# Vulnerabilities published in 2024


- [CVE-2024-14010](https://insights.sbomify.com/CVE-2024-14010/): Typora 1.7.4 OS Command Injection via Export PDF Preferences (high 8.5)
- [CVE-2024-1401](https://insights.sbomify.com/CVE-2024-1401/): Profile Box Shortcode And Widget < 1.2.1 Admin+ Stored XSS (medium 4.8)
- [CVE-2024-14009](https://insights.sbomify.com/CVE-2024-14009/): Nagios XI < 2024R1.0.1 Privilege Escalation via System Profile (critical 9.4)
- [CVE-2024-14008](https://insights.sbomify.com/CVE-2024-14008/): Nagios XI < 2024R1.3.2 RCE via WinRM Configuration Wizard (critical 9.4)
- [CVE-2024-14007](https://insights.sbomify.com/CVE-2024-14007/): TVT NVMS-9000 < 1.3.4 Unauthenticated Administrative Queries & Information Disclosure (high 8.7)
- [CVE-2024-14006](https://insights.sbomify.com/CVE-2024-14006/): Nagios XI < 2024R1.2.2 Host Header Injection (high 8.8)
- [CVE-2024-14005](https://insights.sbomify.com/CVE-2024-14005/): Nagios XI < 2024R1.2 Command Injection via Docker Wizard (critical 9.4)
- [CVE-2024-14004](https://insights.sbomify.com/CVE-2024-14004/): Nagios XI < 2024R1.2 Privilege Escalation via NagVis Configuration (nagvis.conf) (high 8.7)
- [CVE-2024-14003](https://insights.sbomify.com/CVE-2024-14003/): Nagios XI < 2024R1.2 RCE via NRDP Server Plugins (critical 9.4)
- [CVE-2024-14002](https://insights.sbomify.com/CVE-2024-14002/): Nagios XI < 2024R1.1.4 Authenticated Local File Inclusion via NagVis (high 7.1)
- [CVE-2024-14001](https://insights.sbomify.com/CVE-2024-14001/): Nagios XI < 2024R1.1.3 XSS via Executive Summary Report (medium 5.1)
- [CVE-2024-14000](https://insights.sbomify.com/CVE-2024-14000/): Nagios XI < 2024R1.1.3 XSS via Capacity Planning Report (medium 5.1)
- [CVE-2024-1400](https://insights.sbomify.com/CVE-2024-1400/): Mollie Forms <= 2.6.3 - Missing Authorization to Arbitrary Post Duplication (medium 4.3)
- [CVE-2024-13999](https://insights.sbomify.com/CVE-2024-13999/): Nagios XI < 2024R1.1.3 AD/LDAP Token Authenticated Information Disclosure (high 7.3)
- [CVE-2024-13998](https://insights.sbomify.com/CVE-2024-13998/): Nagios XI < 2024R1.1.3 API Keys & Hashed Passwords Authenticated Information Disclosure (medium 6.0)
- [CVE-2024-13997](https://insights.sbomify.com/CVE-2024-13997/): Nagios XI < 2024R1.1.3 Privilege Escalation via Migrate Server Feature to Root on Host (critical 9.4)
- [CVE-2024-13996](https://insights.sbomify.com/CVE-2024-13996/): Nagios XI < 2024R1.1.3 Session Not Invalidated After Password Change (critical 9.2)
- [CVE-2024-13995](https://insights.sbomify.com/CVE-2024-13995/): Nagios XI < 2024R1.1.2 API Keys & Hashed Passwords Authenticated Information Disclosure (high 7.1)
- [CVE-2024-13994](https://insights.sbomify.com/CVE-2024-13994/): Nagios XI < 2024R1.1.2 Allow Insecure Logins Missing Authorization (high 8.7)
- [CVE-2024-13993](https://insights.sbomify.com/CVE-2024-13993/): Nagios XI < 2024R1.1.2 Reflected XSS via Login Page on Older Browsers (medium 5.1)
- [CVE-2024-13992](https://insights.sbomify.com/CVE-2024-13992/): Nagios XI < 2024R1.1 XSS via Missing Page / 404 (medium 5.1)
- [CVE-2024-13991](https://insights.sbomify.com/CVE-2024-13991/): Huijietong Cloud Video Platform fileDownload Arbitrary File Read (high 8.7)
- [CVE-2024-13990](https://insights.sbomify.com/CVE-2024-13990/): MicroWorld eScan AV Insecure Update Mechanism Allows Man-in-the-Middle Replacement of Updates (critical 9.3)
- [CVE-2024-1399](https://insights.sbomify.com/CVE-2024-1399/): Restaurant Menu and Food Ordering <= 2.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-13987](https://insights.sbomify.com/CVE-2024-13987/): Cross-site scripting in RADIUS Server (medium 5.9)
- [CVE-2024-13986](https://insights.sbomify.com/CVE-2024-13986/): Nagios XI < 2024R1.3.2 Authenticated Arbitrary File Upload Path Traversal RCE (high 8.7)
- [CVE-2024-13985](https://insights.sbomify.com/CVE-2024-13985/): Dahua EIMS capture_handle.action RCE (critical 10.0)
- [CVE-2024-13984](https://insights.sbomify.com/CVE-2024-13984/): Qi'anxin TianQing Management Center rptsvr Arbitrary File Upload (critical 10.0)
- [CVE-2024-13983](https://insights.sbomify.com/CVE-2024-13983/): Other in Chrome (medium 6.3)
- [CVE-2024-13982](https://insights.sbomify.com/CVE-2024-13982/): SPON IP Network Intercom System rj_get_token.php Arbitrary File Read (high 8.7)
- [CVE-2024-13981](https://insights.sbomify.com/CVE-2024-13981/): LiveBos UploadFile.do Arbitrary File Upload (critical 10.0)
- [CVE-2024-13980](https://insights.sbomify.com/CVE-2024-13980/): H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE (critical 10.0)
- [CVE-2024-1398](https://insights.sbomify.com/CVE-2024-1398/): Ultimate Bootstrap Elements for Elementor <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-13979](https://insights.sbomify.com/CVE-2024-13979/): St. Joe ERP System SingleRowQueryConverter SQL Injection (critical 9.3)
- [CVE-2024-13978](https://insights.sbomify.com/CVE-2024-13978/): LibTIFF fax2ps tiff2pdf.c t2p_read_tiff_init null pointer dereference (low 2.0)
- [CVE-2024-13976](https://insights.sbomify.com/CVE-2024-13976/): Commvault 11.20.0 - 11.36.0 Windows Maintenance Installer DLL Injection (high 8.5)
- [CVE-2024-13975](https://insights.sbomify.com/CVE-2024-13975/): Commvault 11.20.0 - 11.36.0 Windows Access Nodes Compromise via Local File Server Agent Abuse (high 8.5)
- [CVE-2024-13974](https://insights.sbomify.com/CVE-2024-13974/): Business logic in Sophos Firewall (high 8.1)
- [CVE-2024-13973](https://insights.sbomify.com/CVE-2024-13973/): SQL injection in Sophos Firewall (medium 6.8)
- [CVE-2024-13972](https://insights.sbomify.com/CVE-2024-13972/): Privilege escalation in Sophos Intercept X for Windows Core Agent (high 8.8)
- [CVE-2024-13971](https://insights.sbomify.com/CVE-2024-13971/): Arbitrary File Read and Server Side Request Forgery via XML External Entities in Lobster_pro (high 7.7)
- [CVE-2024-1397](https://insights.sbomify.com/CVE-2024-1397/): HT Mega <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag (medium 6.4)
- [CVE-2024-13967](https://insights.sbomify.com/CVE-2024-13967/): ession-Management Failure (critical 9.4)
- [CVE-2024-13966](https://insights.sbomify.com/CVE-2024-13966/): ZKTeco BioTime default password (medium 6.9)
- [CVE-2024-13962](https://insights.sbomify.com/CVE-2024-13962/): Link Following Local Privilege Escalation Vulnerability in Avast Cleanup Premium Version 24.2.16593.17810 (high 7.8)
- [CVE-2024-13961](https://insights.sbomify.com/CVE-2024-13961/): Avast Cleanup Premium TuneupSvc Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-13960](https://insights.sbomify.com/CVE-2024-13960/): Link Following Local Privilege Escalation Vulnerability in AVG TuneUp Version 23.4 (high 7.8)
- [CVE-2024-1396](https://insights.sbomify.com/CVE-2024-1396/): Cross-site scripting in Shortcodes and extra features for Phlox theme (medium 6.4)
- [CVE-2024-13959](https://insights.sbomify.com/CVE-2024-13959/): Link Following Local Privilege Escalation Vulnerability in AVG TuneUp 24.2.16593.9844 (high 7.8)
- [CVE-2024-13958](https://insights.sbomify.com/CVE-2024-13958/): Stored Cross Site Scripting (medium 4.6)
- [CVE-2024-13957](https://insights.sbomify.com/CVE-2024-13957/): SSRF Server Side Request Forgery (high 7.0)
- [CVE-2024-13956](https://insights.sbomify.com/CVE-2024-13956/): SSL Verification Bypass (high 8.8)
- [CVE-2024-13955](https://insights.sbomify.com/CVE-2024-13955/): SQL Injection 2nd Order (critical 9.4)
- [CVE-2024-13954](https://insights.sbomify.com/CVE-2024-13954/): Serialization / Deserialization of configuration data (medium 5.1)
- [CVE-2024-13953](https://insights.sbomify.com/CVE-2024-13953/): Sensitive Information disclosed in log files (medium 6.9)
- [CVE-2024-13952](https://insights.sbomify.com/CVE-2024-13952/): Remote Code Execution (high 8.7)
- [CVE-2024-13951](https://insights.sbomify.com/CVE-2024-13951/): One way hash with predictable salt (medium 6.1)
- [CVE-2024-13950](https://insights.sbomify.com/CVE-2024-13950/): Log Injection (medium 6.9)
- [CVE-2024-1395](https://insights.sbomify.com/CVE-2024-1395/): Mali GPU Kernel Driver allows improper GPU memory processing operations (medium 6.7)
- [CVE-2024-13949](https://insights.sbomify.com/CVE-2024-13949/): Log Forging (medium 6.9)
- [CVE-2024-13948](https://insights.sbomify.com/CVE-2024-13948/): Insecure Permissions (medium 6.9)
- [CVE-2024-13947](https://insights.sbomify.com/CVE-2024-13947/): External System or Configuration Control (high 7.1)
- [CVE-2024-13946](https://insights.sbomify.com/CVE-2024-13946/): Binary Planting / LoadLibrary DLL's not Signed (high 7.1)
- [CVE-2024-13945](https://insights.sbomify.com/CVE-2024-13945/): Stored Absolute Path Traversal (high 8.4)
- [CVE-2024-13944](https://insights.sbomify.com/CVE-2024-13944/): Race condition in CleanUp (high 7.8)
- [CVE-2024-13943](https://insights.sbomify.com/CVE-2024-13943/): Tesla Model S Iris Modem QCMAP_ConnectionManager Improper Input Validation Sandbox Escape Vulnerability (high 7.8)
- [CVE-2024-13942](https://insights.sbomify.com/CVE-2024-13942/): Race condition in RK3588s (high 7.6)
- [CVE-2024-13941](https://insights.sbomify.com/CVE-2024-13941/): ouch-org ouch zip.rs convert_zip_date_time memory corruption (medium 4.8)
- [CVE-2024-13940](https://insights.sbomify.com/CVE-2024-13940/): Ninja Forms Webhooks <= 3.0.7 - Authenticated (Admin+) Server-Side Request Forgery via Form Webhook (medium 5.5)
- [CVE-2024-1394](https://insights.sbomify.com/CVE-2024-1394/): Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads (high 7.5)
- [CVE-2024-13939](https://insights.sbomify.com/CVE-2024-13939/): Information disclosure in String::Compare::ConstantTime (high 7.5)
- [CVE-2024-13933](https://insights.sbomify.com/CVE-2024-13933/): FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Cross-Site Request Forgery in Multiple Functions (high 8.8)
- [CVE-2024-13931](https://insights.sbomify.com/CVE-2024-13931/): Authenticated Relative Path Traversal (high 7.5)
- [CVE-2024-13930](https://insights.sbomify.com/CVE-2024-13930/): Authenticated Unchecked Loop Condition (medium 5.9)
- [CVE-2024-1393](https://insights.sbomify.com/CVE-2024-1393/): Cross-site scripting in Addon Elements for Elementor (formerly Elementor Addon Elements) (medium 6.4)
- [CVE-2024-13929](https://insights.sbomify.com/CVE-2024-13929/): Authenticated Servlet Command Injection (high 7.5)
- [CVE-2024-13928](https://insights.sbomify.com/CVE-2024-13928/): Authenticated SQL Injection (high 7.5)
- [CVE-2024-13926](https://insights.sbomify.com/CVE-2024-13926/): WP-Syntax <= 1.2 - Author+ Potential ReDoS (high 7.5)
- [CVE-2024-13925](https://insights.sbomify.com/CVE-2024-13925/): Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive Logging (high 7.5)
- [CVE-2024-13924](https://insights.sbomify.com/CVE-2024-13924/): Starter Templates by FancyWP <= 2.0.0 - Unauthenticated Blind Server-Side Request Forgery (medium 5.3)
- [CVE-2024-13923](https://insights.sbomify.com/CVE-2024-13923/): Server-side request forgery in Order Export & Order Import for WooCommerce (high 7.6)
- [CVE-2024-13922](https://insights.sbomify.com/CVE-2024-13922/): Path traversal in Order Export & Order Import for WooCommerce (low 2.7)
- [CVE-2024-13921](https://insights.sbomify.com/CVE-2024-13921/): Deserialization in Order Export & Order Import for WooCommerce (high 7.2)
- [CVE-2024-13920](https://insights.sbomify.com/CVE-2024-13920/): Path traversal in Order Export & Order Import for WooCommerce (medium 4.9)
- [CVE-2024-1392](https://insights.sbomify.com/CVE-2024-1392/): Elementor Addon Elements <= 1.12.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dual Button Widget (medium 6.4)
- [CVE-2024-13919](https://insights.sbomify.com/CVE-2024-13919/): Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page (high 8.0)
- [CVE-2024-13918](https://insights.sbomify.com/CVE-2024-13918/): Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page (high 8.0)
- [CVE-2024-13917](https://insights.sbomify.com/CVE-2024-13917/): Intent Injection in Kruger&Matz AppLock application (high 8.3)
- [CVE-2024-13916](https://insights.sbomify.com/CVE-2024-13916/): Exposure of Applications' Encryption PINs in Kruger&Matz AppLock (medium 6.9)
- [CVE-2024-13915](https://insights.sbomify.com/CVE-2024-13915/): Unrestricted Access to Exported Service in com.pri.factorytest (medium 6.9)
- [CVE-2024-13914](https://insights.sbomify.com/CVE-2024-13914/): Path traversal in File Manager Advanced Shortcode (high 7.2)
- [CVE-2024-13913](https://insights.sbomify.com/CVE-2024-13913/): InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion (high 8.8)
- [CVE-2024-13911](https://insights.sbomify.com/CVE-2024-13911/): Information disclosure in Database Backup and Table Integrity Check with Automated Scheduling (high 7.2)
- [CVE-2024-13910](https://insights.sbomify.com/CVE-2024-13910/): Path traversal in Database Backup and Table Integrity Check with Automated Scheduling (high 7.2)
- [CVE-2024-1391](https://insights.sbomify.com/CVE-2024-1391/): Cross-site scripting in Addon Elements for Elementor (formerly Elementor Addon Elements) (medium 6.4)
- [CVE-2024-13909](https://insights.sbomify.com/CVE-2024-13909/): Accredible Certificates & Open Badges <= 1.4.9 - Authenticated (Administrator+) SQL Injection via orderby Parameter (medium 4.9)
- [CVE-2024-13908](https://insights.sbomify.com/CVE-2024-13908/): SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload (high 7.2)
- [CVE-2024-13907](https://insights.sbomify.com/CVE-2024-13907/): Server-side request forgery in Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid (medium 4.9)
- [CVE-2024-13906](https://insights.sbomify.com/CVE-2024-13906/): Deserialization in Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress (high 7.2)
- [CVE-2024-13905](https://insights.sbomify.com/CVE-2024-13905/): OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/471/