# Vulnerabilities published in 2024


- [GHSA-3fmq-x9q6-wm39](https://insights.sbomify.com/GHSA-3fmq-x9q6-wm39/): random_compat Uses insecure CSPRNG (not scored)
- [GHSA-3c5g-73f7-grvm](https://insights.sbomify.com/GHSA-3c5g-73f7-grvm/): Neos Information Disclosure Security Note (not scored)
- [GHSA-39j2-4p9j-5w4j](https://insights.sbomify.com/GHSA-39j2-4p9j-5w4j/): Ez Platform Object Injection in legacy shop module (not scored)
- [GHSA-34q6-xqxh-gq39](https://insights.sbomify.com/GHSA-34q6-xqxh-gq39/): Silverstripe XSS In rewritten hash links (not scored)
- [GHSA-346h-749j-r28w](https://insights.sbomify.com/GHSA-346h-749j-r28w/): PHPECC vulnerable to multiple cryptographic side-channel attacks (not scored)
- [GHSA-337w-fxpq-5m34](https://insights.sbomify.com/GHSA-337w-fxpq-5m34/): Drupal core uses a vulnerable Third-party library CKEditor (not scored)
- [GHSA-32rx-xvvr-4xv9](https://insights.sbomify.com/GHSA-32rx-xvvr-4xv9/): easyadmin-extension-bundle action case insensitivity (not scored)
- [GHSA-2x7m-gf85-3745](https://insights.sbomify.com/GHSA-2x7m-gf85-3745/): Remote Denial of Service Vulnerability in Microsoft QUIC (not scored)
- [GHSA-2x36-qhx3-7m5f](https://insights.sbomify.com/GHSA-2x36-qhx3-7m5f/): ZendFramework1 Potential SQL injection in the ORDER implementation of Zend_Db_Select (not scored)
- [GHSA-2wq5-g96f-mv3v](https://insights.sbomify.com/GHSA-2wq5-g96f-mv3v/): Segmentation fault due to use of uninitialized memory (not scored)
- [GHSA-2w9p-xxqr-h253](https://insights.sbomify.com/GHSA-2w9p-xxqr-h253/): eZ Platform Object Injection in SiteAccessMatchListener (not scored)
- [GHSA-2vh3-cj9j-mcj5](https://insights.sbomify.com/GHSA-2vh3-cj9j-mcj5/): eZ Publish Legacy Cross-site Scripting (XSS) in 'disabled module' error template (not scored)
- [GHSA-2rxc-gjrp-vjhx](https://insights.sbomify.com/GHSA-2rxc-gjrp-vjhx/): Unsoundness in anstream (not scored)
- [GHSA-2rcw-9hrm-8q7q](https://insights.sbomify.com/GHSA-2rcw-9hrm-8q7q/): TYPO3 Cross-Site Scripting in Frontend User Login (not scored)
- [GHSA-2r6g-7r83-jg72](https://insights.sbomify.com/GHSA-2r6g-7r83-jg72/): `spam` project on PyPI compromised, malicious releases made (not scored)
- [GHSA-2q97-m5rc-p3gp](https://insights.sbomify.com/GHSA-2q97-m5rc-p3gp/): CosmWasm VM Incorrect metering (not scored)
- [GHSA-2p4f-vc9q-r5vp](https://insights.sbomify.com/GHSA-2p4f-vc9q-r5vp/): Typo3 Arbitrary file upload and XML External Entity processing (not scored)
- [GHSA-2m5g-8xpw-42vp](https://insights.sbomify.com/GHSA-2m5g-8xpw-42vp/): OpenCFP Framework (Sentry) Account takeover via null password reset codes (not scored)
- [GHSA-2jx7-xg83-j2m7](https://insights.sbomify.com/GHSA-2jx7-xg83-j2m7/): Zendframework Denial of Service vector via XEE injection (not scored)
- [GHSA-2j6r-9vv4-6gf5](https://insights.sbomify.com/GHSA-2j6r-9vv4-6gf5/): github.com/bincyber/go-sqlcrypter vulnerable to IV collision (not scored)
- [GHSA-2hpc-mf4q-j885](https://insights.sbomify.com/GHSA-2hpc-mf4q-j885/): Silverstripe CSRF vulnerability in GridFieldAddExistingAutocompleter (not scored)
- [GHSA-2gq2-m628-33xp](https://insights.sbomify.com/GHSA-2gq2-m628-33xp/): gregwar/rst Local File Inclusion Vulnerability (not scored)
- [GHSA-2gh6-wc3m-g37f](https://insights.sbomify.com/GHSA-2gh6-wc3m-g37f/): hermes-management is vulnerable to RCE due to Apache commons-jxpath (not scored)
- [GHSA-2g98-f9jv-w8c5](https://insights.sbomify.com/GHSA-2g98-f9jv-w8c5/): robrichards/xmlseclibs XPath injection (not scored)
- [GHSA-2fhr-8r8r-qp56](https://insights.sbomify.com/GHSA-2fhr-8r8r-qp56/): ZendFramework Information Disclosure and Insufficient Entropy vulnerability (not scored)
- [GHSA-2ffv-r4r9-r8xr](https://insights.sbomify.com/GHSA-2ffv-r4r9-r8xr/): Laravel RCE vulnerability in "cookie" session driver (not scored)
- [GHSA-2ff4-xfpr-m32r](https://insights.sbomify.com/GHSA-2ff4-xfpr-m32r/): Impact <!-- _What kind of vulnerability is it? (not scored)
- [GHSA-2f46-4xjm-73x5](https://insights.sbomify.com/GHSA-2f46-4xjm-73x5/): Passbolt API Stored XSS on first/last name during setup (not scored)
- [GHSA-29w6-c52g-m8jc](https://insights.sbomify.com/GHSA-29w6-c52g-m8jc/): C5 Firefly III CSV Injection. (not scored)
- [GHSA-29m4-mx89-3mjg](https://insights.sbomify.com/GHSA-29m4-mx89-3mjg/): TYPO3 Denial of Service in Online Media Asset Handling (not scored)
- [GHSA-29c2-65rj-h343](https://insights.sbomify.com/GHSA-29c2-65rj-h343/): Nervos CKB Permit load cell data from memory (not scored)
- [GHSA-297g-xg4h-7w4c](https://insights.sbomify.com/GHSA-297g-xg4h-7w4c/): Laravel Cross-site Scripting vulnerability in blade templating (not scored)
- [GHSA-2867-6rrm-38gr](https://insights.sbomify.com/GHSA-2867-6rrm-38gr/): Laravel Cookie serialization vulnerability (not scored)
- [GHSA-27qr-636m-wxg2](https://insights.sbomify.com/GHSA-27qr-636m-wxg2/): codeigniter/framework SQL injection in ODBC database driver (not scored)
- [GHSA-277h-px4m-62q8](https://insights.sbomify.com/GHSA-277h-px4m-62q8/): @saltcorn/server arbitrary file zip read and download when downloading auto backups (not scored)
- [GHSA-26jh-r8g2-6fpr](https://insights.sbomify.com/GHSA-26jh-r8g2-6fpr/): Gradio's dropdown component pre-process step does not limit the values to those in the dropdown list (not scored)
- [GHSA-26hq-7286-mg8f](https://insights.sbomify.com/GHSA-26hq-7286-mg8f/): Magento Patch SUPEE-9652 - Remote Code Execution using mail vulnerability (not scored)
- [GHSA-26hp-cgjj-m2j3](https://insights.sbomify.com/GHSA-26hp-cgjj-m2j3/): fuel/core ImageMagick driver does not escape all shell arguments. (not scored)
- [GHSA-265q-222x-52m6](https://insights.sbomify.com/GHSA-265q-222x-52m6/): silverstripe/framework has potential SQL Injection vulnerability in PostgreSQL database connector (not scored)
- [GHSA-25gq-jvx2-vg9x](https://insights.sbomify.com/GHSA-25gq-jvx2-vg9x/): Silverstripe X-Forwarded-Host request hostname injection (not scored)
- [GHSA-259v-xm34-p7fr](https://insights.sbomify.com/GHSA-259v-xm34-p7fr/): Typo3 Cross-Site Scripting in Language Pack Handling (not scored)
- [GHSA-259p-rvjx-ffwg](https://insights.sbomify.com/GHSA-259p-rvjx-ffwg/): .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. (not scored)
- [GHSA-2557-x9mg-76w8](https://insights.sbomify.com/GHSA-2557-x9mg-76w8/): ASA-2024-002: Default `PrepareProposalHandler` may produce invalid proposals when used with default `SenderNonceMempool` **Component**: C (not scored)
- [GHSA-23q2-5gf8-gjpp](https://insights.sbomify.com/GHSA-23q2-5gf8-gjpp/): Enabling Authentication does not close all logged in socket connections immediately (not scored)
- [GHSA-23j4-mw76-5v7h](https://insights.sbomify.com/GHSA-23j4-mw76-5v7h/): Scrapy allows redirect following in protocols other than HTTP (not scored)
- [GHSA-22q7-cg4r-p9mx](https://insights.sbomify.com/GHSA-22q7-cg4r-p9mx/): TYPO3 Cross-Site Scripting in Fluid ViewHelpers (not scored)
- [GHSA-229x-22xc-2f2w](https://insights.sbomify.com/GHSA-229x-22xc-2f2w/): Zendframework Local file disclosure via XXE injection in Zend_XmlRpc (not scored)
- [CVE-2024-9999](https://insights.sbomify.com/CVE-2024-9999/): Multi-Factor Authentication Bypass in Progress WS_FTP Server (medium 6.5)
- [CVE-2024-9997](https://insights.sbomify.com/CVE-2024-9997/): Autodesk AutoCAD DWG File Parsing Memory Corruption Code Execution Vulnerability (high 7.8)
- [CVE-2024-9996](https://insights.sbomify.com/CVE-2024-9996/): Autodesk AutoCAD DWG File Parsing Out-Of-Bounds Write Code Execution Vulnerability (high 7.8)
- [CVE-2024-9994](https://insights.sbomify.com/CVE-2024-9994/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-9993](https://insights.sbomify.com/CVE-2024-9993/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-9991](https://insights.sbomify.com/CVE-2024-9991/): Cleartext Storage of Sensitive Information Vulnerability in Philips Lighting Devices (high 7.0)
- [CVE-2024-9990](https://insights.sbomify.com/CVE-2024-9990/): Crypto <= 2.15 - Cross-Site Request Forgery to Authentication Bypass (high 8.8)
- [CVE-2024-9989](https://insights.sbomify.com/CVE-2024-9989/): Crypto <= 2.18 - Authentication Bypass via log_in (critical 9.8)
- [CVE-2024-9988](https://insights.sbomify.com/CVE-2024-9988/): Crypto <= 2.19 - Authentication Bypass via register (critical 9.8)
- [CVE-2024-9987](https://insights.sbomify.com/CVE-2024-9987/): SQL Injection in CSV Module Data Collection (high 8.6)
- [CVE-2024-9986](https://insights.sbomify.com/CVE-2024-9986/): code-projects Blood Bank Management System member_register.php sql injection (medium 6.9)
- [CVE-2024-9985](https://insights.sbomify.com/CVE-2024-9985/): Ragic Enterprise Cloud Database - Arbitrary File Upload (critical 10.0)
- [CVE-2024-9984](https://insights.sbomify.com/CVE-2024-9984/): Ragic Enterprise Cloud Database - Missing Authentication (critical 9.8)
- [CVE-2024-9983](https://insights.sbomify.com/CVE-2024-9983/): Ragic Enterprise Cloud Database - Arbitrary File Read through Path Traversal (high 7.5)
- [CVE-2024-9982](https://insights.sbomify.com/CVE-2024-9982/): ESi Technology AIM LINE Marketing Platform - SQL Injection (critical 9.8)
- [CVE-2024-9981](https://insights.sbomify.com/CVE-2024-9981/): FormosaSoft ee-class - Local File Inclusion (high 8.8)
- [CVE-2024-9980](https://insights.sbomify.com/CVE-2024-9980/): FormosaSoft ee-class - SQL Injection (high 8.8)
- [CVE-2024-9979](https://insights.sbomify.com/CVE-2024-9979/): Pyo3: risk of use-after-free in `borrowed` reads from python weak references (medium 5.3)
- [CVE-2024-9978](https://insights.sbomify.com/CVE-2024-9978/): Liteos_a has an out-of-bounds read vulnerability (medium 5.5)
- [CVE-2024-9977](https://insights.sbomify.com/CVE-2024-9977/): MitraStar GPT-2541GNAC Firewall Settings Page settings-firewall.cgi os command injection (medium 5.1)
- [CVE-2024-9976](https://insights.sbomify.com/CVE-2024-9976/): code-projects Pharmacy Management System manage_customer.php sql injection (medium 5.3)
- [CVE-2024-9975](https://insights.sbomify.com/CVE-2024-9975/): SourceCodester Drag and Drop Image Upload upload.php unrestricted upload (medium 5.3)
- [CVE-2024-9974](https://insights.sbomify.com/CVE-2024-9974/): SourceCodester Online Eyewear Shop POST Request Master.php sql injection (medium 5.3)
- [CVE-2024-9973](https://insights.sbomify.com/CVE-2024-9973/): SourceCodester Online Eyewear Shop Report Viewing Page page sql injection (medium 5.3)
- [CVE-2024-9972](https://insights.sbomify.com/CVE-2024-9972/): ChanGate Property Management System - SQL Injection (critical 9.8)
- [CVE-2024-9971](https://insights.sbomify.com/CVE-2024-9971/): NewType FlowMaster BPM Plus - SQL Injection (high 8.8)
- [CVE-2024-9970](https://insights.sbomify.com/CVE-2024-9970/): NewType FlowMaster BPM Plus - Privilege Escalation (high 8.8)
- [CVE-2024-9969](https://insights.sbomify.com/CVE-2024-9969/): NewType WebEIP v3.0 - Reflected XSS (medium 5.4)
- [CVE-2024-9968](https://insights.sbomify.com/CVE-2024-9968/): NewType WebEIP v3.0 - SQL injection (high 8.8)
- [CVE-2024-9967](https://insights.sbomify.com/CVE-2024-9967/): WP show more <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via show_more Shortcode (medium 6.4)
- [CVE-2024-9966](https://insights.sbomify.com/CVE-2024-9966/): Security feature bypass in Chrome (medium 5.3)
- [CVE-2024-9965](https://insights.sbomify.com/CVE-2024-9965/): Other in Chrome (high 8.8)
- [CVE-2024-9964](https://insights.sbomify.com/CVE-2024-9964/): Other in Chrome (medium 4.3)
- [CVE-2024-9963](https://insights.sbomify.com/CVE-2024-9963/): Other in Chrome (medium 4.3)
- [CVE-2024-9962](https://insights.sbomify.com/CVE-2024-9962/): Other in Chrome (medium 4.3)
- [CVE-2024-9961](https://insights.sbomify.com/CVE-2024-9961/): Use after free in Chrome (high 8.8)
- [CVE-2024-9960](https://insights.sbomify.com/CVE-2024-9960/): Use after free in Chrome (high 8.8)
- [CVE-2024-9959](https://insights.sbomify.com/CVE-2024-9959/): Use after free in Chrome (high 8.8)
- [CVE-2024-9958](https://insights.sbomify.com/CVE-2024-9958/): Other in Chrome (medium 4.3)
- [CVE-2024-9957](https://insights.sbomify.com/CVE-2024-9957/): Use after free in Chrome (high 8.8)
- [CVE-2024-9956](https://insights.sbomify.com/CVE-2024-9956/): Privilege escalation in Chrome (high 7.8)
- [CVE-2024-9955](https://insights.sbomify.com/CVE-2024-9955/): Use after free in Chrome (high 8.8)
- [CVE-2024-9954](https://insights.sbomify.com/CVE-2024-9954/): Use after free in Chrome (high 8.8)
- [CVE-2024-9953](https://insights.sbomify.com/CVE-2024-9953/): Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8 (medium 4.9)
- [CVE-2024-9952](https://insights.sbomify.com/CVE-2024-9952/): SourceCodester Online Eyewear Shop Contact Information Page contact_info cross site scripting (medium 5.1)
- [CVE-2024-9951](https://insights.sbomify.com/CVE-2024-9951/): Wordpress Photo Album Plus <= 8.8.05.003 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9950](https://insights.sbomify.com/CVE-2024-9950/): Abuse of Unauthenticated Compliance Recheck in SecureConnector (high 8.5)
- [CVE-2024-9949](https://insights.sbomify.com/CVE-2024-9949/): Denial of Service in Forescout SecureConnector (medium 5.8)
- [CVE-2024-9947](https://insights.sbomify.com/CVE-2024-9947/): ProfilePress - Pro <= 4.11.1 - Authentication Bypass via WordPress.com OAuth provider (high 8.1)
- [CVE-2024-9946](https://insights.sbomify.com/CVE-2024-9946/): Auth bypass in Social Share, Social Login and Social Comments Plugin – Super Socializer (high 8.1)
- [CVE-2024-9945](https://insights.sbomify.com/CVE-2024-9945/): Limited Information Disclosure in GoAnywhere MFT Prior to 7.7.0 (medium 5.3)
- [CVE-2024-9944](https://insights.sbomify.com/CVE-2024-9944/): WooCommerce <= 9.0.2 - Unauthenticated HTML Injection (medium 5.3)
- [CVE-2024-9943](https://insights.sbomify.com/CVE-2024-9943/): Cross-site request forgery in MultiVendorX – WooCommerce Multivendor Marketplace Solutions (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/136/