# Vulnerabilities published in 2024


- [CVE-2024-5739](https://insights.sbomify.com/CVE-2024-5739/): Cross-site scripting in LINE client for iOS (medium 6.1)
- [CVE-2024-57386](https://insights.sbomify.com/CVE-2024-57386/): Cross-site scripting in wallosapp:wallos (medium 6.1)
- [CVE-2024-57378](https://insights.sbomify.com/CVE-2024-57378/): Wazuh SIEM version 4.8.2 is affected by a broken access control vulnerability. (high 7.3)
- [CVE-2024-57376](https://insights.sbomify.com/CVE-2024-57376/): Memory corruption in dlink:dsr-1000n firmware (high 8.8)
- [CVE-2024-57375](https://insights.sbomify.com/CVE-2024-57375/): Denial of service in Pump It Up (low 2.4)
- [CVE-2024-57373](https://insights.sbomify.com/CVE-2024-57373/): Cross Site Request Forgery (CSRF) vulnerability in LifestyleStore v1.0 allows a remote attacker to execute unauthorized actions on behalf of (high 8.1)
- [CVE-2024-57372](https://insights.sbomify.com/CVE-2024-57372/): Cross Site Scripting vulnerability in InformationPush master version allows a remote attacker to obtain sensitive information via the title, (medium 6.1)
- [CVE-2024-57370](https://insights.sbomify.com/CVE-2024-57370/): Cross Site Scripting vulnerability in sunnygkp10 Online Exam System master version allows a remote attacker to obtain sensitive information via the w parameter. (medium 6.1)
- [CVE-2024-5737](https://insights.sbomify.com/CVE-2024-5737/): HTML Injection in AdmirorFrames Joomla! Extension (medium 6.3)
- [CVE-2024-57369](https://insights.sbomify.com/CVE-2024-57369/): Other in typecho:typecho (medium 6.4)
- [CVE-2024-57360](https://insights.sbomify.com/CVE-2024-57360/): https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. (medium 5.5)
- [CVE-2024-5736](https://insights.sbomify.com/CVE-2024-5736/): SSRF in AdmirorFrames Joomla! Extension (high 8.2)
- [CVE-2024-57357](https://insights.sbomify.com/CVE-2024-57357/): Command injection in tp-link:tl-wpa8630 firmware (high 8.0)
- [CVE-2024-5735](https://insights.sbomify.com/CVE-2024-5735/): Full Path Disclosure in AdmirorFrames Joomla! Extension (medium 6.3)
- [CVE-2024-57348](https://insights.sbomify.com/CVE-2024-57348/): Cross-site scripting in pecanproject:pecan (medium 6.1)
- [CVE-2024-5734](https://insights.sbomify.com/CVE-2024-5734/): itsourcecode Online Discussion Forum poster.php unrestricted upload (medium 5.3)
- [CVE-2024-57338](https://insights.sbomify.com/CVE-2024-57338/): An arbitrary file upload vulnerability in M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.960, and v8.x to v8.2.0.345 allow (medium 6.5)
- [CVE-2024-57337](https://insights.sbomify.com/CVE-2024-57337/): An arbitrary file upload vulnerability in the opcode 500 functionality of M2Soft CROWNIX Report & ERS v5.x to v5.5.14.1070, v7.x to v7.4.3.9 (medium 6.5)
- [CVE-2024-57336](https://insights.sbomify.com/CVE-2024-57336/): Incorrect access control in M2Soft CROWNIX Report & ERS affected v7.x to v7.4.3.599 and v8.x to v8.0.3.79 allows unauthorized attackers to o (medium 6.5)
- [CVE-2024-5733](https://insights.sbomify.com/CVE-2024-5733/): itsourcecode Online Discussion Forum register_me.php sql injection (medium 6.9)
- [CVE-2024-57329](https://insights.sbomify.com/CVE-2024-57329/): Cross-site scripting in hortusfox:hortusfox (medium 5.4)
- [CVE-2024-57328](https://insights.sbomify.com/CVE-2024-57328/): SQL injection in projectworlds:online food ordering system (critical 9.8)
- [CVE-2024-57326](https://insights.sbomify.com/CVE-2024-57326/): Cross-site scripting in online pizza delivery system project:online pizza delivery system (medium 6.1)
- [CVE-2024-5732](https://insights.sbomify.com/CVE-2024-5732/): Clash Proxy Port improper authentication (medium 6.9)
- [CVE-2024-5731](https://insights.sbomify.com/CVE-2024-5731/): Information disclosure in Intrusion Prevention System (IPS) Manager (medium 6.8)
- [CVE-2024-5730](https://insights.sbomify.com/CVE-2024-5730/): Pagerank Tools <= 1.1.5 - Reflected XSS (medium 6.1)
- [CVE-2024-5729](https://insights.sbomify.com/CVE-2024-5729/): Simple AL Slider <= 1.2.10 - Reflected XSS (medium 6.1)
- [CVE-2024-5728](https://insights.sbomify.com/CVE-2024-5728/): Animated AL List <= 1.0.6 - Reflected XSS (medium 5.4)
- [CVE-2024-57279](https://insights.sbomify.com/CVE-2024-57279/): A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the LDAP User Manager <= ce92321, specifically in the /setup/ind (medium 5.4)
- [CVE-2024-57278](https://insights.sbomify.com/CVE-2024-57278/): A reflected Cross-Site Scripting (XSS) vulnerability exists in /webscan/sqlmap/index.html in QingScan <=v1.8.0. (medium 5.4)
- [CVE-2024-57277](https://insights.sbomify.com/CVE-2024-57277/): InnoShop V.0.3.8 and below is vulnerable to Cross Site Scripting (XSS) via SVG file upload. (medium 5.7)
- [CVE-2024-57276](https://insights.sbomify.com/CVE-2024-57276/): In Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability. (high 7.3)
- [CVE-2024-57273](https://insights.sbomify.com/CVE-2024-57273/): Cross-site scripting in netgate:pfsense ce (medium 5.4)
- [CVE-2024-57272](https://insights.sbomify.com/CVE-2024-57272/): SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower is vulnerable to Cross Site Scripting (XSS). (medium 6.1)
- [CVE-2024-5727](https://insights.sbomify.com/CVE-2024-5727/): Widget4Call <= 1.0.7 - Reflected XSS (medium 4.7)
- [CVE-2024-57262](https://insights.sbomify.com/CVE-2024-57262/): Integer overflow in barebox (high 7.1)
- [CVE-2024-57261](https://insights.sbomify.com/CVE-2024-57261/): Integer overflow in barebox (high 7.1)
- [CVE-2024-5726](https://insights.sbomify.com/CVE-2024-5726/): Timeline Event History <= 3.1 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-57259](https://insights.sbomify.com/CVE-2024-57259/): Memory corruption in U-Boot (high 7.1)
- [CVE-2024-57258](https://insights.sbomify.com/CVE-2024-57258/): Integer overflow in U-Boot (high 7.1)
- [CVE-2024-57257](https://insights.sbomify.com/CVE-2024-57257/): Denial of service in U-Boot (low 2.0)
- [CVE-2024-57256](https://insights.sbomify.com/CVE-2024-57256/): Integer overflow in U-Boot (high 7.1)
- [CVE-2024-57255](https://insights.sbomify.com/CVE-2024-57255/): Integer overflow in U-Boot (high 7.1)
- [CVE-2024-57254](https://insights.sbomify.com/CVE-2024-57254/): Integer overflow in U-Boot (high 7.1)
- [CVE-2024-57252](https://insights.sbomify.com/CVE-2024-57252/): Server-side request forgery in otcms:otcms (medium 4.3)
- [CVE-2024-5725](https://insights.sbomify.com/CVE-2024-5725/): Centreon initCurveList SQL Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-57249](https://insights.sbomify.com/CVE-2024-57249/): Auth bypass in gleamtech:filevista (medium 6.5)
- [CVE-2024-57248](https://insights.sbomify.com/CVE-2024-57248/): Path traversal in gleamtech:filevista (medium 6.3)
- [CVE-2024-57241](https://insights.sbomify.com/CVE-2024-57241/): Open redirect in dedecms:dedecms (medium 6.5)
- [CVE-2024-57240](https://insights.sbomify.com/CVE-2024-57240/): Cross-site scripting in apryse:webviewer (medium 5.4)
- [CVE-2024-5724](https://insights.sbomify.com/CVE-2024-5724/): Photo Video Gallery Master <= 1.5.3 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-57238](https://insights.sbomify.com/CVE-2024-57238/): Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to SQL Injection in in the /reqproc/proc_get endpoint. (high 7.3)
- [CVE-2024-57237](https://insights.sbomify.com/CVE-2024-57237/): Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting (XSS) in the /reqproc/proc_get endpoint. (medium 6.3)
- [CVE-2024-57235](https://insights.sbomify.com/CVE-2024-57235/): Command injection in netgear:rax50 firmware (medium 6.5)
- [CVE-2024-57234](https://insights.sbomify.com/CVE-2024-57234/): Command injection in netgear:rax50 firmware (medium 6.5)
- [CVE-2024-57233](https://insights.sbomify.com/CVE-2024-57233/): Command injection in netgear:rax50 firmware (medium 6.5)
- [CVE-2024-57232](https://insights.sbomify.com/CVE-2024-57232/): Command injection in netgear:rax50 firmware (medium 6.5)
- [CVE-2024-57231](https://insights.sbomify.com/CVE-2024-57231/): Command injection in netgear:rax50 firmware (medium 6.5)
- [CVE-2024-57230](https://insights.sbomify.com/CVE-2024-57230/): Command injection in netgear:rax50 firmware (medium 6.5)
- [CVE-2024-5723](https://insights.sbomify.com/CVE-2024-5723/): Centreon updateServiceHost SQL Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-57229](https://insights.sbomify.com/CVE-2024-57229/): Command injection in netgear:rax50 firmware (medium 6.5)
- [CVE-2024-57228](https://insights.sbomify.com/CVE-2024-57228/): Command injection in linksys:e7350 firmware (high 8.0)
- [CVE-2024-57227](https://insights.sbomify.com/CVE-2024-57227/): Command injection in linksys:e7350 firmware (high 8.0)
- [CVE-2024-57226](https://insights.sbomify.com/CVE-2024-57226/): Command injection in linksys:e7350 firmware (high 8.0)
- [CVE-2024-57225](https://insights.sbomify.com/CVE-2024-57225/): Command injection in linksys:e7350 firmware (critical 9.8)
- [CVE-2024-57224](https://insights.sbomify.com/CVE-2024-57224/): Command injection in linksys:e7350 firmware (critical 9.8)
- [CVE-2024-57223](https://insights.sbomify.com/CVE-2024-57223/): Command injection in linksys:e7350 firmware (critical 9.8)
- [CVE-2024-57222](https://insights.sbomify.com/CVE-2024-57222/): Command injection in linksys:e7350 firmware (medium 6.3)
- [CVE-2024-5722](https://insights.sbomify.com/CVE-2024-5722/): Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-57214](https://insights.sbomify.com/CVE-2024-57214/): Command injection in totolink:a6000r firmware (medium 6.3)
- [CVE-2024-57213](https://insights.sbomify.com/CVE-2024-57213/): Command injection in totolink:a6000r firmware (medium 6.3)
- [CVE-2024-57212](https://insights.sbomify.com/CVE-2024-57212/): Command injection in totolink:a6000r firmware (medium 5.1)
- [CVE-2024-57211](https://insights.sbomify.com/CVE-2024-57211/): Command injection in totolink:a6000r firmware (high 8.0)
- [CVE-2024-5721](https://insights.sbomify.com/CVE-2024-5721/): Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-5720](https://insights.sbomify.com/CVE-2024-5720/): Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-57190](https://insights.sbomify.com/CVE-2024-57190/): Erxes Incorrect Access Control vulnerability (critical 9.8)
- [CVE-2024-5719](https://insights.sbomify.com/CVE-2024-5719/): Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-57189](https://insights.sbomify.com/CVE-2024-57189/): Erxes Path Traversal vulnerability (medium 5.4)
- [CVE-2024-57186](https://insights.sbomify.com/CVE-2024-57186/): Erxes Path Traversal vulnerability (medium 5.4)
- [CVE-2024-57184](https://insights.sbomify.com/CVE-2024-57184/): Memory corruption in gpac:gpac (medium 5.5)
- [CVE-2024-5718](https://insights.sbomify.com/CVE-2024-5718/): Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-57178](https://insights.sbomify.com/CVE-2024-57178/): An SQL injection vulnerability exists in Stock-Forecaster <=01-04-2020. (medium 5.9)
- [CVE-2024-57177](https://insights.sbomify.com/CVE-2024-57177/): CouchAuth has a Server-Side Template Injection vulnerability in its email functionality (high 7.3)
- [CVE-2024-57176](https://insights.sbomify.com/CVE-2024-57176/): Auth bypass in antabot:white-jotter (high 7.6)
- [CVE-2024-57175](https://insights.sbomify.com/CVE-2024-57175/): Cross-site scripting in phpgurukul:online birth certificate system (medium 5.4)
- [CVE-2024-57174](https://insights.sbomify.com/CVE-2024-57174/): A misconfiguration in Alphion ASEE-1443 Firmware v0.4.H.00.02.15 defines a previously unregistered domain name as the default DNS suffix. (high 8.1)
- [CVE-2024-57170](https://insights.sbomify.com/CVE-2024-57170/): Path traversal in soplanning:soplanning (medium 6.5)
- [CVE-2024-5717](https://insights.sbomify.com/CVE-2024-5717/): Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-57169](https://insights.sbomify.com/CVE-2024-57169/): File upload in soplanning:soplanning (critical 9.8)
- [CVE-2024-57162](https://insights.sbomify.com/CVE-2024-57162/): SQL injection in campcodes:cybercafe management system (high 7.2)
- [CVE-2024-57161](https://insights.sbomify.com/CVE-2024-57161/): Cross-site request forgery in 07fly:customer relationship management (medium 4.3)
- [CVE-2024-57160](https://insights.sbomify.com/CVE-2024-57160/): Cross-site request forgery in 07fly:customer relationship management (medium 4.3)
- [CVE-2024-5716](https://insights.sbomify.com/CVE-2024-5716/): Logsign Unified SecOps Platform Authentication Bypass Vulnerability (high 8.6)
- [CVE-2024-57159](https://insights.sbomify.com/CVE-2024-57159/): Cross-site request forgery in 07fly:07flycms (low 3.5)
- [CVE-2024-57157](https://insights.sbomify.com/CVE-2024-57157/): Incorrect access control in Jantent v1.1 allows attackers to bypass authentication and access sensitive APIs without a token. (critical 9.8)
- [CVE-2024-57155](https://insights.sbomify.com/CVE-2024-57155/): Incorrect access control in radar v1.0.8 allows attackers to bypass authentication and access sensitive APIs without a token. (critical 9.8)
- [CVE-2024-57154](https://insights.sbomify.com/CVE-2024-57154/): Incorrect access control in dts-shop v0.0.1-SNAPSHOT allows attackers to bypass authentication via sending a crafted payload to /admin/auth/index. (critical 9.8)
- [CVE-2024-57152](https://insights.sbomify.com/CVE-2024-57152/): Auth bypass in winterchens:my-site (high 7.5)
- [CVE-2024-57151](https://insights.sbomify.com/CVE-2024-57151/): SQL injection in rockoa:xinhu (medium 6.8)
- [CVE-2024-5715](https://insights.sbomify.com/CVE-2024-5715/): WP eMember < 10.6.7 - Reflected XSS via Member Edit (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/182/