# Vulnerabilities published in 2024


- [CVE-2024-23601](https://insights.sbomify.com/CVE-2024-23601/): Code injection in P3-550E (critical 9.8)
- [CVE-2024-23600](https://insights.sbomify.com/CVE-2024-23600/): PingIDM Query Filter Vulnerability (low 2.7)
- [CVE-2024-2360](https://insights.sbomify.com/CVE-2024-2360/): Path Traversal leading to Remote Code Execution in parisneo/lollms-webui (critical 9.8)
- [CVE-2024-23599](https://insights.sbomify.com/CVE-2024-23599/): Race condition in Seamless Firmware Updates for some Intel® reference platforms (high 8.3)
- [CVE-2024-23597](https://insights.sbomify.com/CVE-2024-23597/): Cross-site request forgery in TvRock (medium 4.3)
- [CVE-2024-23594](https://insights.sbomify.com/CVE-2024-23594/): Memory corruption in Windows 7 and 8 PC Preloads (medium 6.4)
- [CVE-2024-23593](https://insights.sbomify.com/CVE-2024-23593/): Privilege escalation in Windows 7 and 8 PC Preloads (medium 6.7)
- [CVE-2024-23592](https://insights.sbomify.com/CVE-2024-23592/): Auth bypass in Synaptics Fingerprint Readers (medium 6.3)
- [CVE-2024-23591](https://insights.sbomify.com/CVE-2024-23591/): Misconfiguration in ThinkSystem SR670 V2 (low 2.0)
- [CVE-2024-23590](https://insights.sbomify.com/CVE-2024-23590/): Apache Kylin: Session fixation in web interface (critical 9.1)
- [CVE-2024-2359](https://insights.sbomify.com/CVE-2024-2359/): Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui (critical 9.8)
- [CVE-2024-23589](https://insights.sbomify.com/CVE-2024-23589/): HCL Glovius Cloud is susceptible to an Outdated Hash Algorithm vulnerability (medium 6.8)
- [CVE-2024-23588](https://insights.sbomify.com/CVE-2024-23588/): A denial of service vulnerability affects HCL Nomad server on Domino (medium 5.3)
- [CVE-2024-23586](https://insights.sbomify.com/CVE-2024-23586/): An insufficient session timeout vulnerability affects HCL Nomad server on Domino (medium 5.3)
- [CVE-2024-23584](https://insights.sbomify.com/CVE-2024-23584/): HCL BigFix Asset Discovery is affected by a security vulnerability (medium 6.6)
- [CVE-2024-23583](https://insights.sbomify.com/CVE-2024-23583/): HCL BigFix Platform is susceptible to insufficiently protected credentials (medium 6.7)
- [CVE-2024-23581](https://insights.sbomify.com/CVE-2024-23581/): HCL Traveler for Microsoft Outlook (HTMO) is susceptible to an application modification vulnerability (medium 6.7)
- [CVE-2024-23580](https://insights.sbomify.com/CVE-2024-23580/): HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of One-Time Passwords (OTPs) (medium 6.5)
- [CVE-2024-2358](https://insights.sbomify.com/CVE-2024-2358/): Path Traversal leading to Remote Code Execution in parisneo/lollms-webui (critical 9.8)
- [CVE-2024-23579](https://insights.sbomify.com/CVE-2024-23579/): HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions (medium 6.5)
- [CVE-2024-23578](https://insights.sbomify.com/CVE-2024-23578/): Misconfiguration in Aftermarket EPC (medium 4.2)
- [CVE-2024-23577](https://insights.sbomify.com/CVE-2024-23577/): Other in Aftermarket EPC (medium 4.3)
- [CVE-2024-23576](https://insights.sbomify.com/CVE-2024-23576/): HCL Commerce is potentially affected by a denial of service and information disclosure vulnerability (high 7.1)
- [CVE-2024-23575](https://insights.sbomify.com/CVE-2024-23575/): Information disclosure in Aftermarket EPC (medium 5.3)
- [CVE-2024-23574](https://insights.sbomify.com/CVE-2024-23574/): Information disclosure in Aftermarket EPC (medium 5.3)
- [CVE-2024-23573](https://insights.sbomify.com/CVE-2024-23573/): Weak cryptography in Aftermarket EPC (low 3.7)
- [CVE-2024-23572](https://insights.sbomify.com/CVE-2024-23572/): Misconfiguration in Aftermarket EPC (medium 4.2)
- [CVE-2024-23571](https://insights.sbomify.com/CVE-2024-23571/): Information disclosure in Aftermarket EPC (medium 4.3)
- [CVE-2024-23570](https://insights.sbomify.com/CVE-2024-23570/): Other in Aftermarket EPC (medium 4.3)
- [CVE-2024-2357](https://insights.sbomify.com/CVE-2024-2357/): IKEv2 misconfiguration can cause libreswan to abort and restart (medium 6.5)
- [CVE-2024-23569](https://insights.sbomify.com/CVE-2024-23569/): Misconfiguration in Aftermarket EPC (medium 4.3)
- [CVE-2024-23568](https://insights.sbomify.com/CVE-2024-23568/): Information disclosure in Aftermarket EPC (medium 5.3)
- [CVE-2024-23567](https://insights.sbomify.com/CVE-2024-23567/): Information disclosure in Aftermarket EPC (medium 4.3)
- [CVE-2024-23566](https://insights.sbomify.com/CVE-2024-23566/): Security feature bypass in Aftermarket EPC (medium 6.5)
- [CVE-2024-23565](https://insights.sbomify.com/CVE-2024-23565/): Denial of service in Aftermarket EPC (medium 5.3)
- [CVE-2024-23564](https://insights.sbomify.com/CVE-2024-23564/): Business logic in Aftermarket EPC (critical 9.1)
- [CVE-2024-23563](https://insights.sbomify.com/CVE-2024-23563/): HCL Connections Docs is vulnerable to a sensitive information disclosure (low 3.9)
- [CVE-2024-23562](https://insights.sbomify.com/CVE-2024-23562/): HCL Domino is susceptible to an information disclosure vulnerability (medium 5.3)
- [CVE-2024-23561](https://insights.sbomify.com/CVE-2024-23561/): HCL DevOps Deploy / HCL Launch is vulnerable to sensitive information disclosure vulnerability (medium 4.3)
- [CVE-2024-23560](https://insights.sbomify.com/CVE-2024-23560/): HCL DevOps Deploy / HCL Launch could be vulnerable to incomplete revocation of permissions when deleting a custom type (medium 4.4)
- [CVE-2024-2356](https://insights.sbomify.com/CVE-2024-2356/): Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui (critical 9.6)
- [CVE-2024-23559](https://insights.sbomify.com/CVE-2024-23559/): HCL DevOps Deploy / Launch is generating an obsolete HTTP header (medium 6.1)
- [CVE-2024-23558](https://insights.sbomify.com/CVE-2024-23558/): HCL DevOps Deploy / HCL Launch does not invalidate all session authentication cookies after logout (medium 6.3)
- [CVE-2024-23557](https://insights.sbomify.com/CVE-2024-23557/): HCL Connections is vulnerable to a user enumeration vulnerability (low 3.5)
- [CVE-2024-23556](https://insights.sbomify.com/CVE-2024-23556/): HCL BigFix Platform is impacted by a failure to restrict SSL/TLS renegotiation (medium 5.9)
- [CVE-2024-23554](https://insights.sbomify.com/CVE-2024-23554/): HCL BigFix Platform is susceptible to Cross-Site Request Forgery (medium 5.7)
- [CVE-2024-23553](https://insights.sbomify.com/CVE-2024-23553/): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (low 3.0)
- [CVE-2024-23551](https://insights.sbomify.com/CVE-2024-23551/): HCL BigFix Compliance is potentially affected by Oracle database credentials stored at endpoint (medium 6.5)
- [CVE-2024-23550](https://insights.sbomify.com/CVE-2024-23550/): HCL DevOps Deploy / HCL Launch (UCD) may be vulnerable to sensitive information disclosure (medium 6.2)
- [CVE-2024-2355](https://insights.sbomify.com/CVE-2024-2355/): keerti1924 Secret-Coder-PHP-Project secret_coder.sql inclusion of sensitive information in source code (low 3.7)
- [CVE-2024-23540](https://insights.sbomify.com/CVE-2024-23540/): HCL BigFix Inventory is vulnerable to path traversal (medium 5.3)
- [CVE-2024-2354](https://insights.sbomify.com/CVE-2024-2354/): Dreamer CMS toEdit cross-site request forgery (medium 4.3)
- [CVE-2024-23539](https://insights.sbomify.com/CVE-2024-23539/): SQL injection in Apache Fineract (high 8.3)
- [CVE-2024-23538](https://insights.sbomify.com/CVE-2024-23538/): SQL injection in Apache Fineract (critical 9.9)
- [CVE-2024-23537](https://insights.sbomify.com/CVE-2024-23537/): Privilege escalation in Apache Fineract (high 8.4)
- [CVE-2024-23535](https://insights.sbomify.com/CVE-2024-23535/): Path traversal in Avalanche (high 8.8)
- [CVE-2024-23534](https://insights.sbomify.com/CVE-2024-23534/): File upload in Avalanche (high 8.8)
- [CVE-2024-23533](https://insights.sbomify.com/CVE-2024-23533/): Memory corruption in Avalanche (medium 4.3)
- [CVE-2024-23532](https://insights.sbomify.com/CVE-2024-23532/): Memory corruption in Avalanche (high 7.5)
- [CVE-2024-23531](https://insights.sbomify.com/CVE-2024-23531/): Integer overflow in Avalanche (high 7.5)
- [CVE-2024-23530](https://insights.sbomify.com/CVE-2024-23530/): Memory corruption in Avalanche (medium 5.3)
- [CVE-2024-2353](https://insights.sbomify.com/CVE-2024-2353/): Totolink X6000R shttpd cstecgi.cgi setDiagnosisCfg os command injection (high 8.8)
- [CVE-2024-23529](https://insights.sbomify.com/CVE-2024-23529/): Memory corruption in Avalanche (medium 5.3)
- [CVE-2024-23528](https://insights.sbomify.com/CVE-2024-23528/): Memory corruption in Avalanche (medium 5.3)
- [CVE-2024-23527](https://insights.sbomify.com/CVE-2024-23527/): Memory corruption in Avalanche (medium 5.3)
- [CVE-2024-23526](https://insights.sbomify.com/CVE-2024-23526/): Memory corruption in Avalanche (medium 5.3)
- [CVE-2024-23525](https://insights.sbomify.com/CVE-2024-23525/): XML external entity in tozt:spreadsheet\ (medium 6.5)
- [CVE-2024-23524](https://insights.sbomify.com/CVE-2024-23524/): WordPress PilotPress plugin <= 2.0.30 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-23523](https://insights.sbomify.com/CVE-2024-23523/): WordPress Elementor Pro plugin <= 3.19.2 - Contributor+ Arbitrary User Meta Data Retrieval vulnerability (medium 6.5)
- [CVE-2024-23522](https://insights.sbomify.com/CVE-2024-23522/): WordPress Formidable Forms plugin <= 6.7 - Content Injection vulnerability (medium 5.3)
- [CVE-2024-23521](https://insights.sbomify.com/CVE-2024-23521/): WordPress Happyforms plugin <= 1.25.10 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-23520](https://insights.sbomify.com/CVE-2024-23520/): WordPress PopupAlly plugin <= 2.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-2352](https://insights.sbomify.com/CVE-2024-2352/): 1Panel swap baseApi.UpdateDeviceSwap command injection (medium 6.3)
- [CVE-2024-23519](https://insights.sbomify.com/CVE-2024-23519/): WordPress Email Before Download Plugin <= 6.9.7 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-23518](https://insights.sbomify.com/CVE-2024-23518/): WordPress ACF Photo Gallery Field plugin <= 2.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-23517](https://insights.sbomify.com/CVE-2024-23517/): WordPress Scheduling Plugin – Online Booking for WordPress Plugin <= 3.5.10 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-23516](https://insights.sbomify.com/CVE-2024-23516/): WordPress CC BMI Calculator Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-23515](https://insights.sbomify.com/CVE-2024-23515/): WordPress Cincopa video and media plugin <= 1.159 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-23514](https://insights.sbomify.com/CVE-2024-23514/): WordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-23513](https://insights.sbomify.com/CVE-2024-23513/): WordPress PropertyHive Plugin <= 2.0.5 is vulnerable to PHP Object Injection (high 8.7)
- [CVE-2024-23512](https://insights.sbomify.com/CVE-2024-23512/): WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injection (high 8.7)
- [CVE-2024-23511](https://insights.sbomify.com/CVE-2024-23511/): WordPress The Plus Addons for Elementor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-23510](https://insights.sbomify.com/CVE-2024-23510/): WordPress Don't Muck My Markup plugin <= 1.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-2351](https://insights.sbomify.com/CVE-2024-2351/): CodeAstro Ecommerce Site Search action.php sql injection (medium 6.3)
- [CVE-2024-23508](https://insights.sbomify.com/CVE-2024-23508/): WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-23507](https://insights.sbomify.com/CVE-2024-23507/): WordPress InstaWP Connect plugin <= 0.1.0.9 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-23506](https://insights.sbomify.com/CVE-2024-23506/): WordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerability (high 7.7)
- [CVE-2024-23505](https://insights.sbomify.com/CVE-2024-23505/): WordPress PDF Viewer & 3D PDF Flipbook – DearPDF Plugin <= 2.0.38 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-23504](https://insights.sbomify.com/CVE-2024-23504/): WordPress Ninja Tables plugin <= 5.0.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-23503](https://insights.sbomify.com/CVE-2024-23503/): WordPress Ninja Tables plugin <= 5.0.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-23502](https://insights.sbomify.com/CVE-2024-23502/): Cross-site scripting in Posts List Designer by Category – List Category Posts Or Recent Posts (medium 6.5)
- [CVE-2024-23501](https://insights.sbomify.com/CVE-2024-23501/): WordPress Ebook Store Plugin <= 5.788 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-23500](https://insights.sbomify.com/CVE-2024-23500/): WordPress Kadence Blocks plugin <= 3.2.19 - Server Side Request Forgery (SSRF) vulnerability (high 7.7)
- [CVE-2024-2350](https://insights.sbomify.com/CVE-2024-2350/): Cross-site scripting in Clever Addons for Elementor (medium 6.4)
- [CVE-2024-23499](https://insights.sbomify.com/CVE-2024-23499/): Security feature bypass in Intel(R) Ethernet Network Controllers and Adapters E810 Series (high 7.0)
- [CVE-2024-23497](https://insights.sbomify.com/CVE-2024-23497/): Memory corruption in Intel(R) Ethernet Network Controllers and Adapters (critical 9.3)
- [CVE-2024-23496](https://insights.sbomify.com/CVE-2024-23496/): Memory corruption in llama.cpp (high 8.8)
- [CVE-2024-23495](https://insights.sbomify.com/CVE-2024-23495/): Misconfiguration in Intel(R) Distribution for GDB software (medium 5.4)
- [CVE-2024-23494](https://insights.sbomify.com/CVE-2024-23494/): Delta Electronics DIAEnergie SQL injection (high 8.8)
- [CVE-2024-23493](https://insights.sbomify.com/CVE-2024-23493/): Team associated AD/LDAP Groups Leaked due to missing authorization (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/436/