# Vulnerabilities published in 2024


- [CVE-2024-7367](https://insights.sbomify.com/CVE-2024-7367/): SourceCodester Simple Realtime Quiz System ajax.php cross-site request forgery (medium 6.9)
- [CVE-2024-7366](https://insights.sbomify.com/CVE-2024-7366/): SourceCodester Tracking Monitoring Management System Login ajax.php sql injection (medium 6.9)
- [CVE-2024-7365](https://insights.sbomify.com/CVE-2024-7365/): SourceCodester Tracking Monitoring Management System manage_establishment.php sql injection (medium 5.3)
- [CVE-2024-7364](https://insights.sbomify.com/CVE-2024-7364/): SourceCodester Tracking Monitoring Management System manage_records.php sql injection (medium 5.3)
- [CVE-2024-7363](https://insights.sbomify.com/CVE-2024-7363/): SourceCodester Tracking Monitoring Management System manage_person.php sql injection (medium 5.3)
- [CVE-2024-7362](https://insights.sbomify.com/CVE-2024-7362/): SourceCodester Tracking Monitoring Management System manage_user.php sql injection (medium 5.3)
- [CVE-2024-7361](https://insights.sbomify.com/CVE-2024-7361/): SourceCodester Tracking Monitoring Management System ajax.php sql injection (medium 5.3)
- [CVE-2024-7360](https://insights.sbomify.com/CVE-2024-7360/): SourceCodester Tracking Monitoring Management System ajax.php cross-site request forgery (medium 6.9)
- [CVE-2024-7359](https://insights.sbomify.com/CVE-2024-7359/): SourceCodester Tracking Monitoring Management System ajax.php cross site scripting (medium 5.3)
- [CVE-2024-7358](https://insights.sbomify.com/CVE-2024-7358/): Point B Ltd Getscreen Agent Installation getscreen.msi temp file (high 8.5)
- [CVE-2024-7357](https://insights.sbomify.com/CVE-2024-7357/): D-Link DIR-600 soap.cgi soapcgi_main os command injection (medium 5.3)
- [CVE-2024-7356](https://insights.sbomify.com/CVE-2024-7356/): Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter (medium 6.4)
- [CVE-2024-7355](https://insights.sbomify.com/CVE-2024-7355/): Cross-site scripting in Organization chart (medium 4.9)
- [CVE-2024-7354](https://insights.sbomify.com/CVE-2024-7354/): Ninja Forms 3.8.6-3.8.10 - Reflected XSS (medium 6.1)
- [CVE-2024-7353](https://insights.sbomify.com/CVE-2024-7353/): Cross-site scripting in Accept Stripe Payments (medium 5.4)
- [CVE-2024-7352](https://insights.sbomify.com/CVE-2024-7352/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-7351](https://insights.sbomify.com/CVE-2024-7351/): Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection (high 7.2)
- [CVE-2024-7350](https://insights.sbomify.com/CVE-2024-7350/): Auth bypass in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress (critical 9.8)
- [CVE-2024-7349](https://insights.sbomify.com/CVE-2024-7349/): LifterLMS <= 7.7.5 - Authenticated (Admin+) SQL Injection (high 7.2)
- [CVE-2024-7348](https://insights.sbomify.com/CVE-2024-7348/): PostgreSQL relation replacement during pg_dump executes arbitrary SQL (high 8.8)
- [CVE-2024-7347](https://insights.sbomify.com/CVE-2024-7347/): NGINX MP4 module vulnerability (medium 5.7)
- [CVE-2024-7346](https://insights.sbomify.com/CVE-2024-7346/): Client connections using default TLS certificates from OpenEdge may bypass TLS host name validation (high 7.2)
- [CVE-2024-7345](https://insights.sbomify.com/CVE-2024-7345/): Direct local client connections to MS Agents can bypass authentication (high 8.3)
- [CVE-2024-7344](https://insights.sbomify.com/CVE-2024-7344/): Security feature bypass in CES NeoImpact (high 8.2)
- [CVE-2024-7343](https://insights.sbomify.com/CVE-2024-7343/): Baidu UEditor cross site scripting (medium 5.3)
- [CVE-2024-7342](https://insights.sbomify.com/CVE-2024-7342/): Baidu UEditor unrestricted upload (medium 5.3)
- [CVE-2024-7341](https://insights.sbomify.com/CVE-2024-7341/): Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters (high 7.1)
- [CVE-2024-7340](https://insights.sbomify.com/CVE-2024-7340/): W&B Weave server remote arbitrary file leak and privilege escalation (high 8.8)
- [CVE-2024-7339](https://insights.sbomify.com/CVE-2024-7339/): TVT DVR TD-2104TS-CL queryDevInfo information disclosure (medium 6.9)
- [CVE-2024-7338](https://insights.sbomify.com/CVE-2024-7338/): TOTOLINK EX1200L cstecgi.cgi setParentalRules buffer overflow (high 8.7)
- [CVE-2024-7337](https://insights.sbomify.com/CVE-2024-7337/): TOTOLINK EX1200L cstecgi.cgi loginauth buffer overflow (high 8.7)
- [CVE-2024-7336](https://insights.sbomify.com/CVE-2024-7336/): TOTOLINK EX200 cstecgi.cgi loginauth buffer overflow (high 8.7)
- [CVE-2024-7335](https://insights.sbomify.com/CVE-2024-7335/): TOTOLINK EX200 getSaveConfig buffer overflow (high 8.7)
- [CVE-2024-7334](https://insights.sbomify.com/CVE-2024-7334/): TOTOLINK EX1200L cstecgi.cgi UploadCustomModule buffer overflow (high 8.7)
- [CVE-2024-7333](https://insights.sbomify.com/CVE-2024-7333/): TOTOLINK N350RT cstecgi.cgi setParentalRules buffer overflow (high 8.7)
- [CVE-2024-7332](https://insights.sbomify.com/CVE-2024-7332/): TOTOLINK CP450 Telnet Service product.ini hard-coded password (critical 9.3)
- [CVE-2024-7331](https://insights.sbomify.com/CVE-2024-7331/): TOTOLINK A3300R cstecgi.cgi UploadCustomModule buffer overflow (high 8.7)
- [CVE-2024-7330](https://insights.sbomify.com/CVE-2024-7330/): YouDianCMS ydLib.php curl_exec server-side request forgery (medium 5.3)
- [CVE-2024-7329](https://insights.sbomify.com/CVE-2024-7329/): YouDianCMS image_upload.php unrestricted upload (medium 5.3)
- [CVE-2024-7328](https://insights.sbomify.com/CVE-2024-7328/): YouDianCMS information disclosure (medium 6.9)
- [CVE-2024-7327](https://insights.sbomify.com/CVE-2024-7327/): Xinhu RockOA openmodhetongAction.php dataAction sql injection (medium 5.3)
- [CVE-2024-7326](https://insights.sbomify.com/CVE-2024-7326/): IObit DualSafe Password Manager BPL RTL120.BPL uncontrolled search path (high 8.5)
- [CVE-2024-7325](https://insights.sbomify.com/CVE-2024-7325/): IObit Driver Booster BPL VCL120.BPL uncontrolled search path (high 8.5)
- [CVE-2024-7324](https://insights.sbomify.com/CVE-2024-7324/): IObit iTop Data Recovery Pro BPL madbasic_.bpl uncontrolled search path (high 8.5)
- [CVE-2024-7323](https://insights.sbomify.com/CVE-2024-7323/): Digiwin EasyFlow .NET - Arbitrary File Download (medium 6.5)
- [CVE-2024-7322](https://insights.sbomify.com/CVE-2024-7322/): Dos in ZigBee device due to unsolicited encrypted rejoin response (medium 5.8)
- [CVE-2024-7321](https://insights.sbomify.com/CVE-2024-7321/): itsourcecode Online Blood Bank Management System User Registration signup.php cross site scripting (medium 6.9)
- [CVE-2024-7320](https://insights.sbomify.com/CVE-2024-7320/): itsourcecode Online Blood Bank Management System Admin Login index.php sql injection (medium 6.9)
- [CVE-2024-7319](https://insights.sbomify.com/CVE-2024-7319/): Openstack-heat: incomplete fix for cve-2023-1625 (medium 5.0)
- [CVE-2024-7318](https://insights.sbomify.com/CVE-2024-7318/): Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity (medium 4.8)
- [CVE-2024-7317](https://insights.sbomify.com/CVE-2024-7317/): Cross-site scripting in Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager (medium 6.4)
- [CVE-2024-7316](https://insights.sbomify.com/CVE-2024-7316/): Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC Series (medium 5.9)
- [CVE-2024-7315](https://insights.sbomify.com/CVE-2024-7315/): Migration, Backup, Staging – WPvivid < 0.9.106 - Unauthenticated Sensitive Data Exposure (high 7.5)
- [CVE-2024-7314](https://insights.sbomify.com/CVE-2024-7314/): anji-plus AJ-Report Authentication Bypass (critical 9.8)
- [CVE-2024-7313](https://insights.sbomify.com/CVE-2024-7313/): Shield Security < 20.0.6 - Reflected XSS (medium 6.1)
- [CVE-2024-7312](https://insights.sbomify.com/CVE-2024-7312/): REST Interface Link Redirection via Host parameter (high 7.0)
- [CVE-2024-7311](https://insights.sbomify.com/CVE-2024-7311/): code-projects Online Bus Reservation Site register.php sql injection (medium 6.9)
- [CVE-2024-7310](https://insights.sbomify.com/CVE-2024-7310/): SourceCodester Record Management System sort_user.php cross site scripting (medium 5.3)
- [CVE-2024-7309](https://insights.sbomify.com/CVE-2024-7309/): SourceCodester Record Management System entry.php cross site scripting (medium 5.3)
- [CVE-2024-7308](https://insights.sbomify.com/CVE-2024-7308/): SourceCodester Establishment Billing Management System view_bill.php sql injection (medium 5.3)
- [CVE-2024-7307](https://insights.sbomify.com/CVE-2024-7307/): SourceCodester Establishment Billing Management System manage_billing.php sql injection (medium 5.3)
- [CVE-2024-7306](https://insights.sbomify.com/CVE-2024-7306/): SourceCodester Establishment Billing Management System manage_block.php sql injection (medium 5.3)
- [CVE-2024-7305](https://insights.sbomify.com/CVE-2024-7305/): DWF Vulnerability in Autodesk Desktop Software (high 7.8)
- [CVE-2024-7304](https://insights.sbomify.com/CVE-2024-7304/): Cross-site scripting in Ninja Tables – Easy Data Table Builder (medium 6.4)
- [CVE-2024-7303](https://insights.sbomify.com/CVE-2024-7303/): itsourcecode Online Blood Bank Management System Send Blood Request Page request.php cross site scripting (medium 5.3)
- [CVE-2024-7302](https://insights.sbomify.com/CVE-2024-7302/): Cross-site scripting in Blog2Social: Social Media Auto Post & Scheduler (medium 6.4)
- [CVE-2024-7301](https://insights.sbomify.com/CVE-2024-7301/): WordPress File Upload <= 4.24.8 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload (high 7.2)
- [CVE-2024-7300](https://insights.sbomify.com/CVE-2024-7300/): Bolt CMS Showcase Creation showcases cross site scripting (medium 5.3)
- [CVE-2024-7299](https://insights.sbomify.com/CVE-2024-7299/): Bolt CMS Entry Preview page cross site scripting (medium 5.3)
- [CVE-2024-7297](https://insights.sbomify.com/CVE-2024-7297/): Langflow Privilege Escalation (high 8.8)
- [CVE-2024-7296](https://insights.sbomify.com/CVE-2024-7296/): Incorrect Authorization in GitLab (low 2.7)
- [CVE-2024-7295](https://insights.sbomify.com/CVE-2024-7295/): Hard-coded credentials used for temporary and cache data encryption (high 7.1)
- [CVE-2024-7294](https://insights.sbomify.com/CVE-2024-7294/): Uncontrolled resource consumption of anonymous endpoints (high 7.5)
- [CVE-2024-7293](https://insights.sbomify.com/CVE-2024-7293/): Password policy for new users is not strong enough (high 7.5)
- [CVE-2024-7292](https://insights.sbomify.com/CVE-2024-7292/): Account Controller allows high count of login attempts (high 7.5)
- [CVE-2024-7291](https://insights.sbomify.com/CVE-2024-7291/): JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation (high 7.2)
- [CVE-2024-7290](https://insights.sbomify.com/CVE-2024-7290/): SourceCodester Establishment Billing Management System manage_tenant.php sql injection (medium 5.3)
- [CVE-2024-7289](https://insights.sbomify.com/CVE-2024-7289/): SourceCodester Establishment Billing Management System manage_payment.php sql injection (medium 5.3)
- [CVE-2024-7288](https://insights.sbomify.com/CVE-2024-7288/): SourceCodester Establishment Billing Management System sql injection (medium 5.3)
- [CVE-2024-7287](https://insights.sbomify.com/CVE-2024-7287/): SourceCodester Establishment Billing Management System manage_user.php sql injection (medium 5.3)
- [CVE-2024-7286](https://insights.sbomify.com/CVE-2024-7286/): SourceCodester Establishment Billing Management System Login sql injection (medium 6.9)
- [CVE-2024-7285](https://insights.sbomify.com/CVE-2024-7285/): SourceCodester Establishment Billing Management System cross site scripting (medium 5.3)
- [CVE-2024-7284](https://insights.sbomify.com/CVE-2024-7284/): SourceCodester Lot Reservation Management System cross site scripting (medium 5.3)
- [CVE-2024-7283](https://insights.sbomify.com/CVE-2024-7283/): SourceCodester Lot Reservation Management System manage_user.php sql injection (medium 5.3)
- [CVE-2024-7282](https://insights.sbomify.com/CVE-2024-7282/): SourceCodester Lot Reservation Management System manage_model.php sql injection (medium 5.3)
- [CVE-2024-7281](https://insights.sbomify.com/CVE-2024-7281/): SourceCodester Lot Reservation Management System sql injection (medium 5.3)
- [CVE-2024-7280](https://insights.sbomify.com/CVE-2024-7280/): SourceCodester Lot Reservation Management System view_reserved.php sql injection (medium 5.3)
- [CVE-2024-7279](https://insights.sbomify.com/CVE-2024-7279/): SourceCodester Lot Reservation Management System sql injection (medium 6.9)
- [CVE-2024-7278](https://insights.sbomify.com/CVE-2024-7278/): itsourcecode Alton Management System team_save.php sql injection (medium 5.1)
- [CVE-2024-7277](https://insights.sbomify.com/CVE-2024-7277/): itsourcecode Alton Management System Add a Menu menu.php unrestricted upload (medium 5.1)
- [CVE-2024-7276](https://insights.sbomify.com/CVE-2024-7276/): itsourcecode Alton Management System member_save.php sql injection (medium 5.1)
- [CVE-2024-7275](https://insights.sbomify.com/CVE-2024-7275/): itsourcecode Alton Management System category_save.php sql injection (medium 5.1)
- [CVE-2024-7274](https://insights.sbomify.com/CVE-2024-7274/): itsourcecode Alton Management System reservation_status.php sql injection (medium 5.1)
- [CVE-2024-7273](https://insights.sbomify.com/CVE-2024-7273/): itsourcecode Alton Management System search.php sql injection (medium 5.3)
- [CVE-2024-7272](https://insights.sbomify.com/CVE-2024-7272/): FFmpeg swresample.c fill_audiodata heap-based overflow (medium 6.9)
- [CVE-2024-7269](https://insights.sbomify.com/CVE-2024-7269/): Stored XSS in ConnX ESP HR Management (high 8.7)
- [CVE-2024-7267](https://insights.sbomify.com/CVE-2024-7267/): Internal infrastructure data leak in EZD RP (high 7.1)
- [CVE-2024-7266](https://insights.sbomify.com/CVE-2024-7266/): Users listing in EZD RP (high 7.1)
- [CVE-2024-7265](https://insights.sbomify.com/CVE-2024-7265/): Privilege Escalation in EZD RP (high 8.7)
- [CVE-2024-7264](https://insights.sbomify.com/CVE-2024-7264/): ASN.1 date parser overread (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/161/