# Vulnerabilities published in 2024


- [CVE-2024-23910](https://insights.sbomify.com/CVE-2024-23910/): Cross-site request forgery in WMC-X1800GST-B (medium 4.3)
- [CVE-2024-2391](https://insights.sbomify.com/CVE-2024-2391/): EVE-NG Lab cross site scripting (low 2.4)
- [CVE-2024-23909](https://insights.sbomify.com/CVE-2024-23909/): Privilege escalation in Intel(R) FPGA SDK for OpenCL(TM) software technology (medium 5.4)
- [CVE-2024-23908](https://insights.sbomify.com/CVE-2024-23908/): Privilege escalation in Flexlm License Daemons for Intel(R) FPGA software (medium 5.4)
- [CVE-2024-23907](https://insights.sbomify.com/CVE-2024-23907/): Privilege escalation in Intel(R) High Level Synthesis Compiler software (medium 5.4)
- [CVE-2024-23906](https://insights.sbomify.com/CVE-2024-23906/): Cross-site scripting in Controller 6000 and Controller 7000 (medium 6.1)
- [CVE-2024-23905](https://insights.sbomify.com/CVE-2024-23905/): Content-Security-Policy disabled by Red Hat Dependency Analytics Jenkins Plugin (medium 5.4)
- [CVE-2024-23904](https://insights.sbomify.com/CVE-2024-23904/): Arbitrary file read vulnerability in Jenkins Log Command Plugin (high 7.5)
- [CVE-2024-23903](https://insights.sbomify.com/CVE-2024-23903/): Non-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin (medium 5.3)
- [CVE-2024-23902](https://insights.sbomify.com/CVE-2024-23902/): CSRF vulnerability in Jenkins GitLab Branch Source Plugin (medium 4.3)
- [CVE-2024-23901](https://insights.sbomify.com/CVE-2024-23901/): Shared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin (medium 6.5)
- [CVE-2024-23900](https://insights.sbomify.com/CVE-2024-23900/): Path traversal vulnerability in Jenkins Matrix Project Plugin (medium 4.3)
- [CVE-2024-2390](https://insights.sbomify.com/CVE-2024-2390/): Local Privilege Escalation (high 7.8)
- [CVE-2024-23899](https://insights.sbomify.com/CVE-2024-23899/): Arbitrary file read vulnerability in Git server Plugin can lead to RCE (medium 6.5)
- [CVE-2024-23898](https://insights.sbomify.com/CVE-2024-23898/): Cross-site WebSocket hijacking vulnerability in the Jenkins CLI (high 8.8)
- [CVE-2024-23897](https://insights.sbomify.com/CVE-2024-23897/): Jenkins Command Line Interface (CLI) Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2024-23896](https://insights.sbomify.com/CVE-2024-23896/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23895](https://insights.sbomify.com/CVE-2024-23895/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23894](https://insights.sbomify.com/CVE-2024-23894/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23893](https://insights.sbomify.com/CVE-2024-23893/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23892](https://insights.sbomify.com/CVE-2024-23892/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23891](https://insights.sbomify.com/CVE-2024-23891/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23890](https://insights.sbomify.com/CVE-2024-23890/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-2389](https://insights.sbomify.com/CVE-2024-2389/): Flowmon Unauthenticated Command Injection Vulnerability (critical 10.0)
- [CVE-2024-23889](https://insights.sbomify.com/CVE-2024-23889/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23888](https://insights.sbomify.com/CVE-2024-23888/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23887](https://insights.sbomify.com/CVE-2024-23887/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23886](https://insights.sbomify.com/CVE-2024-23886/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23885](https://insights.sbomify.com/CVE-2024-23885/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23884](https://insights.sbomify.com/CVE-2024-23884/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23883](https://insights.sbomify.com/CVE-2024-23883/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23882](https://insights.sbomify.com/CVE-2024-23882/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23881](https://insights.sbomify.com/CVE-2024-23881/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23880](https://insights.sbomify.com/CVE-2024-23880/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23879](https://insights.sbomify.com/CVE-2024-23879/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23878](https://insights.sbomify.com/CVE-2024-23878/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23877](https://insights.sbomify.com/CVE-2024-23877/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23876](https://insights.sbomify.com/CVE-2024-23876/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23875](https://insights.sbomify.com/CVE-2024-23875/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23874](https://insights.sbomify.com/CVE-2024-23874/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23873](https://insights.sbomify.com/CVE-2024-23873/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23872](https://insights.sbomify.com/CVE-2024-23872/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23871](https://insights.sbomify.com/CVE-2024-23871/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23870](https://insights.sbomify.com/CVE-2024-23870/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-2387](https://insights.sbomify.com/CVE-2024-2387/): SQL injection in AFI – The Easiest Integration Plugin (medium 6.1)
- [CVE-2024-23869](https://insights.sbomify.com/CVE-2024-23869/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23868](https://insights.sbomify.com/CVE-2024-23868/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23867](https://insights.sbomify.com/CVE-2024-23867/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23866](https://insights.sbomify.com/CVE-2024-23866/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23865](https://insights.sbomify.com/CVE-2024-23865/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23864](https://insights.sbomify.com/CVE-2024-23864/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23863](https://insights.sbomify.com/CVE-2024-23863/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23862](https://insights.sbomify.com/CVE-2024-23862/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23861](https://insights.sbomify.com/CVE-2024-23861/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23860](https://insights.sbomify.com/CVE-2024-23860/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-2386](https://insights.sbomify.com/CVE-2024-2386/): WordPress Plugin for Google Maps – WP MAPS <= 4.6.1 - Authenticated (Contributor+) SQL Injection (high 8.8)
- [CVE-2024-23859](https://insights.sbomify.com/CVE-2024-23859/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23858](https://insights.sbomify.com/CVE-2024-23858/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23857](https://insights.sbomify.com/CVE-2024-23857/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23856](https://insights.sbomify.com/CVE-2024-23856/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23855](https://insights.sbomify.com/CVE-2024-23855/): Cross-Site Scripting (XSS) vulnerability in Cups Easy (high 8.2)
- [CVE-2024-23851](https://insights.sbomify.com/CVE-2024-23851/): Integer overflow in linux:linux kernel (medium 5.5)
- [CVE-2024-23850](https://insights.sbomify.com/CVE-2024-23850/): Race condition in linux:linux kernel (medium 5.5)
- [CVE-2024-2385](https://insights.sbomify.com/CVE-2024-2385/): Elementor Addons by Livemesh <= 8.4 - Authenticated (Contributor+) Limited Local File Inclusion via Widgets (high 8.8)
- [CVE-2024-23849](https://insights.sbomify.com/CVE-2024-23849/): Memory corruption in linux:linux kernel (medium 5.5)
- [CVE-2024-23848](https://insights.sbomify.com/CVE-2024-23848/): Use after free in linux:linux kernel (medium 5.5)
- [CVE-2024-23847](https://insights.sbomify.com/CVE-2024-23847/): Misconfiguration in Unifier (high 7.8)
- [CVE-2024-23843](https://insights.sbomify.com/CVE-2024-23843/): SQL injection in Genian NAC LTS V5.0 (low 2.2)
- [CVE-2024-23842](https://insights.sbomify.com/CVE-2024-23842/): Hitron Systems DVR LGUVR-16H Improper Input Validation Vulnerability (high 7.4)
- [CVE-2024-23841](https://insights.sbomify.com/CVE-2024-23841/): XSS in @apollo/experimental-nextjs-app-support (high 8.2)
- [CVE-2024-23840](https://insights.sbomify.com/CVE-2024-23840/): `goreleaser release --debug` shows secrets (medium 5.5)
- [CVE-2024-2384](https://insights.sbomify.com/CVE-2024-2384/): Missing authorization in WCPOS – Point of Sale (POS) plugin for WooCommerce (medium 4.3)
- [CVE-2024-23839](https://insights.sbomify.com/CVE-2024-23839/): Suricata http: heap use after free with http.request_header and http.response_header keywords (high 7.1)
- [CVE-2024-23838](https://insights.sbomify.com/CVE-2024-23838/): TrueLayer.Client SSRF when fetching payment or payment provider (high 8.6)
- [CVE-2024-23837](https://insights.sbomify.com/CVE-2024-23837/): LibHTP unbounded folded header handling leads to denial service (high 7.5)
- [CVE-2024-23836](https://insights.sbomify.com/CVE-2024-23836/): crafted traffic can cause denial of service (high 7.5)
- [CVE-2024-23835](https://insights.sbomify.com/CVE-2024-23835/): Suricata's pgsql: memory exhaustion use on record parsing (high 7.5)
- [CVE-2024-23834](https://insights.sbomify.com/CVE-2024-23834/): Discourse improperly sanitized user input leads to XSS (medium 6.3)
- [CVE-2024-23833](https://insights.sbomify.com/CVE-2024-23833/): OpenRefine JDBC Attack Vulnerability (high 7.5)
- [CVE-2024-23832](https://insights.sbomify.com/CVE-2024-23832/): Mastodon Remote user impersonation and takeover (critical 9.4)
- [CVE-2024-23831](https://insights.sbomify.com/CVE-2024-23831/): Privilege escalation through CSRF attack on 'setup.pl' (high 7.5)
- [CVE-2024-23830](https://insights.sbomify.com/CVE-2024-23830/): MantisBT Host Header Injection vulnerability (high 8.3)
- [CVE-2024-2383](https://insights.sbomify.com/CVE-2024-2383/): Clickjacking Vulnerability in zenml-io/zenml (medium 4.3)
- [CVE-2024-23829](https://insights.sbomify.com/CVE-2024-23829/): aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators (medium 6.5)
- [CVE-2024-23828](https://insights.sbomify.com/CVE-2024-23828/): Nginx-UI authenticated RCE through injecting into the application config via CRLF (high 8.8)
- [CVE-2024-23827](https://insights.sbomify.com/CVE-2024-23827/): Nginx-UI arbitrary file write through the Import Certificate feature (critical 9.8)
- [CVE-2024-23826](https://insights.sbomify.com/CVE-2024-23826/): Uploading an image with a specific filename causes a server-side DoS (medium 6.8)
- [CVE-2024-23825](https://insights.sbomify.com/CVE-2024-23825/): TablePress SSRF vulnerability due to insufficient filtering of cloud provider hosts (low 3.0)
- [CVE-2024-23824](https://insights.sbomify.com/CVE-2024-23824/): mailcow ipixel flood attack leads to Denial of Service in admin page (medium 4.7)
- [CVE-2024-23823](https://insights.sbomify.com/CVE-2024-23823/): CORS settings overly permissive in vantage6 (medium 4.2)
- [CVE-2024-23822](https://insights.sbomify.com/CVE-2024-23822/): Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22) (medium 5.4)
- [CVE-2024-23821](https://insights.sbomify.com/CVE-2024-23821/): GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS) (medium 4.8)
- [CVE-2024-23820](https://insights.sbomify.com/CVE-2024-23820/): OpenFGA DoS (medium 5.3)
- [CVE-2024-2382](https://insights.sbomify.com/CVE-2024-2382/): Business logic in Authorize.net Payment Gateway For WooCommerce (medium 5.3)
- [CVE-2024-23819](https://insights.sbomify.com/CVE-2024-23819/): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page (medium 4.8)
- [CVE-2024-23818](https://insights.sbomify.com/CVE-2024-23818/): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format (medium 4.8)
- [CVE-2024-23817](https://insights.sbomify.com/CVE-2024-23817/): Dolibarr Application Home Page HTML injection vulnerability (high 7.1)
- [CVE-2024-23816](https://insights.sbomify.com/CVE-2024-23816/): Hardcoded credentials in Location Intelligence Perpetual Large (critical 9.8)
- [CVE-2024-23815](https://insights.sbomify.com/CVE-2024-23815/): Auth bypass in Desigo CC (high 8.7)
- [CVE-2024-23814](https://insights.sbomify.com/CVE-2024-23814/): Denial of service in SIDOOR ATD430W (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/433/