# Vulnerabilities published in 2024


- [CVE-2024-7688](https://insights.sbomify.com/CVE-2024-7688/): AZIndex <= 0.8.1 - Index Deletion via CSRF (medium 6.5)
- [CVE-2024-7687](https://insights.sbomify.com/CVE-2024-7687/): AZIndex <= 0.8.1 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-7686](https://insights.sbomify.com/CVE-2024-7686/): SourceCodester Kortex Lite Advocate Office Management System register_case.php cross site scripting (medium 5.3)
- [CVE-2024-7685](https://insights.sbomify.com/CVE-2024-7685/): SourceCodester Kortex Lite Advocate Office Management System adds.php cross site scripting (medium 5.3)
- [CVE-2024-7684](https://insights.sbomify.com/CVE-2024-7684/): SourceCodester Kortex Lite Advocate Office Management System add_act.php cross site scripting (medium 5.3)
- [CVE-2024-7683](https://insights.sbomify.com/CVE-2024-7683/): SourceCodester Kortex Lite Advocate Office Management System addcase_stage.php cross site scripting (medium 5.3)
- [CVE-2024-7682](https://insights.sbomify.com/CVE-2024-7682/): code-projects Job Portal rw_i_nat.php sql injection (medium 6.9)
- [CVE-2024-7681](https://insights.sbomify.com/CVE-2024-7681/): code-projects College Management System Login Page login.php sql injection (medium 6.9)
- [CVE-2024-7680](https://insights.sbomify.com/CVE-2024-7680/): itsourcecode Tailoring Management System incedit.php sql injection (medium 5.3)
- [CVE-2024-7679](https://insights.sbomify.com/CVE-2024-7679/): Improper neutralization special element in hyperlinks (high 7.8)
- [CVE-2024-7678](https://insights.sbomify.com/CVE-2024-7678/): SourceCodester Car Driving School Management System Master.php cross site scripting (medium 5.3)
- [CVE-2024-7677](https://insights.sbomify.com/CVE-2024-7677/): SourceCodester Car Driving School Management System SystemSettings.php update_settings_info cross site scripting (medium 5.3)
- [CVE-2024-7676](https://insights.sbomify.com/CVE-2024-7676/): Sourcecodester Car Driving School Management System Master.php save_package sql injection (medium 5.3)
- [CVE-2024-7675](https://insights.sbomify.com/CVE-2024-7675/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-7674](https://insights.sbomify.com/CVE-2024-7674/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-7673](https://insights.sbomify.com/CVE-2024-7673/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-7672](https://insights.sbomify.com/CVE-2024-7672/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-7671](https://insights.sbomify.com/CVE-2024-7671/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-7670](https://insights.sbomify.com/CVE-2024-7670/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-7669](https://insights.sbomify.com/CVE-2024-7669/): SourceCodester Car Driving School Management System Master.php delete_enrollment sql injection (medium 5.3)
- [CVE-2024-7668](https://insights.sbomify.com/CVE-2024-7668/): SourceCodester Car Driving School Management System Master.php delete_package sql injection (medium 5.3)
- [CVE-2024-7667](https://insights.sbomify.com/CVE-2024-7667/): SourceCodester Car Driving School Management System User.php delete_users sql injection (medium 5.3)
- [CVE-2024-7666](https://insights.sbomify.com/CVE-2024-7666/): SourceCodester Car Driving School Management System view_package.php sql injection (medium 5.3)
- [CVE-2024-7665](https://insights.sbomify.com/CVE-2024-7665/): SourceCodester Car Driving School Management System manage_package.php sql injection (medium 5.3)
- [CVE-2024-7664](https://insights.sbomify.com/CVE-2024-7664/): SourceCodester Car Driving School Management System view_details.php sql injection (medium 5.3)
- [CVE-2024-7663](https://insights.sbomify.com/CVE-2024-7663/): SourceCodester Car Driving School Management System manage_user.php sql injection (medium 5.3)
- [CVE-2024-7662](https://insights.sbomify.com/CVE-2024-7662/): SourceCodester Car Driving School Management System manag_package.php save_package cross-site request forgery (medium 6.9)
- [CVE-2024-7661](https://insights.sbomify.com/CVE-2024-7661/): SourceCodester Car Driving School Management System index.php save_users cross-site request forgery (medium 6.9)
- [CVE-2024-7660](https://insights.sbomify.com/CVE-2024-7660/): SourceCodester File Manager App Add File cross site scripting (medium 5.3)
- [CVE-2024-7659](https://insights.sbomify.com/CVE-2024-7659/): projectsend Password Reset Token functions.php generate_random_string random values (medium 6.3)
- [CVE-2024-7658](https://insights.sbomify.com/CVE-2024-7658/): projectsend process.php get_preview resource injection (medium 6.9)
- [CVE-2024-7657](https://insights.sbomify.com/CVE-2024-7657/): Gila CMS HTTP POST Request page cross site scripting (medium 5.3)
- [CVE-2024-7656](https://insights.sbomify.com/CVE-2024-7656/): Image Hotspot by DevVN <= 1.2.5 - Authenticated (Author+) PHP Object Injection (high 8.8)
- [CVE-2024-7655](https://insights.sbomify.com/CVE-2024-7655/): Cross-site scripting in Community by PeepSo – Download from PeepSo.com (medium 4.4)
- [CVE-2024-7654](https://insights.sbomify.com/CVE-2024-7654/): Unauthenticated Content Injection in OpenEdge Management web interface via ActiveMQ discovery service (high 8.3)
- [CVE-2024-7652](https://insights.sbomify.com/CVE-2024-7652/): Type Confusion in Async Generators in Javascript Engine (high 7.5)
- [CVE-2024-7651](https://insights.sbomify.com/CVE-2024-7651/): SQL injection in App Builder – Create Native Android & iOS Apps On The Flight (medium 5.6)
- [CVE-2024-7650](https://insights.sbomify.com/CVE-2024-7650/): Remote code execution vulnerability discovered in OpenText™ Directory Services CE 23.4 (medium 6.3)
- [CVE-2024-7649](https://insights.sbomify.com/CVE-2024-7649/): Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-7648](https://insights.sbomify.com/CVE-2024-7648/): Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure (medium 4.3)
- [CVE-2024-7647](https://insights.sbomify.com/CVE-2024-7647/): OTA Sync Booking Engine Widget 1.2.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-7646](https://insights.sbomify.com/CVE-2024-7646/): Command injection in ingress-nginx (high 8.8)
- [CVE-2024-7645](https://insights.sbomify.com/CVE-2024-7645/): SourceCodester Clinics Patient Management System User Page users.php cross-site request forgery (medium 6.9)
- [CVE-2024-7644](https://insights.sbomify.com/CVE-2024-7644/): SourceCodester Leads Manager Tool Add Leads add-leads.php cross site scripting (medium 5.3)
- [CVE-2024-7643](https://insights.sbomify.com/CVE-2024-7643/): SourceCodester Leads Manager Tool Delete Leads delete-leads.php sql injection (medium 5.3)
- [CVE-2024-7642](https://insights.sbomify.com/CVE-2024-7642/): SourceCodester Kortex Lite Advocate Office Management System activate_act.php sql injection (medium 5.3)
- [CVE-2024-7641](https://insights.sbomify.com/CVE-2024-7641/): SourceCodester Kortex Lite Advocate Office Management System deactivate_act.php sql injection (medium 5.3)
- [CVE-2024-7640](https://insights.sbomify.com/CVE-2024-7640/): SourceCodester Kortex Lite Advocate Office Management System delete_register.php sql injection (medium 5.3)
- [CVE-2024-7639](https://insights.sbomify.com/CVE-2024-7639/): SourceCodester Kortex Lite Advocate Office Management System delete_act.php sql injection (medium 5.3)
- [CVE-2024-7638](https://insights.sbomify.com/CVE-2024-7638/): SourceCodester Kortex Lite Advocate Office Management System delete_client.php sql injection (medium 5.3)
- [CVE-2024-7637](https://insights.sbomify.com/CVE-2024-7637/): code-projects Online Polling Registration registeracc.php sql injection (medium 6.9)
- [CVE-2024-7636](https://insights.sbomify.com/CVE-2024-7636/): code-projects Simple Ticket Booking Login authenticate.php sql injection (medium 6.9)
- [CVE-2024-7635](https://insights.sbomify.com/CVE-2024-7635/): code-projects Simple Ticket Booking Registration register_insert.php sql injection (medium 6.9)
- [CVE-2024-7634](https://insights.sbomify.com/CVE-2024-7634/): NGINX Agent Vulnerability (medium 6.9)
- [CVE-2024-7631](https://insights.sbomify.com/CVE-2024-7631/): Openshift-console: openshift console: path traversal (medium 4.3)
- [CVE-2024-7630](https://insights.sbomify.com/CVE-2024-7630/): Relevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information Exposure (medium 5.3)
- [CVE-2024-7629](https://insights.sbomify.com/CVE-2024-7629/): Responsive Video <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-7628](https://insights.sbomify.com/CVE-2024-7628/): MStore API – Create Native Android & iOS Apps On The Cloud <= 4.15.2 - Authentication Bypass to Account Takeover (high 8.1)
- [CVE-2024-7627](https://insights.sbomify.com/CVE-2024-7627/): Bit File Manager 6.0 - 6.5.5 - Unauthenticated Remote Code Execution via Race Condition (high 8.1)
- [CVE-2024-7626](https://insights.sbomify.com/CVE-2024-7626/): Path traversal in WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) (high 8.1)
- [CVE-2024-7625](https://insights.sbomify.com/CVE-2024-7625/): Nomad Vulnerable to Allocation Directory Escape On Non-Existing File Paths Through Archive Unpacking (medium 5.8)
- [CVE-2024-7624](https://insights.sbomify.com/CVE-2024-7624/): Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation (high 8.1)
- [CVE-2024-7622](https://insights.sbomify.com/CVE-2024-7622/): Revision Manager TMC <= 2.8.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending (medium 4.3)
- [CVE-2024-7621](https://insights.sbomify.com/CVE-2024-7621/): Missing authorization in Atarim – Visual Feedback, Review & AI Collaboration (medium 5.4)
- [CVE-2024-7620](https://insights.sbomify.com/CVE-2024-7620/): Customizer Export/Import <= 0.9.7 - Authenticated (Admin+) Arbitrary File Upload via Customization Settings Import (medium 6.6)
- [CVE-2024-7618](https://insights.sbomify.com/CVE-2024-7618/): Cross-site scripting in Community by PeepSo – Download from PeepSo.com (medium 4.4)
- [CVE-2024-7617](https://insights.sbomify.com/CVE-2024-7617/): Contact Form to Any API <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Contact Form (high 7.2)
- [CVE-2024-7616](https://insights.sbomify.com/CVE-2024-7616/): Edimax IC-6220DC/IC-5150W ipcam_cgi cgiFormString command injection (medium 5.1)
- [CVE-2024-7615](https://insights.sbomify.com/CVE-2024-7615/): Tenda FH1206 fromSafeUrlFilter stack-based overflow (high 8.7)
- [CVE-2024-7614](https://insights.sbomify.com/CVE-2024-7614/): Tenda FH1206 qossetting fromqossetting stack-based overflow (high 8.7)
- [CVE-2024-7613](https://insights.sbomify.com/CVE-2024-7613/): Tenda FH1206 GstDhcpSetSer fromGstDhcpSetSer buffer overflow (high 8.7)
- [CVE-2024-7612](https://insights.sbomify.com/CVE-2024-7612/): Misconfiguration in Endpoint Manager Mobile (high 8.8)
- [CVE-2024-7611](https://insights.sbomify.com/CVE-2024-7611/): Cross-site scripting in Enter Addons – Ultimate Template Builder for Elementor (medium 6.4)
- [CVE-2024-7610](https://insights.sbomify.com/CVE-2024-7610/): Uncontrolled Resource Consumption in GitLab (medium 4.3)
- [CVE-2024-7609](https://insights.sbomify.com/CVE-2024-7609/): Directory Traversal in Vidco Software's VOC TESTER (critical 9.2)
- [CVE-2024-7608](https://insights.sbomify.com/CVE-2024-7608/): Path traversal in Trellix NX, EX, AX, FX, CMS and IVX (medium 5.9)
- [CVE-2024-7607](https://insights.sbomify.com/CVE-2024-7607/): Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection (high 8.8)
- [CVE-2024-7606](https://insights.sbomify.com/CVE-2024-7606/): Front End Users <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-7605](https://insights.sbomify.com/CVE-2024-7605/): HelloAsso <= 1.1.10 - Missing Authorization to Authenticated (Contributor+) Limited Options Update (medium 4.3)
- [CVE-2024-7604](https://insights.sbomify.com/CVE-2024-7604/): Logsign Unified SecOps Platform Incorrect Authorization Authentication Bypass Vulnerability (medium 5.1)
- [CVE-2024-7603](https://insights.sbomify.com/CVE-2024-7603/): Logsign Unified SecOps Platform Directory Traversal Arbitrary Directory Deletion Vulnerability (high 7.1)
- [CVE-2024-7602](https://insights.sbomify.com/CVE-2024-7602/): Logsign Unified SecOps Platform Directory Traversal Information Disclosure Vulnerability (medium 6.5)
- [CVE-2024-7601](https://insights.sbomify.com/CVE-2024-7601/): Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion Vulnerability (high 7.1)
- [CVE-2024-7600](https://insights.sbomify.com/CVE-2024-7600/): Logsign Unified SecOps Platform Directory Traversal Arbitrary File Deletion Vulnerability (high 7.1)
- [CVE-2024-7599](https://insights.sbomify.com/CVE-2024-7599/): Advanced Sermons <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-7598](https://insights.sbomify.com/CVE-2024-7598/): Network restriction bypass via race condition during namespace termination (low 3.1)
- [CVE-2024-7596](https://insights.sbomify.com/CVE-2024-7596/): Generic UDP Encapsulation (GUE) (IETF Draft) do not validate or verify the source of a network packet (medium 5.3)
- [CVE-2024-7595](https://insights.sbomify.com/CVE-2024-7595/): GRE and GRE6 Protocols (RFC2784) do not validate or verify the source of a network packet (medium 5.3)
- [CVE-2024-7594](https://insights.sbomify.com/CVE-2024-7594/): Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default (high 7.5)
- [CVE-2024-7593](https://insights.sbomify.com/CVE-2024-7593/): Ivanti Virtual Traffic Manager Authentication Bypass (critical 9.8, exploited in the wild)
- [CVE-2024-7592](https://insights.sbomify.com/CVE-2024-7592/): Quadratic complexity parsing cookies with backslashes (high 7.5)
- [CVE-2024-7591](https://insights.sbomify.com/CVE-2024-7591/): Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection (critical 10.0)
- [CVE-2024-7590](https://insights.sbomify.com/CVE-2024-7590/): WordPress Spectra plugin<= 2.14.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-7589](https://insights.sbomify.com/CVE-2024-7589/): OpenSSH pre-authentication async signal safety issue (high 8.1)
- [CVE-2024-7588](https://insights.sbomify.com/CVE-2024-7588/): Cross-site scripting in Post Grid (medium 6.4)
- [CVE-2024-7587](https://insights.sbomify.com/CVE-2024-7587/): Misconfiguration in GENESIS32 (high 7.8)
- [CVE-2024-7586](https://insights.sbomify.com/CVE-2024-7586/): Insertion of Sensitive Information into Log File in GitLab (medium 4.1)
- [CVE-2024-7585](https://insights.sbomify.com/CVE-2024-7585/): Tenda i22 apPortalAuth formApPortalWebAuth buffer overflow (high 8.7)
- [CVE-2024-7584](https://insights.sbomify.com/CVE-2024-7584/): Tenda i22 apPortalPhoneAuth formApPortalPhoneAuth buffer overflow (high 8.7)
- [CVE-2024-7583](https://insights.sbomify.com/CVE-2024-7583/): Tenda i22 apPortalOneKeyAuth formApPortalOneKeyAuth buffer overflow (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/158/