# Vulnerabilities published in 2024


- [CVE-2024-56951](https://insights.sbomify.com/CVE-2024-56951/): An issue in Hangzhou Bobo Technology Co Ltd UU Game Booster iOS 10.6.13 allows attackers to access sensitive user information via supplying a crafted link. (medium 6.5)
- [CVE-2024-56950](https://insights.sbomify.com/CVE-2024-56950/): An issue in KuGou Technology Co., Ltd KuGou Concept iOS 4.0.61 allows attackers to access sensitive user information via supplying a crafted link. (medium 6.5)
- [CVE-2024-5695](https://insights.sbomify.com/CVE-2024-5695/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-56949](https://insights.sbomify.com/CVE-2024-56949/): An issue in Guangzhou Polar Future Culture Technology Co., Ltd University Search iOS 2.27.0 allows attackers to access sensitive user inform (medium 6.5)
- [CVE-2024-56948](https://insights.sbomify.com/CVE-2024-56948/): An issue in KuGou Technology CO. (medium 6.5)
- [CVE-2024-56947](https://insights.sbomify.com/CVE-2024-56947/): An issue in Xiamen Meitu Technology Co., Ltd. (medium 6.5)
- [CVE-2024-56946](https://insights.sbomify.com/CVE-2024-56946/): Denial of service in technitium:dnsserver (medium 5.3)
- [CVE-2024-56940](https://insights.sbomify.com/CVE-2024-56940/): Denial of service in learndash:learndash (high 7.5)
- [CVE-2024-5694](https://insights.sbomify.com/CVE-2024-5694/): Use after free in Firefox (high 7.5)
- [CVE-2024-56939](https://insights.sbomify.com/CVE-2024-56939/): Cross-site scripting in learndash:learndash (medium 5.4)
- [CVE-2024-56938](https://insights.sbomify.com/CVE-2024-56938/): Cross-site scripting in learndash:learndash (medium 5.4)
- [CVE-2024-5693](https://insights.sbomify.com/CVE-2024-5693/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2024-56924](https://insights.sbomify.com/CVE-2024-56924/): Cross-site request forgery in codeastro:internet banking system (high 7.3)
- [CVE-2024-56923](https://insights.sbomify.com/CVE-2024-56923/): Cross site scripting in Silverpeas Core (medium 5.4)
- [CVE-2024-56921](https://insights.sbomify.com/CVE-2024-56921/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2024-5692](https://insights.sbomify.com/CVE-2024-5692/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2024-56918](https://insights.sbomify.com/CVE-2024-56918/): Cross-site scripting in netbox:netbox (medium 6.1)
- [CVE-2024-56917](https://insights.sbomify.com/CVE-2024-56917/): Cross-site scripting in netbox:netbox (high 7.1)
- [CVE-2024-56916](https://insights.sbomify.com/CVE-2024-56916/): Cross-site scripting in netbox:netbox (medium 6.1)
- [CVE-2024-56915](https://insights.sbomify.com/CVE-2024-56915/): Cross-site scripting in netbox:netbox (medium 6.5)
- [CVE-2024-56914](https://insights.sbomify.com/CVE-2024-56914/): Memory corruption in dlink:dsl-3782 firmware (medium 5.7)
- [CVE-2024-5691](https://insights.sbomify.com/CVE-2024-5691/): Security feature bypass in Firefox (medium 4.7)
- [CVE-2024-56908](https://insights.sbomify.com/CVE-2024-56908/): In Perfex Crm < 3.2.1, an authenticated attacker can send a crafted HTTP POST request to the affected upload_sales_file endpoint. (medium 6.8)
- [CVE-2024-56903](https://insights.sbomify.com/CVE-2024-56903/): Geovision GV-ASWeb with the version 6.1.1.0 or less allows attackers to modify POST request method with the GET against critical functionali (high 8.1)
- [CVE-2024-56902](https://insights.sbomify.com/CVE-2024-56902/): Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account in (high 7.5)
- [CVE-2024-56901](https://insights.sbomify.com/CVE-2024-56901/): A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers t (high 8.8)
- [CVE-2024-5690](https://insights.sbomify.com/CVE-2024-5690/): Information disclosure in Firefox (medium 4.3)
- [CVE-2024-56898](https://insights.sbomify.com/CVE-2024-56898/): Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. (high 8.8)
- [CVE-2024-56897](https://insights.sbomify.com/CVE-2024-56897/): Missing authorization in yitechnology:yi car dashcam firmware (critical 9.8)
- [CVE-2024-5689](https://insights.sbomify.com/CVE-2024-5689/): Other in Firefox (medium 4.3)
- [CVE-2024-56889](https://insights.sbomify.com/CVE-2024-56889/): Missing authorization in codeastro:complaint management system (high 7.5)
- [CVE-2024-56883](https://insights.sbomify.com/CVE-2024-56883/): Missing authorization in sagedpw:sage dpw (high 8.1)
- [CVE-2024-56882](https://insights.sbomify.com/CVE-2024-56882/): Cross-site scripting in sagedpw:sage dpw (medium 5.4)
- [CVE-2024-5688](https://insights.sbomify.com/CVE-2024-5688/): Use after free in Firefox (high 8.1)
- [CVE-2024-5687](https://insights.sbomify.com/CVE-2024-5687/): Security feature bypass in Firefox (medium 5.3)
- [CVE-2024-5686](https://insights.sbomify.com/CVE-2024-5686/): Cross-site scripting in WPZOOM Addons for Elementor – Starter Templates & Widgets (medium 6.4)
- [CVE-2024-5685](https://insights.sbomify.com/CVE-2024-5685/): Broken Function Level Authorization (BFLA) in snipe/snipe-it (high 7.6)
- [CVE-2024-56841](https://insights.sbomify.com/CVE-2024-56841/): Auth bypass in Mendix LDAP (critical 9.1)
- [CVE-2024-56840](https://insights.sbomify.com/CVE-2024-56840/): Code injection in RUGGEDCOM ROX MX5000 (high 7.5)
- [CVE-2024-5684](https://insights.sbomify.com/CVE-2024-5684/): ID Charger Connect & Pro - JWT-Null-Algorithm (medium 6.3)
- [CVE-2024-56839](https://insights.sbomify.com/CVE-2024-56839/): Code injection in RUGGEDCOM ROX MX5000 (high 8.6)
- [CVE-2024-56838](https://insights.sbomify.com/CVE-2024-56838/): Code injection in RUGGEDCOM ROX MX5000 (high 8.6)
- [CVE-2024-56837](https://insights.sbomify.com/CVE-2024-56837/): Command injection in RUGGEDCOM ROX MX5000 (high 8.6)
- [CVE-2024-56836](https://insights.sbomify.com/CVE-2024-56836/): Command injection in RUGGEDCOM ROX MX5000 (high 7.7)
- [CVE-2024-56835](https://insights.sbomify.com/CVE-2024-56835/): Code injection in RUGGEDCOM ROX MX5000 (high 8.7)
- [CVE-2024-56830](https://insights.sbomify.com/CVE-2024-56830/): The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is present. (medium 5.4)
- [CVE-2024-5683](https://insights.sbomify.com/CVE-2024-5683/): Remote Code Execution in Next4Biz's BPM (critical 9.8)
- [CVE-2024-56829](https://insights.sbomify.com/CVE-2024-56829/): Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the (critical 10.0)
- [CVE-2024-56828](https://insights.sbomify.com/CVE-2024-56828/): File upload in 1000mz:chestnutcms (critical 9.8)
- [CVE-2024-56827](https://insights.sbomify.com/CVE-2024-56827/): Openjpeg: heap buffer overflow in lib/openjp2/j2k.c (medium 5.6)
- [CVE-2024-56826](https://insights.sbomify.com/CVE-2024-56826/): Openjpeg: heap buffer overflow in bin/common/color.c (medium 5.6)
- [CVE-2024-5682](https://insights.sbomify.com/CVE-2024-5682/): User Enumeration in Yordam Information Technology's Yordam Library Automation System (medium 6.9)
- [CVE-2024-56812](https://insights.sbomify.com/CVE-2024-56812/): IBM EntireX information disclosure (low 3.3)
- [CVE-2024-56811](https://insights.sbomify.com/CVE-2024-56811/): IBM EntireX information disclosure (low 3.3)
- [CVE-2024-56810](https://insights.sbomify.com/CVE-2024-56810/): IBM EntireX information disclosure (low 3.3)
- [CVE-2024-5681](https://insights.sbomify.com/CVE-2024-5681/): Other in EcoStruxure Foxboro DCS Core Control Services (high 7.8)
- [CVE-2024-56808](https://insights.sbomify.com/CVE-2024-56808/): Media Streaming add-on (low 2.0)
- [CVE-2024-56807](https://insights.sbomify.com/CVE-2024-56807/): Media Streaming add-on (low 1.7)
- [CVE-2024-56805](https://insights.sbomify.com/CVE-2024-56805/): QTS, QuTS hero (medium 5.3)
- [CVE-2024-56804](https://insights.sbomify.com/CVE-2024-56804/): Video Station (medium 5.3)
- [CVE-2024-56803](https://insights.sbomify.com/CVE-2024-56803/): Ghostty improperly handles window title sequences which can lead to arbitrary command execution (medium 5.1)
- [CVE-2024-56802](https://insights.sbomify.com/CVE-2024-56802/): Tapir allows DeployKey exposure (high 8.7)
- [CVE-2024-56801](https://insights.sbomify.com/CVE-2024-56801/): Tasklists has Blind SQL Injection in /ajax/reorder.php (medium 6.9)
- [CVE-2024-56800](https://insights.sbomify.com/CVE-2024-56800/): Firecrawl has SSRF Vulnerability via malicious scrape target (high 7.4)
- [CVE-2024-5680](https://insights.sbomify.com/CVE-2024-5680/): Denial of service in EcoStruxure Foxboro DCS Core Control Services (high 7.1)
- [CVE-2024-56799](https://insights.sbomify.com/CVE-2024-56799/): Simofa Allows Unauthenticated Access to API Routes (critical 10.0)
- [CVE-2024-5679](https://insights.sbomify.com/CVE-2024-5679/): Memory corruption in EcoStruxure Foxboro DCS Core Control Services (high 7.1)
- [CVE-2024-56788](https://insights.sbomify.com/CVE-2024-56788/): net: ethernet: oa_tc6: fix tx skb race condition between reference pointers (high 7.5)
- [CVE-2024-56787](https://insights.sbomify.com/CVE-2024-56787/): soc: imx8m: Probe the SoC driver as platform driver (medium 5.5)
- [CVE-2024-56785](https://insights.sbomify.com/CVE-2024-56785/): MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a (medium 5.5)
- [CVE-2024-56784](https://insights.sbomify.com/CVE-2024-56784/): drm/amd/display: Adding array index check to prevent memory corruption (high 7.8)
- [CVE-2024-56783](https://insights.sbomify.com/CVE-2024-56783/): netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level (medium 5.5)
- [CVE-2024-56782](https://insights.sbomify.com/CVE-2024-56782/): ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration() (medium 5.5)
- [CVE-2024-56780](https://insights.sbomify.com/CVE-2024-56780/): quota: flush quota_release_work upon quota writeback (medium 5.5)
- [CVE-2024-5678](https://insights.sbomify.com/CVE-2024-5678/): SQL Injection (medium 4.7)
- [CVE-2024-56779](https://insights.sbomify.com/CVE-2024-56779/): nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (critical 9.8)
- [CVE-2024-56778](https://insights.sbomify.com/CVE-2024-56778/): drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check (medium 5.5)
- [CVE-2024-56777](https://insights.sbomify.com/CVE-2024-56777/): drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check (medium 5.5)
- [CVE-2024-56776](https://insights.sbomify.com/CVE-2024-56776/): drm/sti: avoid potential dereference of error pointers (medium 5.5)
- [CVE-2024-56775](https://insights.sbomify.com/CVE-2024-56775/): drm/amd/display: Fix handling of plane refcount (high 7.8)
- [CVE-2024-56774](https://insights.sbomify.com/CVE-2024-56774/): btrfs: add a sanity check for btrfs root in btrfs_search_slot() (medium 5.5)
- [CVE-2024-56773](https://insights.sbomify.com/CVE-2024-56773/): kunit: Fix potential null dereference in kunit_device_driver_test() (medium 5.5)
- [CVE-2024-56772](https://insights.sbomify.com/CVE-2024-56772/): kunit: string-stream: Fix a UAF bug in kunit_init_suite() (high 7.8)
- [CVE-2024-56771](https://insights.sbomify.com/CVE-2024-56771/): mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information (medium 5.5)
- [CVE-2024-56770](https://insights.sbomify.com/CVE-2024-56770/): net/sched: netem: account for backlog updates from child qdisc (medium 5.5)
- [CVE-2024-5677](https://insights.sbomify.com/CVE-2024-5677/): Featured Image Generator <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Images Upload (medium 4.3)
- [CVE-2024-56769](https://insights.sbomify.com/CVE-2024-56769/): media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg (medium 5.5)
- [CVE-2024-56768](https://insights.sbomify.com/CVE-2024-56768/): bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP (medium 5.5)
- [CVE-2024-56767](https://insights.sbomify.com/CVE-2024-56767/): dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset (medium 5.5)
- [CVE-2024-56766](https://insights.sbomify.com/CVE-2024-56766/): mtd: rawnand: fix double free in atmel_pmecc_create_user() (high 7.8)
- [CVE-2024-56765](https://insights.sbomify.com/CVE-2024-56765/): powerpc/pseries/vas: Add close() callback in vas_vm_ops struct (high 7.8)
- [CVE-2024-56764](https://insights.sbomify.com/CVE-2024-56764/): ublk: detach gendisk from ublk device if add_disk() fails (high 7.8)
- [CVE-2024-56763](https://insights.sbomify.com/CVE-2024-56763/): tracing: Prevent bad count for tracing_cpumask_write (medium 5.5)
- [CVE-2024-56761](https://insights.sbomify.com/CVE-2024-56761/): x86/fred: Clear WFE in missing-ENDBRANCH #CPs (medium 5.5)
- [CVE-2024-56760](https://insights.sbomify.com/CVE-2024-56760/): PCI/MSI: Handle lack of irqdomain gracefully (medium 5.5)
- [CVE-2024-5676](https://insights.sbomify.com/CVE-2024-5676/): Paradox IP150 Internet Module Cross-Site Request Forgery (medium 6.8)
- [CVE-2024-56759](https://insights.sbomify.com/CVE-2024-56759/): btrfs: fix use-after-free when COWing tree bock and tracing is enabled (high 7.8)
- [CVE-2024-56758](https://insights.sbomify.com/CVE-2024-56758/): btrfs: check folio mapping after unlock in relocate_one_folio() (medium 5.5)
- [CVE-2024-56757](https://insights.sbomify.com/CVE-2024-56757/): Bluetooth: btusb: mediatek: add intf release flow when usb disconnect (high 7.8)
- [CVE-2024-56756](https://insights.sbomify.com/CVE-2024-56756/): nvme-pci: fix freeing of the HMB descriptor table (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/184/