# Vulnerabilities published in 2024


- [CVE-2024-25610](https://insights.sbomify.com/CVE-2024-25610/): Liferay Portal has a Stored XSS with Blog entries (Insecure defaults) (critical 9.0)
- [CVE-2024-2561](https://insights.sbomify.com/CVE-2024-2561/): 74CMS Company Logo Index.php#sendCompanyLogo unrestricted upload (medium 6.3)
- [CVE-2024-25609](https://insights.sbomify.com/CVE-2024-25609/): Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Two Forward Slashes (medium 6.1)
- [CVE-2024-25608](https://insights.sbomify.com/CVE-2024-25608/): Liferay Portal and Liferay DXP's HtmlUtil.escapeRedirect Can Be Circumvented via Replacement Character (medium 6.1)
- [CVE-2024-25607](https://insights.sbomify.com/CVE-2024-25607/): Liferay Portal defaults to a low work factor for the default password hashing algorithm (high 8.1)
- [CVE-2024-25606](https://insights.sbomify.com/CVE-2024-25606/): Liferay Portal has an XXE vulnerability in Java2WsddTask._format (high 8.0)
- [CVE-2024-25605](https://insights.sbomify.com/CVE-2024-25605/): Liferay Portal and Liferay DXP Allows Templates to be Viewed via the UI or API (medium 5.3)
- [CVE-2024-25604](https://insights.sbomify.com/CVE-2024-25604/): Liferay Portal and Liferay DXP Allows Authenticated Users with View Permissions to Edit Permissions (medium 6.5)
- [CVE-2024-25603](https://insights.sbomify.com/CVE-2024-25603/): Liferay Portal's Dynamic Data Mapping module's DDMForm and Liferay DXP vulnerable to stored Cross-site Scripting (critical 9.0)
- [CVE-2024-25602](https://insights.sbomify.com/CVE-2024-25602/): Liferay Portal and Liferay DXP's Users Admin module vulnerable to stored Cross-site Scripting (critical 9.0)
- [CVE-2024-25601](https://insights.sbomify.com/CVE-2024-25601/): Liferay Portal Expando module and Liferay DXP vulnerable to stored Cross-site Scripting (critical 9.0)
- [CVE-2024-25600](https://insights.sbomify.com/CVE-2024-25600/): WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2024-2560](https://insights.sbomify.com/CVE-2024-2560/): Tenda AC18 SysToolRestoreSet fromSysToolRestoreSet cross-site request forgery (medium 4.3)
- [CVE-2024-25599](https://insights.sbomify.com/CVE-2024-25599/): WordPress Seriously Simple Podcasting plugin <= 3.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-25598](https://insights.sbomify.com/CVE-2024-25598/): WordPress Elementor Addons by Livemesh plugin <= 8.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-25597](https://insights.sbomify.com/CVE-2024-25597/): WordPress Ultimate Reviews plugin <= 3.2.8 - Unauthenticated Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-25596](https://insights.sbomify.com/CVE-2024-25596/): WordPress Doofinder for WooCommerce plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-25595](https://insights.sbomify.com/CVE-2024-25595/): WordPress Defender Security plugin <= 4.4.1 - IP Restriction Bypass vulnerability (medium 5.3)
- [CVE-2024-25594](https://insights.sbomify.com/CVE-2024-25594/): WordPress MyWaze Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-25593](https://insights.sbomify.com/CVE-2024-25593/): WordPress NEX-Forms plugin <= 8.5.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-25592](https://insights.sbomify.com/CVE-2024-25592/): WordPress Broken Link Checker plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-25591](https://insights.sbomify.com/CVE-2024-25591/): WordPress WP Editor plugin <=1.2.7 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-25590](https://insights.sbomify.com/CVE-2024-25590/): Crafted responses can lead to a denial of service due to cache inefficiencies in the Recursor (high 7.5)
- [CVE-2024-2559](https://insights.sbomify.com/CVE-2024-2559/): Tenda AC18 SysToolReboot fromSysToolReboot cross-site request forgery (medium 4.3)
- [CVE-2024-25584](https://insights.sbomify.com/CVE-2024-25584/): Other in OX Dovecot Pro (medium 5.3)
- [CVE-2024-25583](https://insights.sbomify.com/CVE-2024-25583/): Crafted responses can lead to a denial of service in Recursor if recursive forwarding is configured (high 7.5)
- [CVE-2024-25582](https://insights.sbomify.com/CVE-2024-25582/): Cross-site scripting in OX App Suite (medium 5.4)
- [CVE-2024-25581](https://insights.sbomify.com/CVE-2024-25581/): Transfer requests received over DoH can lead to a denial of service in DNSdist (high 7.5)
- [CVE-2024-25580](https://insights.sbomify.com/CVE-2024-25580/): Memory corruption in qt:qt (medium 6.2)
- [CVE-2024-2558](https://insights.sbomify.com/CVE-2024-2558/): Tenda AC18 execCommand formexeCommand stack-based overflow (high 8.8)
- [CVE-2024-25579](https://insights.sbomify.com/CVE-2024-25579/): Command injection in WMC-2LX2-B (medium 6.8)
- [CVE-2024-25578](https://insights.sbomify.com/CVE-2024-25578/): MicroDicom DICOM Viewer Out-of-Bounds Write (high 7.8)
- [CVE-2024-25576](https://insights.sbomify.com/CVE-2024-25576/): Privilege escalation in Intel(R) FPGA products (high 8.5)
- [CVE-2024-25575](https://insights.sbomify.com/CVE-2024-25575/): Memory corruption in Foxit Reader (high 8.8)
- [CVE-2024-25574](https://insights.sbomify.com/CVE-2024-25574/): Delta Electronics DIAEnergie SQL Injection (high 8.8)
- [CVE-2024-25573](https://insights.sbomify.com/CVE-2024-25573/): Stored Cross-Site Scripting in Administrative Console Context (medium 6.9)
- [CVE-2024-25572](https://insights.sbomify.com/CVE-2024-25572/): Cross-site request forgery in Ninja Forms (high 8.8)
- [CVE-2024-25571](https://insights.sbomify.com/CVE-2024-25571/): Denial of service in Intel(R) SPS firmware before SPS E5 06.01.04.059.0 (medium 4.6)
- [CVE-2024-2557](https://insights.sbomify.com/CVE-2024-2557/): kishor-23 Food Waste Management System admin.php improper authorization (medium 5.3)
- [CVE-2024-25569](https://insights.sbomify.com/CVE-2024-25569/): Memory corruption in Grassroot DICOM (medium 6.5)
- [CVE-2024-25568](https://insights.sbomify.com/CVE-2024-25568/): Command injection in WMC-X1800GST-B (high 8.8)
- [CVE-2024-25567](https://insights.sbomify.com/CVE-2024-25567/): Delta Electronics DIAEnergie Path traversal (high 8.1)
- [CVE-2024-25566](https://insights.sbomify.com/CVE-2024-25566/): Open Redirect in PingAM (medium 5.1)
- [CVE-2024-25565](https://insights.sbomify.com/CVE-2024-25565/): Denial of service in Intel(R) Xeon(R) Processors (medium 4.8)
- [CVE-2024-25563](https://insights.sbomify.com/CVE-2024-25563/): Information disclosure in Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi (medium 4.6)
- [CVE-2024-25562](https://insights.sbomify.com/CVE-2024-25562/): Memory corruption in Intel(R) Distribution for GDB software (medium 5.8)
- [CVE-2024-25561](https://insights.sbomify.com/CVE-2024-25561/): Misconfiguration in Intel(R) HID Event Filter software installers (medium 5.4)
- [CVE-2024-25560](https://insights.sbomify.com/CVE-2024-25560/): TMM Vulnerability (high 7.5)
- [CVE-2024-2556](https://insights.sbomify.com/CVE-2024-2556/): SourceCodester Employee Task Management System attendance-info.php sql injection (medium 6.3)
- [CVE-2024-25559](https://insights.sbomify.com/CVE-2024-25559/): Open redirect in a-blog cms (medium 4.7)
- [CVE-2024-25552](https://insights.sbomify.com/CVE-2024-25552/): Wiesemann & Theis: Multiple products prone to unquoted search path (high 7.8)
- [CVE-2024-25551](https://insights.sbomify.com/CVE-2024-25551/): Cross-site scripting in oretnom23:simple student attendance system (medium 6.1)
- [CVE-2024-2555](https://insights.sbomify.com/CVE-2024-2555/): SourceCodester Employee Task Management System update-admin.php sql injection (medium 6.3)
- [CVE-2024-25545](https://insights.sbomify.com/CVE-2024-25545/): Code injection in weave:weave desktop (high 7.8)
- [CVE-2024-2554](https://insights.sbomify.com/CVE-2024-2554/): SourceCodester Employee Task Management System update-employee.php sql injection (medium 6.3)
- [CVE-2024-25533](https://insights.sbomify.com/CVE-2024-25533/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25532](https://insights.sbomify.com/CVE-2024-25532/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-25531](https://insights.sbomify.com/CVE-2024-25531/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-25530](https://insights.sbomify.com/CVE-2024-25530/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-2553](https://insights.sbomify.com/CVE-2024-2553/): SourceCodester Product Review Rating System Rate Product cross site scripting (low 3.5)
- [CVE-2024-25529](https://insights.sbomify.com/CVE-2024-25529/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-25528](https://insights.sbomify.com/CVE-2024-25528/): SQL injection in ruvar:ruvaroa (medium 5.9)
- [CVE-2024-25527](https://insights.sbomify.com/CVE-2024-25527/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25526](https://insights.sbomify.com/CVE-2024-25526/): SQL injection in ruvar:ruvaroa (high 8.1)
- [CVE-2024-25525](https://insights.sbomify.com/CVE-2024-25525/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-25524](https://insights.sbomify.com/CVE-2024-25524/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25523](https://insights.sbomify.com/CVE-2024-25523/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-25522](https://insights.sbomify.com/CVE-2024-25522/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25521](https://insights.sbomify.com/CVE-2024-25521/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25520](https://insights.sbomify.com/CVE-2024-25520/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-2552](https://insights.sbomify.com/CVE-2024-2552/): PAN-OS: Arbitrary File Delete Vulnerability in the Command Line Interface (CLI) (medium 6.8)
- [CVE-2024-25519](https://insights.sbomify.com/CVE-2024-25519/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-25518](https://insights.sbomify.com/CVE-2024-25518/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25517](https://insights.sbomify.com/CVE-2024-25517/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-25515](https://insights.sbomify.com/CVE-2024-25515/): SQL injection in ruvar:ruvaroa (high 7.3)
- [CVE-2024-25514](https://insights.sbomify.com/CVE-2024-25514/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25513](https://insights.sbomify.com/CVE-2024-25513/): SQL injection in ruvar:ruvaroa (high 7.8)
- [CVE-2024-25512](https://insights.sbomify.com/CVE-2024-25512/): SQL injection in ruvar:ruvaroa (high 8.1)
- [CVE-2024-25511](https://insights.sbomify.com/CVE-2024-25511/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25510](https://insights.sbomify.com/CVE-2024-25510/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-2551](https://insights.sbomify.com/CVE-2024-2551/): PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet (high 8.7)
- [CVE-2024-25509](https://insights.sbomify.com/CVE-2024-25509/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25508](https://insights.sbomify.com/CVE-2024-25508/): SQL injection in ruvar:ruvaroa (critical 9.8)
- [CVE-2024-25507](https://insights.sbomify.com/CVE-2024-25507/): SQL injection in ruvar:ruvaroa (critical 9.4)
- [CVE-2024-25506](https://insights.sbomify.com/CVE-2024-25506/): Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control (medium 6.5)
- [CVE-2024-25503](https://insights.sbomify.com/CVE-2024-25503/): Cross Site Scripting (XSS) vulnerability in Advanced REST Client v.17.0.9 allows a remote attacker to execute arbitrary code and obtain sens (medium 4.7)
- [CVE-2024-25502](https://insights.sbomify.com/CVE-2024-25502/): Path traversal in flusity:flusity (critical 9.8)
- [CVE-2024-25501](https://insights.sbomify.com/CVE-2024-25501/): Code injection in winmail:winmail (high 8.8)
- [CVE-2024-2550](https://insights.sbomify.com/CVE-2024-2550/): PAN-OS: Firewall Denial of Service (DoS) in GlobalProtect Gateway Using a Specially Crafted Packet (high 8.7)
- [CVE-2024-2548](https://insights.sbomify.com/CVE-2024-2548/): Path Traversal in parisneo/lollms-webui (high 7.5)
- [CVE-2024-2547](https://insights.sbomify.com/CVE-2024-2547/): Tenda AC18 R7WebsSecurityHandler stack-based overflow (high 8.8)
- [CVE-2024-25469](https://insights.sbomify.com/CVE-2024-25469/): SQL injection in crmeb:crmeb java (high 7.5)
- [CVE-2024-25468](https://insights.sbomify.com/CVE-2024-25468/): Command injection in totolink:x5000r firmware (high 7.5)
- [CVE-2024-25466](https://insights.sbomify.com/CVE-2024-25466/): React Native Document Picker Directory Traversal vulnerability (high 7.3)
- [CVE-2024-25461](https://insights.sbomify.com/CVE-2024-25461/): Path traversal in creatio:crm creatio (high 7.5)
- [CVE-2024-2546](https://insights.sbomify.com/CVE-2024-2546/): Tenda AC18 fromSetWirelessRepeat stack-based overflow (high 8.8)
- [CVE-2024-25458](https://insights.sbomify.com/CVE-2024-25458/): An issue in CYCZCAM, SHIX ZHAO, SHIXCAM A9 Camera (circuit board identifier A9-48B-V1.0) firmware v.CYCAM_48B_BC01_v87_0903 allows a remote (high 7.5)
- [CVE-2024-25454](https://insights.sbomify.com/CVE-2024-25454/): Null dereference in axiosys:bento4 (medium 5.5)
- [CVE-2024-25453](https://insights.sbomify.com/CVE-2024-25453/): Null dereference in axiosys:bento4 (medium 5.5)
- [CVE-2024-25452](https://insights.sbomify.com/CVE-2024-25452/): Denial of service in axiosys:bento4 (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/422/