# Vulnerabilities published in 2024


- [CVE-2024-23148](https://insights.sbomify.com/CVE-2024-23148/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23147](https://insights.sbomify.com/CVE-2024-23147/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23146](https://insights.sbomify.com/CVE-2024-23146/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23145](https://insights.sbomify.com/CVE-2024-23145/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23144](https://insights.sbomify.com/CVE-2024-23144/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23143](https://insights.sbomify.com/CVE-2024-23143/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23142](https://insights.sbomify.com/CVE-2024-23142/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23141](https://insights.sbomify.com/CVE-2024-23141/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23140](https://insights.sbomify.com/CVE-2024-23140/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-2314](https://insights.sbomify.com/CVE-2024-2314/): Other in BPF Compiler Collection (low 2.8)
- [CVE-2024-23139](https://insights.sbomify.com/CVE-2024-23139/): ActionScript Byte Code “ABC” Vulnerability in the Autodesk FBX Review software (high 7.8)
- [CVE-2024-23138](https://insights.sbomify.com/CVE-2024-23138/): Stack-based Overflow Vulnerability in the TrueViewTM Desktop Software (high 7.8)
- [CVE-2024-23137](https://insights.sbomify.com/CVE-2024-23137/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23136](https://insights.sbomify.com/CVE-2024-23136/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23135](https://insights.sbomify.com/CVE-2024-23135/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23134](https://insights.sbomify.com/CVE-2024-23134/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23133](https://insights.sbomify.com/CVE-2024-23133/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23132](https://insights.sbomify.com/CVE-2024-23132/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23131](https://insights.sbomify.com/CVE-2024-23131/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23130](https://insights.sbomify.com/CVE-2024-23130/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-2313](https://insights.sbomify.com/CVE-2024-2313/): Other in bpftrace (low 2.8)
- [CVE-2024-23129](https://insights.sbomify.com/CVE-2024-23129/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23128](https://insights.sbomify.com/CVE-2024-23128/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23127](https://insights.sbomify.com/CVE-2024-23127/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23126](https://insights.sbomify.com/CVE-2024-23126/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23125](https://insights.sbomify.com/CVE-2024-23125/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23124](https://insights.sbomify.com/CVE-2024-23124/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23123](https://insights.sbomify.com/CVE-2024-23123/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23122](https://insights.sbomify.com/CVE-2024-23122/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23121](https://insights.sbomify.com/CVE-2024-23121/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-23120](https://insights.sbomify.com/CVE-2024-23120/): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (high 7.8)
- [CVE-2024-2312](https://insights.sbomify.com/CVE-2024-2312/): Use after free in Debian based GNU GRUB (medium 6.7)
- [CVE-2024-23119](https://insights.sbomify.com/CVE-2024-23119/): Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-23118](https://insights.sbomify.com/CVE-2024-23118/): Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-23117](https://insights.sbomify.com/CVE-2024-23117/): Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-23116](https://insights.sbomify.com/CVE-2024-23116/): Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-23115](https://insights.sbomify.com/CVE-2024-23115/): Centreon updateGroups SQL Injection Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-23114](https://insights.sbomify.com/CVE-2024-23114/): Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository (critical 9.8)
- [CVE-2024-23113](https://insights.sbomify.com/CVE-2024-23113/): Fortinet Multiple Products Format String (critical 9.8, exploited in the wild)
- [CVE-2024-23112](https://insights.sbomify.com/CVE-2024-23112/): Missing authorization in FortiOS (high 7.2)
- [CVE-2024-23111](https://insights.sbomify.com/CVE-2024-23111/): Cross-site scripting in FortiOS (medium 6.2)
- [CVE-2024-23110](https://insights.sbomify.com/CVE-2024-23110/): Memory corruption in FortiOS (high 7.4)
- [CVE-2024-2311](https://insights.sbomify.com/CVE-2024-2311/): Avada <= 7.11.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-23109](https://insights.sbomify.com/CVE-2024-23109/): Command injection in FortiSIEM (critical 9.7)
- [CVE-2024-23108](https://insights.sbomify.com/CVE-2024-23108/): Command injection in FortiSIEM (critical 9.7)
- [CVE-2024-23107](https://insights.sbomify.com/CVE-2024-23107/): Information disclosure in FortiWeb (medium 5.2)
- [CVE-2024-23106](https://insights.sbomify.com/CVE-2024-23106/): Auth bypass in FortiClientEMS (high 7.7)
- [CVE-2024-23105](https://insights.sbomify.com/CVE-2024-23105/): Security feature bypass in FortiPortal (high 7.1)
- [CVE-2024-23104](https://insights.sbomify.com/CVE-2024-23104/): Information disclosure in FortiNDR (medium 5.4)
- [CVE-2024-2310](https://insights.sbomify.com/CVE-2024-2310/): WP Google Review Slider < 13.6 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-23094](https://insights.sbomify.com/CVE-2024-23094/): Cross-site request forgery in flusity:flusity (high 8.8)
- [CVE-2024-23091](https://insights.sbomify.com/CVE-2024-23091/): Weak cryptography in digitaldruid:hoteldruid (high 7.5)
- [CVE-2024-2309](https://insights.sbomify.com/CVE-2024-2309/): WP Staging < 3.4.0, 5.4.0 (Pro Version) - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-23086](https://insights.sbomify.com/CVE-2024-23086/): Memory corruption in mikkotommila:apfloat (critical 9.8)
- [CVE-2024-23085](https://insights.sbomify.com/CVE-2024-23085/): Null dereference in mikkotommila:apfloat (high 7.5)
- [CVE-2024-23084](https://insights.sbomify.com/CVE-2024-23084/): Denial of service in mikkotommila:apfloat (high 7.5)
- [CVE-2024-23083](https://insights.sbomify.com/CVE-2024-23083/): Time4J Base v5.9.3 was discovered to contain a NullPointerException via the component net.time4j.format.internal.FormatUtils::useDefaultWeekmodel(Locale). (medium 5.3)
- [CVE-2024-23082](https://insights.sbomify.com/CVE-2024-23082/): ThreeTen Backport v1.6.8 was discovered to contain an integer overflow via the component org.threeten.bp.format.DateTimeFormatter::parse(Cha (not scored)
- [CVE-2024-23081](https://insights.sbomify.com/CVE-2024-23081/): Null dereference in threeten:threeten backport (low 3.3)
- [CVE-2024-23080](https://insights.sbomify.com/CVE-2024-23080/): Joda Time v2.12.5 was discovered to contain a NullPointerException via the component org.joda.time.format.PeriodFormat::wordBased(Locale). (critical 9.1)
- [CVE-2024-2308](https://insights.sbomify.com/CVE-2024-2308/): ElementInvader Addons for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-23079](https://insights.sbomify.com/CVE-2024-23079/): JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double). (medium 6.2)
- [CVE-2024-23078](https://insights.sbomify.com/CVE-2024-23078/): JGraphT Core v1.5.2 was discovered to contain a NullPointerException via the component org.jgrapht.alg.util.ToleranceDoubleComparator::compare(Double, Double). (critical 9.1)
- [CVE-2024-23077](https://insights.sbomify.com/CVE-2024-23077/): Memory corruption in jfree:jfreechart (high 7.5)
- [CVE-2024-23076](https://insights.sbomify.com/CVE-2024-23076/): Null dereference in jfree:jfreechart (high 7.5)
- [CVE-2024-2307](https://insights.sbomify.com/CVE-2024-2307/): Osbuild-composer: race condition may disable gpg verification for package repositories (medium 6.1)
- [CVE-2024-23061](https://insights.sbomify.com/CVE-2024-23061/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-23060](https://insights.sbomify.com/CVE-2024-23060/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-2306](https://insights.sbomify.com/CVE-2024-2306/): Revslider <= 6.6.20 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-23059](https://insights.sbomify.com/CVE-2024-23059/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-23058](https://insights.sbomify.com/CVE-2024-23058/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-23057](https://insights.sbomify.com/CVE-2024-23057/): Command injection in totolink:a3300r firmware (high 8.8)
- [CVE-2024-23055](https://insights.sbomify.com/CVE-2024-23055/): Code injection in plone:plone docker official image (medium 6.1)
- [CVE-2024-23054](https://insights.sbomify.com/CVE-2024-23054/): Supply chain in plone:plone docker official image (critical 9.8)
- [CVE-2024-23052](https://insights.sbomify.com/CVE-2024-23052/): Deserialization in 5kcrm:wukong crm (critical 9.8)
- [CVE-2024-2305](https://insights.sbomify.com/CVE-2024-2305/): Cards for Beaver Builder <= 1.1.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via bootstrapcard link (medium 6.4)
- [CVE-2024-23049](https://insights.sbomify.com/CVE-2024-23049/): Command injection in b3log:symphony (critical 9.8)
- [CVE-2024-2304](https://insights.sbomify.com/CVE-2024-2304/): Animated Headline <= 4.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-23034](https://insights.sbomify.com/CVE-2024-23034/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2024-23033](https://insights.sbomify.com/CVE-2024-23033/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2024-23032](https://insights.sbomify.com/CVE-2024-23032/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2024-23031](https://insights.sbomify.com/CVE-2024-23031/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2024-2303](https://insights.sbomify.com/CVE-2024-2303/): Easy Textillate <= 2.01 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-2302](https://insights.sbomify.com/CVE-2024-2302/): Information disclosure in Easy Digital Downloads – eCommerce Payments and Subscriptions made easy (medium 5.3)
- [CVE-2024-2301](https://insights.sbomify.com/CVE-2024-2301/): Cross-site scripting in Certain HP LaserJet Pro Devices (high 7.6)
- [CVE-2024-2300](https://insights.sbomify.com/CVE-2024-2300/): HP Advance Mobile Application – Potential Information Disclosure (medium 6.2)
- [CVE-2024-2299](https://insights.sbomify.com/CVE-2024-2299/): Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui (high 7.4)
- [CVE-2024-22988](https://insights.sbomify.com/CVE-2024-22988/): Information disclosure in zkteco:zkbio wdms (critical 9.8)
- [CVE-2024-22983](https://insights.sbomify.com/CVE-2024-22983/): SQL injection in projectworlds:visitor management system (high 8.1)
- [CVE-2024-2298](https://insights.sbomify.com/CVE-2024-2298/): affiliate-toolkit – WordPress Affiliate Plugin <= 3.5.4 - Missing Authorization via atkp_import_product (medium 4.3)
- [CVE-2024-2297](https://insights.sbomify.com/CVE-2024-2297/): Bricksbuilder <= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create_autosave (high 7.1)
- [CVE-2024-2296](https://insights.sbomify.com/CVE-2024-2296/): Cross-site scripting in Photo Gallery by 10Web – Mobile-Friendly Image Gallery (medium 5.5)
- [CVE-2024-22957](https://insights.sbomify.com/CVE-2024-22957/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2024-22956](https://insights.sbomify.com/CVE-2024-22956/): Use after free in swftools:swftools (high 7.8)
- [CVE-2024-22955](https://insights.sbomify.com/CVE-2024-22955/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2024-2295](https://insights.sbomify.com/CVE-2024-2295/): Contact Form Manager <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-22949](https://insights.sbomify.com/CVE-2024-22949/): Null dereference in jfree:jfreechart (critical 9.1)
- [CVE-2024-22942](https://insights.sbomify.com/CVE-2024-22942/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-2294](https://insights.sbomify.com/CVE-2024-2294/): Backuply – Backup, Restore, Migrate and Clone <= 1.2.7 - Authenticated (Admin+) Directory Traversal (medium 4.9)
- [CVE-2024-22939](https://insights.sbomify.com/CVE-2024-22939/): Cross-site request forgery in sunkaifei:flycms (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/440/