# Vulnerabilities published in 2024


- [CVE-2024-29220](https://insights.sbomify.com/CVE-2024-29220/): Cross-site scripting in Ninja Forms (medium 6.1)
- [CVE-2024-2922](https://insights.sbomify.com/CVE-2024-2922/): Themesflat Addons For Elementor <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Tags (medium 6.4)
- [CVE-2024-29219](https://insights.sbomify.com/CVE-2024-29219/): Memory corruption in KV REPLAY VIEWER (high 7.8)
- [CVE-2024-29218](https://insights.sbomify.com/CVE-2024-29218/): Memory corruption in KV REPLAY VIEWER (high 8.8)
- [CVE-2024-29217](https://insights.sbomify.com/CVE-2024-29217/): Apache Answer: XSS vulnerability when changing personal website (medium 4.6)
- [CVE-2024-29216](https://insights.sbomify.com/CVE-2024-29216/): Missing authorization in cg6kwin2k.sys (medium 6.1)
- [CVE-2024-29215](https://insights.sbomify.com/CVE-2024-29215/): Slash commands run in channel without channel membership via playbook task commands (medium 4.3)
- [CVE-2024-29214](https://insights.sbomify.com/CVE-2024-29214/): Privilege escalation in Intel(R) Processors (high 8.7)
- [CVE-2024-29213](https://insights.sbomify.com/CVE-2024-29213/): Privilege escalation in DSM (high 7.8)
- [CVE-2024-29212](https://insights.sbomify.com/CVE-2024-29212/): Deserialization in Service Provider Console (critical 9.9)
- [CVE-2024-29211](https://insights.sbomify.com/CVE-2024-29211/): Race condition in Secure Access Client (high 7.1)
- [CVE-2024-29210](https://insights.sbomify.com/CVE-2024-29210/): Privilege escalation in PasswordIQ (PIQ) Client (low 2.8)
- [CVE-2024-2921](https://insights.sbomify.com/CVE-2024-2921/): Missing authorization in Server (critical 9.8)
- [CVE-2024-29209](https://insights.sbomify.com/CVE-2024-29209/): Code injection in PasswordIQ (PIQ) Client (medium 6.0)
- [CVE-2024-29208](https://insights.sbomify.com/CVE-2024-29208/): Auth bypass in Update UniFi Connect Display (low 2.2)
- [CVE-2024-29207](https://insights.sbomify.com/CVE-2024-29207/): Security feature bypass in UniFi Connect Application (high 7.5)
- [CVE-2024-29206](https://insights.sbomify.com/CVE-2024-29206/): Missing authorization in UniFi Access G2 Reader Pro (low 2.2)
- [CVE-2024-29205](https://insights.sbomify.com/CVE-2024-29205/): Denial of service in Connect Secure (high 7.5)
- [CVE-2024-29204](https://insights.sbomify.com/CVE-2024-29204/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2024-29203](https://insights.sbomify.com/CVE-2024-29203/): TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes (medium 4.3)
- [CVE-2024-29202](https://insights.sbomify.com/CVE-2024-29202/): JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery (critical 10.0)
- [CVE-2024-29201](https://insights.sbomify.com/CVE-2024-29201/): JumpServer's insecure Ansible playbook validation leads to RCE in Celery (critical 10.0)
- [CVE-2024-29200](https://insights.sbomify.com/CVE-2024-29200/): API returns timesheet entries a user should not be authorized to view (medium 6.8)
- [CVE-2024-2920](https://insights.sbomify.com/CVE-2024-2920/): WP-Members Membership Plugin <= 3.4.9.3 - Unprotected Storage of Potentially Sensitive Files (medium 5.3)
- [CVE-2024-29199](https://insights.sbomify.com/CVE-2024-29199/): Unauthenticated views may expose information to anonymous users (low 3.7)
- [CVE-2024-29198](https://insights.sbomify.com/CVE-2024-29198/): GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost (high 7.5)
- [CVE-2024-29197](https://insights.sbomify.com/CVE-2024-29197/): Pimcore Preview Documents are not restricted to logged in users anymore (medium 6.5)
- [CVE-2024-29196](https://insights.sbomify.com/CVE-2024-29196/): phpMyFAQ Path Traversal in Attachments (low 3.8)
- [CVE-2024-29195](https://insights.sbomify.com/CVE-2024-29195/): Azure C SDK Integer Wraparound Vulnerability (medium 6.0)
- [CVE-2024-29194](https://insights.sbomify.com/CVE-2024-29194/): OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation (high 8.3)
- [CVE-2024-29193](https://insights.sbomify.com/CVE-2024-29193/): GHSL-2023-207 gotortc DOM-based Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-29192](https://insights.sbomify.com/CVE-2024-29192/): GHSL-2023-206 gotortc Cross-Site Request Forgery vulnerability (high 8.8)
- [CVE-2024-29191](https://insights.sbomify.com/CVE-2024-29191/): GHSL-2023-205 gotortc DOM-based Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-29190](https://insights.sbomify.com/CVE-2024-29190/): MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns) (high 7.5)
- [CVE-2024-2919](https://insights.sbomify.com/CVE-2024-2919/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-29189](https://insights.sbomify.com/CVE-2024-29189/): ansys-geometry-core OS Command Injection vulnerability (high 7.4)
- [CVE-2024-29188](https://insights.sbomify.com/CVE-2024-29188/): Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files (high 7.8)
- [CVE-2024-29187](https://insights.sbomify.com/CVE-2024-29187/): WiX based installers are vulnerable to binary hijack when run as SYSTEM (high 7.3)
- [CVE-2024-29186](https://insights.sbomify.com/CVE-2024-29186/): Slow String Operations via MultiPart Requests in Event-Driven Functions (medium 5.3)
- [CVE-2024-29185](https://insights.sbomify.com/CVE-2024-29185/): FreeScout OS Command Injection vulnerability (critical 9.1)
- [CVE-2024-29184](https://insights.sbomify.com/CVE-2024-29184/): FreeScout Stored XSS to Privilege Escalation After CSP Bypass (high 8.0)
- [CVE-2024-29183](https://insights.sbomify.com/CVE-2024-29183/): OpenRASP vulnerable to a reflected Cross-Site Scripting (XSS) attack in /login (medium 6.1)
- [CVE-2024-29182](https://insights.sbomify.com/CVE-2024-29182/): Collabora Online Stored Cross-Site-Scripting vulnerability via tooltip (medium 6.1)
- [CVE-2024-29181](https://insights.sbomify.com/CVE-2024-29181/): @strapi/plugin-content-manager leaks data via relations via the Admin Panel (low 2.3)
- [CVE-2024-29180](https://insights.sbomify.com/CVE-2024-29180/): webpack-dev-middleware Path Traversal vulnerability (high 7.4)
- [CVE-2024-2918](https://insights.sbomify.com/CVE-2024-2918/): Other in Server (low 3.6)
- [CVE-2024-29179](https://insights.sbomify.com/CVE-2024-29179/): phpMyFAQ Stored Cross-site Scripting at File Attachments (medium 4.3)
- [CVE-2024-29178](https://insights.sbomify.com/CVE-2024-29178/): Apache StreamPark: FreeMarker SSTI RCE Vulnerability (high 8.8)
- [CVE-2024-29177](https://insights.sbomify.com/CVE-2024-29177/): Information disclosure in PowerProtect DD (low 2.7)
- [CVE-2024-29176](https://insights.sbomify.com/CVE-2024-29176/): Memory corruption in PowerProtect DD (high 8.8)
- [CVE-2024-29175](https://insights.sbomify.com/CVE-2024-29175/): Weak cryptography in PowerProtect DD (medium 5.9)
- [CVE-2024-29174](https://insights.sbomify.com/CVE-2024-29174/): SQL injection in PowerProtect DD (medium 4.4)
- [CVE-2024-29173](https://insights.sbomify.com/CVE-2024-29173/): Server-side request forgery in PowerProtect DD (medium 6.8)
- [CVE-2024-29172](https://insights.sbomify.com/CVE-2024-29172/): Denial of service in Dell BSAFE SSL-J (medium 5.9)
- [CVE-2024-29171](https://insights.sbomify.com/CVE-2024-29171/): Security feature bypass in Dell BSAFE SSL-J (medium 5.9)
- [CVE-2024-29170](https://insights.sbomify.com/CVE-2024-29170/): Hardcoded credentials in PowerScale OneFS (high 8.1)
- [CVE-2024-2917](https://insights.sbomify.com/CVE-2024-2917/): Campcodes House Rental Management System index.php file inclusion (medium 5.4)
- [CVE-2024-29169](https://insights.sbomify.com/CVE-2024-29169/): SQL injection in Secure Connect Gateway-Appliance (medium 5.4)
- [CVE-2024-29168](https://insights.sbomify.com/CVE-2024-29168/): SQL injection in Secure Connect Gateway-Appliance (medium 5.4)
- [CVE-2024-29167](https://insights.sbomify.com/CVE-2024-29167/): Command injection in SVR-116 (high 7.2)
- [CVE-2024-29166](https://insights.sbomify.com/CVE-2024-29166/): Memory corruption in hdfgroup:hdf5 (medium 5.7)
- [CVE-2024-29165](https://insights.sbomify.com/CVE-2024-29165/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-29164](https://insights.sbomify.com/CVE-2024-29164/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2024-29163](https://insights.sbomify.com/CVE-2024-29163/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-29162](https://insights.sbomify.com/CVE-2024-29162/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-29161](https://insights.sbomify.com/CVE-2024-29161/): Memory corruption in hdfgroup:hdf5 (high 8.8)
- [CVE-2024-29160](https://insights.sbomify.com/CVE-2024-29160/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-2916](https://insights.sbomify.com/CVE-2024-2916/): Campcodes House Rental Management System ajax.php sql injection (high 7.3)
- [CVE-2024-29159](https://insights.sbomify.com/CVE-2024-29159/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2024-29158](https://insights.sbomify.com/CVE-2024-29158/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-29157](https://insights.sbomify.com/CVE-2024-29157/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2024-29156](https://insights.sbomify.com/CVE-2024-29156/): Information leakage in YAQL (medium 6.5)
- [CVE-2024-29155](https://insights.sbomify.com/CVE-2024-29155/): Denial of service on Microchip RN4870 devices (medium 4.3)
- [CVE-2024-29154](https://insights.sbomify.com/CVE-2024-29154/): Cross-site scripting in danielmiessler:fabric (high 7.4)
- [CVE-2024-29153](https://insights.sbomify.com/CVE-2024-29153/): Denial of service in samsung:exynos 1080 firmware (high 8.1)
- [CVE-2024-29152](https://insights.sbomify.com/CVE-2024-29152/): Information disclosure in samsung:exynos 1080 firmware (medium 5.9)
- [CVE-2024-29151](https://insights.sbomify.com/CVE-2024-29151/): Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI. (critical 9.1)
- [CVE-2024-29150](https://insights.sbomify.com/CVE-2024-29150/): An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. (high 8.8)
- [CVE-2024-2915](https://insights.sbomify.com/CVE-2024-2915/): Privilege escalation in Server (high 8.8)
- [CVE-2024-29149](https://insights.sbomify.com/CVE-2024-29149/): An issue was discovered in Alcatel-Lucent ALE NOE deskphones through 86x8_NOE-R300.1.40.12.4180 and SIP deskphones through 86x8_SIP-R200.1.01.10.728. (high 7.4)
- [CVE-2024-29146](https://insights.sbomify.com/CVE-2024-29146/): Information disclosure in Multiple MFPs (multifunction printers) (medium 5.9)
- [CVE-2024-29143](https://insights.sbomify.com/CVE-2024-29143/): WordPress Passwordless Login plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29142](https://insights.sbomify.com/CVE-2024-29142/): WordPress Better Search plugin <= 3.3.0 - Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29141](https://insights.sbomify.com/CVE-2024-29141/): WordPress PDF Embedder plugin <= 4.6.4 - Cross Site Scripting (XSS) vulnerability (medium 5.5)
- [CVE-2024-29140](https://insights.sbomify.com/CVE-2024-29140/): WordPress MJM Clinic plugin <= 1.1.22 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-2914](https://insights.sbomify.com/CVE-2024-2914/): TarSlip Vulnerability in deepjavalibrary/djl (high 7.8)
- [CVE-2024-29139](https://insights.sbomify.com/CVE-2024-29139/): WordPress MyCurator Content Curation plugin <= 3.76 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29138](https://insights.sbomify.com/CVE-2024-29138/): WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29137](https://insights.sbomify.com/CVE-2024-29137/): WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29136](https://insights.sbomify.com/CVE-2024-29136/): WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerability (high 8.5)
- [CVE-2024-29135](https://insights.sbomify.com/CVE-2024-29135/): WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-29134](https://insights.sbomify.com/CVE-2024-29134/): WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29133](https://insights.sbomify.com/CVE-2024-29133/): Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree (medium 5.4)
- [CVE-2024-29131](https://insights.sbomify.com/CVE-2024-29131/): Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() (high 7.3)
- [CVE-2024-29130](https://insights.sbomify.com/CVE-2024-29130/): WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-2913](https://insights.sbomify.com/CVE-2024-2913/): Race Condition Vulnerability in mintplex-labs/anything-llm (medium 6.5)
- [CVE-2024-29129](https://insights.sbomify.com/CVE-2024-29129/): WordPress OxyExtras plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29128](https://insights.sbomify.com/CVE-2024-29128/): WordPress POST SMTP Mailer plugin <= 2.8.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29127](https://insights.sbomify.com/CVE-2024-29127/): WordPress Advanced Access Manager plugin <= 6.9.20 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29126](https://insights.sbomify.com/CVE-2024-29126/): WordPress Specific Content For Mobile plugin <= 0.1.9.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/393/