# Vulnerabilities published in 2024


- [CVE-2024-9834](https://insights.sbomify.com/CVE-2024-9834/): Improper data protection on Life2000 ventilator serial interface (critical 9.3)
- [CVE-2024-9832](https://insights.sbomify.com/CVE-2024-9832/): No limit on failed login attempts with Clinician Password or Serial Number Clinician Password on Life2000 Ventilator (critical 9.3)
- [CVE-2024-9831](https://insights.sbomify.com/CVE-2024-9831/): Taskbuilder < 3.0.9 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-9830](https://insights.sbomify.com/CVE-2024-9830/): Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter (medium 6.1)
- [CVE-2024-9829](https://insights.sbomify.com/CVE-2024-9829/): Download Plugin <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) User Metadata and Comment Download (medium 6.5)
- [CVE-2024-9828](https://insights.sbomify.com/CVE-2024-9828/): Taskbuilder < 3.0.5 - Admin+ SQL Injection (medium 4.1)
- [CVE-2024-9827](https://insights.sbomify.com/CVE-2024-9827/): Autodesk AutoCAD ACTranslators CATPART File Parsing Out-Of-Bounds Read Vulnerability (high 7.8)
- [CVE-2024-9826](https://insights.sbomify.com/CVE-2024-9826/): Autodesk AutoCAD ACTranslators 3DM File Parsing Use-After-Free Code Execution Vulnerability (high 7.8)
- [CVE-2024-9825](https://insights.sbomify.com/CVE-2024-9825/): The Chef Habitat builder is impacted by Indirect Object reference(IDOR) by deletion of personal access token (medium 5.4)
- [CVE-2024-9824](https://insights.sbomify.com/CVE-2024-9824/): Missing authorization in ImagePress – Image Gallery (medium 4.3)
- [CVE-2024-9823](https://insights.sbomify.com/CVE-2024-9823/): Jetty DOS vulnerability on DosFilter (medium 5.3)
- [CVE-2024-9822](https://insights.sbomify.com/CVE-2024-9822/): Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator (critical 9.8)
- [CVE-2024-9821](https://insights.sbomify.com/CVE-2024-9821/): Missing authorization in Bot for Telegram on WooCommerce (high 8.8)
- [CVE-2024-9820](https://insights.sbomify.com/CVE-2024-9820/): WP 2FA with Telegram <= 3.0 - Two-Factor Authentication Bypass (medium 6.5)
- [CVE-2024-9819](https://insights.sbomify.com/CVE-2024-9819/): IDOR in NextGEO's NG Analyser (medium 6.5)
- [CVE-2024-9818](https://insights.sbomify.com/CVE-2024-9818/): SourceCodester Online Veterinary Appointment System manage_category.php sql injection (medium 6.9)
- [CVE-2024-9817](https://insights.sbomify.com/CVE-2024-9817/): code-projects Blood Bank System update.php sql injection (medium 5.3)
- [CVE-2024-9816](https://insights.sbomify.com/CVE-2024-9816/): Codezips Tourist Management System change-image.php unrestricted upload (medium 5.1)
- [CVE-2024-9815](https://insights.sbomify.com/CVE-2024-9815/): Codezips Tourist Management System create-package.php unrestricted upload (medium 5.1)
- [CVE-2024-9814](https://insights.sbomify.com/CVE-2024-9814/): Codezips Pharmacy Management System update.php sql injection (medium 6.9)
- [CVE-2024-9813](https://insights.sbomify.com/CVE-2024-9813/): Codezips Pharmacy Management System register.php sql injection (medium 6.9)
- [CVE-2024-9812](https://insights.sbomify.com/CVE-2024-9812/): code-projects Crud Operation System delete.php sql injection (medium 6.9)
- [CVE-2024-9811](https://insights.sbomify.com/CVE-2024-9811/): code-projects Restaurant Reservation System filter3.php sql injection (medium 6.9)
- [CVE-2024-9810](https://insights.sbomify.com/CVE-2024-9810/): SourceCodester Record Management System sort2_user.php cross site scripting (medium 5.3)
- [CVE-2024-9809](https://insights.sbomify.com/CVE-2024-9809/): SourceCodester Online Eyewear Shop Master.php delete_product sql injection (medium 5.3)
- [CVE-2024-9808](https://insights.sbomify.com/CVE-2024-9808/): SourceCodester Online Eyewear Shop sql injection (medium 5.3)
- [CVE-2024-9807](https://insights.sbomify.com/CVE-2024-9807/): Craig Rodway Classroombookings Session Page sessions cross site scripting (medium 5.1)
- [CVE-2024-9806](https://insights.sbomify.com/CVE-2024-9806/): Craig Rodway Classroombookings Room Page fields cross site scripting (medium 5.3)
- [CVE-2024-9805](https://insights.sbomify.com/CVE-2024-9805/): code-projects Blood Bank System campsdetails.php cross site scripting (medium 5.3)
- [CVE-2024-9804](https://insights.sbomify.com/CVE-2024-9804/): code-projects Blood Bank System campsdetails.php sql injection (medium 5.1)
- [CVE-2024-9803](https://insights.sbomify.com/CVE-2024-9803/): code-projects Blood Bank Management System blooddetails.php cross site scripting (medium 5.3)
- [CVE-2024-9802](https://insights.sbomify.com/CVE-2024-9802/): Conformance validation endpoint discloses detail about service to unauthenticated users (medium 5.3)
- [CVE-2024-9799](https://insights.sbomify.com/CVE-2024-9799/): SourceCodester Profile Registration without Reload Refresh add.php cross site scripting (medium 5.3)
- [CVE-2024-9798](https://insights.sbomify.com/CVE-2024-9798/): Health endpoint offers list of onboarded services to unauthenticated users (medium 5.3)
- [CVE-2024-9797](https://insights.sbomify.com/CVE-2024-9797/): code-projects Blood Bank System register.php sql injection (medium 6.9)
- [CVE-2024-9796](https://insights.sbomify.com/CVE-2024-9796/): WP-Advanced-Search < 3.3.9.2 - Unauthenticated SQL Injection (medium 5.9)
- [CVE-2024-9794](https://insights.sbomify.com/CVE-2024-9794/): Codezips Online Shopping Portal update-image1.php unrestricted upload (medium 5.3)
- [CVE-2024-9793](https://insights.sbomify.com/CVE-2024-9793/): Tenda AC1206 ate ate_ifconfig_set command injection (medium 5.3)
- [CVE-2024-9792](https://insights.sbomify.com/CVE-2024-9792/): D-Link DSL-2750U Port Forwarding Page cross site scripting (medium 5.1)
- [CVE-2024-9790](https://insights.sbomify.com/CVE-2024-9790/): LyLme_spage sou.php sql injection (medium 5.1)
- [CVE-2024-9789](https://insights.sbomify.com/CVE-2024-9789/): LyLme_spage apply.php sql injection (medium 5.1)
- [CVE-2024-9788](https://insights.sbomify.com/CVE-2024-9788/): LyLme_spage tag.php sql injection (medium 5.1)
- [CVE-2024-9787](https://insights.sbomify.com/CVE-2024-9787/): Contemporary Control System BASrouter BACnet BASRT-B UDP Packet denial of service (medium 6.9)
- [CVE-2024-9786](https://insights.sbomify.com/CVE-2024-9786/): D-Link DIR-619L B1 formSetLog buffer overflow (high 8.7)
- [CVE-2024-9785](https://insights.sbomify.com/CVE-2024-9785/): D-Link DIR-619L B1 formSetDDNS buffer overflow (high 8.7)
- [CVE-2024-9784](https://insights.sbomify.com/CVE-2024-9784/): D-Link DIR-619L B1 formResetStatistic buffer overflow (high 8.7)
- [CVE-2024-9783](https://insights.sbomify.com/CVE-2024-9783/): D-Link DIR-619L B1 formLogDnsquery buffer overflow (high 8.7)
- [CVE-2024-9782](https://insights.sbomify.com/CVE-2024-9782/): D-Link DIR-619L B1 formEasySetupWWConfig buffer overflow (high 8.7)
- [CVE-2024-9781](https://insights.sbomify.com/CVE-2024-9781/): Improper Handling of Missing Values in Wireshark (high 7.8)
- [CVE-2024-9780](https://insights.sbomify.com/CVE-2024-9780/): Missing Initialization of a Variable in Wireshark (high 7.8)
- [CVE-2024-9779](https://insights.sbomify.com/CVE-2024-9779/): Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokens (high 7.5)
- [CVE-2024-9778](https://insights.sbomify.com/CVE-2024-9778/): ImagePress – Image Gallery <= 1.2.2 - Cross-Site Request Forgery to Plugin Settings Update (medium 4.3)
- [CVE-2024-9777](https://insights.sbomify.com/CVE-2024-9777/): Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter (medium 6.1)
- [CVE-2024-9776](https://insights.sbomify.com/CVE-2024-9776/): ImagePress - Image Gallery <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings (medium 4.4)
- [CVE-2024-9775](https://insights.sbomify.com/CVE-2024-9775/): Anih - Creative Agency WordPress Theme <= 2024 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-9774](https://insights.sbomify.com/CVE-2024-9774/): Python-sql: python-sql unary operators does not escape non-expression (medium 6.5)
- [CVE-2024-9773](https://insights.sbomify.com/CVE-2024-9773/): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (low 3.7)
- [CVE-2024-9772](https://insights.sbomify.com/CVE-2024-9772/): Uix Shortcodes – Compatible with Gutenberg <= 1.9.9 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-9771](https://insights.sbomify.com/CVE-2024-9771/): WP-Recall < 16.26.12 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-9770](https://insights.sbomify.com/CVE-2024-9770/): WP-Recall < 16.26.12 - Admin+ SQL Injection (medium 4.7)
- [CVE-2024-9769](https://insights.sbomify.com/CVE-2024-9769/): Video Gallery <= 2.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-9768](https://insights.sbomify.com/CVE-2024-9768/): Formidable Forms < 6.14.1 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-9767](https://insights.sbomify.com/CVE-2024-9767/): IrfanView SID File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9766](https://insights.sbomify.com/CVE-2024-9766/): Wacom Center WTabletServicePro Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-9765](https://insights.sbomify.com/CVE-2024-9765/): EKC Tournament Manager < 2.2.2 - Local File Download Vulnerability (medium 6.5)
- [CVE-2024-9764](https://insights.sbomify.com/CVE-2024-9764/): Tungsten Automation Power PDF PDF File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9763](https://insights.sbomify.com/CVE-2024-9763/): Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9762](https://insights.sbomify.com/CVE-2024-9762/): Tungsten Automation Power PDF OXPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9761](https://insights.sbomify.com/CVE-2024-9761/): Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9760](https://insights.sbomify.com/CVE-2024-9760/): Tungsten Automation Power PDF PNG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9759](https://insights.sbomify.com/CVE-2024-9759/): Tungsten Automation Power PDF GIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9758](https://insights.sbomify.com/CVE-2024-9758/): Tungsten Automation Power PDF AcroForm Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9757](https://insights.sbomify.com/CVE-2024-9757/): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9756](https://insights.sbomify.com/CVE-2024-9756/): Missing authorization in Order Attachments for WooCommerce (medium 4.3)
- [CVE-2024-9755](https://insights.sbomify.com/CVE-2024-9755/): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9754](https://insights.sbomify.com/CVE-2024-9754/): Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9753](https://insights.sbomify.com/CVE-2024-9753/): Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9752](https://insights.sbomify.com/CVE-2024-9752/): Tungsten Automation Power PDF JPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9751](https://insights.sbomify.com/CVE-2024-9751/): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9750](https://insights.sbomify.com/CVE-2024-9750/): Tungsten Automation Power PDF PNG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9749](https://insights.sbomify.com/CVE-2024-9749/): Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-9748](https://insights.sbomify.com/CVE-2024-9748/): Tungsten Automation Power PDF XPS File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9747](https://insights.sbomify.com/CVE-2024-9747/): Tungsten Automation Power PDF PSD File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9746](https://insights.sbomify.com/CVE-2024-9746/): Tungsten Automation Power PDF TGA File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9745](https://insights.sbomify.com/CVE-2024-9745/): Tungsten Automation Power PDF TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9744](https://insights.sbomify.com/CVE-2024-9744/): Tungsten Automation Power PDF JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9743](https://insights.sbomify.com/CVE-2024-9743/): Tungsten Automation Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9742](https://insights.sbomify.com/CVE-2024-9742/): Tungsten Automation Power PDF PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9741](https://insights.sbomify.com/CVE-2024-9741/): Tungsten Automation Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9740](https://insights.sbomify.com/CVE-2024-9740/): Tungsten Automation Power PDF BMP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9739](https://insights.sbomify.com/CVE-2024-9739/): Tungsten Automation Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9738](https://insights.sbomify.com/CVE-2024-9738/): Tungsten Automation Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9737](https://insights.sbomify.com/CVE-2024-9737/): Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9736](https://insights.sbomify.com/CVE-2024-9736/): Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9735](https://insights.sbomify.com/CVE-2024-9735/): Tungsten Automation Power PDF JPF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9734](https://insights.sbomify.com/CVE-2024-9734/): Tungsten Automation Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9733](https://insights.sbomify.com/CVE-2024-9733/): Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9732](https://insights.sbomify.com/CVE-2024-9732/): Tungsten Automation Power PDF XPS File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9731](https://insights.sbomify.com/CVE-2024-9731/): Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9730](https://insights.sbomify.com/CVE-2024-9730/): Trimble SketchUp Viewer SKP File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/138/