# Vulnerabilities published in 2024


- [CVE-2024-57605](https://insights.sbomify.com/CVE-2024-57605/): Cross-site scripting in thedaylightstudio:fuel cms (medium 5.4)
- [CVE-2024-57604](https://insights.sbomify.com/CVE-2024-57604/): MaysWind ezBookkeeping has Improper Privilege Management (critical 9.8)
- [CVE-2024-57603](https://insights.sbomify.com/CVE-2024-57603/): Missing rate limit in MaysWind ezBookkeeping (medium 6.3)
- [CVE-2024-57602](https://insights.sbomify.com/CVE-2024-57602/): Easy!Appointments Improper Restriction of Excessive Authentication Attempts (critical 9.8)
- [CVE-2024-57601](https://insights.sbomify.com/CVE-2024-57601/): Remote code execution in alextselegidis/easyappointments (medium 6.1)
- [CVE-2024-5760](https://insights.sbomify.com/CVE-2024-5760/): Privilege escalation in Samsung Universal Print Driver (high 8.4)
- [CVE-2024-57599](https://insights.sbomify.com/CVE-2024-57599/): Cross-site scripting in douco:douphp (medium 4.8)
- [CVE-2024-57598](https://insights.sbomify.com/CVE-2024-57598/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2024-57595](https://insights.sbomify.com/CVE-2024-57595/): DLINK DIR-825 REVB 2.03 devices have an OS command injection vulnerability in the CGl interface apc_client_pin.cgi, which allows remote atta (critical 9.8)
- [CVE-2024-57590](https://insights.sbomify.com/CVE-2024-57590/): Command injection in trendnet:tew-632brp firmware (critical 9.8)
- [CVE-2024-5759](https://insights.sbomify.com/CVE-2024-5759/): Improper privilege management (medium 5.4)
- [CVE-2024-57587](https://insights.sbomify.com/CVE-2024-57587/): SQL injection in easyvirt:co2scope (critical 9.1)
- [CVE-2024-57583](https://insights.sbomify.com/CVE-2024-57583/): Command injection in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-57582](https://insights.sbomify.com/CVE-2024-57582/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-57581](https://insights.sbomify.com/CVE-2024-57581/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-57580](https://insights.sbomify.com/CVE-2024-57580/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-57579](https://insights.sbomify.com/CVE-2024-57579/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-57578](https://insights.sbomify.com/CVE-2024-57578/): Memory corruption in tenda:ac18 firmware (medium 5.7)
- [CVE-2024-57577](https://insights.sbomify.com/CVE-2024-57577/): Memory corruption in tenda:ac18 firmware (medium 5.7)
- [CVE-2024-57575](https://insights.sbomify.com/CVE-2024-57575/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-5757](https://insights.sbomify.com/CVE-2024-5757/): Cross-site scripting in Ultimate Addons for Elementor (medium 6.4)
- [CVE-2024-5756](https://insights.sbomify.com/CVE-2024-5756/): SQL injection in Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress (critical 9.8)
- [CVE-2024-57556](https://insights.sbomify.com/CVE-2024-57556/): Cross Site Scripting vulnerability in store2 (medium 6.1)
- [CVE-2024-5755](https://insights.sbomify.com/CVE-2024-5755/): Email Validation Bypass in lunary-ai/lunary (medium 5.3)
- [CVE-2024-57549](https://insights.sbomify.com/CVE-2024-57549/): Path traversal in cmsimple:cmsimple (high 7.5)
- [CVE-2024-57548](https://insights.sbomify.com/CVE-2024-57548/): Missing authorization in cmsimple:cmsimple (critical 9.1)
- [CVE-2024-57547](https://insights.sbomify.com/CVE-2024-57547/): Information disclosure in cmsimple:cmsimple (high 7.5)
- [CVE-2024-57546](https://insights.sbomify.com/CVE-2024-57546/): Information disclosure in cmsimple:cmsimple (high 7.5)
- [CVE-2024-57545](https://insights.sbomify.com/CVE-2024-57545/): Memory corruption in linksys:e8450 firmware (medium 5.5)
- [CVE-2024-57544](https://insights.sbomify.com/CVE-2024-57544/): Memory corruption in linksys:e8450 firmware (medium 5.5)
- [CVE-2024-57543](https://insights.sbomify.com/CVE-2024-57543/): Memory corruption in linksys:e8450 firmware (medium 5.5)
- [CVE-2024-57542](https://insights.sbomify.com/CVE-2024-57542/): Command injection in linksys:e8450 firmware (high 8.8)
- [CVE-2024-57541](https://insights.sbomify.com/CVE-2024-57541/): Memory corruption in linksys:e8450 firmware (medium 5.5)
- [CVE-2024-57540](https://insights.sbomify.com/CVE-2024-57540/): Memory corruption in linksys:e8450 firmware (medium 6.5)
- [CVE-2024-5754](https://insights.sbomify.com/CVE-2024-5754/): BT: Encryption procedure host vulnerability (high 8.2)
- [CVE-2024-57539](https://insights.sbomify.com/CVE-2024-57539/): Command injection in linksys:e8450 firmware (high 8.2)
- [CVE-2024-57538](https://insights.sbomify.com/CVE-2024-57538/): Memory corruption in linksys:e8450 firmware (medium 6.5)
- [CVE-2024-57537](https://insights.sbomify.com/CVE-2024-57537/): Memory corruption in linksys:e8450 firmware (medium 6.3)
- [CVE-2024-57536](https://insights.sbomify.com/CVE-2024-57536/): Command injection in linksys:e8450 firmware (high 8.0)
- [CVE-2024-5753](https://insights.sbomify.com/CVE-2024-5753/): Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vanna (high 7.5)
- [CVE-2024-57529](https://insights.sbomify.com/CVE-2024-57529/): Cross-site scripting in jeppesen:jetplanner (medium 6.1)
- [CVE-2024-57523](https://insights.sbomify.com/CVE-2024-57523/): Cross-site request forgery in oretnom23:packers and movers management system (medium 4.5)
- [CVE-2024-57522](https://insights.sbomify.com/CVE-2024-57522/): Cross-site scripting in oretnom23:packers and movers management system (medium 6.4)
- [CVE-2024-57521](https://insights.sbomify.com/CVE-2024-57521/): SQL injection in ruoyi:ruoyi (critical 10.0)
- [CVE-2024-57520](https://insights.sbomify.com/CVE-2024-57520/): Path traversal in sangoma:asterisk (critical 9.8)
- [CVE-2024-5752](https://insights.sbomify.com/CVE-2024-5752/): Path Traversal in stitionai/devika (critical 9.1)
- [CVE-2024-57519](https://insights.sbomify.com/CVE-2024-57519/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2024-57514](https://insights.sbomify.com/CVE-2024-57514/): The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting (XSS) due to improper handling of directory listing paths in the web interface. (medium 4.8)
- [CVE-2024-57513](https://insights.sbomify.com/CVE-2024-57513/): A floating-point exception (FPE) vulnerability exists in the AP4_TfraAtom::AP4_TfraAtom function in Bento4. (medium 6.5)
- [CVE-2024-57510](https://insights.sbomify.com/CVE-2024-57510/): Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code (high 7.8)
- [CVE-2024-5751](https://insights.sbomify.com/CVE-2024-5751/): Remote Code Execution in BerriAI/litellm (critical 9.8)
- [CVE-2024-57509](https://insights.sbomify.com/CVE-2024-57509/): Buffer Overflow vulnerability in Bento4 mp42avc v.3bdc891602d19789b8e8626e4a3e613a937b4d35 allows a local attacker to execute arbitrary code (high 7.8)
- [CVE-2024-57498](https://insights.sbomify.com/CVE-2024-57498/): Cross-site scripting in forestblog project:forestblog (medium 4.8)
- [CVE-2024-57494](https://insights.sbomify.com/CVE-2024-57494/): Cross Site Scripting vulnerability in Neto E-Commerce CMS v.6.313.0 through v.6.3115 allows a remote attacker to escalate privileges via the kw parameter. (medium 6.5)
- [CVE-2024-57493](https://insights.sbomify.com/CVE-2024-57493/): Denial of service in redox-os:redox (medium 5.5)
- [CVE-2024-57492](https://insights.sbomify.com/CVE-2024-57492/): Integer overflow in redox-os:redox (medium 6.0)
- [CVE-2024-57491](https://insights.sbomify.com/CVE-2024-57491/): Authentication Bypass vulnerability in jobx up to v1.0.1-RELEASE allows an attacker can exploit this vulnerability to access sensitive API w (high 8.8)
- [CVE-2024-57490](https://insights.sbomify.com/CVE-2024-57490/): Auth bypass in ioffice:ioffice20 (high 7.7)
- [CVE-2024-5749](https://insights.sbomify.com/CVE-2024-5749/): Certain HP DesignJet products – Credential reflection (high 7.5)
- [CVE-2024-57488](https://insights.sbomify.com/CVE-2024-57488/): Cross-site scripting in code-projects:online car rental system (medium 6.5)
- [CVE-2024-57487](https://insights.sbomify.com/CVE-2024-57487/): File upload in code-projects:online car rental system (medium 6.5)
- [CVE-2024-57483](https://insights.sbomify.com/CVE-2024-57483/): Memory corruption in tenda:i24 firmware (critical 9.8)
- [CVE-2024-57482](https://insights.sbomify.com/CVE-2024-57482/): Memory corruption in h3c:n12 firmware (critical 9.8)
- [CVE-2024-57480](https://insights.sbomify.com/CVE-2024-57480/): Memory corruption in h3c:n12 firmware (critical 9.8)
- [CVE-2024-57479](https://insights.sbomify.com/CVE-2024-57479/): Memory corruption in h3c:n12 firmware (critical 9.8)
- [CVE-2024-57473](https://insights.sbomify.com/CVE-2024-57473/): Memory corruption in h3c:n12 firmware (critical 9.8)
- [CVE-2024-57471](https://insights.sbomify.com/CVE-2024-57471/): Memory corruption in h3c:n12 firmware (critical 9.8)
- [CVE-2024-5746](https://insights.sbomify.com/CVE-2024-5746/): Server-side request forgery in GitHub Enterprise Server (high 7.6)
- [CVE-2024-57459](https://insights.sbomify.com/CVE-2024-57459/): SQL injection in vishalmathur:cloudclassroom-php project (high 7.3)
- [CVE-2024-57452](https://insights.sbomify.com/CVE-2024-57452/): Path traversal in 1000mz:chestnutcms (high 7.5)
- [CVE-2024-57451](https://insights.sbomify.com/CVE-2024-57451/): Path traversal in 1000mz:chestnutcms (high 7.5)
- [CVE-2024-57450](https://insights.sbomify.com/CVE-2024-57450/): File upload in 1000mz:chestnutcms (critical 9.8)
- [CVE-2024-5745](https://insights.sbomify.com/CVE-2024-5745/): itsourcecode Bakery Online Ordering System unrestricted upload (medium 6.9)
- [CVE-2024-57440](https://insights.sbomify.com/CVE-2024-57440/): Memory corruption in dlink:dsl-3788 firmware (high 7.5)
- [CVE-2024-5744](https://insights.sbomify.com/CVE-2024-5744/): WP eMember < 10.6.7 - Reflected XSS (medium 6.8)
- [CVE-2024-57439](https://insights.sbomify.com/CVE-2024-57439/): RuoYi vulnerable to Denial of Service by attackers with admin privileges (medium 4.9)
- [CVE-2024-57438](https://insights.sbomify.com/CVE-2024-57438/): RuoYi has insecure permissions (medium 5.4)
- [CVE-2024-57437](https://insights.sbomify.com/CVE-2024-57437/): SQL injection in ruoyi:ruoyi (medium 6.5)
- [CVE-2024-57436](https://insights.sbomify.com/CVE-2024-57436/): RuoYi allowed unauthorized attackers to view the session ID of the admin in the system monitoring (high 7.2)
- [CVE-2024-57435](https://insights.sbomify.com/CVE-2024-57435/): Null dereference in macrozheng:mall-tiny (medium 6.5)
- [CVE-2024-57434](https://insights.sbomify.com/CVE-2024-57434/): Hardcoded credentials in macrozheng:mall-tiny (high 8.8)
- [CVE-2024-57433](https://insights.sbomify.com/CVE-2024-57433/): Auth bypass in macrozheng:mall-tiny (high 7.5)
- [CVE-2024-57432](https://insights.sbomify.com/CVE-2024-57432/): Hardcoded credentials in macrozheng:mall-tiny (high 7.5)
- [CVE-2024-57430](https://insights.sbomify.com/CVE-2024-57430/): SQL injection in phpjabbers:cinema booking system (critical 9.8)
- [CVE-2024-5743](https://insights.sbomify.com/CVE-2024-5743/): Command Injection Vulnerability (critical 9.8)
- [CVE-2024-57429](https://insights.sbomify.com/CVE-2024-57429/): Cross-site request forgery in phpjabbers:cinema booking system (medium 5.4)
- [CVE-2024-57428](https://insights.sbomify.com/CVE-2024-57428/): Cross-site scripting in phpjabbers:cinema booking system (critical 9.3)
- [CVE-2024-57427](https://insights.sbomify.com/CVE-2024-57427/): Cross-site scripting in phpjabbers:cinema booking system (medium 6.1)
- [CVE-2024-57426](https://insights.sbomify.com/CVE-2024-57426/): NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a malicious DLL in a direc (high 7.3)
- [CVE-2024-57423](https://insights.sbomify.com/CVE-2024-57423/): Cross-site scripting in vishalmathur:cloudclassroom-php project (medium 6.1)
- [CVE-2024-5742](https://insights.sbomify.com/CVE-2024-5742/): Privilege escalation in Red Hat Enterprise Linux 10 (medium 6.7)
- [CVE-2024-57412](https://insights.sbomify.com/CVE-2024-57412/): An issue in SunOS Omnios v5.11 allows attackers to cause a Denial of Service (DoS) via repeatedly sending crafted TCP packets. (high 7.5)
- [CVE-2024-5741](https://insights.sbomify.com/CVE-2024-5741/): XSS in inventory view (medium 6.5)
- [CVE-2024-57409](https://insights.sbomify.com/CVE-2024-57409/): Cross-site scripting in beian.miit:cool-admin-java (medium 4.8)
- [CVE-2024-57408](https://insights.sbomify.com/CVE-2024-57408/): File upload in beian.miit:cool-admin-java (high 7.2)
- [CVE-2024-57407](https://insights.sbomify.com/CVE-2024-57407/): An arbitrary file upload vulnerability in the component /userPicture of Timo v2.0.3 allows attackers to execute arbitrary code via uploading a crafted file. (high 7.3)
- [CVE-2024-57401](https://insights.sbomify.com/CVE-2024-57401/): SQL Injection vulnerability in Uniclare Student portal v.2 and before allows a remote attacker to execute arbitrary code via the Forgot Password function. (critical 9.8)
- [CVE-2024-57395](https://insights.sbomify.com/CVE-2024-57395/): Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrar (critical 9.8)
- [CVE-2024-57394](https://insights.sbomify.com/CVE-2024-57394/): Privilege escalation in qianxin:tianqing endpoint security management system (high 8.8)
- [CVE-2024-57392](https://insights.sbomify.com/CVE-2024-57392/): Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Servic (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/181/