# Vulnerabilities published in 2024


- [CVE-2024-31219](https://insights.sbomify.com/CVE-2024-31219/): Discourse-reactions' reaction data and public topic whisper content exposed on reactions given user activity page (medium 4.3)
- [CVE-2024-31218](https://insights.sbomify.com/CVE-2024-31218/): Missing Authentication for Critical Function in Webhood backend (critical 9.8)
- [CVE-2024-31217](https://insights.sbomify.com/CVE-2024-31217/): @strapi/plugin-upload has a Denial-of-Service via Improper Exception Handling (medium 5.3)
- [CVE-2024-31216](https://insights.sbomify.com/CVE-2024-31216/): source-controller leaks theAzure Storage SAS token into logs on connection errors (medium 5.1)
- [CVE-2024-31215](https://insights.sbomify.com/CVE-2024-31215/): Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check (medium 6.3)
- [CVE-2024-31214](https://insights.sbomify.com/CVE-2024-31214/): Traccar's unrestricted file upload vulnerability in device image upload could lead to remote code execution (critical 9.7)
- [CVE-2024-31213](https://insights.sbomify.com/CVE-2024-31213/): InstantCMS Open Redirect vulnerability (low 3.5)
- [CVE-2024-31212](https://insights.sbomify.com/CVE-2024-31212/): SQL injection in index_chart_data action (medium 6.7)
- [CVE-2024-31211](https://insights.sbomify.com/CVE-2024-31211/): Remote Code Execution in `WP_HTML_Token` (medium 5.5)
- [CVE-2024-31210](https://insights.sbomify.com/CVE-2024-31210/): PHP file upload bypass via Plugin installer (high 7.7)
- [CVE-2024-3121](https://insights.sbomify.com/CVE-2024-3121/): Remote Code Execution in create_conda_env function in parisneo/lollms (medium 6.8)
- [CVE-2024-31209](https://insights.sbomify.com/CVE-2024-31209/): OpenID Connect client Atom Exhaustion in provider configuration worker ets table location (medium 5.3)
- [CVE-2024-31208](https://insights.sbomify.com/CVE-2024-31208/): Synapse's V2 state resolution weakness allows DoS from remote room members (medium 6.5)
- [CVE-2024-31207](https://insights.sbomify.com/CVE-2024-31207/): Vite's `server.fs.deny` did not deny requests for patterns with directories (medium 5.9)
- [CVE-2024-31206](https://insights.sbomify.com/CVE-2024-31206/): Use of Unencrypted HTTP Request in dectalk-tts (high 8.2)
- [CVE-2024-31205](https://insights.sbomify.com/CVE-2024-31205/): Saleor CSRF bypass in refreshToken mutation (medium 4.2)
- [CVE-2024-31204](https://insights.sbomify.com/CVE-2024-31204/): mailcow Cross-site Scripting Vulnerability via Exception Handler (medium 6.1)
- [CVE-2024-31203](https://insights.sbomify.com/CVE-2024-31203/): Memory corruption in Thermoscan IP (low 3.3)
- [CVE-2024-31202](https://insights.sbomify.com/CVE-2024-31202/): Misconfiguration in Thermoscan IP (high 7.8)
- [CVE-2024-31201](https://insights.sbomify.com/CVE-2024-31201/): Privilege escalation in Thermoscan IP (medium 6.5)
- [CVE-2024-31200](https://insights.sbomify.com/CVE-2024-31200/): Information disclosure in Sensor Net Connect V2 (medium 4.2)
- [CVE-2024-3120](https://insights.sbomify.com/CVE-2024-3120/): Stack-Buffer Overflow in 'Content-Length' and 'Warning' Header Processing in sngrep (critical 9.0)
- [CVE-2024-31199](https://insights.sbomify.com/CVE-2024-31199/): Cross-site scripting in Sensor Net Connect V2 (high 8.8)
- [CVE-2024-31198](https://insights.sbomify.com/CVE-2024-31198/): Out-of-bounds Read in libfluid_msg library (medium 5.3)
- [CVE-2024-31197](https://insights.sbomify.com/CVE-2024-31197/): Improper Null Termination in libfluid_msg library (medium 5.3)
- [CVE-2024-31196](https://insights.sbomify.com/CVE-2024-31196/): NULL Pointer Dereference in libfluid_msg library (medium 5.3)
- [CVE-2024-31195](https://insights.sbomify.com/CVE-2024-31195/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31194](https://insights.sbomify.com/CVE-2024-31194/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31193](https://insights.sbomify.com/CVE-2024-31193/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31192](https://insights.sbomify.com/CVE-2024-31192/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31191](https://insights.sbomify.com/CVE-2024-31191/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31190](https://insights.sbomify.com/CVE-2024-31190/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-3119](https://insights.sbomify.com/CVE-2024-3119/): Stack-Buffer Overflow in 'Call-ID' and 'X-Call-ID' SIP Header Processing in sngrep (critical 9.0)
- [CVE-2024-31189](https://insights.sbomify.com/CVE-2024-31189/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31188](https://insights.sbomify.com/CVE-2024-31188/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31187](https://insights.sbomify.com/CVE-2024-31187/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31186](https://insights.sbomify.com/CVE-2024-31186/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31185](https://insights.sbomify.com/CVE-2024-31185/): NULL Pointer Dereference in libfluid_msg library (medium 5.3)
- [CVE-2024-31184](https://insights.sbomify.com/CVE-2024-31184/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31183](https://insights.sbomify.com/CVE-2024-31183/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31182](https://insights.sbomify.com/CVE-2024-31182/): NULL Pointer Dereference in libfluid_msg library (medium 5.3)
- [CVE-2024-31181](https://insights.sbomify.com/CVE-2024-31181/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31180](https://insights.sbomify.com/CVE-2024-31180/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-3118](https://insights.sbomify.com/CVE-2024-3118/): Dreamer CMS Attachment permission (medium 6.3)
- [CVE-2024-31179](https://insights.sbomify.com/CVE-2024-31179/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31178](https://insights.sbomify.com/CVE-2024-31178/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31177](https://insights.sbomify.com/CVE-2024-31177/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31176](https://insights.sbomify.com/CVE-2024-31176/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31175](https://insights.sbomify.com/CVE-2024-31175/): NULL Pointer Dereference in libfluid_msg library (medium 5.3)
- [CVE-2024-31174](https://insights.sbomify.com/CVE-2024-31174/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31173](https://insights.sbomify.com/CVE-2024-31173/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31172](https://insights.sbomify.com/CVE-2024-31172/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31171](https://insights.sbomify.com/CVE-2024-31171/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31170](https://insights.sbomify.com/CVE-2024-31170/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-3117](https://insights.sbomify.com/CVE-2024-3117/): YouDianCMS ChannelAction.class.php unrestricted upload (medium 4.7)
- [CVE-2024-31169](https://insights.sbomify.com/CVE-2024-31169/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31168](https://insights.sbomify.com/CVE-2024-31168/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31167](https://insights.sbomify.com/CVE-2024-31167/): NULL Pointer Dereference in libfluid_msg library (medium 5.3)
- [CVE-2024-31166](https://insights.sbomify.com/CVE-2024-31166/): Out-of-bounds Read in libfluid_msg library (medium 6.5)
- [CVE-2024-31165](https://insights.sbomify.com/CVE-2024-31165/): NULL Pointer Dereference in libfluid_msg library (medium 5.3)
- [CVE-2024-31164](https://insights.sbomify.com/CVE-2024-31164/): NULL Pointer Dereference in libfluid_msg library (medium 5.3)
- [CVE-2024-31163](https://insights.sbomify.com/CVE-2024-31163/): ASUS Download Master - Buffer Overflow (high 7.2)
- [CVE-2024-31162](https://insights.sbomify.com/CVE-2024-31162/): ASUS Download Master - OS Command Injection (high 7.2)
- [CVE-2024-31161](https://insights.sbomify.com/CVE-2024-31161/): ASUS Download Master - Arbitrary File Upload (high 7.2)
- [CVE-2024-31160](https://insights.sbomify.com/CVE-2024-31160/): ASUS Download Master - Stored XSS (medium 4.8)
- [CVE-2024-3116](https://insights.sbomify.com/CVE-2024-3116/): Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 (high 7.4)
- [CVE-2024-31159](https://insights.sbomify.com/CVE-2024-31159/): ASUS Download Master - Reflected XSS (medium 4.8)
- [CVE-2024-31158](https://insights.sbomify.com/CVE-2024-31158/): Privilege escalation in Intel(R) Server Board S2600BP Family (high 8.7)
- [CVE-2024-31157](https://insights.sbomify.com/CVE-2024-31157/): Information disclosure in Intel(R) Processors (medium 6.8)
- [CVE-2024-31156](https://insights.sbomify.com/CVE-2024-31156/): BIG-IP Configuration utility XSS vulnerability (high 8.0)
- [CVE-2024-31155](https://insights.sbomify.com/CVE-2024-31155/): Memory corruption in Intel(R) Processors (high 8.7)
- [CVE-2024-31154](https://insights.sbomify.com/CVE-2024-31154/): Privilege escalation in Intel(R) Server S2600BPBR (high 8.7)
- [CVE-2024-31153](https://insights.sbomify.com/CVE-2024-31153/): Denial of service in Intel(R) QuickAssist Technology software (medium 5.1)
- [CVE-2024-31152](https://insights.sbomify.com/CVE-2024-31152/): Denial of service in WBR-6012 (medium 5.3)
- [CVE-2024-31151](https://insights.sbomify.com/CVE-2024-31151/): Hardcoded credentials in WBR-6012 (high 8.1)
- [CVE-2024-31150](https://insights.sbomify.com/CVE-2024-31150/): Memory corruption in Intel(R) Graphics Driver software (medium 4.8)
- [CVE-2024-3115](https://insights.sbomify.com/CVE-2024-3115/): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (medium 4.3)
- [CVE-2024-31146](https://insights.sbomify.com/CVE-2024-31146/): PCI device pass-through with shared resources (high 7.5)
- [CVE-2024-31145](https://insights.sbomify.com/CVE-2024-31145/): error handling in x86 IOMMU identity mapping (high 7.5)
- [CVE-2024-31144](https://insights.sbomify.com/CVE-2024-31144/): Xapi: Metadata injection attack against backup/restore functionality (low 3.8)
- [CVE-2024-31143](https://insights.sbomify.com/CVE-2024-31143/): double unlock in x86 guest IRQ handling (high 7.5)
- [CVE-2024-31142](https://insights.sbomify.com/CVE-2024-31142/): x86: Incorrect logic for BTC/SRSO mitigations (high 7.5)
- [CVE-2024-31141](https://insights.sbomify.com/CVE-2024-31141/): Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider (medium 6.5)
- [CVE-2024-31140](https://insights.sbomify.com/CVE-2024-31140/): Path traversal in TeamCity (medium 4.1)
- [CVE-2024-3114](https://insights.sbomify.com/CVE-2024-3114/): Uncontrolled Resource Consumption in GitLab (medium 4.3)
- [CVE-2024-31139](https://insights.sbomify.com/CVE-2024-31139/): XML external entity in TeamCity (medium 5.9)
- [CVE-2024-31138](https://insights.sbomify.com/CVE-2024-31138/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-31137](https://insights.sbomify.com/CVE-2024-31137/): Cross-site scripting in TeamCity (medium 6.8)
- [CVE-2024-31136](https://insights.sbomify.com/CVE-2024-31136/): Auth bypass in TeamCity (high 7.4)
- [CVE-2024-31135](https://insights.sbomify.com/CVE-2024-31135/): Open redirect in TeamCity (medium 6.1)
- [CVE-2024-31134](https://insights.sbomify.com/CVE-2024-31134/): Missing authorization in TeamCity (medium 6.5)
- [CVE-2024-3113](https://insights.sbomify.com/CVE-2024-3113/): FormFlow < 2.12.2 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-31127](https://insights.sbomify.com/CVE-2024-31127/): MacOS Zscaler Client Connector Local Privilege Escalation (high 7.3)
- [CVE-2024-31123](https://insights.sbomify.com/CVE-2024-31123/): WordPress SpiderFAQ plugin <= 1.3.2 - Cross Site Scripting vulnerability (high 7.1)
- [CVE-2024-31122](https://insights.sbomify.com/CVE-2024-31122/): WordPress User Rights Access Manager plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability (medium 5.8)
- [CVE-2024-31121](https://insights.sbomify.com/CVE-2024-31121/): WordPress HeartThis plugin <= 0.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31120](https://insights.sbomify.com/CVE-2024-31120/): WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3112](https://insights.sbomify.com/CVE-2024-3112/): Quotes and Tips < 1.45 - Admin+ Arbitrary File Upload (medium 4.9)
- [CVE-2024-31119](https://insights.sbomify.com/CVE-2024-31119/): WordPress Download Special Box for Content plugin <= 1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31118](https://insights.sbomify.com/CVE-2024-31118/): WordPress SP Project & Document Manager plugin <= 4.70 - Broken Access Control to XSS vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/379/