# Vulnerabilities published in 2024


- [CVE-2024-0586](https://insights.sbomify.com/CVE-2024-0586/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-0585](https://insights.sbomify.com/CVE-2024-0585/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 5.4)
- [CVE-2024-0582](https://insights.sbomify.com/CVE-2024-0582/): Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap (high 7.8)
- [CVE-2024-0581](https://insights.sbomify.com/CVE-2024-0581/): Uncontrolled Resource Consumption vulnerability on Sandsprite scdbg (medium 4.0)
- [CVE-2024-0580](https://insights.sbomify.com/CVE-2024-0580/): Omission of key-controlled authorization in Qsige (medium 6.5)
- [CVE-2024-0579](https://insights.sbomify.com/CVE-2024-0579/): Totolink X2000R formMapDelDevice command injection (medium 5.3)
- [CVE-2024-0578](https://insights.sbomify.com/CVE-2024-0578/): Totolink LR1200GB cstecgi.cgi UploadCustomModule stack-based overflow (high 8.8)
- [CVE-2024-0577](https://insights.sbomify.com/CVE-2024-0577/): Totolink LR1200GB cstecgi.cgi setLanguageCfg stack-based overflow (high 8.8)
- [CVE-2024-0576](https://insights.sbomify.com/CVE-2024-0576/): Totolink LR1200GB cstecgi.cgi setIpPortFilterRules stack-based overflow (high 8.8)
- [CVE-2024-0575](https://insights.sbomify.com/CVE-2024-0575/): Totolink LR1200GB cstecgi.cgi setTracerouteCfg stack-based overflow (high 8.8)
- [CVE-2024-0574](https://insights.sbomify.com/CVE-2024-0574/): Totolink LR1200GB cstecgi.cgi setParentalRules stack-based overflow (high 8.8)
- [CVE-2024-0573](https://insights.sbomify.com/CVE-2024-0573/): Totolink LR1200GB cstecgi.cgi setDiagnosisCfg stack-based overflow (high 8.8)
- [CVE-2024-0572](https://insights.sbomify.com/CVE-2024-0572/): Totolink LR1200GB cstecgi.cgi setOpModeCfg stack-based overflow (high 8.8)
- [CVE-2024-0571](https://insights.sbomify.com/CVE-2024-0571/): Totolink LR1200GB cstecgi.cgi setSmsCfg stack-based overflow (high 8.8)
- [CVE-2024-0570](https://insights.sbomify.com/CVE-2024-0570/): Totolink N350RT Setting cstecgi.cgi access control (medium 6.9)
- [CVE-2024-0569](https://insights.sbomify.com/CVE-2024-0569/): Totolink T8 Setting cstecgi.cgi getSysStatusCfg information disclosure (medium 5.3)
- [CVE-2024-0568](https://insights.sbomify.com/CVE-2024-0568/): Auth bypass in Harmony Control Relay RMNF22TB30 (high 8.8)
- [CVE-2024-0567](https://insights.sbomify.com/CVE-2024-0567/): Gnutls: rejects certificate chain with distributed trust (high 7.5)
- [CVE-2024-0566](https://insights.sbomify.com/CVE-2024-0566/): Smart Manager < 8.28.0 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-0565](https://insights.sbomify.com/CVE-2024-0565/): Integer overflow in RHOL-5.7-RHEL-8 (medium 6.8)
- [CVE-2024-0564](https://insights.sbomify.com/CVE-2024-0564/): Kernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplication (medium 5.3)
- [CVE-2024-0563](https://insights.sbomify.com/CVE-2024-0563/): Denial of service condition in M-Files Server (medium 4.3)
- [CVE-2024-0562](https://insights.sbomify.com/CVE-2024-0562/): Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.c (high 7.8)
- [CVE-2024-0561](https://insights.sbomify.com/CVE-2024-0561/): Ultimate Posts Widget < 2.3.1 - Admin+ Stored XSS (medium 5.4)
- [CVE-2024-0560](https://insights.sbomify.com/CVE-2024-0560/): Auth bypass in Red Hat 3scale API Management Platform 2 (medium 6.3)
- [CVE-2024-0559](https://insights.sbomify.com/CVE-2024-0559/): Enhanced Text Widget < 1.6.6 - Admin+ Stored XSS (medium 6.5)
- [CVE-2024-0558](https://insights.sbomify.com/CVE-2024-0558/): DedeBIZ makehtml_freelist_action.php sql injection (medium 4.7)
- [CVE-2024-0557](https://insights.sbomify.com/CVE-2024-0557/): DedeBIZ Website Copyright Setting cross site scripting (low 2.4)
- [CVE-2024-0556](https://insights.sbomify.com/CVE-2024-0556/): Weak Cryptography for Passwords vulnerability on WIC1200 (high 7.1)
- [CVE-2024-0555](https://insights.sbomify.com/CVE-2024-0555/): Cross-Site Request Forgery (CSRF) vulnerability on WIC1200 (medium 4.6)
- [CVE-2024-0554](https://insights.sbomify.com/CVE-2024-0554/): Cross-site scripting (XSS) vulnerability on WIC1200 (medium 5.5)
- [CVE-2024-0553](https://insights.sbomify.com/CVE-2024-0553/): Gnutls: incomplete fix for cve-2023-5981 (high 7.5)
- [CVE-2024-0552](https://insights.sbomify.com/CVE-2024-0552/): Intumit inc. SmartRobot - Remote Code Execution (critical 9.8)
- [CVE-2024-0551](https://insights.sbomify.com/CVE-2024-0551/): Download and export of file via default user role (high 7.1)
- [CVE-2024-0550](https://insights.sbomify.com/CVE-2024-0550/): Privileged User using traversal to read system files (critical 9.6)
- [CVE-2024-0549](https://insights.sbomify.com/CVE-2024-0549/): Relative Path Traversal in mintplex-labs/anything-llm (high 8.1)
- [CVE-2024-0548](https://insights.sbomify.com/CVE-2024-0548/): FreeFloat FTP Server SIZE Command denial of service (medium 5.3)
- [CVE-2024-0547](https://insights.sbomify.com/CVE-2024-0547/): Ability FTP Server APPE Command denial of service (medium 5.3)
- [CVE-2024-0546](https://insights.sbomify.com/CVE-2024-0546/): EasyFTP LIST Command denial of service (medium 5.3)
- [CVE-2024-0545](https://insights.sbomify.com/CVE-2024-0545/): CodeCanyon RISE Ultimate Project Manager signin redirect (medium 6.9)
- [CVE-2024-0543](https://insights.sbomify.com/CVE-2024-0543/): CodeAstro Real Estate Management System propertydetail.php sql injection (medium 6.3)
- [CVE-2024-0542](https://insights.sbomify.com/CVE-2024-0542/): Tenda W9 httpd formWifiMacFilterGet stack-based overflow (high 8.8)
- [CVE-2024-0541](https://insights.sbomify.com/CVE-2024-0541/): Tenda W9 httpd formAddSysLogRule stack-based overflow (high 8.8)
- [CVE-2024-0540](https://insights.sbomify.com/CVE-2024-0540/): Tenda W9 httpd formOfflineSet stack-based overflow (medium 6.3)
- [CVE-2024-0539](https://insights.sbomify.com/CVE-2024-0539/): Tenda W9 httpd formQosManage_user stack-based overflow (high 8.8)
- [CVE-2024-0538](https://insights.sbomify.com/CVE-2024-0538/): Tenda W9 httpd formQosManage_auto stack-based overflow (high 8.8)
- [CVE-2024-0537](https://insights.sbomify.com/CVE-2024-0537/): Tenda W9 httpd setWrlBasicInfo stack-based overflow (high 8.8)
- [CVE-2024-0536](https://insights.sbomify.com/CVE-2024-0536/): Tenda W9 httpd setWrlAccessList stack-based overflow (high 8.8)
- [CVE-2024-0535](https://insights.sbomify.com/CVE-2024-0535/): Tenda PA6 httpd portmap cgiPortMapAdd stack-based overflow (high 8.8)
- [CVE-2024-0534](https://insights.sbomify.com/CVE-2024-0534/): Tenda A15 Web-based Management Interface SetOnlineDevName stack-based overflow (high 7.2)
- [CVE-2024-0533](https://insights.sbomify.com/CVE-2024-0533/): Tenda A15 Web-based Management Interface SetOnlineDevName stack-based overflow (high 7.2)
- [CVE-2024-0532](https://insights.sbomify.com/CVE-2024-0532/): Tenda A15 Web-based Management Interface WifiExtraSet set_repeat5 stack-based overflow (high 8.6)
- [CVE-2024-0531](https://insights.sbomify.com/CVE-2024-0531/): Tenda A15 Web-based Management Interface setBlackRule stack-based overflow (high 7.2)
- [CVE-2024-0530](https://insights.sbomify.com/CVE-2024-0530/): CXBSoft Post-Office HTTP POST Request reg_go.php sql injection (medium 5.5)
- [CVE-2024-0529](https://insights.sbomify.com/CVE-2024-0529/): CXBSoft Post-Office HTTP POST Request login_auth.php sql injection (medium 5.5)
- [CVE-2024-0528](https://insights.sbomify.com/CVE-2024-0528/): CXBSoft Post-Office HTTP POST Request update_go.php sql injection (medium 5.5)
- [CVE-2024-0527](https://insights.sbomify.com/CVE-2024-0527/): CXBSoft Url-shorting HTTP POST Request update_go.php sql injection (medium 6.3)
- [CVE-2024-0526](https://insights.sbomify.com/CVE-2024-0526/): CXBSoft Url-shorting HTTP POST Request short_to_long.php sql injection (medium 5.5)
- [CVE-2024-0525](https://insights.sbomify.com/CVE-2024-0525/): CXBSoft Url-shorting HTTP POST Request long_s_short.php sql injection (medium 5.5)
- [CVE-2024-0524](https://insights.sbomify.com/CVE-2024-0524/): CXBSoft Url-shorting index.php sql injection (medium 5.5)
- [CVE-2024-0523](https://insights.sbomify.com/CVE-2024-0523/): CmsEasy language_admin.php getslide_child_action sql injection (medium 6.3)
- [CVE-2024-0522](https://insights.sbomify.com/CVE-2024-0522/): Allegro RomPager HTTP POST Request cross-site request forgery (medium 4.3)
- [CVE-2024-0521](https://insights.sbomify.com/CVE-2024-0521/): Code Injection in paddlepaddle/paddle (critical 9.3)
- [CVE-2024-0520](https://insights.sbomify.com/CVE-2024-0520/): Remote Code Execution due to Full Controlled File Write in mlflow/mlflow (critical 10.0)
- [CVE-2024-0519](https://insights.sbomify.com/CVE-2024-0519/): Google Chromium V8 Out-of-Bounds Memory Access (high 8.8, exploited in the wild)
- [CVE-2024-0518](https://insights.sbomify.com/CVE-2024-0518/): Memory corruption in Chrome (high 7.5)
- [CVE-2024-0517](https://insights.sbomify.com/CVE-2024-0517/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-0516](https://insights.sbomify.com/CVE-2024-0516/): Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_meta (medium 5.3)
- [CVE-2024-0515](https://insights.sbomify.com/CVE-2024-0515/): Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_compare (medium 4.3)
- [CVE-2024-0514](https://insights.sbomify.com/CVE-2024-0514/): Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_compare (medium 4.3)
- [CVE-2024-0513](https://insights.sbomify.com/CVE-2024-0513/): Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlist (medium 4.3)
- [CVE-2024-0512](https://insights.sbomify.com/CVE-2024-0512/): Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlist (medium 4.3)
- [CVE-2024-0511](https://insights.sbomify.com/CVE-2024-0511/): Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta (medium 4.3)
- [CVE-2024-0510](https://insights.sbomify.com/CVE-2024-0510/): HaoKeKeJi YiQiNiu Api.php http_post server-side request forgery (high 7.3)
- [CVE-2024-0509](https://insights.sbomify.com/CVE-2024-0509/): WP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via request (medium 6.1)
- [CVE-2024-0508](https://insights.sbomify.com/CVE-2024-0508/): Cross-site scripting in Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More (medium 6.4)
- [CVE-2024-0507](https://insights.sbomify.com/CVE-2024-0507/): Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server (medium 6.5)
- [CVE-2024-0506](https://insights.sbomify.com/CVE-2024-0506/): Cross-site scripting in Elementor Website Builder – more than just a page builder (medium 6.4)
- [CVE-2024-0505](https://insights.sbomify.com/CVE-2024-0505/): ZhongFuCheng3y Austin Upload Material Menu MaterialController.java getFile unrestricted upload (medium 5.5)
- [CVE-2024-0504](https://insights.sbomify.com/CVE-2024-0504/): code-projects Simple Online Hotel Reservation System Make a Reservation Page add_reserve.php cross site scripting (low 3.5)
- [CVE-2024-0503](https://insights.sbomify.com/CVE-2024-0503/): code-projects Online FIR System registercomplaint.php cross site scripting (low 3.5)
- [CVE-2024-0502](https://insights.sbomify.com/CVE-2024-0502/): SourceCodester House Rental Management System Edit User manage_user.php sql injection (medium 4.7)
- [CVE-2024-0501](https://insights.sbomify.com/CVE-2024-0501/): SourceCodester House Rental Management System Manage Invoice Details cross site scripting (low 2.4)
- [CVE-2024-0500](https://insights.sbomify.com/CVE-2024-0500/): SourceCodester House Rental Management System Manage Tenant Details cross site scripting (low 2.4)
- [CVE-2024-0499](https://insights.sbomify.com/CVE-2024-0499/): SourceCodester House Rental Management System index.php cross site scripting (low 2.4)
- [CVE-2024-0498](https://insights.sbomify.com/CVE-2024-0498/): Project Worlds Lawyer Management System searchLawyer.php sql injection (medium 6.3)
- [CVE-2024-0497](https://insights.sbomify.com/CVE-2024-0497/): Campcodes Student Information System sql injection (medium 6.3)
- [CVE-2024-0496](https://insights.sbomify.com/CVE-2024-0496/): Kashipara Billing Software HTTP POST Request item_list_edit.php sql injection (medium 6.3)
- [CVE-2024-0495](https://insights.sbomify.com/CVE-2024-0495/): Kashipara Billing Software HTTP POST Request party_submit.php sql injection (medium 6.3)
- [CVE-2024-0494](https://insights.sbomify.com/CVE-2024-0494/): Kashipara Billing Software HTTP POST Request material_bill.php sql injection (medium 6.3)
- [CVE-2024-0493](https://insights.sbomify.com/CVE-2024-0493/): Kashipara Billing Software HTTP POST Request submit_delivery_list.php sql injection (medium 6.3)
- [CVE-2024-0492](https://insights.sbomify.com/CVE-2024-0492/): Kashipara Billing Software HTTP POST Request buyer_detail_submit.php sql injection (medium 6.3)
- [CVE-2024-0491](https://insights.sbomify.com/CVE-2024-0491/): Huaxia ERP UserController.java password recovery (medium 5.3)
- [CVE-2024-0490](https://insights.sbomify.com/CVE-2024-0490/): Huaxia ERP getAllList information disclosure (medium 5.3)
- [CVE-2024-0489](https://insights.sbomify.com/CVE-2024-0489/): code-projects Fighting Cock Information System edit_chicken.php sql injection (medium 6.3)
- [CVE-2024-0488](https://insights.sbomify.com/CVE-2024-0488/): code-projects Fighting Cock Information System new-feed.php sql injection (medium 6.3)
- [CVE-2024-0487](https://insights.sbomify.com/CVE-2024-0487/): code-projects Fighting Cock Information System delete-vaccine.php sql injection (medium 6.3)
- [CVE-2024-0486](https://insights.sbomify.com/CVE-2024-0486/): code-projects Fighting Cock Information System add_con.php sql injection (medium 6.3)
- [CVE-2024-0485](https://insights.sbomify.com/CVE-2024-0485/): code-projects Fighting Cock Information System add_con.php sql injection (medium 6.3)
- [CVE-2024-0484](https://insights.sbomify.com/CVE-2024-0484/): code-projects Fighting Cock Information System update_mother.php sql injection (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/516/