# Vulnerabilities published in 2024


- [CVE-2024-29760](https://insights.sbomify.com/CVE-2024-29760/): WordPress Booster for WooCommerce plugin <= 7.1.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-2976](https://insights.sbomify.com/CVE-2024-2976/): Tenda F1203 execCommand R7WebsSecurityHandler stack-based overflow (high 8.8)
- [CVE-2024-29759](https://insights.sbomify.com/CVE-2024-29759/): WordPress Calculated Fields Form plugin <= 1.2.54 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29758](https://insights.sbomify.com/CVE-2024-29758/): WordPress Co-marquage service-public.fr plugin <= 0.5.72 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29757](https://insights.sbomify.com/CVE-2024-29757/): Security feature bypass in Android (high 7.3)
- [CVE-2024-29756](https://insights.sbomify.com/CVE-2024-29756/): Memory corruption in Android (critical 9.8)
- [CVE-2024-29755](https://insights.sbomify.com/CVE-2024-29755/): Memory corruption in Android (medium 4.4)
- [CVE-2024-29754](https://insights.sbomify.com/CVE-2024-29754/): Memory corruption in Android (medium 6.2)
- [CVE-2024-29753](https://insights.sbomify.com/CVE-2024-29753/): Memory corruption in Android (high 7.7)
- [CVE-2024-29752](https://insights.sbomify.com/CVE-2024-29752/): Memory corruption in Android (high 7.8)
- [CVE-2024-29751](https://insights.sbomify.com/CVE-2024-29751/): Memory corruption in Android (medium 5.5)
- [CVE-2024-29750](https://insights.sbomify.com/CVE-2024-29750/): Memory corruption in Android (medium 5.5)
- [CVE-2024-2975](https://insights.sbomify.com/CVE-2024-2975/): Race condition in Octopus Server (high 8.8)
- [CVE-2024-29749](https://insights.sbomify.com/CVE-2024-29749/): Memory corruption in Android (high 8.4)
- [CVE-2024-29748](https://insights.sbomify.com/CVE-2024-29748/): Android Pixel Privilege Escalation (high 7.8, exploited in the wild)
- [CVE-2024-29747](https://insights.sbomify.com/CVE-2024-29747/): Memory corruption in Android (medium 5.9)
- [CVE-2024-29746](https://insights.sbomify.com/CVE-2024-29746/): Memory corruption in Android (high 8.4)
- [CVE-2024-29745](https://insights.sbomify.com/CVE-2024-29745/): Android Pixel Information Disclosure (medium 5.5, exploited in the wild)
- [CVE-2024-29744](https://insights.sbomify.com/CVE-2024-29744/): Memory corruption in Android (medium 5.5)
- [CVE-2024-29743](https://insights.sbomify.com/CVE-2024-29743/): Memory corruption in Android (high 7.7)
- [CVE-2024-29742](https://insights.sbomify.com/CVE-2024-29742/): Memory corruption in Android (medium 5.5)
- [CVE-2024-29741](https://insights.sbomify.com/CVE-2024-29741/): Privilege escalation in Android (high 7.8)
- [CVE-2024-29740](https://insights.sbomify.com/CVE-2024-29740/): Memory corruption in Android (high 7.4)
- [CVE-2024-2974](https://insights.sbomify.com/CVE-2024-2974/): Information disclosure in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 5.3)
- [CVE-2024-29739](https://insights.sbomify.com/CVE-2024-29739/): Memory corruption in Android (medium 5.5)
- [CVE-2024-29738](https://insights.sbomify.com/CVE-2024-29738/): Memory corruption in Android (medium 5.5)
- [CVE-2024-29737](https://insights.sbomify.com/CVE-2024-29737/): Apache StreamPark (incubating): maven build params could trigger remote command execution (high 8.8)
- [CVE-2024-29736](https://insights.sbomify.com/CVE-2024-29736/): Apache CXF: SSRF vulnerability via WADL stylesheet parameter (high 7.5)
- [CVE-2024-29735](https://insights.sbomify.com/CVE-2024-29735/): Apache Airflow: Potentially harmful permission changing by log task handler (medium 5.3)
- [CVE-2024-29734](https://insights.sbomify.com/CVE-2024-29734/): Other in SonicDICOM Media Viewer (high 7.8)
- [CVE-2024-29733](https://insights.sbomify.com/CVE-2024-29733/): Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL context (low 2.7)
- [CVE-2024-29732](https://insights.sbomify.com/CVE-2024-29732/): SQL Injection vulnerability on SCAN_VISIO eDocument Suite Web Viewer from Abast (critical 9.8)
- [CVE-2024-29731](https://insights.sbomify.com/CVE-2024-29731/): Multiple vulnerabilities in SportsNET (critical 9.8)
- [CVE-2024-29730](https://insights.sbomify.com/CVE-2024-29730/): Multiple vulnerabilities in SportsNET (critical 9.8)
- [CVE-2024-2973](https://insights.sbomify.com/CVE-2024-2973/): Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed (critical 10.0)
- [CVE-2024-29729](https://insights.sbomify.com/CVE-2024-29729/): Multiple vulnerabilities in SportsNET (critical 9.8)
- [CVE-2024-29728](https://insights.sbomify.com/CVE-2024-29728/): Multiple vulnerabilities in SportsNET (critical 9.8)
- [CVE-2024-29727](https://insights.sbomify.com/CVE-2024-29727/): Multiple vulnerabilities in SportsNET (critical 9.8)
- [CVE-2024-29726](https://insights.sbomify.com/CVE-2024-29726/): Multiple vulnerabilities in SportsNET (critical 9.8)
- [CVE-2024-29725](https://insights.sbomify.com/CVE-2024-29725/): Multiple vulnerabilities in SportsNET (critical 9.8)
- [CVE-2024-29724](https://insights.sbomify.com/CVE-2024-29724/): Multiple vulnerabilities in SportsNET (critical 9.8)
- [CVE-2024-29723](https://insights.sbomify.com/CVE-2024-29723/): Multiple vulnerabilities in SportsNET (critical 9.8)
- [CVE-2024-29720](https://insights.sbomify.com/CVE-2024-29720/): Information disclosure in terrainformatica:sciter (medium 6.2)
- [CVE-2024-2972](https://insights.sbomify.com/CVE-2024-2972/): Floating Chat Widget < 3.1.9 - Editor+ Stored XSS (low 3.8)
- [CVE-2024-2971](https://insights.sbomify.com/CVE-2024-2971/): Out-of-bounds array access due to negative object numbers in indirect references in Xpdf 4.05 (low 2.9)
- [CVE-2024-2970](https://insights.sbomify.com/CVE-2024-2970/): News Wall <= 1.1.0 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2024-2969](https://insights.sbomify.com/CVE-2024-2969/): WP-Eggdrop <= 0.1 - Cross-Site Request Forgery to Settings Update (medium 5.4)
- [CVE-2024-29686](https://insights.sbomify.com/CVE-2024-29686/): Winter CMS Server-Side Template Injection (SSTI) vulnerability (high 7.2)
- [CVE-2024-29684](https://insights.sbomify.com/CVE-2024-29684/): Cross-site request forgery in dedecms:dedecms (critical 9.8)
- [CVE-2024-2968](https://insights.sbomify.com/CVE-2024-2968/): WP-Eggdrop <= 0.1 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-29672](https://insights.sbomify.com/CVE-2024-29672/): Directory Traversal vulnerability in zly2006 Reden before v.0.2.514 allows a remote attacker to execute arbitrary code via the DEBUG_RTC_REQ (high 8.8)
- [CVE-2024-29671](https://insights.sbomify.com/CVE-2024-29671/): Buffer Overflow vulnerability in NEXTU FLATA AX1500 Router v.1.0.2 allows a remote attacker to execute arbitrary code via the POST request handler component. (critical 9.8)
- [CVE-2024-2967](https://insights.sbomify.com/CVE-2024-2967/): Cross-site scripting in Guest posting / Frontend Posting / Front Editor – WP Front User Submit (medium 4.4)
- [CVE-2024-29667](https://insights.sbomify.com/CVE-2024-29667/): SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate pri (critical 9.8)
- [CVE-2024-29666](https://insights.sbomify.com/CVE-2024-29666/): Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to esc (critical 9.8)
- [CVE-2024-29661](https://insights.sbomify.com/CVE-2024-29661/): File upload in dedecms:dedecms (critical 9.8)
- [CVE-2024-29660](https://insights.sbomify.com/CVE-2024-29660/): Cross-site scripting in dedecms:dedecms (medium 5.3)
- [CVE-2024-2966](https://insights.sbomify.com/CVE-2024-2966/): Information disclosure in Element Pack – Widgets, Templates & Addons for Elementor (medium 5.3)
- [CVE-2024-29651](https://insights.sbomify.com/CVE-2024-29651/): json-schema-ref-parser Prototype Pollution issue (high 8.1)
- [CVE-2024-29650](https://insights.sbomify.com/CVE-2024-29650/): @thi.ng/paths Prototype Pollution vulnerability (critical 9.8)
- [CVE-2024-2965](https://insights.sbomify.com/CVE-2024-2965/): Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchain (medium 4.2)
- [CVE-2024-29646](https://insights.sbomify.com/CVE-2024-29646/): Memory corruption in radare:radare2 (critical 9.8)
- [CVE-2024-29645](https://insights.sbomify.com/CVE-2024-29645/): Memory corruption in radare:radare2 (high 7.8)
- [CVE-2024-29644](https://insights.sbomify.com/CVE-2024-29644/): dcat-admin Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2024-29643](https://insights.sbomify.com/CVE-2024-29643/): croogo Host header injection (critical 9.1)
- [CVE-2024-29640](https://insights.sbomify.com/CVE-2024-29640/): aliyundrive-webdav vulnerable to Command Injection (critical 9.8)
- [CVE-2024-2964](https://insights.sbomify.com/CVE-2024-2964/): Pocket News Generator <= 0.2.0 - Cross-Site Request Forgery to Settings Update (medium 5.4)
- [CVE-2024-2963](https://insights.sbomify.com/CVE-2024-2963/): Pocket News Generator <= 0.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-2962](https://insights.sbomify.com/CVE-2024-2962/): Networker - Tech News WordPress Theme with Dark Mode <= 1.1.9 - Missing Authorization (medium 5.3)
- [CVE-2024-2961](https://insights.sbomify.com/CVE-2024-2961/): Memory corruption in glibc (high 7.3)
- [CVE-2024-2960](https://insights.sbomify.com/CVE-2024-2960/): SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Deletion (medium 4.3)
- [CVE-2024-2959](https://insights.sbomify.com/CVE-2024-2959/): SVS Pricing Tables <= 1.0.4 - Cross-Site Request Forgery to Pricing Table Edit/Creation (medium 4.3)
- [CVE-2024-2958](https://insights.sbomify.com/CVE-2024-2958/): SVS Pricing Tables <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-2956](https://insights.sbomify.com/CVE-2024-2956/): Simple Ajax Chat <= 20231101 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-2955](https://insights.sbomify.com/CVE-2024-2955/): Mismatched Memory Management Routines in Wireshark (high 7.8)
- [CVE-2024-2954](https://insights.sbomify.com/CVE-2024-2954/): SQL injection in Action Network (high 7.2)
- [CVE-2024-2953](https://insights.sbomify.com/CVE-2024-2953/): LuckyWP Table of Contents <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-2952](https://insights.sbomify.com/CVE-2024-2952/): Server-Side Template Injection in BerriAI/litellm (critical 9.8)
- [CVE-2024-29515](https://insights.sbomify.com/CVE-2024-29515/): File upload in lepton-cms:leptoncms (high 8.8)
- [CVE-2024-29514](https://insights.sbomify.com/CVE-2024-29514/): File upload in lepton-cms:leptoncms (high 8.8)
- [CVE-2024-29513](https://insights.sbomify.com/CVE-2024-29513/): An issue in briscKernelDriver.sys in BlueRiSC WindowsSCOPE Cyber Forensics before 3.3 allows a local attacker to execute arbitrary code with (high 7.8)
- [CVE-2024-29511](https://insights.sbomify.com/CVE-2024-29511/): Path traversal in artifex:ghostscript (high 7.5)
- [CVE-2024-29510](https://insights.sbomify.com/CVE-2024-29510/): Memory corruption in artifex:ghostscript (medium 6.3)
- [CVE-2024-2951](https://insights.sbomify.com/CVE-2024-2951/): WordPress RegistrationMagic plugin <= 5.3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-29509](https://insights.sbomify.com/CVE-2024-29509/): Memory corruption in artifex:ghostscript (high 8.8)
- [CVE-2024-29508](https://insights.sbomify.com/CVE-2024-29508/): Information disclosure in artifex:ghostscript (low 3.3)
- [CVE-2024-29507](https://insights.sbomify.com/CVE-2024-29507/): Memory corruption in artifex:ghostscript (medium 5.4)
- [CVE-2024-29506](https://insights.sbomify.com/CVE-2024-29506/): Memory corruption in artifex:ghostscript (medium 5.4)
- [CVE-2024-29504](https://insights.sbomify.com/CVE-2024-29504/): Summernote vulnerable to cross-site scripting (high 7.6)
- [CVE-2024-29502](https://insights.sbomify.com/CVE-2024-29502/): Path traversal in inteset:secure lockdown (medium 6.5)
- [CVE-2024-29500](https://insights.sbomify.com/CVE-2024-29500/): Code injection in inteset:secure lockdown (critical 9.8)
- [CVE-2024-2950](https://insights.sbomify.com/CVE-2024-2950/): BoldGrid Easy SEO – Simple and Effective SEO <= 1.6.14 - Information Exposure (medium 5.3)
- [CVE-2024-29499](https://insights.sbomify.com/CVE-2024-29499/): Cross-Site Request Forgery in Anchor CMS (high 7.4)
- [CVE-2024-2949](https://insights.sbomify.com/CVE-2024-2949/): Cross-site scripting in Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel (medium 6.4)
- [CVE-2024-29489](https://insights.sbomify.com/CVE-2024-29489/): Null dereference in jerryscript:jerryscript (medium 5.5)
- [CVE-2024-2948](https://insights.sbomify.com/CVE-2024-2948/): Favorites <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-29477](https://insights.sbomify.com/CVE-2024-29477/): Dolibarr ERP CRM Code Injection vulnerability during installation (high 8.8)
- [CVE-2024-29474](https://insights.sbomify.com/CVE-2024-29474/): Cross-site scripting in zhyd:oneblog (medium 5.4)
- [CVE-2024-29473](https://insights.sbomify.com/CVE-2024-29473/): Cross-site scripting in zhyd:oneblog (medium 6.1)
- [CVE-2024-29472](https://insights.sbomify.com/CVE-2024-29472/): Cross-site scripting in zhyd:oneblog (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/391/