# Vulnerabilities published in 2024


- [CVE-2024-7041](https://insights.sbomify.com/CVE-2024-7041/): IDOR in open-webui/open-webui (medium 6.5)
- [CVE-2024-7035](https://insights.sbomify.com/CVE-2024-7035/): Cross-Site Request Forgery (CSRF) in open-webui/open-webui (medium 6.9)
- [CVE-2024-7032](https://insights.sbomify.com/CVE-2024-7032/): Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Plugin Deactivation and Data Deletion (medium 6.5)
- [CVE-2024-7031](https://insights.sbomify.com/CVE-2024-7031/): File Manager Pro – Filester <= 1.8.2 - Authenticated Plugin Settings Update (high 7.5)
- [CVE-2024-7030](https://insights.sbomify.com/CVE-2024-7030/): Smart Online Order for Clover <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Plugin Data Update (medium 4.3)
- [CVE-2024-7029](https://insights.sbomify.com/CVE-2024-7029/): Command Injection in AVTech AVM1203 (IP Camera) (high 8.7)
- [CVE-2024-7027](https://insights.sbomify.com/CVE-2024-7027/): WooCommerce - PDF Vouchers <= 4.9.3 - Authentication Bypass to Voucher Vendor (high 7.3)
- [CVE-2024-7026](https://insights.sbomify.com/CVE-2024-7026/): SQLi in Teknogis Informatics' Closed Circuit Vehicle Tracking Software (high 7.5)
- [CVE-2024-7025](https://insights.sbomify.com/CVE-2024-7025/): Integer overflow in Chrome (high 8.8)
- [CVE-2024-7024](https://insights.sbomify.com/CVE-2024-7024/): Memory corruption in Chrome (critical 9.3)
- [CVE-2024-7023](https://insights.sbomify.com/CVE-2024-7023/): Privilege escalation in Chrome (high 8.0)
- [CVE-2024-7022](https://insights.sbomify.com/CVE-2024-7022/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7021](https://insights.sbomify.com/CVE-2024-7021/): Other in Chrome (medium 4.3)
- [CVE-2024-7020](https://insights.sbomify.com/CVE-2024-7020/): Other in Chrome (medium 4.3)
- [CVE-2024-7019](https://insights.sbomify.com/CVE-2024-7019/): Other in Chrome (medium 4.3)
- [CVE-2024-7018](https://insights.sbomify.com/CVE-2024-7018/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-7017](https://insights.sbomify.com/CVE-2024-7017/): Race condition in Chrome (high 7.5)
- [CVE-2024-7016](https://insights.sbomify.com/CVE-2024-7016/): Stored XSS in Smarttek Informatics' Smart Doctor (medium 4.8)
- [CVE-2024-7015](https://insights.sbomify.com/CVE-2024-7015/): Improper Authentication in Profelis Informatics and Consulting's PassBOX (high 7.1)
- [CVE-2024-7014](https://insights.sbomify.com/CVE-2024-7014/): Improper multimedia file attachment validation in Telegram for Android app (high 7.1)
- [CVE-2024-7013](https://insights.sbomify.com/CVE-2024-7013/): Memory corruption in Control FPWIN Pro (high 7.8)
- [CVE-2024-7012](https://insights.sbomify.com/CVE-2024-7012/): Puppet-foreman: an authentication bypass vulnerability exists in foreman (critical 9.8)
- [CVE-2024-7011](https://insights.sbomify.com/CVE-2024-7011/): Denial of service in NP-CA4120X (medium 6.5)
- [CVE-2024-7010](https://insights.sbomify.com/CVE-2024-7010/): Timing Attack in mudler/localai (high 7.5)
- [CVE-2024-7009](https://insights.sbomify.com/CVE-2024-7009/): Calibre SQL Injection (medium 4.2)
- [CVE-2024-7008](https://insights.sbomify.com/CVE-2024-7008/): Calibre Reflected Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2024-7007](https://insights.sbomify.com/CVE-2024-7007/): Authentication Bypass Using an Alternate Path or Channel in Positron Broadcast Signal Processor TRA7005 (high 8.7)
- [CVE-2024-7006](https://insights.sbomify.com/CVE-2024-7006/): Libtiff: null pointer dereference in tif_dirinfo.c (high 7.5)
- [CVE-2024-7005](https://insights.sbomify.com/CVE-2024-7005/): Security feature bypass in Chrome (high 8.8)
- [CVE-2024-7004](https://insights.sbomify.com/CVE-2024-7004/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2024-7003](https://insights.sbomify.com/CVE-2024-7003/): Other in Chrome (medium 4.3)
- [CVE-2024-7001](https://insights.sbomify.com/CVE-2024-7001/): Other in Chrome (medium 4.3)
- [CVE-2024-7000](https://insights.sbomify.com/CVE-2024-7000/): Use after free in Chrome (high 8.8)
- [CVE-2024-6999](https://insights.sbomify.com/CVE-2024-6999/): Other in Chrome (medium 4.3)
- [CVE-2024-6998](https://insights.sbomify.com/CVE-2024-6998/): Use after free in Chrome (high 8.8)
- [CVE-2024-6997](https://insights.sbomify.com/CVE-2024-6997/): Use after free in Chrome (high 8.8)
- [CVE-2024-6996](https://insights.sbomify.com/CVE-2024-6996/): Race condition in Chrome (low 3.1)
- [CVE-2024-6995](https://insights.sbomify.com/CVE-2024-6995/): Security feature bypass in Chrome (high 8.8)
- [CVE-2024-6994](https://insights.sbomify.com/CVE-2024-6994/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-6991](https://insights.sbomify.com/CVE-2024-6991/): Use after free in Chrome (high 8.8)
- [CVE-2024-6990](https://insights.sbomify.com/CVE-2024-6990/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-6989](https://insights.sbomify.com/CVE-2024-6989/): Use after free in Chrome (high 8.8)
- [CVE-2024-6988](https://insights.sbomify.com/CVE-2024-6988/): Use after free in Chrome (high 8.8)
- [CVE-2024-6987](https://insights.sbomify.com/CVE-2024-6987/): Orchid Store <= 1.5.6 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation (medium 4.3)
- [CVE-2024-6986](https://insights.sbomify.com/CVE-2024-6986/): Cross-site Scripting (XSS) in parisneo/lollms-webui (medium 5.5)
- [CVE-2024-6985](https://insights.sbomify.com/CVE-2024-6985/): Path Traversal in api open_personality_folder in parisneo/lollms-webui (medium 4.4)
- [CVE-2024-6984](https://insights.sbomify.com/CVE-2024-6984/): Juju's unprivileged user running on charm node can leak any secret or relation data accessible to the local charm (high 8.8)
- [CVE-2024-6983](https://insights.sbomify.com/CVE-2024-6983/): Remote Code Execution in mudler/localai (high 8.8)
- [CVE-2024-6982](https://insights.sbomify.com/CVE-2024-6982/): Remote Code Execution in Calculate Function in parisneo/lollms (high 8.4)
- [CVE-2024-6981](https://insights.sbomify.com/CVE-2024-6981/): OMNTEC Proteus Tank Monitoring Missing Authentication for Critical Function (critical 9.3)
- [CVE-2024-6980](https://insights.sbomify.com/CVE-2024-6980/): Verbose error handling issue in GravityZone Update Server proxy service (critical 9.2)
- [CVE-2024-6979](https://insights.sbomify.com/CVE-2024-6979/): Privilege escalation in AXIS OS (medium 6.8)
- [CVE-2024-6978](https://insights.sbomify.com/CVE-2024-6978/): Cato Networks Windows SDP Client Local root certificates can be installed by low-privileged users (medium 5.6)
- [CVE-2024-6977](https://insights.sbomify.com/CVE-2024-6977/): Cato Networks Windows SDP Client Sensitive data in trace logs can lead to account takeover (medium 6.5)
- [CVE-2024-6975](https://insights.sbomify.com/CVE-2024-6975/): Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file (high 8.8)
- [CVE-2024-6974](https://insights.sbomify.com/CVE-2024-6974/): Cato Networks Windows SDP Client Local Privilege Escalation via self-upgrade (high 8.8)
- [CVE-2024-6973](https://insights.sbomify.com/CVE-2024-6973/): Remote Code Execution in Cato Windows SDP client via crafted URLs (high 7.5)
- [CVE-2024-6972](https://insights.sbomify.com/CVE-2024-6972/): Information disclosure in Octopus Server (medium 6.5)
- [CVE-2024-6971](https://insights.sbomify.com/CVE-2024-6971/): Path Traversal in parisneo/lollms-webui (low 3.4)
- [CVE-2024-6970](https://insights.sbomify.com/CVE-2024-6970/): itsourcecode Tailoring Management System staffcatadd.php sql injection (medium 5.3)
- [CVE-2024-6969](https://insights.sbomify.com/CVE-2024-6969/): SourceCodester Clinics Patient Management System get_patient_history.php sql injection (medium 5.3)
- [CVE-2024-6968](https://insights.sbomify.com/CVE-2024-6968/): SourceCodester Clinics Patient Management System print_patients_visits.php sql injection (medium 5.3)
- [CVE-2024-6967](https://insights.sbomify.com/CVE-2024-6967/): SourceCodester Employee and Visitor Gate Pass Logging System sql injection (medium 5.3)
- [CVE-2024-6966](https://insights.sbomify.com/CVE-2024-6966/): itsourcecode Online Blood Bank Management System Login login.php sql injection (medium 6.9)
- [CVE-2024-6965](https://insights.sbomify.com/CVE-2024-6965/): Tenda O3 fromVirtualSet stack-based overflow (high 8.7)
- [CVE-2024-6964](https://insights.sbomify.com/CVE-2024-6964/): Tenda O3 fromDhcpSetSer stack-based overflow (high 8.7)
- [CVE-2024-6963](https://insights.sbomify.com/CVE-2024-6963/): Tenda O3 formexeCommand stack-based overflow (high 8.7)
- [CVE-2024-6962](https://insights.sbomify.com/CVE-2024-6962/): Tenda O3 formQosSet stack-based overflow (high 8.7)
- [CVE-2024-6961](https://insights.sbomify.com/CVE-2024-6961/): XXE in Guardrails AI when consuming RAIL documents (medium 5.9)
- [CVE-2024-6960](https://insights.sbomify.com/CVE-2024-6960/): H2O deserializes ML models without filtering, potentially allowing execution of malicious code (high 7.5)
- [CVE-2024-6959](https://insights.sbomify.com/CVE-2024-6959/): Denial of Service (DOS) in multipart boundary while uploading file in parisneo/lollms-webui (high 7.1)
- [CVE-2024-6958](https://insights.sbomify.com/CVE-2024-6958/): itsourcecode University Management System Avatar File st_update.php unrestricted upload (medium 5.3)
- [CVE-2024-6957](https://insights.sbomify.com/CVE-2024-6957/): itsourcecode University Management System Login functions.php sql injection (medium 6.9)
- [CVE-2024-6956](https://insights.sbomify.com/CVE-2024-6956/): itsourcecode University Management System view_cgpa.php sql injection (medium 5.3)
- [CVE-2024-6955](https://insights.sbomify.com/CVE-2024-6955/): SourceCodester Record Management System sort2.php cross site scripting (medium 5.3)
- [CVE-2024-6954](https://insights.sbomify.com/CVE-2024-6954/): SourceCodester Record Management System sort1.php cross site scripting (medium 5.3)
- [CVE-2024-6953](https://insights.sbomify.com/CVE-2024-6953/): itsourcecode Tailoring Management System sms.php sql injection (medium 5.3)
- [CVE-2024-6952](https://insights.sbomify.com/CVE-2024-6952/): itsourcecode University Management System sql injection (medium 5.3)
- [CVE-2024-6951](https://insights.sbomify.com/CVE-2024-6951/): SourceCodester Simple Online Book Store System admin_delete.php sql injection (medium 5.3)
- [CVE-2024-6950](https://insights.sbomify.com/CVE-2024-6950/): Prain HTTP POST Request ?import code injection (medium 5.3)
- [CVE-2024-6949](https://insights.sbomify.com/CVE-2024-6949/): Gargaj wuhu path traversal (medium 5.3)
- [CVE-2024-6948](https://insights.sbomify.com/CVE-2024-6948/): Gargaj wuhu Slide Editor slideeditor.php unrestricted upload (medium 5.3)
- [CVE-2024-6947](https://insights.sbomify.com/CVE-2024-6947/): Flute CMS Notification ContentParser.php replaceContent code injection (medium 5.1)
- [CVE-2024-6946](https://insights.sbomify.com/CVE-2024-6946/): Flute CMS list code injection (medium 5.1)
- [CVE-2024-6945](https://insights.sbomify.com/CVE-2024-6945/): Flute CMS Avatar Upload Page ImagesController.php unrestricted upload (medium 5.3)
- [CVE-2024-6944](https://insights.sbomify.com/CVE-2024-6944/): ZhongBangKeJi CRMEB PublicController.php get_image_base64 deserialization (medium 5.3)
- [CVE-2024-6943](https://insights.sbomify.com/CVE-2024-6943/): ZhongBangKeJi CRMEB CopyTaobaoServices.php downloadImage deserialization (medium 5.3)
- [CVE-2024-6942](https://insights.sbomify.com/CVE-2024-6942/): ThinkSAAS Admin Panel Security Center anti.php cross site scripting (medium 5.3)
- [CVE-2024-6941](https://insights.sbomify.com/CVE-2024-6941/): ThinkSAAS do.php cross site scripting (medium 5.3)
- [CVE-2024-6940](https://insights.sbomify.com/CVE-2024-6940/): DedeCMS article_template_rand.php code injection (medium 5.1)
- [CVE-2024-6939](https://insights.sbomify.com/CVE-2024-6939/): Xinhu RockOA tpl_upload.html okla cross site scripting (medium 5.3)
- [CVE-2024-6938](https://insights.sbomify.com/CVE-2024-6938/): SiYuan PDF PDF.js cross site scripting (medium 5.3)
- [CVE-2024-6937](https://insights.sbomify.com/CVE-2024-6937/): formtools.org Form Tools Import Option List edit.php curl_exec file inclusion (medium 5.1)
- [CVE-2024-6936](https://insights.sbomify.com/CVE-2024-6936/): formtools.org Form Tools Setting code injection (medium 5.1)
- [CVE-2024-6935](https://insights.sbomify.com/CVE-2024-6935/): formtools.org Form Tools User Settings Page cross site scripting (medium 5.1)
- [CVE-2024-6934](https://insights.sbomify.com/CVE-2024-6934/): formtools.org Form Tools cross site scripting (medium 5.1)
- [CVE-2024-6933](https://insights.sbomify.com/CVE-2024-6933/): SQL injection in LimeSurvey (medium 5.3)
- [CVE-2024-6932](https://insights.sbomify.com/CVE-2024-6932/): ClassCMS cross site scripting (medium 5.3)
- [CVE-2024-6931](https://insights.sbomify.com/CVE-2024-6931/): The Events Calendar <= 6.6.3 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-6930](https://insights.sbomify.com/CVE-2024-6930/): WP Booking Calendar <= 10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingform Shortcode (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/164/