# Vulnerabilities published in 2024


- [CVE-2024-26003](https://insights.sbomify.com/CVE-2024-26003/): PHOENIX CONTACT: DoS of the control agent in CHARX Series (high 7.5)
- [CVE-2024-26002](https://insights.sbomify.com/CVE-2024-26002/): PHOENIX CONTACT: File ownership manipulation in CHARX Series (high 7.8)
- [CVE-2024-26001](https://insights.sbomify.com/CVE-2024-26001/): PHOENIX CONTACT: Out of bounds write only memory access (high 7.4)
- [CVE-2024-26000](https://insights.sbomify.com/CVE-2024-26000/): PHOENIX CONTACT: Out of bounds read only memory access (medium 5.9)
- [CVE-2024-25999](https://insights.sbomify.com/CVE-2024-25999/): PHOENIX CONTACT: Privilege escalation in the OCPP agent service (high 8.4)
- [CVE-2024-25998](https://insights.sbomify.com/CVE-2024-25998/): PHOENIX CONTACT: Command injection in the OCPP Service (high 7.3)
- [CVE-2024-25997](https://insights.sbomify.com/CVE-2024-25997/): PHOENIX CONTACT: Log injection in CHARX Series (medium 5.3)
- [CVE-2024-25996](https://insights.sbomify.com/CVE-2024-25996/): PHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series (medium 5.3)
- [CVE-2024-25995](https://insights.sbomify.com/CVE-2024-25995/): PHOENIX CONTACT: Remote code execution in CHARX Series (critical 9.8)
- [CVE-2024-25994](https://insights.sbomify.com/CVE-2024-25994/): PHOENIX CONTACT: Unintended script file upload in CHARX Series (medium 5.3)
- [CVE-2024-25993](https://insights.sbomify.com/CVE-2024-25993/): Memory corruption in Android (high 8.4)
- [CVE-2024-25992](https://insights.sbomify.com/CVE-2024-25992/): Memory corruption in Android (high 7.8)
- [CVE-2024-25991](https://insights.sbomify.com/CVE-2024-25991/): Memory corruption in Android (low 3.3)
- [CVE-2024-25990](https://insights.sbomify.com/CVE-2024-25990/): Race condition in Android (medium 6.4)
- [CVE-2024-2599](https://insights.sbomify.com/CVE-2024-2599/): Unrestricted Upload of File with Dangerous Type vulnerability in AMSS++ (critical 9.9)
- [CVE-2024-25989](https://insights.sbomify.com/CVE-2024-25989/): Memory corruption in Android (medium 5.9)
- [CVE-2024-25988](https://insights.sbomify.com/CVE-2024-25988/): Memory corruption in Android (high 8.4)
- [CVE-2024-25987](https://insights.sbomify.com/CVE-2024-25987/): Memory corruption in Android (medium 6.7)
- [CVE-2024-25986](https://insights.sbomify.com/CVE-2024-25986/): Memory corruption in Android (high 7.8)
- [CVE-2024-25985](https://insights.sbomify.com/CVE-2024-25985/): Use after free in Android (high 8.4)
- [CVE-2024-25984](https://insights.sbomify.com/CVE-2024-25984/): Memory corruption in Android (medium 6.2)
- [CVE-2024-25983](https://insights.sbomify.com/CVE-2024-25983/): Msa-24-0006: idor on dashboard comments block (low 3.5)
- [CVE-2024-25982](https://insights.sbomify.com/CVE-2024-25982/): Msa-24-0005: csrf risk in language import utility (medium 4.3)
- [CVE-2024-25981](https://insights.sbomify.com/CVE-2024-25981/): Msa-24-0004: forum export did not respect activity group settings (medium 4.3)
- [CVE-2024-25980](https://insights.sbomify.com/CVE-2024-25980/): Msa-24-0003: h5p attempts report did not respect activity group settings (medium 4.3)
- [CVE-2024-2598](https://insights.sbomify.com/CVE-2024-2598/): Cross-Site Scripting (XSS) in AMSS++ (high 7.1)
- [CVE-2024-25979](https://insights.sbomify.com/CVE-2024-25979/): Msa-24-0002: forum search accepted random parameters in its url (medium 5.3)
- [CVE-2024-25978](https://insights.sbomify.com/CVE-2024-25978/): Msa-24-0001: denial of service risk in file picker unzip functionality (high 7.5)
- [CVE-2024-25977](https://insights.sbomify.com/CVE-2024-25977/): Session Fixation (high 7.3)
- [CVE-2024-25976](https://insights.sbomify.com/CVE-2024-25976/): Reflected Cross-Site-Scripting (XSS) (medium 6.1)
- [CVE-2024-25975](https://insights.sbomify.com/CVE-2024-25975/): Arbitrary File Overwrite (medium 6.5)
- [CVE-2024-25974](https://insights.sbomify.com/CVE-2024-25974/): Stored Cross-Site Scripting (XSS) within the Media Center (medium 5.4)
- [CVE-2024-25973](https://insights.sbomify.com/CVE-2024-25973/): Multiple Stored Cross-Site Scripting Vulnerabilities (medium 5.4)
- [CVE-2024-25972](https://insights.sbomify.com/CVE-2024-25972/): Misconfiguration in OET-213H-BTS1 (high 8.3)
- [CVE-2024-25971](https://insights.sbomify.com/CVE-2024-25971/): XML external entity in PowerProtect Data Manager (medium 5.5)
- [CVE-2024-25970](https://insights.sbomify.com/CVE-2024-25970/): Other in PowerScale OneFS (medium 6.5)
- [CVE-2024-2597](https://insights.sbomify.com/CVE-2024-2597/): Cross-Site Scripting (XSS) in AMSS++ (high 7.1)
- [CVE-2024-25969](https://insights.sbomify.com/CVE-2024-25969/): Denial of service in PowerScale OneFS (medium 6.2)
- [CVE-2024-25968](https://insights.sbomify.com/CVE-2024-25968/): Weak cryptography in PowerScale OneFS (medium 5.9)
- [CVE-2024-25967](https://insights.sbomify.com/CVE-2024-25967/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2024-25966](https://insights.sbomify.com/CVE-2024-25966/): Denial of service in PowerScale OneFS (medium 5.3)
- [CVE-2024-25965](https://insights.sbomify.com/CVE-2024-25965/): Path traversal in PowerScale OneFS (medium 6.1)
- [CVE-2024-25964](https://insights.sbomify.com/CVE-2024-25964/): Denial of service in PowerScale OneFS (medium 5.3)
- [CVE-2024-25963](https://insights.sbomify.com/CVE-2024-25963/): Weak cryptography in PowerScale OneFS (medium 5.9)
- [CVE-2024-25962](https://insights.sbomify.com/CVE-2024-25962/): Missing authorization in InsightIQ (high 8.3)
- [CVE-2024-25961](https://insights.sbomify.com/CVE-2024-25961/): Privilege escalation in PowerScale OneFS (medium 6.0)
- [CVE-2024-25960](https://insights.sbomify.com/CVE-2024-25960/): Information disclosure in PowerScale OneFS (high 7.3)
- [CVE-2024-2596](https://insights.sbomify.com/CVE-2024-2596/): Cross-Site Scripting (XSS) in AMSS++ (high 7.1)
- [CVE-2024-25959](https://insights.sbomify.com/CVE-2024-25959/): Information disclosure in PowerScale OneFS (high 7.9)
- [CVE-2024-25958](https://insights.sbomify.com/CVE-2024-25958/): Misconfiguration in Grab for Windows (medium 6.7)
- [CVE-2024-25957](https://insights.sbomify.com/CVE-2024-25957/): Information disclosure in Grab for Windows (medium 4.8)
- [CVE-2024-25956](https://insights.sbomify.com/CVE-2024-25956/): Information disclosure in Grab for Windows (medium 5.5)
- [CVE-2024-25955](https://insights.sbomify.com/CVE-2024-25955/): Command injection in Virtual Appliance (vApp) Manager (high 7.2)
- [CVE-2024-25954](https://insights.sbomify.com/CVE-2024-25954/): Denial of service in PowerScale OneFS (medium 5.3)
- [CVE-2024-25953](https://insights.sbomify.com/CVE-2024-25953/): Path traversal in PowerScale OneFS (medium 6.0)
- [CVE-2024-25952](https://insights.sbomify.com/CVE-2024-25952/): Path traversal in PowerScale OneFS (medium 6.0)
- [CVE-2024-25951](https://insights.sbomify.com/CVE-2024-25951/): Command injection in Integrated Dell Remote Access Controller 8 (high 8.0)
- [CVE-2024-2595](https://insights.sbomify.com/CVE-2024-2595/): Cross-Site Scripting (XSS) in AMSS++ (high 7.1)
- [CVE-2024-25949](https://insights.sbomify.com/CVE-2024-25949/): Privilege escalation in SmartFabric OS10 Software (high 8.8)
- [CVE-2024-25948](https://insights.sbomify.com/CVE-2024-25948/): Memory corruption in iDRAC Service Module (iSM) (medium 4.8)
- [CVE-2024-25947](https://insights.sbomify.com/CVE-2024-25947/): Memory corruption in iDRAC Service Module (iSM) (medium 4.8)
- [CVE-2024-25946](https://insights.sbomify.com/CVE-2024-25946/): Command injection in Virtual Appliance (vApp) Manager (high 7.2)
- [CVE-2024-25944](https://insights.sbomify.com/CVE-2024-25944/): Path traversal in Dell OpenManage Enterprise (medium 5.7)
- [CVE-2024-25943](https://insights.sbomify.com/CVE-2024-25943/): Weak cryptography in Integrated Dell Remote Access Controller 9 (high 7.6)
- [CVE-2024-25942](https://insights.sbomify.com/CVE-2024-25942/): Memory corruption in PowerEdge Platform (medium 4.4)
- [CVE-2024-25941](https://insights.sbomify.com/CVE-2024-25941/): jail(2) information leak (low 3.3)
- [CVE-2024-25940](https://insights.sbomify.com/CVE-2024-25940/): bhyveload(8) host file access (medium 6.3)
- [CVE-2024-2594](https://insights.sbomify.com/CVE-2024-2594/): Cross-Site Scripting (XSS) in AMSS++ (high 7.1)
- [CVE-2024-25939](https://insights.sbomify.com/CVE-2024-25939/): Memory corruption in 3rd Generation Intel(R) Xeon(R) Scalable Processors (medium 6.7)
- [CVE-2024-25938](https://insights.sbomify.com/CVE-2024-25938/): Use after free in Foxit Reader (high 8.8)
- [CVE-2024-25937](https://insights.sbomify.com/CVE-2024-25937/): Delta Electronics DIAEnergie SQL injection (high 8.8)
- [CVE-2024-25936](https://insights.sbomify.com/CVE-2024-25936/): WordPress SoundCloud Shortcode plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-25935](https://insights.sbomify.com/CVE-2024-25935/): WordPress RegistrationMagic plugin <= 5.2.5.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-25934](https://insights.sbomify.com/CVE-2024-25934/): WordPress FormFacade plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-25933](https://insights.sbomify.com/CVE-2024-25933/): WordPress PeproDev Ultimate Invoice plugin <= 1.9.7 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-25932](https://insights.sbomify.com/CVE-2024-25932/): WordPress Change Table Prefix plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-25931](https://insights.sbomify.com/CVE-2024-25931/): WordPress Heureka Plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-25930](https://insights.sbomify.com/CVE-2024-25930/): WordPress Custom Order Statuses for WooCommerce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-2593](https://insights.sbomify.com/CVE-2024-2593/): Cross-Site Scripting (XSS) in AMSS++ (high 7.1)
- [CVE-2024-25929](https://insights.sbomify.com/CVE-2024-25929/): WordPress Product Catalog Mode For Woocommerce plugin <= 5.0.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-25928](https://insights.sbomify.com/CVE-2024-25928/): WordPress Sitepact's Contact Form 7 Extension For Klaviyo Plugin <= 1.0.5 is vulnerable to SQL Injection (high 7.1)
- [CVE-2024-25927](https://insights.sbomify.com/CVE-2024-25927/): WordPress postMash – custom post order Plugin <= 1.2.0 is vulnerable to SQL Injection (critical 9.3)
- [CVE-2024-25926](https://insights.sbomify.com/CVE-2024-25926/): WordPress Widgets Controller plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-25925](https://insights.sbomify.com/CVE-2024-25925/): File upload in WooCommerce Easy Checkout Field Editor, Fees & Discounts (critical 10.0)
- [CVE-2024-25924](https://insights.sbomify.com/CVE-2024-25924/): WordPress WP Testimonials plugin <= 1.4.3 - Auth. SQL Injection vulnerability (high 7.6)
- [CVE-2024-25923](https://insights.sbomify.com/CVE-2024-25923/): WordPress Community by PeepSo plugin <= 6.2.7.0 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-25922](https://insights.sbomify.com/CVE-2024-25922/): WordPress Peach Payments Gateway plugin <= 3.1.9 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-25921](https://insights.sbomify.com/CVE-2024-25921/): WordPress Action Network plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-25920](https://insights.sbomify.com/CVE-2024-25920/): WordPress WP SMS plugin <= 6.3.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-2592](https://insights.sbomify.com/CVE-2024-2592/): SQL injection vulnerability in AMSS++ (high 8.2)
- [CVE-2024-25919](https://insights.sbomify.com/CVE-2024-25919/): WordPress Custom Field Template plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-25918](https://insights.sbomify.com/CVE-2024-25918/): WordPress InstaWP Connect plugin <= 0.1.0.8 - Remote Code Execution vulnerability (critical 9.9)
- [CVE-2024-25917](https://insights.sbomify.com/CVE-2024-25917/): WordPress WP Setup Wizard plugin <= 1.0.8.1 - Auth. Full Database Download Vulnerability (high 8.8)
- [CVE-2024-25916](https://insights.sbomify.com/CVE-2024-25916/): WordPress My Calendar plugin <= 3.4.23 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-25915](https://insights.sbomify.com/CVE-2024-25915/): WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.9)
- [CVE-2024-25914](https://insights.sbomify.com/CVE-2024-25914/): WordPress SMTP Mail Plugin <= 1.3.20 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-25913](https://insights.sbomify.com/CVE-2024-25913/): WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload (critical 10.0)
- [CVE-2024-25912](https://insights.sbomify.com/CVE-2024-25912/): WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary WordPress Settings Change vulnerability (critical 9.8)
- [CVE-2024-25911](https://insights.sbomify.com/CVE-2024-25911/): WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-25910](https://insights.sbomify.com/CVE-2024-25910/): WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/419/