights.sbomify.com/CVE-2024-31464/): XWiki Platform: Password hash might be leaked by diff once the xobject holding them is deleted (medium 6.8)
- [CVE-2024-31463](https://insights.sbomify.com/CVE-2024-31463/): Ironic-image allows unauthenticated local access to Ironic API (medium 4.7)
- [CVE-2024-31462](https://insights.sbomify.com/CVE-2024-31462/): Limited file write in Stable-diffusion-webui - GHSL-2024-010 (medium 6.3)
- [CVE-2024-31461](https://insights.sbomify.com/CVE-2024-31461/): Plane Server-Side Request Forgery (SSRF) Vulnerability (critical 9.1)
- [CVE-2024-31460](https://insights.sbomify.com/CVE-2024-31460/): Cacti SQL Injection vulnerability in lib/api_automation.php caused by reading dirty data stored in database (medium 6.5)
- [CVE-2024-3146](https://insights.sbomify.com/CVE-2024-3146/): DedeCMS makehtml_rss_action.php cross-site request forgery (medium 4.3)
- [CVE-2024-31459](https://insights.sbomify.com/CVE-2024-31459/): Cacti RCE vulnerability by file include in lib/plugin.php (high 8.1)
- [CVE-2024-31458](https://insights.sbomify.com/CVE-2024-31458/): Cacti SQL Injection vulnerability in lib/html_form_templates.php by reading dirty data stored in database (medium 4.6)
- [CVE-2024-31457](https://insights.sbomify.com/CVE-2024-31457/): gin-vue-admin background arbitrary code coverage vulnerability (high 7.7)
- [CVE-2024-31456](https://insights.sbomify.com/CVE-2024-31456/): GLPI contains an authenticated SQL injection (high 7.7)
- [CVE-2024-31455](https://insights.sbomify.com/CVE-2024-31455/): Minder GetRepositoryByName data leak (medium 4.3)
- [CVE-2024-31454](https://insights.sbomify.com/CVE-2024-31454/): PsiTransfer file integrity violation vulnerability (medium 6.5)
- [CVE-2024-31453](https://insights.sbomify.com/CVE-2024-31453/): PsiTransfer vulnerable to violation of the integrity of file distribution (medium 6.5)
- [CVE-2024-31452](https://insights.sbomify.com/CVE-2024-31452/): OpenFGA Authorization Bypass (high 8.1)
- [CVE-2024-31451](https://insights.sbomify.com/CVE-2024-31451/): Limited file write in routes.py (GHSL-2023-250) (medium 5.3)
- [CVE-2024-31450](https://insights.sbomify.com/CVE-2024-31450/): Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277) (low 2.7)
- [CVE-2024-3145](https://insights.sbomify.com/CVE-2024-3145/): DedeCMS makehtml_js_action.php cross-site request forgery (medium 4.3)
- [CVE-2024-31449](https://insights.sbomify.com/CVE-2024-31449/): Lua library commands may lead to stack overflow and RCE in Redis (high 7.0)
- [CVE-2024-31448](https://insights.sbomify.com/CVE-2024-31448/): Cross-site Scripting vulnerability in link CSV import in Combodo iTop (high 8.8)
- [CVE-2024-31447](https://insights.sbomify.com/CVE-2024-31447/): Shopware has Improper Session Handling in store-api (medium 5.3)
- [CVE-2024-31446](https://insights.sbomify.com/CVE-2024-31446/): OpenComputers Denial of Service using xpcall (high 7.7)
- [CVE-2024-31445](https://insights.sbomify.com/CVE-2024-31445/): SQL Injection vulnerability in automation_get_new_graphs_sql (high 8.8)
- [CVE-2024-31444](https://insights.sbomify.com/CVE-2024-31444/): Cacti XSS vulnerability in lib/html.php by reading dirty data stored in database (medium 4.6)
- [CVE-2024-31443](https://insights.sbomify.com/CVE-2024-31443/): Cacti XSS vulnerability in lib/html_tree.php by reading dirty data stored in database (medium 5.7)
- [CVE-2024-31442](https://insights.sbomify.com/CVE-2024-31442/): Redon-Hub has incorrect permissions on all admin related commands (high 8.8)
- [CVE-2024-31441](https://insights.sbomify.com/CVE-2024-31441/): Arbitrary File Reading in DataEase (high 7.5)
- [CVE-2024-3144](https://insights.sbomify.com/CVE-2024-3144/): DedeCMS makehtml_spec.php cross-site request forgery (medium 4.3)
- [CVE-2024-31435](https://insights.sbomify.com/CVE-2024-31435/): WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31434](https://insights.sbomify.com/CVE-2024-31434/): WordPress Newsletter plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31433](https://insights.sbomify.com/CVE-2024-31433/): WordPress The Events Calendar plugin <= 6.3.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31432](https://insights.sbomify.com/CVE-2024-31432/): WordPress Restrict Content plugin <= 3.2.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-31431](https://insights.sbomify.com/CVE-2024-31431/): WordPress Product Input Fields for WooCommerce plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31430](https://insights.sbomify.com/CVE-2024-31430/): Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR and WOLF WordPress plugins (medium 4.3)
- [CVE-2024-3143](https://insights.sbomify.com/CVE-2024-3143/): DedeCMS member_rank.php cross-site request forgery (medium 4.3)
- [CVE-2024-31429](https://insights.sbomify.com/CVE-2024-31429/): WordPress Sarada Lite theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31428](https://insights.sbomify.com/CVE-2024-31428/): WordPress The Conference theme <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31427](https://insights.sbomify.com/CVE-2024-31427/): WordPress Marker.io plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31426](https://insights.sbomify.com/CVE-2024-31426/): WordPress Inline Related Posts plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31425](https://insights.sbomify.com/CVE-2024-31425/): WordPress Amelia plugin <= 1.0.95 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31424](https://insights.sbomify.com/CVE-2024-31424/): WordPress Login with Phone Number plugin <= 1.6.93 - Cross Site Request Forgery (CSRF) vulnerability (high 8.8)
- [CVE-2024-31423](https://insights.sbomify.com/CVE-2024-31423/): WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31422](https://insights.sbomify.com/CVE-2024-31422/): WordPress Favicon by RealFaviconGenerator plugin <= 1.3.29 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31421](https://insights.sbomify.com/CVE-2024-31421/): WordPress Popup by Supsystic plugin <= 1.10.27 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31420](https://insights.sbomify.com/CVE-2024-31420/): Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes (medium 6.5)
- [CVE-2024-3142](https://insights.sbomify.com/CVE-2024-3142/): Clavister E10/E80 Setting cross-site request forgery (medium 4.3)
- [CVE-2024-31419](https://insights.sbomify.com/CVE-2024-31419/): Cnv: information disclosure through the usage of vm-dump-metrics (medium 4.3)
- [CVE-2024-31416](https://insights.sbomify.com/CVE-2024-31416/): Integer overflow in Foreseer (medium 5.6)
- [CVE-2024-31415](https://insights.sbomify.com/CVE-2024-31415/): Weak cryptography in Foreseer (medium 6.3)
- [CVE-2024-31414](https://insights.sbomify.com/CVE-2024-31414/): Cross-site scripting in Foreseer (medium 6.7)
- [CVE-2024-31413](https://insights.sbomify.com/CVE-2024-31413/): Memory corruption in CX-One CX-One CXONE-AL[][]D-V4 (medium 5.9)
- [CVE-2024-31412](https://insights.sbomify.com/CVE-2024-31412/): Memory corruption in CX-Programmer (high 7.8)
- [CVE-2024-31411](https://insights.sbomify.com/CVE-2024-31411/): Apache StreamPipes: Potential remote code execution (RCE) via file upload (medium 6.0)
- [CVE-2024-31410](https://insights.sbomify.com/CVE-2024-31410/): CyberPower PowerPanel business Use of Hard-coded Cryptographic Key (high 7.7)
- [CVE-2024-3141](https://insights.sbomify.com/CVE-2024-3141/): Clavister E10/E80 Misc Settings Page MiscSettings cross site scripting (low 2.4)
- [CVE-2024-31409](https://insights.sbomify.com/CVE-2024-31409/): CyberPower PowerPanel business Incorrect Authorization (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/376/