# Vulnerabilities published in 2024


- [CVE-2024-25130](https://insights.sbomify.com/CVE-2024-25130/): Tuleap's mass update clears the permissions on artifact field (medium 5.4)
- [CVE-2024-2513](https://insights.sbomify.com/CVE-2024-2513/): WP Chat App <= 3.6.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Image Attribute (medium 6.4)
- [CVE-2024-25129](https://insights.sbomify.com/CVE-2024-25129/): Limited data exfiltration in CodeQL CLI (low 2.7)
- [CVE-2024-25128](https://insights.sbomify.com/CVE-2024-25128/): Flask-AppBuilder incorrect authentication when using auth type OpenID (critical 9.1)
- [CVE-2024-25126](https://insights.sbomify.com/CVE-2024-25126/): Rack ReDos in content type parsing (2nd degree polynomial) (medium 5.3)
- [CVE-2024-25125](https://insights.sbomify.com/CVE-2024-25125/): Absolute path traversal vulnerability in digdag server (medium 5.3)
- [CVE-2024-25124](https://insights.sbomify.com/CVE-2024-25124/): Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials (critical 9.4)
- [CVE-2024-25123](https://insights.sbomify.com/CVE-2024-25123/): Path Manipulation in file mslib/index.py in MSS (high 7.3)
- [CVE-2024-25122](https://insights.sbomify.com/CVE-2024-25122/): Cross-site Scripting sidekiq-unique-jobs UI server vulnerability (high 7.1)
- [CVE-2024-25121](https://insights.sbomify.com/CVE-2024-25121/): Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3 (high 7.1)
- [CVE-2024-25120](https://insights.sbomify.com/CVE-2024-25120/): Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3 (medium 4.3)
- [CVE-2024-25119](https://insights.sbomify.com/CVE-2024-25119/): Information Disclosure of Encryption Key in TYPO3 Install Tool (medium 4.9)
- [CVE-2024-25118](https://insights.sbomify.com/CVE-2024-25118/): Information Disclosure of Hashed Passwords in TYPO3 Backend Forms (medium 4.3)
- [CVE-2024-25117](https://insights.sbomify.com/CVE-2024-25117/): php-svg-lib lacks path validation on font through SVG inline styles (medium 6.8)
- [CVE-2024-25116](https://insights.sbomify.com/CVE-2024-25116/): Specially crafted CF.RESERVE command can lead to denial-of-service (medium 5.5)
- [CVE-2024-25115](https://insights.sbomify.com/CVE-2024-25115/): RedisBloom heap buffer overflow in CF.LOADCHUNK command (high 7.0)
- [CVE-2024-25114](https://insights.sbomify.com/CVE-2024-25114/): Sensitive Information Disclosure (JailID) to users in Collabora Online (low 2.6)
- [CVE-2024-25112](https://insights.sbomify.com/CVE-2024-25112/): Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2 (medium 5.5)
- [CVE-2024-25111](https://insights.sbomify.com/CVE-2024-25111/): SQUID-2024:1 Denial of Service in HTTP Chunked Decoding (high 8.6)
- [CVE-2024-25110](https://insights.sbomify.com/CVE-2024-25110/): Azure IoT Platform Device SDK Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-2511](https://insights.sbomify.com/CVE-2024-2511/): Unbounded memory growth with session handling in TLSv1.3 (medium 5.9)
- [CVE-2024-25109](https://insights.sbomify.com/CVE-2024-25109/): Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki (medium 6.5)
- [CVE-2024-25108](https://insights.sbomify.com/CVE-2024-25108/): Insufficient authorization allowing elevated access to resources in pixelfed (critical 9.9)
- [CVE-2024-25107](https://insights.sbomify.com/CVE-2024-25107/): Cross-Site Scripting in WikiDiscover (medium 4.9)
- [CVE-2024-25106](https://insights.sbomify.com/CVE-2024-25106/): OpenObserve Unauthorized Access Vulnerability in Users API (critical 9.1)
- [CVE-2024-25103](https://insights.sbomify.com/CVE-2024-25103/): Dynamic Link Library (DLL) Hijacking Vulnerability in CDAC AppSamvid Software (medium 6.3)
- [CVE-2024-25102](https://insights.sbomify.com/CVE-2024-25102/): Information Disclosure Vulnerability in CDAC AppSamvid Software (high 7.8)
- [CVE-2024-25101](https://insights.sbomify.com/CVE-2024-25101/): WordPress Maspik – Spam blacklist Plugin <= 0.10.6 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-25100](https://insights.sbomify.com/CVE-2024-25100/): WordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerability (critical 10.0)
- [CVE-2024-25099](https://insights.sbomify.com/CVE-2024-25099/): WordPress Paytium: Mollie payment forms & donations Plugin <= 4.4.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-25098](https://insights.sbomify.com/CVE-2024-25098/): WordPress PB oEmbed HTML5 Audio Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-25097](https://insights.sbomify.com/CVE-2024-25097/): WordPress TNC PDF viewer Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-25096](https://insights.sbomify.com/CVE-2024-25096/): WordPress canto plugin <= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability (critical 10.0)
- [CVE-2024-25095](https://insights.sbomify.com/CVE-2024-25095/): WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Sensitive Data Exposure via Log File vulnerability (high 7.5)
- [CVE-2024-25094](https://insights.sbomify.com/CVE-2024-25094/): WordPress PJ News Ticker Plugin <= 1.9.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-25093](https://insights.sbomify.com/CVE-2024-25093/): WordPress GD Rating System Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-25092](https://insights.sbomify.com/CVE-2024-25092/): WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability (high 8.8)
- [CVE-2024-25091](https://insights.sbomify.com/CVE-2024-25091/): Security feature bypass in RevoWorks Browser (critical 9.1)
- [CVE-2024-25090](https://insights.sbomify.com/CVE-2024-25090/): Cross-site scripting in Apache Roller (medium 5.4)
- [CVE-2024-2509](https://insights.sbomify.com/CVE-2024-2509/): Gutenberg Blocks by Kadence Blocks < 3.2.26 - Contributor+ Stored XSS (medium 6.5)
- [CVE-2024-25089](https://insights.sbomify.com/CVE-2024-25089/): Code injection in malwarebytes:binisoft windows firewall control (critical 9.8)
- [CVE-2024-25088](https://insights.sbomify.com/CVE-2024-25088/): Privilege escalation in jungo:windriver (high 7.8)
- [CVE-2024-25087](https://insights.sbomify.com/CVE-2024-25087/): Denial of service in jungo:windriver (medium 5.5)
- [CVE-2024-25086](https://insights.sbomify.com/CVE-2024-25086/): Privilege escalation in jungo:windriver (high 7.8)
- [CVE-2024-25083](https://insights.sbomify.com/CVE-2024-25083/): Privilege escalation in beyondtrust:privilege management for windows (medium 6.3)
- [CVE-2024-25082](https://insights.sbomify.com/CVE-2024-25082/): Command injection in debian:debian linux (medium 6.5)
- [CVE-2024-25081](https://insights.sbomify.com/CVE-2024-25081/): Command injection in debian:debian linux (medium 4.2)
- [CVE-2024-25080](https://insights.sbomify.com/CVE-2024-25080/): WebMail in Axigen 10.x before 10.3.3.62 allows XSS via the image attachment viewer. (medium 4.7)
- [CVE-2024-2508](https://insights.sbomify.com/CVE-2024-2508/): WP Mobile Menu <= 2.8.4.4 - Missing Authorization to _mobmenu_icon Post Meta Modification (medium 5.3)
- [CVE-2024-25079](https://insights.sbomify.com/CVE-2024-25079/): Memory corruption in insyde:insydeh2o (high 7.4)
- [CVE-2024-25078](https://insights.sbomify.com/CVE-2024-25078/): Memory corruption in insyde:kernel (high 7.4)
- [CVE-2024-25077](https://insights.sbomify.com/CVE-2024-25077/): An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. (critical 9.8)
- [CVE-2024-25076](https://insights.sbomify.com/CVE-2024-25076/): An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. (medium 6.8)
- [CVE-2024-25075](https://insights.sbomify.com/CVE-2024-25075/): An issue was discovered in Softing uaToolkit Embedded before 1.41.1. (medium 5.1)
- [CVE-2024-25074](https://insights.sbomify.com/CVE-2024-25074/): Null dereference in samsung:exynos 1080 firmware (medium 5.9)
- [CVE-2024-25073](https://insights.sbomify.com/CVE-2024-25073/): Null dereference in samsung:exynos 1080 firmware (medium 5.9)
- [CVE-2024-2507](https://insights.sbomify.com/CVE-2024-2507/): JetWidgets For Elementor <= 1.0.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Button URL (medium 6.4)
- [CVE-2024-25066](https://insights.sbomify.com/CVE-2024-25066/): XML external entity in Authentication Manager (medium 4.3)
- [CVE-2024-25065](https://insights.sbomify.com/CVE-2024-25065/): Apache OFBiz: Path traversal allowing authentication bypass. (critical 9.1)
- [CVE-2024-25064](https://insights.sbomify.com/CVE-2024-25064/): Missing authorization in HikCentral Professional (medium 4.3)
- [CVE-2024-25063](https://insights.sbomify.com/CVE-2024-25063/): Missing authorization in HikCentral Professional (high 7.5)
- [CVE-2024-25062](https://insights.sbomify.com/CVE-2024-25062/): Use after free in xmlsoft:libxml2 (high 7.5)
- [CVE-2024-2506](https://insights.sbomify.com/CVE-2024-2506/): Popup Builder <= 4.2.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom JS (medium 6.4)
- [CVE-2024-25053](https://insights.sbomify.com/CVE-2024-25053/): IBM Cognos Analytics improper certificate validation (medium 5.9)
- [CVE-2024-25052](https://insights.sbomify.com/CVE-2024-25052/): IBM Jazz Reporting Service information disclosure (medium 4.4)
- [CVE-2024-25051](https://insights.sbomify.com/CVE-2024-25051/): IBM Jazz Reporting Service insufficient session expiration (medium 6.6)
- [CVE-2024-25050](https://insights.sbomify.com/CVE-2024-25050/): IBM i privilege escalation (high 8.4)
- [CVE-2024-2505](https://insights.sbomify.com/CVE-2024-2505/): GamiPress < 6.8.9 - Broken Access Control (high 8.1)
- [CVE-2024-25048](https://insights.sbomify.com/CVE-2024-25048/): IBM MQ code execution (high 7.5)
- [CVE-2024-25047](https://insights.sbomify.com/CVE-2024-25047/): IBM Cognos Analytics log injection (high 8.6)
- [CVE-2024-25046](https://insights.sbomify.com/CVE-2024-25046/): IBM Db2 for Linux, UNIX and Windows denial of service (medium 5.3)
- [CVE-2024-25042](https://insights.sbomify.com/CVE-2024-25042/): IBM Cognos Analytics cross-site scripting (medium 5.4)
- [CVE-2024-25041](https://insights.sbomify.com/CVE-2024-25041/): IBM Cognos Analytics cross-site scripting (medium 5.4)
- [CVE-2024-2504](https://insights.sbomify.com/CVE-2024-2504/): Cross-site scripting in Page Builder: Pagelayer – Drag and Drop website builder (medium 6.4)
- [CVE-2024-25039](https://insights.sbomify.com/CVE-2024-25039/): IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities (high 7.5)
- [CVE-2024-25037](https://insights.sbomify.com/CVE-2024-25037/): IBM Cognos Controller information disclosure (medium 4.3)
- [CVE-2024-25036](https://insights.sbomify.com/CVE-2024-25036/): IBM Cognos Controller authentication bypass (medium 4.3)
- [CVE-2024-25035](https://insights.sbomify.com/CVE-2024-25035/): IBM Cognos Controller information disclosure (medium 5.3)
- [CVE-2024-25034](https://insights.sbomify.com/CVE-2024-25034/): IBM Planning Analytics file upload (high 8.0)
- [CVE-2024-25031](https://insights.sbomify.com/CVE-2024-25031/): IBM Storage Defender information disclosure (medium 6.5)
- [CVE-2024-25030](https://insights.sbomify.com/CVE-2024-25030/): Information disclosure in Db2 for Linux, UNIX and Windows (medium 6.2)
- [CVE-2024-2503](https://insights.sbomify.com/CVE-2024-2503/): Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Post Grid (medium 6.4)
- [CVE-2024-25029](https://insights.sbomify.com/CVE-2024-25029/): IBM Personal Communications code execution (critical 9.0)
- [CVE-2024-25027](https://insights.sbomify.com/CVE-2024-25027/): IBM Security Verify Access Container information disclosure (medium 6.2)
- [CVE-2024-25026](https://insights.sbomify.com/CVE-2024-25026/): IBM WebSphere Application Server denial of service (medium 5.9)
- [CVE-2024-25024](https://insights.sbomify.com/CVE-2024-25024/): IBM QRadar Suite Software information disclosure (medium 5.5)
- [CVE-2024-25023](https://insights.sbomify.com/CVE-2024-25023/): IBM QRadar Suite Software information disclosure (medium 5.5)
- [CVE-2024-25021](https://insights.sbomify.com/CVE-2024-25021/): IBM AIX command execution (high 8.4)
- [CVE-2024-25020](https://insights.sbomify.com/CVE-2024-25020/): IBM Cognos Controller file upload (medium 5.5)
- [CVE-2024-2502](https://insights.sbomify.com/CVE-2024-2502/): Failure to update the tamper reset cause register when a tamper event occurs (low 2.0)
- [CVE-2024-25019](https://insights.sbomify.com/CVE-2024-25019/): IBM Cognos Controller file upload (medium 5.5)
- [CVE-2024-25016](https://insights.sbomify.com/CVE-2024-25016/): IBM MQ denial of service (high 7.5)
- [CVE-2024-25015](https://insights.sbomify.com/CVE-2024-25015/): IBM MQ denial of service (high 7.5)
- [CVE-2024-25011](https://insights.sbomify.com/CVE-2024-25011/): Ericsson Catalog Manager and Ericsson Order Care - Exposure of Sensitive Information Vulnerability (medium 5.3)
- [CVE-2024-25010](https://insights.sbomify.com/CVE-2024-25010/): Ericsson RAN Compute and Site Controller 6610 - Improper Input Validation Vulnerability (high 8.8)
- [CVE-2024-2501](https://insights.sbomify.com/CVE-2024-2501/): Hubbub Lite – Fast, Reliable Social Network Sharing Buttons <= 1.33.1 - PHP Object Injection (high 7.5)
- [CVE-2024-25009](https://insights.sbomify.com/CVE-2024-25009/): Ericsson Packet Core Controller (PCC) - Improper Input Validation Vulnerability (medium 6.5)
- [CVE-2024-25008](https://insights.sbomify.com/CVE-2024-25008/): Ericsson RAN Compute and Site Controller 6610 - Improper Input Validation Vulnerability (medium 6.8)
- [CVE-2024-25007](https://insights.sbomify.com/CVE-2024-25007/): Ericsson Network Manager - Improper Neutralization of Formula Elements Vulnerability (high 7.1)
- [CVE-2024-25006](https://insights.sbomify.com/CVE-2024-25006/): Path traversal in xenforo:xenforo (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/425/