# Vulnerabilities published in 2024


- [CVE-2024-55500](https://insights.sbomify.com/CVE-2024-55500/): Avenwu Whistle Cross-Site Request Forgery (CSRF) (high 8.8)
- [CVE-2024-5550](https://insights.sbomify.com/CVE-2024-5550/): Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3 (medium 5.3)
- [CVE-2024-55496](https://insights.sbomify.com/CVE-2024-55496/): SQL injection in 1000projects:bookstore management system (critical 9.1)
- [CVE-2024-55494](https://insights.sbomify.com/CVE-2024-55494/): A PHP Code Injection vulnerability that can lead to Remote Code Execution (RCE) and XSS in Opencode Mobile Collect Call v5.4.7 allows attack (medium 6.1)
- [CVE-2024-55492](https://insights.sbomify.com/CVE-2024-55492/): Cross-site scripting in magicwinmail:winmail server (medium 6.1)
- [CVE-2024-5549](https://insights.sbomify.com/CVE-2024-5549/): Data leak through CORS misconfiguration in stitionai/devika (high 8.1)
- [CVE-2024-55488](https://insights.sbomify.com/CVE-2024-55488/): Cross-site scripting in umbraco:umbraco cms (medium 6.5)
- [CVE-2024-5548](https://insights.sbomify.com/CVE-2024-5548/): Directory Traversal in stitionai/devika (high 7.5)
- [CVE-2024-55471](https://insights.sbomify.com/CVE-2024-55471/): Oqtane Framework Insecure Direct Object Reference vulnerability (medium 6.5)
- [CVE-2024-55470](https://insights.sbomify.com/CVE-2024-55470/): Oqtane Framework Incorrect Access Control vulnerability (high 7.5)
- [CVE-2024-5547](https://insights.sbomify.com/CVE-2024-5547/): Directory Traversal in stitionai/devika (high 7.5)
- [CVE-2024-55466](https://insights.sbomify.com/CVE-2024-55466/): File upload in thingsboard:thingsboard (medium 6.5)
- [CVE-2024-55461](https://insights.sbomify.com/CVE-2024-55461/): Command injection in seacms:seacms (critical 9.8)
- [CVE-2024-55460](https://insights.sbomify.com/CVE-2024-55460/): A time-based SQL injection vulnerability in the login page of BoardRoom Limited Dividend Distribution Tax Election System Version v2.0 allow (critical 9.8)
- [CVE-2024-5546](https://insights.sbomify.com/CVE-2024-5546/): SQL Injection (high 8.3)
- [CVE-2024-55459](https://insights.sbomify.com/CVE-2024-55459/): keras Path Traversal vulnerability (medium 6.5)
- [CVE-2024-55457](https://insights.sbomify.com/CVE-2024-55457/): MasterSAM Star Gate 11 is vulnerable to directory traversal via /adama/adama/downloadService. (medium 6.5)
- [CVE-2024-55456](https://insights.sbomify.com/CVE-2024-55456/): Memory corruption in sammycage:lunasvg (medium 6.5)
- [CVE-2024-55452](https://insights.sbomify.com/CVE-2024-55452/): Open redirect in ujcms:ujcms (medium 5.4)
- [CVE-2024-55451](https://insights.sbomify.com/CVE-2024-55451/): Cross-site scripting in ujcms:ujcms (medium 4.8)
- [CVE-2024-5545](https://insights.sbomify.com/CVE-2024-5545/): Motors – Car Dealer, Classifieds & Listing <= 1.4.9 - Missing Authorization (medium 5.3)
- [CVE-2024-5544](https://insights.sbomify.com/CVE-2024-5544/): Media Library Assistant <= 3.17 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-5543](https://insights.sbomify.com/CVE-2024-5543/): Slideshow Gallery LITE <= 1.8.1 - Authenticated (Contributor+) SQL Injection (high 8.1)
- [CVE-2024-5542](https://insights.sbomify.com/CVE-2024-5542/): Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits (high 7.2)
- [CVE-2024-55417](https://insights.sbomify.com/CVE-2024-55417/): DevDojo Voyager Arbitrary File Write (medium 4.3)
- [CVE-2024-55416](https://insights.sbomify.com/CVE-2024-55416/): DevDojo Voyager vulnerable to reflected Cross-site Scripting (low 3.5)
- [CVE-2024-55415](https://insights.sbomify.com/CVE-2024-55415/): DevDojo Voyager vulnerable to path traversal (medium 5.7)
- [CVE-2024-55414](https://insights.sbomify.com/CVE-2024-55414/): A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged users to mapping phys (critical 9.8)
- [CVE-2024-55413](https://insights.sbomify.com/CVE-2024-55413/): A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write ar (high 7.8)
- [CVE-2024-55412](https://insights.sbomify.com/CVE-2024-55412/): A vulnerability exits in driver snxpsamd.sys in SUNIX Serial Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbi (high 7.8)
- [CVE-2024-55411](https://insights.sbomify.com/CVE-2024-55411/): An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via su (high 8.8)
- [CVE-2024-5541](https://insights.sbomify.com/CVE-2024-5541/): Ibtana - WordPress Website Builder <= 1.2.3.3 - Unauthenticated reCAPTCHA Settings Update (medium 5.3)
- [CVE-2024-55408](https://insights.sbomify.com/CVE-2024-55408/): Missing authorization in ASCI (medium 5.1)
- [CVE-2024-55407](https://insights.sbomify.com/CVE-2024-55407/): An issue in the DeviceloControl function of ITE Tech. (high 7.8)
- [CVE-2024-55402](https://insights.sbomify.com/CVE-2024-55402/): Missing authorization in 4cstrategies:exonaut (medium 5.3)
- [CVE-2024-55401](https://insights.sbomify.com/CVE-2024-55401/): Path traversal in 4cstrategies:exonaut (medium 6.5)
- [CVE-2024-5540](https://insights.sbomify.com/CVE-2024-5540/): ALC WebCTRL Carrier i-Vu Reflected Cross-Site Scripting (medium 6.9)
- [CVE-2024-55399](https://insights.sbomify.com/CVE-2024-55399/): Server-side request forgery in 4cstrategies:exonaut (medium 6.5)
- [CVE-2024-55398](https://insights.sbomify.com/CVE-2024-55398/): Misconfiguration in 4cstrategies:exonaut (medium 6.5)
- [CVE-2024-5539](https://insights.sbomify.com/CVE-2024-5539/): ALC WebCTRL Carrier i-Vu Access Control Bypass (critical 9.2)
- [CVE-2024-55374](https://insights.sbomify.com/CVE-2024-55374/): Information disclosure in vanderbilt:redcap (medium 5.3)
- [CVE-2024-55372](https://insights.sbomify.com/CVE-2024-55372/): File upload in wallosapp:wallos (critical 9.8)
- [CVE-2024-55371](https://insights.sbomify.com/CVE-2024-55371/): File upload in wallosapp:wallos (critical 9.8)
- [CVE-2024-5536](https://insights.sbomify.com/CVE-2024-5536/): GamiPress – Link <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-55354](https://insights.sbomify.com/CVE-2024-55354/): Security feature bypass in Lucee Server (high 8.8)
- [CVE-2024-5535](https://insights.sbomify.com/CVE-2024-5535/): SSL_select_next_proto buffer overread (critical 9.1)
- [CVE-2024-55342](https://insights.sbomify.com/CVE-2024-55342/): Piranha CMS Cross-site Scripting vulnerability (medium 4.7)
- [CVE-2024-55341](https://insights.sbomify.com/CVE-2024-55341/): Piranha CMS Cross-site Scripting vulnerability (medium 4.7)
- [CVE-2024-5533](https://insights.sbomify.com/CVE-2024-5533/): Divi <= 4.25.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-5532](https://insights.sbomify.com/CVE-2024-5532/): A stored XSS vulnerability has been discovered on OpenText™ Operations Agent (OA). (low 1.8)
- [CVE-2024-5531](https://insights.sbomify.com/CVE-2024-5531/): Ocean Extra <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Flickr Widget (medium 6.4)
- [CVE-2024-5530](https://insights.sbomify.com/CVE-2024-5530/): Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (medium 6.4)
- [CVE-2024-5529](https://insights.sbomify.com/CVE-2024-5529/): WP QuickLaTeX < 3.8.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-5528](https://insights.sbomify.com/CVE-2024-5528/): Incomplete Comparison with Missing Factors in GitLab (low 3.5)
- [CVE-2024-55279](https://insights.sbomify.com/CVE-2024-55279/): Cross-site scripting in uguu:uguu (medium 6.0)
- [CVE-2024-55272](https://insights.sbomify.com/CVE-2024-55272/): An issue in Brainasoft Braina v2.8 allows a remote attacker to obtain sensitive information via the chat window function. (high 7.5)
- [CVE-2024-55271](https://insights.sbomify.com/CVE-2024-55271/): Cross-site request forgery in phpgurukul:gym management system (low 3.5)
- [CVE-2024-55270](https://insights.sbomify.com/CVE-2024-55270/): SQL injection in phpgurukul:student management system (high 8.8)
- [CVE-2024-5527](https://insights.sbomify.com/CVE-2024-5527/): SQL Injection (high 8.3)
- [CVE-2024-55268](https://insights.sbomify.com/CVE-2024-55268/): Cross-site scripting in phpgurukul:covid 19 testing management system (medium 6.1)
- [CVE-2024-5526](https://insights.sbomify.com/CVE-2024-5526/): Server-side request forgery in OnCall (high 7.7)
- [CVE-2024-5525](https://insights.sbomify.com/CVE-2024-5525/): Improper privilege management vulnerability in Astrotalks (high 8.3)
- [CVE-2024-55241](https://insights.sbomify.com/CVE-2024-55241/): An issue in deep-diver LLM-As-Chatbot before commit 99c2c03 allows a remote attacker to execute arbitrary code via the modelsbyom.py component. (high 8.8)
- [CVE-2024-5524](https://insights.sbomify.com/CVE-2024-5524/): Information exposure vulnerability in Astrotalks (medium 5.3)
- [CVE-2024-55239](https://insights.sbomify.com/CVE-2024-55239/): Cross-site scripting in portabilis:i-educar (medium 5.4)
- [CVE-2024-55238](https://insights.sbomify.com/CVE-2024-55238/): OpenMetadata SQL Injection (high 7.1)
- [CVE-2024-55232](https://insights.sbomify.com/CVE-2024-55232/): Missing authorization in phpgurukul:online notes sharing management system (medium 5.4)
- [CVE-2024-55231](https://insights.sbomify.com/CVE-2024-55231/): Missing authorization in phpgurukul:online notes sharing management system (medium 4.3)
- [CVE-2024-5523](https://insights.sbomify.com/CVE-2024-5523/): SQL injection vulnerability in Astrotalks (high 8.8)
- [CVE-2024-55228](https://insights.sbomify.com/CVE-2024-55228/): Dolibarr Cross-site Scripting vulnerability (critical 9.0)
- [CVE-2024-55227](https://insights.sbomify.com/CVE-2024-55227/): Dolibarr Cross-site Scripting vulnerability (critical 9.0)
- [CVE-2024-55226](https://insights.sbomify.com/CVE-2024-55226/): Vaultwarden authenticated reflected cross-site scripting (XSS) vulnerability (medium 5.4)
- [CVE-2024-55225](https://insights.sbomify.com/CVE-2024-55225/): Vaultwarden vulnerable to user impersonation (critical 9.8)
- [CVE-2024-55224](https://insights.sbomify.com/CVE-2024-55224/): Vaultwarden HTML injection vulnerability (critical 9.6)
- [CVE-2024-5522](https://insights.sbomify.com/CVE-2024-5522/): HTML5 Video Player < 2.5.27 - Unauthenticated SQLi (medium 6.5)
- [CVE-2024-55218](https://insights.sbomify.com/CVE-2024-55218/): Cross-site scripting in icewarp:icewarp (medium 6.1)
- [CVE-2024-55215](https://insights.sbomify.com/CVE-2024-55215/): Privilege escalation in jrohy:trojan (critical 9.8)
- [CVE-2024-55214](https://insights.sbomify.com/CVE-2024-55214/): Path traversal in dhtmlx:file explorer (medium 6.5)
- [CVE-2024-55213](https://insights.sbomify.com/CVE-2024-55213/): Path traversal in dhtmlx:file explorer (medium 6.5)
- [CVE-2024-55212](https://insights.sbomify.com/CVE-2024-55212/): DNNGo xBlog v6.5.0 was discovered to contain a SQL injection vulnerability via the Categorys parameter at /DNNGo_xBlog/Resource_Service.aspx. (medium 6.5)
- [CVE-2024-55211](https://insights.sbomify.com/CVE-2024-55211/): Auth bypass in think:tk-rt-wr135g firmware (high 8.4)
- [CVE-2024-55210](https://insights.sbomify.com/CVE-2024-55210/): Auth bypass in totvs:framework \(linha protheus\) (critical 9.8)
- [CVE-2024-5521](https://insights.sbomify.com/CVE-2024-5521/): Cross-Site Scripting stored in Alkacon OpenCMS (medium 6.4)
- [CVE-2024-5520](https://insights.sbomify.com/CVE-2024-5520/): Cross-Site Scripting stored in Alkacon OpenCMS (medium 6.4)
- [CVE-2024-55199](https://insights.sbomify.com/CVE-2024-55199/): Cross-site scripting in celk:celk saude (medium 5.4)
- [CVE-2024-55198](https://insights.sbomify.com/CVE-2024-55198/): Information disclosure in celk:celk saude (medium 5.3)
- [CVE-2024-55196](https://insights.sbomify.com/CVE-2024-55196/): GoPhish sends cleartext passwords (high 7.5)
- [CVE-2024-55195](https://insights.sbomify.com/CVE-2024-55195/): An allocation-size-too-big bug in the component /imagebuf.cpp of OpenImageIO v3.1.0.0dev may cause a Denial of Service (DoS) when the progra (high 7.5)
- [CVE-2024-55194](https://insights.sbomify.com/CVE-2024-55194/): Memory corruption in openimageio:openimageio (critical 9.8)
- [CVE-2024-55193](https://insights.sbomify.com/CVE-2024-55193/): Null dereference in openimageio:openimageio (medium 6.5)
- [CVE-2024-55192](https://insights.sbomify.com/CVE-2024-55192/): Memory corruption in openimageio:openimageio (critical 9.8)
- [CVE-2024-5519](https://insights.sbomify.com/CVE-2024-5519/): ItsourceCode Learning Management System Project In PHP login.php sql injection (medium 6.9)
- [CVE-2024-55186](https://insights.sbomify.com/CVE-2024-55186/): Oqtane Framework Insecure Direct Object Reference vulnerability (medium 4.3)
- [CVE-2024-5518](https://insights.sbomify.com/CVE-2024-5518/): itsourcecode Online Discussion Forum change_profile_picture.php unrestricted upload (medium 5.3)
- [CVE-2024-5517](https://insights.sbomify.com/CVE-2024-5517/): itsourcecode Online Blood Bank Management System changepwd.php sql injection (medium 6.9)
- [CVE-2024-55160](https://insights.sbomify.com/CVE-2024-55160/): SQL injection in g-fast:gfast (critical 9.8)
- [CVE-2024-5516](https://insights.sbomify.com/CVE-2024-5516/): itsourcecode Online Blood Bank Management System massage.php sql injection (medium 5.3)
- [CVE-2024-55159](https://insights.sbomify.com/CVE-2024-55159/): GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the SortName parameter at /system/loginLog/list. (medium 4.2)
- [CVE-2024-55156](https://insights.sbomify.com/CVE-2024-55156/): An XML External Entity (XXE) vulnerability in the deserializeArgs() method of Java SDK for CloudEvents v4.0.1 allows attackers to access sen (medium 5.5)
- [CVE-2024-5515](https://insights.sbomify.com/CVE-2024-5515/): SourceCodester Stock Management System createBrand.php sql injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/194/