# Vulnerabilities published in 2024


- [CVE-2024-29954](https://insights.sbomify.com/CVE-2024-29954/): password management API prints sensitive information in log files (medium 5.9)
- [CVE-2024-29953](https://insights.sbomify.com/CVE-2024-29953/): Encoded session passwords on session storage for Virtual Fabric platforms (medium 4.3)
- [CVE-2024-29952](https://insights.sbomify.com/CVE-2024-29952/): Clear text storage of sensistive information by manipulating command variables (medium 5.5)
- [CVE-2024-29951](https://insights.sbomify.com/CVE-2024-29951/): Brocade SANnav has weak encryption in internal SSH ports (medium 5.7)
- [CVE-2024-29950](https://insights.sbomify.com/CVE-2024-29950/): Brocade SANnav before v2.3.1, v2.3.0a uses weak encryption (high 7.5)
- [CVE-2024-2995](https://insights.sbomify.com/CVE-2024-2995/): NUUO Camera deletefile.php denial of service (medium 5.4)
- [CVE-2024-29949](https://insights.sbomify.com/CVE-2024-29949/): Command injection in DS-7604NI-K1 / 4P(B) (high 7.2)
- [CVE-2024-29948](https://insights.sbomify.com/CVE-2024-29948/): Memory corruption in DS-7604NXI-K1/4P (low 3.8)
- [CVE-2024-29947](https://insights.sbomify.com/CVE-2024-29947/): Null dereference in DS-7604NI-K1 / 4P(B) (low 2.7)
- [CVE-2024-29946](https://insights.sbomify.com/CVE-2024-29946/): Risky command safeguards bypass in Dashboard Examples Hub (high 8.1)
- [CVE-2024-29945](https://insights.sbomify.com/CVE-2024-29945/): Splunk Authentication Token Exposure in Debug Log in Splunk Enterprise (high 7.2)
- [CVE-2024-29944](https://insights.sbomify.com/CVE-2024-29944/): Code injection in Firefox (high 8.4)
- [CVE-2024-29943](https://insights.sbomify.com/CVE-2024-29943/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-29941](https://insights.sbomify.com/CVE-2024-29941/): Credential Cloning (high 8.0)
- [CVE-2024-2994](https://insights.sbomify.com/CVE-2024-2994/): Tenda FH1203 GetParentControlInfo stack-based overflow (high 8.8)
- [CVE-2024-29937](https://insights.sbomify.com/CVE-2024-29937/): Code injection in freebsd:freebsd (critical 9.8)
- [CVE-2024-29936](https://insights.sbomify.com/CVE-2024-29936/): WordPress Image Hover Effects – Elementor Addon plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29935](https://insights.sbomify.com/CVE-2024-29935/): WordPress Sina Extension for Elementor plugin <= 3.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29934](https://insights.sbomify.com/CVE-2024-29934/): WordPress Piotnet Addons For Elementor plugin <= 2.4.25 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29933](https://insights.sbomify.com/CVE-2024-29933/): WordPress Web Icons plugin <= 1.0.0.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29932](https://insights.sbomify.com/CVE-2024-29932/): WordPress WordPress Meta Data and Taxonomies Filter (MDTF) plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29931](https://insights.sbomify.com/CVE-2024-29931/): WordPress WP Go Maps plugin <= 9.0.29 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29930](https://insights.sbomify.com/CVE-2024-29930/): WordPress Crypto Converter Widget plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-2993](https://insights.sbomify.com/CVE-2024-2993/): Tenda FH1203 QuickIndex formQuickIndex stack-based overflow (high 8.8)
- [CVE-2024-29929](https://insights.sbomify.com/CVE-2024-29929/): WordPress WCFM plugin <= 6.7.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29928](https://insights.sbomify.com/CVE-2024-29928/): WordPress Advanced Sermons plugin <= 3.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29927](https://insights.sbomify.com/CVE-2024-29927/): WordPress WishSuite plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29926](https://insights.sbomify.com/CVE-2024-29926/): WordPress WC Builder plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29925](https://insights.sbomify.com/CVE-2024-29925/): WordPress Post Grid, Slider & Carousel Ultimate plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29924](https://insights.sbomify.com/CVE-2024-29924/): WordPress Premium Packages plugin <= 5.8.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29923](https://insights.sbomify.com/CVE-2024-29923/): WordPress PropertyHive plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29922](https://insights.sbomify.com/CVE-2024-29922/): WordPress Slider Hero plugin <= 8.6.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29921](https://insights.sbomify.com/CVE-2024-29921/): WordPress Photo Gallery by Supsystic plugin <= 1.15.16 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29920](https://insights.sbomify.com/CVE-2024-29920/): WordPress Move Addons for Elementor plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-2992](https://insights.sbomify.com/CVE-2024-2992/): Tenda FH1203 setcfm formSetCfm stack-based overflow (high 8.8)
- [CVE-2024-29919](https://insights.sbomify.com/CVE-2024-29919/): WordPress Photo Gallery by Ays Plugin <=5.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29918](https://insights.sbomify.com/CVE-2024-29918/): WordPress Survey Maker plugin <= 4.0.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29917](https://insights.sbomify.com/CVE-2024-29917/): WordPress Compact WP Audio Player plugin <= 1.9.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29916](https://insights.sbomify.com/CVE-2024-29916/): The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged k (medium 5.6)
- [CVE-2024-29915](https://insights.sbomify.com/CVE-2024-29915/): WordPress Podlove Podcast Publisher plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29914](https://insights.sbomify.com/CVE-2024-29914/): WordPress Stratum – Elementor Widgets plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29913](https://insights.sbomify.com/CVE-2024-29913/): WordPress Tutor LMS Elementor Addons plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29912](https://insights.sbomify.com/CVE-2024-29912/): WordPress iCalendrier plugin <= 1.80 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29911](https://insights.sbomify.com/CVE-2024-29911/): WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29910](https://insights.sbomify.com/CVE-2024-29910/): WordPress Dropdown Multisite selector plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-2991](https://insights.sbomify.com/CVE-2024-2991/): Tenda FH1203 WriteFacMac formWriteFacMac command injection (medium 6.3)
- [CVE-2024-29909](https://insights.sbomify.com/CVE-2024-29909/): WordPress Travelers' Map plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29908](https://insights.sbomify.com/CVE-2024-29908/): WordPress Co-marquage service-public.fr plugin <= 0.5.71 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29907](https://insights.sbomify.com/CVE-2024-29907/): WordPress SEO Backlink Monitor plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29906](https://insights.sbomify.com/CVE-2024-29906/): WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29905](https://insights.sbomify.com/CVE-2024-29905/): DIRAC: Unauthorized users can read proxy contents during generation (high 8.1)
- [CVE-2024-29904](https://insights.sbomify.com/CVE-2024-29904/): CodeIgniter4 Language class DoS Vulnerability (high 7.5)
- [CVE-2024-29903](https://insights.sbomify.com/CVE-2024-29903/): Cosign vulnerable to machine-wide denial of service via malicious artifacts (medium 4.2)
- [CVE-2024-29902](https://insights.sbomify.com/CVE-2024-29902/): Cosign vulnerable to system-wide denial of service via malicious attachments (medium 4.2)
- [CVE-2024-29901](https://insights.sbomify.com/CVE-2024-29901/): @workos-inc/authkit-nextjs session replay vulnerability (medium 4.8)
- [CVE-2024-29900](https://insights.sbomify.com/CVE-2024-29900/): @electron/packager's build process memory potentially leaked into final executable (high 7.5)
- [CVE-2024-2990](https://insights.sbomify.com/CVE-2024-2990/): Tenda FH1203 execCommand formexeCommand stack-based overflow (high 8.8)
- [CVE-2024-29898](https://insights.sbomify.com/CVE-2024-29898/): Oversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikis (medium 4.9)
- [CVE-2024-29897](https://insights.sbomify.com/CVE-2024-29897/): CreateWiki Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki` (medium 4.9)
- [CVE-2024-29896](https://insights.sbomify.com/CVE-2024-29896/): Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections (high 7.5)
- [CVE-2024-29895](https://insights.sbomify.com/CVE-2024-29895/): Cacti command injection in cmd_realtime.php (critical 10.0)
- [CVE-2024-29894](https://insights.sbomify.com/CVE-2024-29894/): Cacti Cross-site Scripting vulnerability when using JavaScript based messaging API (medium 5.4)
- [CVE-2024-29893](https://insights.sbomify.com/CVE-2024-29893/): Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server (medium 6.5)
- [CVE-2024-29892](https://insights.sbomify.com/CVE-2024-29892/): ZITADEL's actions can overload reserved claims (medium 6.1)
- [CVE-2024-29891](https://insights.sbomify.com/CVE-2024-29891/): ZITADEL Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass (high 8.7)
- [CVE-2024-29890](https://insights.sbomify.com/CVE-2024-29890/): Remote code execution in datalens-ui (high 8.8)
- [CVE-2024-2989](https://insights.sbomify.com/CVE-2024-2989/): Tenda FH1203 NatStaticSetting fromNatStaticSetting stack-based overflow (high 8.8)
- [CVE-2024-29889](https://insights.sbomify.com/CVE-2024-29889/): GLPI contains an SQL injection through the saved searches (high 7.1)
- [CVE-2024-29888](https://insights.sbomify.com/CVE-2024-29888/): Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method (medium 4.2)
- [CVE-2024-29887](https://insights.sbomify.com/CVE-2024-29887/): Serverpod client accepts any certificate (high 7.4)
- [CVE-2024-29886](https://insights.sbomify.com/CVE-2024-29886/): Improved security for stored password hashes (medium 5.3)
- [CVE-2024-29885](https://insights.sbomify.com/CVE-2024-29885/): Reports are still accessible even when `canView()` returns false in silverstripe/reports (medium 4.3)
- [CVE-2024-29883](https://insights.sbomify.com/CVE-2024-29883/): CreateWiki's wiki request suppression ignores the suppression settings set by the suppressor (medium 4.9)
- [CVE-2024-29882](https://insights.sbomify.com/CVE-2024-29882/): SRS DOM - XSS on JSONP callback (high 7.2)
- [CVE-2024-29881](https://insights.sbomify.com/CVE-2024-29881/): TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements (medium 4.3)
- [CVE-2024-29880](https://insights.sbomify.com/CVE-2024-29880/): Privilege escalation in TeamCity (medium 4.2)
- [CVE-2024-2988](https://insights.sbomify.com/CVE-2024-2988/): Tenda FH1203 fromRouteStatic fromSetRouteStatic stack-based overflow (high 8.8)
- [CVE-2024-29879](https://insights.sbomify.com/CVE-2024-29879/): Cross-Site Scripting (XSS) vulnerability in Sentrifugo (high 7.1)
- [CVE-2024-29878](https://insights.sbomify.com/CVE-2024-29878/): Cross-Site Scripting (XSS) vulnerability in Sentrifugo (high 7.1)
- [CVE-2024-29877](https://insights.sbomify.com/CVE-2024-29877/): Cross-Site Scripting (XSS) vulnerability in Sentrifugo (high 7.1)
- [CVE-2024-29876](https://insights.sbomify.com/CVE-2024-29876/): SQL injection vulnerability in Sentrifugo (critical 9.8)
- [CVE-2024-29875](https://insights.sbomify.com/CVE-2024-29875/): SQL injection vulnerability in Sentrifugo (critical 9.8)
- [CVE-2024-29874](https://insights.sbomify.com/CVE-2024-29874/): SQL injection vulnerability in Sentrifugo (critical 9.8)
- [CVE-2024-29873](https://insights.sbomify.com/CVE-2024-29873/): SQL injection vulnerability in Sentrifugo (critical 9.8)
- [CVE-2024-29872](https://insights.sbomify.com/CVE-2024-29872/): SQL injection vulnerability in Sentrifugo (critical 9.8)
- [CVE-2024-29871](https://insights.sbomify.com/CVE-2024-29871/): SQL injection vulnerability in Sentrifugo (critical 9.8)
- [CVE-2024-29870](https://insights.sbomify.com/CVE-2024-29870/): SQL injection vulnerability in Sentrifugo (critical 9.8)
- [CVE-2024-2987](https://insights.sbomify.com/CVE-2024-2987/): Tenda FH1202 GetParentControlInfo stack-based overflow (high 8.8)
- [CVE-2024-29869](https://insights.sbomify.com/CVE-2024-29869/): Apache Hive: Credentials file created with non restrictive permissions (medium 5.5)
- [CVE-2024-29868](https://insights.sbomify.com/CVE-2024-29868/): Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation (critical 9.1)
- [CVE-2024-29866](https://insights.sbomify.com/CVE-2024-29866/): Privilege escalation in datalust:seq (critical 9.1)
- [CVE-2024-29865](https://insights.sbomify.com/CVE-2024-29865/): Cross-site scripting in logpoint:siem (medium 5.4)
- [CVE-2024-29864](https://insights.sbomify.com/CVE-2024-29864/): Command injection in 89luca89:distrobox (critical 9.8)
- [CVE-2024-29863](https://insights.sbomify.com/CVE-2024-29863/): A race condition in the installer executable in Qlik Qlikview before versions May 2022 SR3 (12.70.20300) and May 2023 SR2 (12,80.20200) may (high 7.8)
- [CVE-2024-29862](https://insights.sbomify.com/CVE-2024-29862/): Security feature bypass in chirpstack:gateway bridge (high 7.5)
- [CVE-2024-2986](https://insights.sbomify.com/CVE-2024-2986/): Tenda FH1202 SetSpeedWan formSetSpeedWan stack-based overflow (high 8.8)
- [CVE-2024-29859](https://insights.sbomify.com/CVE-2024-29859/): File upload in misp-project:misp (critical 9.8)
- [CVE-2024-29858](https://insights.sbomify.com/CVE-2024-29858/): File upload in misp-project:misp (critical 9.8)
- [CVE-2024-29857](https://insights.sbomify.com/CVE-2024-29857/): Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation. (high 7.5)
- [CVE-2024-29855](https://insights.sbomify.com/CVE-2024-29855/): Hardcoded credentials in Recovery Orchestrator (critical 9.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/389/