# Vulnerabilities published in 2024


- [CVE-2024-8227](https://insights.sbomify.com/CVE-2024-8227/): Tenda O1 DhcpSetSer fromDhcpSetSer stack-based overflow (high 8.7)
- [CVE-2024-8226](https://insights.sbomify.com/CVE-2024-8226/): Tenda O1 setcfm formSetCfm stack-based overflow (high 8.7)
- [CVE-2024-8225](https://insights.sbomify.com/CVE-2024-8225/): Tenda G3 SetSysTimeCfg formSetSysTime stack-based overflow (high 8.7)
- [CVE-2024-8224](https://insights.sbomify.com/CVE-2024-8224/): Tenda G3 setDebugCfg formSetDebugCfg stack-based overflow (high 8.7)
- [CVE-2024-8223](https://insights.sbomify.com/CVE-2024-8223/): SourceCodester Music Gallery Site Master.php sql injection (medium 5.3)
- [CVE-2024-8222](https://insights.sbomify.com/CVE-2024-8222/): SourceCodester Music Gallery Site sql injection (medium 5.3)
- [CVE-2024-8221](https://insights.sbomify.com/CVE-2024-8221/): SourceCodester Music Gallery Site manage_category.php sql injection (medium 5.3)
- [CVE-2024-8220](https://insights.sbomify.com/CVE-2024-8220/): itsourcecode Tailoring Management System staffedit.php sql injection (medium 5.3)
- [CVE-2024-8219](https://insights.sbomify.com/CVE-2024-8219/): code-projects Responsive Hotel Site index.php sql injection (medium 6.9)
- [CVE-2024-8218](https://insights.sbomify.com/CVE-2024-8218/): code-projects Online Quiz Site index.php sql injection (medium 6.9)
- [CVE-2024-8217](https://insights.sbomify.com/CVE-2024-8217/): SourceCodester E-Commerce Website registration.php sql injection (medium 6.9)
- [CVE-2024-8216](https://insights.sbomify.com/CVE-2024-8216/): nafisulbari/itsourcecode Insurance Management System Payment editPayment.php access control (medium 5.3)
- [CVE-2024-8215](https://insights.sbomify.com/CVE-2024-8215/): Payload Injection Attack via Management REST interface (high 8.7)
- [CVE-2024-8214](https://insights.sbomify.com/CVE-2024-8214/): D-Link DNS-1550-04 hd_config.cgi cgi_FMT_Std2R5_2nd_DiskMGR command injection (medium 5.3)
- [CVE-2024-8213](https://insights.sbomify.com/CVE-2024-8213/): D-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_1st_DiskMGR command injection (medium 5.3)
- [CVE-2024-8212](https://insights.sbomify.com/CVE-2024-8212/): D-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_2nd_DiskMGR command injection (medium 5.3)
- [CVE-2024-8211](https://insights.sbomify.com/CVE-2024-8211/): D-Link DNS-1550-04 hd_config.cgi cgi_FMT_Std2R1_DiskMGR command injection (medium 5.3)
- [CVE-2024-8210](https://insights.sbomify.com/CVE-2024-8210/): D-Link DNS-1550-04 hd_config.cgi sprintf command injection (medium 5.3)
- [CVE-2024-8209](https://insights.sbomify.com/CVE-2024-8209/): nafisulbari/itsourcecode Insurance Management System addClient.php cross site scripting (medium 5.3)
- [CVE-2024-8208](https://insights.sbomify.com/CVE-2024-8208/): nafisulbari/itsourcecode Insurance Management System editClient.php cross site scripting (medium 5.3)
- [CVE-2024-8207](https://insights.sbomify.com/CVE-2024-8207/): MongoDB Server binaries may load potentially insecure shared libraries from specific relative paths (medium 6.4)
- [CVE-2024-8201](https://insights.sbomify.com/CVE-2024-8201/): Cross-Site WebSocket Hijacking Vulnerability in Hitachi Ops Center Analyzer (medium 5.4)
- [CVE-2024-8200](https://insights.sbomify.com/CVE-2024-8200/): Cross-site request forgery in Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More (medium 4.3)
- [CVE-2024-8199](https://insights.sbomify.com/CVE-2024-8199/): Missing authorization in Reviews Feed – Add Testimonials and Customer Reviews From Google Reviews, Yelp, TripAdvisor, and More (medium 4.3)
- [CVE-2024-8198](https://insights.sbomify.com/CVE-2024-8198/): Memory corruption in Chrome (high 7.5)
- [CVE-2024-8196](https://insights.sbomify.com/CVE-2024-8196/): Missing Authentication for Critical Function in mintplex-labs/anything-llm (critical 9.8)
- [CVE-2024-8195](https://insights.sbomify.com/CVE-2024-8195/): Permalink Manager Lite <= 2.4.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2024-8194](https://insights.sbomify.com/CVE-2024-8194/): Memory corruption in Chrome (high 7.5)
- [CVE-2024-8193](https://insights.sbomify.com/CVE-2024-8193/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-8191](https://insights.sbomify.com/CVE-2024-8191/): SQL injection in Endpoint Manager (high 7.8)
- [CVE-2024-8190](https://insights.sbomify.com/CVE-2024-8190/): Ivanti Cloud Services Appliance OS Command Injection (high 7.2, exploited in the wild)
- [CVE-2024-8189](https://insights.sbomify.com/CVE-2024-8189/): WP MultiTasking - WP Utilities <= 0.1.17 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-8187](https://insights.sbomify.com/CVE-2024-8187/): Smart Post Show <= 3.0.0 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-8186](https://insights.sbomify.com/CVE-2024-8186/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 5.4)
- [CVE-2024-8185](https://insights.sbomify.com/CVE-2024-8185/): Vault Vulnerable to Denial of Service When Processing Raft Join Requests (high 7.5)
- [CVE-2024-8184](https://insights.sbomify.com/CVE-2024-8184/): Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks (medium 5.9)
- [CVE-2024-8183](https://insights.sbomify.com/CVE-2024-8183/): CORS Misconfiguration in prefecthq/prefect (high 7.6)
- [CVE-2024-8182](https://insights.sbomify.com/CVE-2024-8182/): Flowise Denial of Service (high 7.5)
- [CVE-2024-8181](https://insights.sbomify.com/CVE-2024-8181/): Flowise Authentication Bypass (critical 9.8)
- [CVE-2024-8180](https://insights.sbomify.com/CVE-2024-8180/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 5.4)
- [CVE-2024-8179](https://insights.sbomify.com/CVE-2024-8179/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 5.4)
- [CVE-2024-8178](https://insights.sbomify.com/CVE-2024-8178/): Multiple issues in ctl(4) CAM Target Layer (critical 9.3)
- [CVE-2024-8177](https://insights.sbomify.com/CVE-2024-8177/): Inefficient Algorithmic Complexity in GitLab (medium 5.3)
- [CVE-2024-8176](https://insights.sbomify.com/CVE-2024-8176/): Libexpat: expat: improper restriction of xml entity expansion depth in libexpat (high 7.5)
- [CVE-2024-8175](https://insights.sbomify.com/CVE-2024-8175/): CODESYS: web server vulnerable to DoS (high 7.5)
- [CVE-2024-8174](https://insights.sbomify.com/CVE-2024-8174/): code-projects Blood Bank System Login Page login.php cross site scripting (medium 6.9)
- [CVE-2024-8173](https://insights.sbomify.com/CVE-2024-8173/): code-projects Blood Bank System Login Page login.php sql injection (medium 6.9)
- [CVE-2024-8172](https://insights.sbomify.com/CVE-2024-8172/): SourceCodester QR Code Attendance System delete-student.php cross site scripting (medium 5.3)
- [CVE-2024-8171](https://insights.sbomify.com/CVE-2024-8171/): itsourcecode Tailoring Management System staffcatedit.php sql injection (medium 5.3)
- [CVE-2024-8170](https://insights.sbomify.com/CVE-2024-8170/): SourceCodester Zipped Folder Manager App add-folder.php unrestricted upload (medium 5.3)
- [CVE-2024-8169](https://insights.sbomify.com/CVE-2024-8169/): code-projects Online Quiz Site signupuser.php sql injection (medium 6.9)
- [CVE-2024-8168](https://insights.sbomify.com/CVE-2024-8168/): code-projects Online Bus Reservation Site login.php sql injection (medium 6.9)
- [CVE-2024-8167](https://insights.sbomify.com/CVE-2024-8167/): code-projects Job Portal forget.php sql injection (medium 6.9)
- [CVE-2024-8166](https://insights.sbomify.com/CVE-2024-8166/): Ruijie EG2000K index.php unrestricted upload (medium 5.1)
- [CVE-2024-8165](https://insights.sbomify.com/CVE-2024-8165/): Chengdu Everbrite Network Technology BeikeShop export exportZip path traversal (medium 5.3)
- [CVE-2024-8164](https://insights.sbomify.com/CVE-2024-8164/): Chengdu Everbrite Network Technology BeikeShop FileManagerController.php rename unrestricted upload (medium 5.3)
- [CVE-2024-8163](https://insights.sbomify.com/CVE-2024-8163/): Chengdu Everbrite Network Technology BeikeShop files destroyFiles path traversal (medium 5.3)
- [CVE-2024-8162](https://insights.sbomify.com/CVE-2024-8162/): TOTOLINK T10 AC1200 Telnet Service product.ini hard-coded credentials (critical 9.3)
- [CVE-2024-8161](https://insights.sbomify.com/CVE-2024-8161/): SQL injection vulnerability in CIGESv2 system (critical 9.8)
- [CVE-2024-8160](https://insights.sbomify.com/CVE-2024-8160/): Command injection in AXIS OS (low 3.8)
- [CVE-2024-8159](https://insights.sbomify.com/CVE-2024-8159/): Deep Freeze 9.00.020.5760 - Out-of-bounds read (medium 6.4)
- [CVE-2024-8158](https://insights.sbomify.com/CVE-2024-8158/): User impersonation for lib9p based 9p fileservers (high 8.8)
- [CVE-2024-8157](https://insights.sbomify.com/CVE-2024-8157/): Alphabetical List <= 1.0.3 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-8156](https://insights.sbomify.com/CVE-2024-8156/): Command Injection in significant-gravitas/autogpt (high 8.8)
- [CVE-2024-8155](https://insights.sbomify.com/CVE-2024-8155/): ContiNew Admin tree sql injection (medium 5.1)
- [CVE-2024-8154](https://insights.sbomify.com/CVE-2024-8154/): SourceCodester QR Code Bookmark System Parameter update-bookmark.php cross site scripting (medium 5.3)
- [CVE-2024-8153](https://insights.sbomify.com/CVE-2024-8153/): SourceCodester QR Code Bookmark System delete-bookmark.php cross site scripting (medium 5.3)
- [CVE-2024-8152](https://insights.sbomify.com/CVE-2024-8152/): SourceCodester QR Code Bookmark System Parameter add-bookmark.php cross site scripting (medium 5.3)
- [CVE-2024-8151](https://insights.sbomify.com/CVE-2024-8151/): SourceCodester Interactive Map with Marker delete-mark.php cross site scripting (medium 5.3)
- [CVE-2024-8150](https://insights.sbomify.com/CVE-2024-8150/): ContiNew Admin user sql injection (medium 5.1)
- [CVE-2024-8149](https://insights.sbomify.com/CVE-2024-8149/): BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (medium 4.6)
- [CVE-2024-8148](https://insights.sbomify.com/CVE-2024-8148/): BUG-000168624 - Unvalidated redirect in Portal for ArcGIS. (11.2, 11.1, 10.9.1. and 10.8.1) (medium 6.1)
- [CVE-2024-8147](https://insights.sbomify.com/CVE-2024-8147/): code-projects Pharmacy Management System index.php sql injection (medium 5.3)
- [CVE-2024-8146](https://insights.sbomify.com/CVE-2024-8146/): code-projects Pharmacy Management System index.php sql injection (medium 5.3)
- [CVE-2024-8145](https://insights.sbomify.com/CVE-2024-8145/): ClassCMS Article admin cross site scripting (medium 5.1)
- [CVE-2024-8144](https://insights.sbomify.com/CVE-2024-8144/): ClassCMS Logo admin cross site scripting (medium 5.3)
- [CVE-2024-8143](https://insights.sbomify.com/CVE-2024-8143/): Unauthorized Access to User Chat History in gaizhenbiao/chuanhuchatgpt (medium 6.5)
- [CVE-2024-8142](https://insights.sbomify.com/CVE-2024-8142/): SourceCodester Daily Calories Monitoring Tool delete-calorie.php cross site scripting (medium 5.3)
- [CVE-2024-8141](https://insights.sbomify.com/CVE-2024-8141/): SourceCodester Daily Calories Monitoring Tool add-calorie.php cross site scripting (medium 5.3)
- [CVE-2024-8140](https://insights.sbomify.com/CVE-2024-8140/): SourceCodester Task Progress Tracker update-task.php cross site scripting (medium 5.3)
- [CVE-2024-8139](https://insights.sbomify.com/CVE-2024-8139/): itsourcecode E-Commerce Website search_list.php sql injection (medium 5.3)
- [CVE-2024-8138](https://insights.sbomify.com/CVE-2024-8138/): code-projects Pharmacy Management System Parameter index.php editManager sql injection (medium 5.3)
- [CVE-2024-8137](https://insights.sbomify.com/CVE-2024-8137/): SourceCodester Record Management System search_user.php cross site scripting (medium 5.3)
- [CVE-2024-8136](https://insights.sbomify.com/CVE-2024-8136/): SourceCodester Record Management System sort1_user.php cross site scripting (medium 5.3)
- [CVE-2024-8135](https://insights.sbomify.com/CVE-2024-8135/): Go-Tribe gotribe token.go Sign hard-coded credentials (medium 5.3)
- [CVE-2024-8134](https://insights.sbomify.com/CVE-2024-8134/): D-Link DNS-1550-04 HTTP POST Request hd_config.cgi cgi_FMT_Std2R5_1st_DiskMGR command injection (medium 5.3)
- [CVE-2024-8133](https://insights.sbomify.com/CVE-2024-8133/): D-Link DNS-1550-04 HTTP POST Request hd_config.cgi cgi_FMT_R5_SpareDsk_DiskMGR command injection (medium 5.3)
- [CVE-2024-8132](https://insights.sbomify.com/CVE-2024-8132/): D-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injection (medium 5.3)
- [CVE-2024-8131](https://insights.sbomify.com/CVE-2024-8131/): D-Link DNS-1550-04 HTTP POST Request apkg_mgr.cgi module_enable_disable command injection (medium 5.3)
- [CVE-2024-8130](https://insights.sbomify.com/CVE-2024-8130/): D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3 command injection (medium 5.3)
- [CVE-2024-8129](https://insights.sbomify.com/CVE-2024-8129/): D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injection (medium 5.3)
- [CVE-2024-8128](https://insights.sbomify.com/CVE-2024-8128/): D-Link DNS-1550-04 HTTP POST Request webfile_mgr.cgi cgi_add_zip command injection (medium 5.3)
- [CVE-2024-8127](https://insights.sbomify.com/CVE-2024-8127/): D-Link DNS-1550-04 HTTP POST Request webfile_mgr.cgi cgi_unzip command injection (medium 5.3)
- [CVE-2024-8126](https://insights.sbomify.com/CVE-2024-8126/): Advanced File Manager <= 5.2.8 - Authenticated (Subscriber+) Arbitrary File Upload (high 7.5)
- [CVE-2024-8125](https://insights.sbomify.com/CVE-2024-8125/): A remote code vulnerability has been discovered in OpenText™ Content Management. (medium 5.4)
- [CVE-2024-8124](https://insights.sbomify.com/CVE-2024-8124/): Inefficient Regular Expression Complexity in GitLab (high 7.5)
- [CVE-2024-8123](https://insights.sbomify.com/CVE-2024-8123/): The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Insecure Direct Object Reference (medium 5.4)
- [CVE-2024-8122](https://insights.sbomify.com/CVE-2024-8122/): Potential brute force vulnerability due to non-expiring SMS OTPs (medium 5.9)
- [CVE-2024-8121](https://insights.sbomify.com/CVE-2024-8121/): The Ultimate WordPress Toolkit – WP Extended <= 3.0.8 - Missing Authorization to Admin Username Change (medium 5.4)
- [CVE-2024-8120](https://insights.sbomify.com/CVE-2024-8120/): ImageRecycle pdf & image compression <= 3.1.14 - Cross-Site Request in Several AJAX Actions (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/153/