# Vulnerabilities published in 2024


- [CVE-2024-8652](https://insights.sbomify.com/CVE-2024-8652/): Netcat CMS: reflected cross-site scripting in openstat module (medium 5.9)
- [CVE-2024-8651](https://insights.sbomify.com/CVE-2024-8651/): Netcat CMS: user enumeration (medium 6.9)
- [CVE-2024-8650](https://insights.sbomify.com/CVE-2024-8650/): Incorrect Authorization in GitLab (medium 5.3)
- [CVE-2024-8648](https://insights.sbomify.com/CVE-2024-8648/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 6.1)
- [CVE-2024-8647](https://insights.sbomify.com/CVE-2024-8647/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (medium 5.4)
- [CVE-2024-8646](https://insights.sbomify.com/CVE-2024-8646/): Eclipse Glassfish: URL redirection vulnerability to untrusted sites (medium 6.1)
- [CVE-2024-8645](https://insights.sbomify.com/CVE-2024-8645/): Access of Uninitialized Pointer in Wireshark (medium 5.5)
- [CVE-2024-8644](https://insights.sbomify.com/CVE-2024-8644/): Cleartext Storage of Sensitive Information in Oceanic Software's ValeApp (critical 9.3)
- [CVE-2024-8643](https://insights.sbomify.com/CVE-2024-8643/): Session Hijacking in Oceanic Software's ValeApp (critical 9.3)
- [CVE-2024-8642](https://insights.sbomify.com/CVE-2024-8642/): Eclipse EDC: Consumer pull transfer token validation checks not applied (medium 5.0)
- [CVE-2024-8641](https://insights.sbomify.com/CVE-2024-8641/): Privilege Context Switching Error in GitLab (medium 6.7)
- [CVE-2024-8640](https://insights.sbomify.com/CVE-2024-8640/): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (high 8.5)
- [CVE-2024-8639](https://insights.sbomify.com/CVE-2024-8639/): Use after free in Chrome (high 8.8)
- [CVE-2024-8638](https://insights.sbomify.com/CVE-2024-8638/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-8637](https://insights.sbomify.com/CVE-2024-8637/): Use after free in Chrome (high 8.8)
- [CVE-2024-8636](https://insights.sbomify.com/CVE-2024-8636/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-8635](https://insights.sbomify.com/CVE-2024-8635/): Server-Side Request Forgery (SSRF) in GitLab (high 7.7)
- [CVE-2024-8633](https://insights.sbomify.com/CVE-2024-8633/): Form Maker <= 1.15.27 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-8632](https://insights.sbomify.com/CVE-2024-8632/): Missing authorization in KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin (medium 6.5)
- [CVE-2024-8631](https://insights.sbomify.com/CVE-2024-8631/): Privilege Defined With Unsafe Actions in GitLab (medium 5.5)
- [CVE-2024-8630](https://insights.sbomify.com/CVE-2024-8630/): Alisonic Sibylla SQL Injection (critical 9.3)
- [CVE-2024-8629](https://insights.sbomify.com/CVE-2024-8629/): WooCommerce Multilingual & Multicurrency with WPML <= 5.3.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8628](https://insights.sbomify.com/CVE-2024-8628/): Cross-site scripting in MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. (medium 5.4)
- [CVE-2024-8627](https://insights.sbomify.com/CVE-2024-8627/): Ultimate TinyMCE <= 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8626](https://insights.sbomify.com/CVE-2024-8626/): Logix Controllers Vulnerable to Denial-of-Service Vulnerability (high 8.7)
- [CVE-2024-8625](https://insights.sbomify.com/CVE-2024-8625/): TS Poll – Survey, Versus Poll, Image Poll, Video Poll < 2.4.0 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-8624](https://insights.sbomify.com/CVE-2024-8624/): MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Authenticated (Contributor+) SQL Injection (critical 9.9)
- [CVE-2024-8623](https://insights.sbomify.com/CVE-2024-8623/): MDTF – Meta Data and Taxonomies Filter <= 1.3.3.3 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-8622](https://insights.sbomify.com/CVE-2024-8622/): amCharts: Charts and Maps <= 1.4.4 - Reflected Cross-Site Scripting via Cross-Site Request Forgery (medium 6.1)
- [CVE-2024-8621](https://insights.sbomify.com/CVE-2024-8621/): Daily Prayer Time <= 2024.08.26 - Authenticated (Contributor+) SQL Injection (critical 9.9)
- [CVE-2024-8620](https://insights.sbomify.com/CVE-2024-8620/): MapPress Maps for WordPress < 2.93 - Admin+ Stored XSS via Map Settings (medium 4.8)
- [CVE-2024-8619](https://insights.sbomify.com/CVE-2024-8619/): Ajax Search Lite <= 4.12.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8618](https://insights.sbomify.com/CVE-2024-8618/): Page Builder: Pagelayer < 1.9.0- Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8617](https://insights.sbomify.com/CVE-2024-8617/): Quiz Maker <= 6.5.9.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8616](https://insights.sbomify.com/CVE-2024-8616/): Arbitrary File Overwrite in h2oai/h2o-3 (high 8.2)
- [CVE-2024-8615](https://insights.sbomify.com/CVE-2024-8615/): WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload (critical 10.0)
- [CVE-2024-8614](https://insights.sbomify.com/CVE-2024-8614/): WP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload (critical 9.9)
- [CVE-2024-8613](https://insights.sbomify.com/CVE-2024-8613/): Improper Access Control in gaizhenbiao/chuanhuchatgpt (high 8.1)
- [CVE-2024-8612](https://insights.sbomify.com/CVE-2024-8612/): Qemu-kvm: information leak in virtio devices (low 3.8)
- [CVE-2024-8611](https://insights.sbomify.com/CVE-2024-8611/): itsourcecode Tailoring Management System ssms.php sql injection (medium 5.3)
- [CVE-2024-8610](https://insights.sbomify.com/CVE-2024-8610/): SourceCodester Best House Rental Management System New Tenant Page index.php cross site scripting (medium 5.3)
- [CVE-2024-8609](https://insights.sbomify.com/CVE-2024-8609/): Improper Access Control in Oceanic Software's ValeApp (high 8.8)
- [CVE-2024-8608](https://insights.sbomify.com/CVE-2024-8608/): Stored XSS in Oceanic Software's ValeApp (high 7.2)
- [CVE-2024-8607](https://insights.sbomify.com/CVE-2024-8607/): SQLi in Oceanic Software's ValeApp (high 8.7)
- [CVE-2024-8606](https://insights.sbomify.com/CVE-2024-8606/): Fix 2FA bypass via RestAPI (critical 9.2)
- [CVE-2024-8605](https://insights.sbomify.com/CVE-2024-8605/): code-projects Inventory Management Registration Form registration.php cross site scripting (medium 6.9)
- [CVE-2024-8604](https://insights.sbomify.com/CVE-2024-8604/): SourceCodester Online Food Ordering System Create an Account Page index.php cross site scripting (medium 6.9)
- [CVE-2024-8603](https://insights.sbomify.com/CVE-2024-8603/): Weak cryptography in Automation Runtime (high 8.2)
- [CVE-2024-8602](https://insights.sbomify.com/CVE-2024-8602/): XML Eternal Entity Attack in the Software Library taxstatement.jar (medium 6.3)
- [CVE-2024-8601](https://insights.sbomify.com/CVE-2024-8601/): Improper Access Control Vulnerability in TechExcel Back Office Software (high 8.7)
- [CVE-2024-8600](https://insights.sbomify.com/CVE-2024-8600/): Memory corruption in Advance Steel (high 7.8)
- [CVE-2024-8599](https://insights.sbomify.com/CVE-2024-8599/): Autodesk AutoCAD ACTranslators STP File Parsing Memory Corruption Code Execution Vulnerability (high 7.8)
- [CVE-2024-8598](https://insights.sbomify.com/CVE-2024-8598/): Autodesk AutoCAD ACTranslators STEP File Parsing Memory Corruption Code Execution Vulnerability (high 7.8)
- [CVE-2024-8597](https://insights.sbomify.com/CVE-2024-8597/): Autodesk AutoCAD STEP File Parsing Memory Corruption Code Execution Vulnerability (high 7.8)
- [CVE-2024-8596](https://insights.sbomify.com/CVE-2024-8596/): Autodesk AutoCAD MODEL File Parsing Out-Of-Bounds Write Code Execution Vulnerability (high 7.8)
- [CVE-2024-8595](https://insights.sbomify.com/CVE-2024-8595/): Autodesk AutoCAD MODEL File Parsing Use-After-Free Code Execution Vulnerability (high 7.8)
- [CVE-2024-8594](https://insights.sbomify.com/CVE-2024-8594/): Autodesk AutoCAD MODEL File Parsing Heap-based Buffer Overflow Code Execution Vulnerability (high 7.8)
- [CVE-2024-8593](https://insights.sbomify.com/CVE-2024-8593/): Autodesk AutoCAD CATPART File Parsing Out-Of-Bounds Write Code Execution Vulnerability (high 7.8)
- [CVE-2024-8592](https://insights.sbomify.com/CVE-2024-8592/): Autodesk AutoCAD CATPART File Parsing Memory Corruption Code Execution Vulnerability (high 7.8)
- [CVE-2024-8591](https://insights.sbomify.com/CVE-2024-8591/): Autodesk AutoCAD 3DM File Parsing Heap-based Buffer Overflow Code Execution Vulnerability (high 7.8)
- [CVE-2024-8590](https://insights.sbomify.com/CVE-2024-8590/): Autodesk AutoCAD 3DM File Parsing Use-After-Free Code Execution Vulnerability (high 7.8)
- [CVE-2024-8589](https://insights.sbomify.com/CVE-2024-8589/): Autodesk AutoCAD SLDPRT File Parsing Out-Of-Bounds Read Vulnerability (high 7.8)
- [CVE-2024-8588](https://insights.sbomify.com/CVE-2024-8588/): Autodesk AutoCAD SLDPRT File Parsing Out-Of-Bounds Read Vulnerability (high 7.8)
- [CVE-2024-8587](https://insights.sbomify.com/CVE-2024-8587/): Autodesk AutoCAD SLDPRT File Parsing Heap-based Buffer Overflow Code Execution Vulnerability (high 7.8)
- [CVE-2024-8586](https://insights.sbomify.com/CVE-2024-8586/): Uniong WebITR - Open Redirect (medium 6.1)
- [CVE-2024-8585](https://insights.sbomify.com/CVE-2024-8585/): LEARNING DIGITAL Orca HCM - Arbitrary File Download (medium 6.5)
- [CVE-2024-8584](https://insights.sbomify.com/CVE-2024-8584/): LEARNING DIGITAL Orca HCM - Missing Authentication (critical 9.8)
- [CVE-2024-8583](https://insights.sbomify.com/CVE-2024-8583/): SourceCodester Online Bank Management System Feedback mfeedback.php cross site scripting (medium 5.3)
- [CVE-2024-8582](https://insights.sbomify.com/CVE-2024-8582/): SourceCodester Food Ordering Management System index.php cross site scripting (medium 5.3)
- [CVE-2024-8581](https://insights.sbomify.com/CVE-2024-8581/): Path Traversal in parisneo/lollms-webui (critical 9.1)
- [CVE-2024-8580](https://insights.sbomify.com/CVE-2024-8580/): TOTOLINK AC1200 T8 shadow.sample hard-coded password (critical 9.2)
- [CVE-2024-8579](https://insights.sbomify.com/CVE-2024-8579/): TOTOLINK AC1200 T8 cstecgi.cgi setWiFiRepeaterCfg buffer overflow (high 8.7)
- [CVE-2024-8578](https://insights.sbomify.com/CVE-2024-8578/): TOTOLINK AC1200 T8 cstecgi.cgi setWiFiMeshName buffer overflow (high 8.7)
- [CVE-2024-8577](https://insights.sbomify.com/CVE-2024-8577/): TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setStaticDhcpRules buffer overflow (high 8.7)
- [CVE-2024-8576](https://insights.sbomify.com/CVE-2024-8576/): TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setIpPortFilterRules buffer overflow (high 8.7)
- [CVE-2024-8575](https://insights.sbomify.com/CVE-2024-8575/): TOTOLINK AC1200 T8 cstecgi.cgi setWiFiScheduleCfg buffer overflow (high 8.7)
- [CVE-2024-8574](https://insights.sbomify.com/CVE-2024-8574/): TOTOLINK AC1200 T8 cstecgi.cgi setParentalRules os command injection (medium 5.3)
- [CVE-2024-8573](https://insights.sbomify.com/CVE-2024-8573/): TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setParentalRules buffer overflow (high 8.7)
- [CVE-2024-8572](https://insights.sbomify.com/CVE-2024-8572/): Gouniverse GoLang CMS FrontendHandler.go PageRenderHtmlByAlias cross site scripting (medium 5.3)
- [CVE-2024-8571](https://insights.sbomify.com/CVE-2024-8571/): erjemin roll_cms views.py information exposure (medium 5.1)
- [CVE-2024-8570](https://insights.sbomify.com/CVE-2024-8570/): itsourcecode Tailoring Management System inccatadd.php sql injection (medium 5.3)
- [CVE-2024-8569](https://insights.sbomify.com/CVE-2024-8569/): code-projects Hospital Management System user-login.php sql injection (medium 6.9)
- [CVE-2024-8568](https://insights.sbomify.com/CVE-2024-8568/): Mini-Tmall 1 rewardMapper.select sql injection (medium 5.3)
- [CVE-2024-8567](https://insights.sbomify.com/CVE-2024-8567/): itsourcecode Payroll Management System ajax.php sql injection (medium 6.9)
- [CVE-2024-8566](https://insights.sbomify.com/CVE-2024-8566/): code-projects Online Shop Store settings.php cross site scripting (medium 6.9)
- [CVE-2024-8565](https://insights.sbomify.com/CVE-2024-8565/): SourceCodesters Clinics Patient Management System print_diseases.php sql injection (medium 6.9)
- [CVE-2024-8564](https://insights.sbomify.com/CVE-2024-8564/): SourceCodester PHP CRUD update.php sql injection (medium 5.3)
- [CVE-2024-8563](https://insights.sbomify.com/CVE-2024-8563/): SourceCodester PHP CRUD update.php cross site scripting (medium 5.3)
- [CVE-2024-8562](https://insights.sbomify.com/CVE-2024-8562/): SourceCodester PHP CRUD Add.php cross site scripting (medium 5.3)
- [CVE-2024-8561](https://insights.sbomify.com/CVE-2024-8561/): SourceCodester PHP CRUD Delete Person delete.php sql injection (medium 5.3)
- [CVE-2024-8560](https://insights.sbomify.com/CVE-2024-8560/): SourceCodester Simple Invoice Generator System save_invoice.php sql injection (medium 5.3)
- [CVE-2024-8559](https://insights.sbomify.com/CVE-2024-8559/): SourceCodester Online Food Menu delete-menu.php sql injection (medium 5.1)
- [CVE-2024-8558](https://insights.sbomify.com/CVE-2024-8558/): SourceCodester Food Ordering Management System Price place-order.php improper validation of specified quantity in input (medium 5.3)
- [CVE-2024-8557](https://insights.sbomify.com/CVE-2024-8557/): SourceCodester Food Ordering Management System cancel-order.php sql injection (medium 5.3)
- [CVE-2024-8556](https://insights.sbomify.com/CVE-2024-8556/): Stored XSS in modelscope/agentscope (medium 6.1)
- [CVE-2024-8555](https://insights.sbomify.com/CVE-2024-8555/): SourceCodester Clinics Patient Management System congratulations.php redirect (medium 6.9)
- [CVE-2024-8554](https://insights.sbomify.com/CVE-2024-8554/): SourceCodester Clinics Patient Management System users.php cross site scripting (medium 5.3)
- [CVE-2024-8553](https://insights.sbomify.com/CVE-2024-8553/): Foreman: read-only access to entire db from templates (medium 6.3)
- [CVE-2024-8552](https://insights.sbomify.com/CVE-2024-8552/): Download Monitor <= 5.0.9 - Missing Authorization to Authenticated (Subscriber+) Shop Enable (medium 4.3)
- [CVE-2024-8551](https://insights.sbomify.com/CVE-2024-8551/): Path Traversal in modelscope/agentscope (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/149/