# Vulnerabilities published in 2024


- [CVE-2024-10017](https://insights.sbomify.com/CVE-2024-10017/): PJW Mime Config <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-10016](https://insights.sbomify.com/CVE-2024-10016/): File Upload Types by WPForms <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-10015](https://insights.sbomify.com/CVE-2024-10015/): Cross-site scripting in ConvertCalculator: Build Cost, Price, Quotation, ROI Interactive Calculators (medium 6.4)
- [CVE-2024-10014](https://insights.sbomify.com/CVE-2024-10014/): Flat UI Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via flatbtn Shortcode (medium 6.4)
- [CVE-2024-10013](https://insights.sbomify.com/CVE-2024-10013/): Progress UI for WinForms format provider unsafe deserialization vulnerability (high 7.8)
- [CVE-2024-10012](https://insights.sbomify.com/CVE-2024-10012/): Progress UI for WPF format provider unsafe deserialization vulnerability (high 7.8)
- [CVE-2024-10011](https://insights.sbomify.com/CVE-2024-10011/): BuddyPress <= 14.1.0 - Authenticated (Subscriber+) Directory Traversal (high 8.1)
- [CVE-2024-10010](https://insights.sbomify.com/CVE-2024-10010/): LearnPress < 4.2.7.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1001](https://insights.sbomify.com/CVE-2024-1001/): Totolink N200RE cstecgi.cgi main stack-based overflow (high 7.2)
- [CVE-2024-10009](https://insights.sbomify.com/CVE-2024-10009/): Website File Changes < 2.1.0 - Admin+ Authenticated SQL Injection (medium 4.1)
- [CVE-2024-10008](https://insights.sbomify.com/CVE-2024-10008/): Missing authorization in Masteriyo LMS – Online Course Builder for eLearning, LMS & Education (high 8.8)
- [CVE-2024-10007](https://insights.sbomify.com/CVE-2024-10007/): Pre-Receive Hook Path Collision Vulnerability in GitHub Enterprise Server Allowing Privilege Escalation (high 8.7)
- [CVE-2024-10006](https://insights.sbomify.com/CVE-2024-10006/): Consul L7 Intentions Vulnerable To Headers Bypass (high 8.3)
- [CVE-2024-10005](https://insights.sbomify.com/CVE-2024-10005/): Consul L7 Intentions Vulnerable To URL Path Bypass (high 8.1)
- [CVE-2024-10004](https://insights.sbomify.com/CVE-2024-10004/): Security feature bypass in Firefox for iOS (critical 9.1)
- [CVE-2024-10003](https://insights.sbomify.com/CVE-2024-10003/): Rover IDX <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions (medium 6.3)
- [CVE-2024-10002](https://insights.sbomify.com/CVE-2024-10002/): Rover IDX <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator (high 8.8)
- [CVE-2024-10001](https://insights.sbomify.com/CVE-2024-10001/): Code Injection Vulnerability in GitHub Enterprise Server Allows Arbitrary Code Execution via Message Handling (high 7.1)
- [CVE-2024-10000](https://insights.sbomify.com/CVE-2024-10000/): Cross-site scripting in Masteriyo LMS – Online Course Builder for eLearning, LMS & Education (medium 6.4)
- [CVE-2024-1000](https://insights.sbomify.com/CVE-2024-1000/): Totolink N200RE cstecgi.cgi setTracerouteCfg stack-based overflow (high 7.2)
- [CVE-2024-0999](https://insights.sbomify.com/CVE-2024-0999/): Totolink N200RE cstecgi.cgi setParentalRules stack-based overflow (high 7.2)
- [CVE-2024-0998](https://insights.sbomify.com/CVE-2024-0998/): Totolink N200RE cstecgi.cgi setDiagnosisCfg stack-based overflow (high 7.2)
- [CVE-2024-0997](https://insights.sbomify.com/CVE-2024-0997/): Totolink N200RE cstecgi.cgi setOpModeCfg stack-based overflow (high 7.2)
- [CVE-2024-0996](https://insights.sbomify.com/CVE-2024-0996/): Tenda i9 httpd setcfm formSetCfm stack-based overflow (high 7.2)
- [CVE-2024-0995](https://insights.sbomify.com/CVE-2024-0995/): Tenda W6 httpd wifiSSIDset formwrlSSIDset stack-based overflow (high 7.2)
- [CVE-2024-0994](https://insights.sbomify.com/CVE-2024-0994/): Tenda W6 httpd setcfm formSetCfm stack-based overflow (high 7.2)
- [CVE-2024-0993](https://insights.sbomify.com/CVE-2024-0993/): Tenda i6 httpd WifiMacFilterGet formWifiMacFilterGet stack-based overflow (high 7.2)
- [CVE-2024-0992](https://insights.sbomify.com/CVE-2024-0992/): Tenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflow (high 7.2)
- [CVE-2024-0991](https://insights.sbomify.com/CVE-2024-0991/): Tenda i6 httpd setcfm formSetCfm stack-based overflow (high 7.2)
- [CVE-2024-0990](https://insights.sbomify.com/CVE-2024-0990/): Tenda i6 httpd setAutoPing formSetAutoPing stack-based overflow (high 7.2)
- [CVE-2024-0989](https://insights.sbomify.com/CVE-2024-0989/): Sichuan Yougou Technology KuERP Service.php del_sn_db path traversal (medium 5.4)
- [CVE-2024-0988](https://insights.sbomify.com/CVE-2024-0988/): Sichuan Yougou Technology KuERP common.php checklogin improper authentication (medium 6.3)
- [CVE-2024-0987](https://insights.sbomify.com/CVE-2024-0987/): Sichuan Yougou Technology KuERP log neutralization for logs (medium 6.3)
- [CVE-2024-0986](https://insights.sbomify.com/CVE-2024-0986/): Issabel PBX Asterisk-Cli os command injection (medium 4.7)
- [CVE-2024-0985](https://insights.sbomify.com/CVE-2024-0985/): PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL (high 8.0)
- [CVE-2024-0984](https://insights.sbomify.com/CVE-2024-0984/): ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in disableOptimization (medium 4.3)
- [CVE-2024-0983](https://insights.sbomify.com/CVE-2024-0983/): ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in enableOptimization (medium 4.3)
- [CVE-2024-0981](https://insights.sbomify.com/CVE-2024-0981/): Cross-site scripting in Okta Browser Plugin (high 7.1)
- [CVE-2024-0980](https://insights.sbomify.com/CVE-2024-0980/): Path traversal in Okta Verify for Windows (high 7.1)
- [CVE-2024-0979](https://insights.sbomify.com/CVE-2024-0979/): Dashboard Widgets Suite <= 3.4.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-0978](https://insights.sbomify.com/CVE-2024-0978/): My Private Site <= 3.0.14 - Improper Access Control to Sensitive Information Exposure via REST API (medium 5.3)
- [CVE-2024-0977](https://insights.sbomify.com/CVE-2024-0977/): Cross-site scripting in Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) (medium 4.4)
- [CVE-2024-0976](https://insights.sbomify.com/CVE-2024-0976/): WP Event Manager <= 3.1.41 - Reflected Cross-Site Scripting via plugin (medium 6.1)
- [CVE-2024-0975](https://insights.sbomify.com/CVE-2024-0975/): WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API (medium 5.3)
- [CVE-2024-0974](https://insights.sbomify.com/CVE-2024-0974/): Social Media Widget < 4.0.9 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-0973](https://insights.sbomify.com/CVE-2024-0973/): Widget for Social Page Feeds < 6.4 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-0972](https://insights.sbomify.com/CVE-2024-0972/): BuddyPress Members Only <= 3.4.8 - Improper Access Control to Sensitive Information Exposure via REST API (medium 5.3)
- [CVE-2024-0971](https://insights.sbomify.com/CVE-2024-0971/): SQL injection in Nessus (medium 6.5)
- [CVE-2024-0970](https://insights.sbomify.com/CVE-2024-0970/): User Activity Tracking and Log < 4.1.4 - IP Spoofing (medium 5.3)
- [CVE-2024-0969](https://insights.sbomify.com/CVE-2024-0969/): ARMember <= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API (medium 5.3)
- [CVE-2024-0967](https://insights.sbomify.com/CVE-2024-0967/): OpenText / Micro Focus ArcSight Enterprise Security Manager Remote Vulnerability (medium 4.3)
- [CVE-2024-0966](https://insights.sbomify.com/CVE-2024-0966/): Shariff Wrapper <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0965](https://insights.sbomify.com/CVE-2024-0965/): Simple Page Access Restriction <= 1.0.21 - Improper Access Control to Sensitive Information Exposure via REST API (medium 5.3)
- [CVE-2024-0964](https://insights.sbomify.com/CVE-2024-0964/): LFI in Gradio (high 7.5)
- [CVE-2024-0963](https://insights.sbomify.com/CVE-2024-0963/): Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0962](https://insights.sbomify.com/CVE-2024-0962/): obgm libcoap Configuration File coap_oscore.c get_split_entry stack-based overflow (medium 6.3)
- [CVE-2024-0961](https://insights.sbomify.com/CVE-2024-0961/): SiteOrigin Widgets Bundle <= 1.58.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0960](https://insights.sbomify.com/CVE-2024-0960/): flink-extended ai-flow workflow_command.py cloudpickle.loads deserialization (medium 5.0)
- [CVE-2024-0959](https://insights.sbomify.com/CVE-2024-0959/): StanfordVL GibsonEnv pposgd_fuse.py cloudpickle.load deserialization (medium 5.0)
- [CVE-2024-0958](https://insights.sbomify.com/CVE-2024-0958/): CodeAstro Stock Management System Add Category index.php cross site scripting (low 3.5)
- [CVE-2024-0957](https://insights.sbomify.com/CVE-2024-0957/): Cross-site scripting in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels (medium 6.1)
- [CVE-2024-0956](https://insights.sbomify.com/CVE-2024-0956/): WP ERP <= 1.13.0 - Authenticated (AccountingManager+) SQL Injection (medium 4.9)
- [CVE-2024-0955](https://insights.sbomify.com/CVE-2024-0955/): Stored XSS vulnerability (medium 4.8)
- [CVE-2024-0954](https://insights.sbomify.com/CVE-2024-0954/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-0953](https://insights.sbomify.com/CVE-2024-0953/): Open redirect in Firefox for iOS (medium 6.1)
- [CVE-2024-0952](https://insights.sbomify.com/CVE-2024-0952/): WP ERP <= 1.12.9 - Authenticated (Accounting Manager+) SQL Injection via id (high 7.2)
- [CVE-2024-0951](https://insights.sbomify.com/CVE-2024-0951/): Advanced Social Feeds Widget & Shortcode <= 1.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-0949](https://insights.sbomify.com/CVE-2024-0949/): Improper Access Control in Talya Informatics' Elektraweb (critical 9.8)
- [CVE-2024-0948](https://insights.sbomify.com/CVE-2024-0948/): NetBox Home Page Configuration config-revisions cross site scripting (low 2.4)
- [CVE-2024-0947](https://insights.sbomify.com/CVE-2024-0947/): Cookies Manipulation in Talya Informatics' Elektraweb (critical 9.8)
- [CVE-2024-0946](https://insights.sbomify.com/CVE-2024-0946/): 60IndexPage Parameter index.php server-side request forgery (high 7.3)
- [CVE-2024-0945](https://insights.sbomify.com/CVE-2024-0945/): 60IndexPage Parameter file.php server-side request forgery (high 7.3)
- [CVE-2024-0944](https://insights.sbomify.com/CVE-2024-0944/): Totolink T8 cstecgi.cgi session expiration (low 3.7)
- [CVE-2024-0943](https://insights.sbomify.com/CVE-2024-0943/): Totolink N350RT cstecgi.cgi session expiration (low 3.7)
- [CVE-2024-0942](https://insights.sbomify.com/CVE-2024-0942/): Totolink N200RE V5 cstecgi.cgi session expiration (low 3.7)
- [CVE-2024-0941](https://insights.sbomify.com/CVE-2024-0941/): Novel-Plus list sql injection (medium 5.5)
- [CVE-2024-0939](https://insights.sbomify.com/CVE-2024-0939/): Byzoro Smart S210 Management Platform uploadfile.php unrestricted upload (medium 6.3)
- [CVE-2024-0938](https://insights.sbomify.com/CVE-2024-0938/): Tongda OA 2017 delete_webmail.php sql injection (medium 5.5)
- [CVE-2024-0937](https://insights.sbomify.com/CVE-2024-0937/): van_der_Schaar LAB synthcity PKL File load_from_file deserialization (medium 6.3)
- [CVE-2024-0936](https://insights.sbomify.com/CVE-2024-0936/): van_der_Schaar LAB TemporAI PKL File load_from_file deserialization (medium 6.3)
- [CVE-2024-0935](https://insights.sbomify.com/CVE-2024-0935/): Information disclosure in DELMIA Apriso (medium 4.4)
- [CVE-2024-0933](https://insights.sbomify.com/CVE-2024-0933/): Niushop B2B2C Upload.php unrestricted upload (medium 6.3)
- [CVE-2024-0932](https://insights.sbomify.com/CVE-2024-0932/): Tenda AC10U setSmartPowerManagement stack-based overflow (medium 4.7)
- [CVE-2024-0931](https://insights.sbomify.com/CVE-2024-0931/): Tenda AC10U saveParentControlInfo stack-based overflow (medium 4.7)
- [CVE-2024-0930](https://insights.sbomify.com/CVE-2024-0930/): Tenda AC10U fromSetWirelessRepeat stack-based overflow (medium 4.7)
- [CVE-2024-0929](https://insights.sbomify.com/CVE-2024-0929/): Tenda AC10U fromNatStaticSetting stack-based overflow (medium 4.7)
- [CVE-2024-0928](https://insights.sbomify.com/CVE-2024-0928/): Tenda AC10U fromDhcpListClient stack-based overflow (medium 4.7)
- [CVE-2024-0927](https://insights.sbomify.com/CVE-2024-0927/): Tenda AC10U fromAddressNat stack-based overflow (medium 4.7)
- [CVE-2024-0926](https://insights.sbomify.com/CVE-2024-0926/): Tenda AC10U formWifiWpsOOB stack-based overflow (medium 4.7)
- [CVE-2024-0925](https://insights.sbomify.com/CVE-2024-0925/): Tenda AC10U formSetVirtualSer stack-based overflow (medium 4.7)
- [CVE-2024-0924](https://insights.sbomify.com/CVE-2024-0924/): Tenda AC10U formSetPPTPServer stack-based overflow (medium 4.7)
- [CVE-2024-0923](https://insights.sbomify.com/CVE-2024-0923/): Tenda AC10U formSetDeviceName stack-based overflow (medium 4.7)
- [CVE-2024-0922](https://insights.sbomify.com/CVE-2024-0922/): Tenda AC10U formQuickIndex stack-based overflow (medium 4.7)
- [CVE-2024-0921](https://insights.sbomify.com/CVE-2024-0921/): D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection (medium 4.7)
- [CVE-2024-0920](https://insights.sbomify.com/CVE-2024-0920/): TRENDnet TEW-822DRE POST Request admin_ping.htm command injection (high 7.2)
- [CVE-2024-0919](https://insights.sbomify.com/CVE-2024-0919/): TRENDnet TEW-815DAP POST Request do_setNTP command injection (high 8.8)
- [CVE-2024-0918](https://insights.sbomify.com/CVE-2024-0918/): TRENDnet TEW-800MB POST Request os command injection (high 7.2)
- [CVE-2024-0917](https://insights.sbomify.com/CVE-2024-0917/): PaddlePaddle vulnerable to remote code execution (critical 9.4)
- [CVE-2024-0916](https://insights.sbomify.com/CVE-2024-0916/): Unauthenticated Remote Code Execution in UvDesk Community (critical 10.0)
- [CVE-2024-0914](https://insights.sbomify.com/CVE-2024-0914/): Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin) (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/512/