# Vulnerabilities published in 2024


- [CVE-2024-5514](https://insights.sbomify.com/CVE-2024-5514/): MinMax CMS - Hidden Functionality (critical 9.8)
- [CVE-2024-5513](https://insights.sbomify.com/CVE-2024-5513/): Kofax Power PDF JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-5512](https://insights.sbomify.com/CVE-2024-5512/): Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-5511](https://insights.sbomify.com/CVE-2024-5511/): Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-55104](https://insights.sbomify.com/CVE-2024-55104/): SQL injection in phpgurukul:online nurse hiring system (high 7.2)
- [CVE-2024-55103](https://insights.sbomify.com/CVE-2024-55103/): SQL injection in phpgurukul:online nurse hiring system (high 7.2)
- [CVE-2024-55100](https://insights.sbomify.com/CVE-2024-55100/): Cross-site scripting in phpgurukul:online nurse hiring system (medium 4.8)
- [CVE-2024-5510](https://insights.sbomify.com/CVE-2024-5510/): Kofax Power PDF JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-55099](https://insights.sbomify.com/CVE-2024-55099/): SQL injection in phpgurukul:online nurse hiring system (critical 9.8)
- [CVE-2024-55093](https://insights.sbomify.com/CVE-2024-55093/): Cross-site scripting in phpIPAM (medium 5.4)
- [CVE-2024-5509](https://insights.sbomify.com/CVE-2024-5509/): Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-55089](https://insights.sbomify.com/CVE-2024-55089/): Server-side request forgery in Rhymix (medium 4.1)
- [CVE-2024-55088](https://insights.sbomify.com/CVE-2024-55088/): Server-side request forgery in getsimple-ce:getsimple cms (high 8.8)
- [CVE-2024-55086](https://insights.sbomify.com/CVE-2024-55086/): Server-side request forgery in getsimple-ce:getsimple cms (high 7.2)
- [CVE-2024-55085](https://insights.sbomify.com/CVE-2024-55085/): Code injection in getsimple-ce:getsimple cms (critical 9.8)
- [CVE-2024-55082](https://insights.sbomify.com/CVE-2024-55082/): A Server-Side Request Forgery (SSRF) in the endpoint http://{your-server}/url-to-pdf of Stirling-PDF 0.35.1 allows attackers to access sensi (high 7.5)
- [CVE-2024-55081](https://insights.sbomify.com/CVE-2024-55081/): An XML External Entity (XXE) injection vulnerability in the component /datagrip/upload of Chat2DB v0.3.5 allows attackers to execute arbitra (critical 9.8)
- [CVE-2024-5508](https://insights.sbomify.com/CVE-2024-5508/): Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-55078](https://insights.sbomify.com/CVE-2024-55078/): An arbitrary file upload vulnerability in the component /adminUser/updateImg of WukongCRM-11.0-JAVA v11.3.3 allows attackers to execute arbi (critical 9.8)
- [CVE-2024-55076](https://insights.sbomify.com/CVE-2024-55076/): Cross-site request forgery in Grocy (high 8.1)
- [CVE-2024-55075](https://insights.sbomify.com/CVE-2024-55075/): Information disclosure in Grocy (medium 4.3)
- [CVE-2024-55074](https://insights.sbomify.com/CVE-2024-55074/): Cross-site scripting in Grocy (high 8.8)
- [CVE-2024-55073](https://insights.sbomify.com/CVE-2024-55073/): Missing authorization in mealie:mealie (high 7.6)
- [CVE-2024-55072](https://insights.sbomify.com/CVE-2024-55072/): Missing authorization in mealie:mealie (medium 5.4)
- [CVE-2024-55070](https://insights.sbomify.com/CVE-2024-55070/): Missing authorization in mealie:mealie (low 3.1)
- [CVE-2024-5507](https://insights.sbomify.com/CVE-2024-5507/): Luxion KeyShot Viewer KSP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-55069](https://insights.sbomify.com/CVE-2024-55069/): Null dereference in ffmpeg:ffmpeg (medium 5.3)
- [CVE-2024-55064](https://insights.sbomify.com/CVE-2024-55064/): Cross-site scripting in easyvirt:dc netscope (medium 5.4)
- [CVE-2024-55063](https://insights.sbomify.com/CVE-2024-55063/): Code injection in easyvirt:dc netscope (high 8.8)
- [CVE-2024-55062](https://insights.sbomify.com/CVE-2024-55062/): Code injection in easyvirt:co2scope (critical 9.8)
- [CVE-2024-55060](https://insights.sbomify.com/CVE-2024-55060/): Cross-site scripting in rafed-system:rafed cms website (medium 6.1)
- [CVE-2024-5506](https://insights.sbomify.com/CVE-2024-5506/): Luxion KeyShot Viewer KSP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-55059](https://insights.sbomify.com/CVE-2024-55059/): Cross-site scripting in phpgurukul:online birth certificate system (medium 6.1)
- [CVE-2024-55058](https://insights.sbomify.com/CVE-2024-55058/): Missing authorization in phpgurukul:online birth certificate system (medium 4.3)
- [CVE-2024-55057](https://insights.sbomify.com/CVE-2024-55057/): Weak cryptography in phpgurukul:online birth certificate system (medium 5.4)
- [CVE-2024-55056](https://insights.sbomify.com/CVE-2024-55056/): Cross-site scripting in phpgurukul:online birth certificate system (medium 5.4)
- [CVE-2024-5505](https://insights.sbomify.com/CVE-2024-5505/): NETGEAR ProSAFE Network Management System UpLoadServlet Directory Traversal Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-55045](https://insights.sbomify.com/CVE-2024-55045/): Firmament-Autopilot FMT-Firmware commit de5aec was discovered to contain a buffer overflow via the task_mavobc_entry function at /comm/task_comm.c. (high 7.3)
- [CVE-2024-55040](https://insights.sbomify.com/CVE-2024-55040/): Cross-site scripting in sensaphone:web600 firmware (medium 6.1)
- [CVE-2024-5504](https://insights.sbomify.com/CVE-2024-5504/): Cross-site scripting in Rife Extensions & Templates for Elementor (medium 6.4)
- [CVE-2024-55030](https://insights.sbomify.com/CVE-2024-55030/): Command injection in nasa:fprime (critical 9.8)
- [CVE-2024-5503](https://insights.sbomify.com/CVE-2024-5503/): WP Blog Post Layouts <= 1.1.3 - Authenticated (Contributor+) Local File Inlcusion (high 8.8)
- [CVE-2024-55029](https://insights.sbomify.com/CVE-2024-55029/): Cross-site scripting in nasa:fprime (medium 6.1)
- [CVE-2024-55028](https://insights.sbomify.com/CVE-2024-55028/): Code injection in nasa:fprime (critical 9.8)
- [CVE-2024-55027](https://insights.sbomify.com/CVE-2024-55027/): Information disclosure in weintek:cmt-3072xh2 firmware (high 7.5)
- [CVE-2024-55026](https://insights.sbomify.com/CVE-2024-55026/): Command injection in weintek:cmt-3072xh2 firmware (high 8.8)
- [CVE-2024-55025](https://insights.sbomify.com/CVE-2024-55025/): Missing authorization in weintek:cmt-3072xh2 firmware (medium 6.5)
- [CVE-2024-55024](https://insights.sbomify.com/CVE-2024-55024/): Auth bypass in weintek:cmt-3072xh2 firmware (high 8.8)
- [CVE-2024-55023](https://insights.sbomify.com/CVE-2024-55023/): Hardcoded credentials in weintek:cmt-3072xh2 firmware (medium 5.3)
- [CVE-2024-55022](https://insights.sbomify.com/CVE-2024-55022/): Command injection in weintek:cmt-3072xh2 firmware (high 8.8)
- [CVE-2024-55021](https://insights.sbomify.com/CVE-2024-55021/): Hardcoded credentials in weintek:cmt-3072xh2 firmware (high 7.5)
- [CVE-2024-55020](https://insights.sbomify.com/CVE-2024-55020/): Command injection in weintek:cmt-3072xh2 firmware (critical 9.8)
- [CVE-2024-5502](https://insights.sbomify.com/CVE-2024-5502/): Piotnet Addons For Elementor <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (medium 6.4)
- [CVE-2024-55019](https://insights.sbomify.com/CVE-2024-55019/): Missing authorization in weintek:cmt-3072xh2 firmware (medium 6.5)
- [CVE-2024-55017](https://insights.sbomify.com/CVE-2024-55017/): Account Takeover in Corezoid 6.6.0 in the OAuth2 implementation via an open redirect in the redirect_uri parameter allows attackers to inter (high 7.5)
- [CVE-2024-55016](https://insights.sbomify.com/CVE-2024-55016/): SQL injection in phpgurukul:student record system (medium 6.5)
- [CVE-2024-5501](https://insights.sbomify.com/CVE-2024-5501/): Cross-site scripting in Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder (medium 6.4)
- [CVE-2024-55009](https://insights.sbomify.com/CVE-2024-55009/): Cross-site scripting in datax:autobib (medium 6.1)
- [CVE-2024-55008](https://insights.sbomify.com/CVE-2024-55008/): Denial of service in jatos:jatos (high 7.5)
- [CVE-2024-55000](https://insights.sbomify.com/CVE-2024-55000/): Cross-site scripting in mayurik:house rental management system (medium 5.4)
- [CVE-2024-5500](https://insights.sbomify.com/CVE-2024-5500/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2024-54999](https://insights.sbomify.com/CVE-2024-54999/): Cross-site scripting in monicahq:monica (medium 6.5)
- [CVE-2024-54998](https://insights.sbomify.com/CVE-2024-54998/): Cross-site scripting in monicahq:monica (medium 5.4)
- [CVE-2024-54997](https://insights.sbomify.com/CVE-2024-54997/): Cross-site scripting in monicahq:monica (medium 5.4)
- [CVE-2024-54996](https://insights.sbomify.com/CVE-2024-54996/): Cross-site scripting in monicahq:monica (high 8.8)
- [CVE-2024-54994](https://insights.sbomify.com/CVE-2024-54994/): Cross-site scripting in monicahq:monica (medium 6.5)
- [CVE-2024-5499](https://insights.sbomify.com/CVE-2024-5499/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-54984](https://insights.sbomify.com/CVE-2024-54984/): An issue in Quectel BG96 BG96MAR02A08M1G allows attackers to bypass authentication via a crafted NAS message. (critical 9.8)
- [CVE-2024-54983](https://insights.sbomify.com/CVE-2024-54983/): An issue in Quectel BC95-CNV V100R001C00SPC051 allows attackers to bypass authentication via a crafted NAS message. (critical 9.8)
- [CVE-2024-54982](https://insights.sbomify.com/CVE-2024-54982/): An issue in Quectel BC25 with firmware version BC25PAR01A06 allows attackers to bypass authentication via a crafted NAS message. (not scored)
- [CVE-2024-5498](https://insights.sbomify.com/CVE-2024-5498/): Use after free in Chrome (medium 5.4)
- [CVE-2024-5497](https://insights.sbomify.com/CVE-2024-5497/): Memory corruption in Chrome (high 7.5)
- [CVE-2024-54961](https://insights.sbomify.com/CVE-2024-54961/): Information disclosure in nagios:nagios xi (medium 6.5)
- [CVE-2024-54960](https://insights.sbomify.com/CVE-2024-54960/): SQL injection in nagios:nagios xi (medium 6.5)
- [CVE-2024-5496](https://insights.sbomify.com/CVE-2024-5496/): Use after free in Chrome (high 7.5)
- [CVE-2024-54959](https://insights.sbomify.com/CVE-2024-54959/): Cross-site request forgery in nagios:nagios xi (medium 6.1)
- [CVE-2024-54958](https://insights.sbomify.com/CVE-2024-54958/): Cross-site scripting in nagios:nagios xi (medium 6.1)
- [CVE-2024-54957](https://insights.sbomify.com/CVE-2024-54957/): Open redirect in nagios:nagios xi (medium 6.1)
- [CVE-2024-54954](https://insights.sbomify.com/CVE-2024-54954/): Code injection in zhyd:oneblog (high 8.0)
- [CVE-2024-54952](https://insights.sbomify.com/CVE-2024-54952/): Null dereference in mikrotik:routeros (high 7.5)
- [CVE-2024-54951](https://insights.sbomify.com/CVE-2024-54951/): Cross-site scripting in monicahq:monica (medium 5.4)
- [CVE-2024-5495](https://insights.sbomify.com/CVE-2024-5495/): Use after free in Chrome (high 7.5)
- [CVE-2024-5494](https://insights.sbomify.com/CVE-2024-5494/): Use after free in Chrome (high 7.5)
- [CVE-2024-54938](https://insights.sbomify.com/CVE-2024-54938/): Information disclosure in lopalopa:e-learning management system (high 7.5)
- [CVE-2024-54937](https://insights.sbomify.com/CVE-2024-54937/): Information disclosure in lopalopa:e-learning management system (medium 5.3)
- [CVE-2024-54936](https://insights.sbomify.com/CVE-2024-54936/): Cross-site scripting in lopalopa:e-learning management system (medium 5.4)
- [CVE-2024-54935](https://insights.sbomify.com/CVE-2024-54935/): Cross-site scripting in lopalopa:e-learning management system (medium 5.4)
- [CVE-2024-54934](https://insights.sbomify.com/CVE-2024-54934/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54933](https://insights.sbomify.com/CVE-2024-54933/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54932](https://insights.sbomify.com/CVE-2024-54932/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54931](https://insights.sbomify.com/CVE-2024-54931/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54930](https://insights.sbomify.com/CVE-2024-54930/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-5493](https://insights.sbomify.com/CVE-2024-5493/): Memory corruption in Chrome (high 7.5)
- [CVE-2024-54929](https://insights.sbomify.com/CVE-2024-54929/): SQL injection in lopalopa:e-learning management system (high 7.2)
- [CVE-2024-54928](https://insights.sbomify.com/CVE-2024-54928/): SQL injection in lopalopa:e-learning management system (high 7.2)
- [CVE-2024-54927](https://insights.sbomify.com/CVE-2024-54927/): SQL injection in lopalopa:e-learning management system (high 7.2)
- [CVE-2024-54926](https://insights.sbomify.com/CVE-2024-54926/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54925](https://insights.sbomify.com/CVE-2024-54925/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54924](https://insights.sbomify.com/CVE-2024-54924/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54923](https://insights.sbomify.com/CVE-2024-54923/): SQL injection in lopalopa:e-learning management system (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/195/