# Vulnerabilities published in 2024


- [CVE-2024-54922](https://insights.sbomify.com/CVE-2024-54922/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54921](https://insights.sbomify.com/CVE-2024-54921/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54920](https://insights.sbomify.com/CVE-2024-54920/): SQL injection in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-5492](https://insights.sbomify.com/CVE-2024-5492/): Open redirect vulnerability allows a remote unauthenticated attacker to redirect users to arbitrary websites (medium 5.1)
- [CVE-2024-54919](https://insights.sbomify.com/CVE-2024-54919/): Cross-site scripting in lopalopa:e-learning management system (medium 5.4)
- [CVE-2024-54918](https://insights.sbomify.com/CVE-2024-54918/): File upload in lopalopa:e-learning management system (critical 9.8)
- [CVE-2024-54916](https://insights.sbomify.com/CVE-2024-54916/): An issue in the SharedConfig class of Telegram Android APK v.11.7.0 allows a physically proximate attacker to bypass authentication and esca (medium 6.8)
- [CVE-2024-54910](https://insights.sbomify.com/CVE-2024-54910/): Hasleo Backup Suite Free v4.9.4 and before is vulnerable to Insecure Permissions via the File recovery function. (medium 4.7)
- [CVE-2024-5491](https://insights.sbomify.com/CVE-2024-5491/): Denial of Service (high 7.2)
- [CVE-2024-54909](https://insights.sbomify.com/CVE-2024-54909/): A vulnerability has been identified in GoldPanKit eva-server v4.1.0. (high 8.1)
- [CVE-2024-54907](https://insights.sbomify.com/CVE-2024-54907/): Code injection in totolink:a3002r firmware (high 8.8)
- [CVE-2024-5490](https://insights.sbomify.com/CVE-2024-5490/): SQL Injection (high 8.3)
- [CVE-2024-5489](https://insights.sbomify.com/CVE-2024-5489/): Wbcom Designs - Custom Font Uploader <= 2.3.4 - Missing Authorization to Font Deletion (medium 4.3)
- [CVE-2024-54887](https://insights.sbomify.com/CVE-2024-54887/): Memory corruption in tp-link:tl-wr940n firmware (high 8.0)
- [CVE-2024-54880](https://insights.sbomify.com/CVE-2024-54880/): Business logic in seacms:seacms (critical 9.1)
- [CVE-2024-5488](https://insights.sbomify.com/CVE-2024-5488/): SEOPress < 7.9 - Unauthenticated Object Injection (critical 9.8)
- [CVE-2024-54879](https://insights.sbomify.com/CVE-2024-54879/): Business logic in seacms:seacms (critical 9.1)
- [CVE-2024-5487](https://insights.sbomify.com/CVE-2024-5487/): SQL Injection (high 8.3)
- [CVE-2024-5486](https://insights.sbomify.com/CVE-2024-5486/): Authenticated Sensitive Information Disclosure in ClearPass Policy Manager (medium 5.8)
- [CVE-2024-54855](https://insights.sbomify.com/CVE-2024-54855/): Hardcoded credentials in fabricators:vanilla os core image (medium 6.4)
- [CVE-2024-54853](https://insights.sbomify.com/CVE-2024-54853/): A Stored Cross-Site Scripting (XSS) vulnerability was identified affecting Skybox Change Manager versions 13.2.170 and earlier that allows r (medium 5.4)
- [CVE-2024-54852](https://insights.sbomify.com/CVE-2024-54852/): Other in sismics:teedy (critical 9.8)
- [CVE-2024-54851](https://insights.sbomify.com/CVE-2024-54851/): Cross-site request forgery in sismics:teedy (high 8.8)
- [CVE-2024-5485](https://insights.sbomify.com/CVE-2024-5485/): Cross-site scripting in OttoKit: All-in-One Automation Platform (medium 6.4)
- [CVE-2024-54849](https://insights.sbomify.com/CVE-2024-54849/): Weak cryptography in cpplusworld:cp-vnr-3104 firmware (medium 5.9)
- [CVE-2024-54848](https://insights.sbomify.com/CVE-2024-54848/): Weak cryptography in cpplusworld:cp-vnr-3104 firmware (high 7.4)
- [CVE-2024-54847](https://insights.sbomify.com/CVE-2024-54847/): Weak cryptography in cpplusworld:cp-vnr-3104 firmware (medium 5.9)
- [CVE-2024-54846](https://insights.sbomify.com/CVE-2024-54846/): Weak cryptography in cpplusworld:cp-vnr-3104 firmware (medium 5.9)
- [CVE-2024-54842](https://insights.sbomify.com/CVE-2024-54842/): SQL injection in phpgurukul:online nurse hiring system (critical 9.8)
- [CVE-2024-54840](https://insights.sbomify.com/CVE-2024-54840/): Other in Privileged Access Manager (medium 4.2)
- [CVE-2024-5483](https://insights.sbomify.com/CVE-2024-5483/): LearnPress – WordPress LMS Plugin <= 4.2.6.8 - Basic Information Disclosure via JSON API (medium 5.3)
- [CVE-2024-54820](https://insights.sbomify.com/CVE-2024-54820/): XOne Web Monitor v02.10.2024.530 framework 1.0.4.9 was discovered to contain a SQL injection vulnerability in the login page. (critical 9.8)
- [CVE-2024-5482](https://insights.sbomify.com/CVE-2024-5482/): SSRF in add_webpage endpoint in parisneo/lollms-webui (high 7.4)
- [CVE-2024-54819](https://insights.sbomify.com/CVE-2024-54819/): I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/sec (critical 9.1)
- [CVE-2024-54818](https://insights.sbomify.com/CVE-2024-54818/): Missing authorization in oretnom23:computer laboratory management system (high 8.8)
- [CVE-2024-54811](https://insights.sbomify.com/CVE-2024-54811/): SQL injection in phpgurukul:park ticketing management system (critical 9.8)
- [CVE-2024-54810](https://insights.sbomify.com/CVE-2024-54810/): SQL injection in phpgurukul:pre-school enrollment system (critical 9.8)
- [CVE-2024-5481](https://insights.sbomify.com/CVE-2024-5481/): Path traversal in Photo Gallery by 10Web – Mobile-Friendly Image Gallery (medium 6.8)
- [CVE-2024-54809](https://insights.sbomify.com/CVE-2024-54809/): Memory corruption in netgear:wnr854t firmware (critical 9.8)
- [CVE-2024-54808](https://insights.sbomify.com/CVE-2024-54808/): Memory corruption in netgear:wnr854t firmware (critical 9.8)
- [CVE-2024-54807](https://insights.sbomify.com/CVE-2024-54807/): Command injection in netgear:wnr854t firmware (critical 9.8)
- [CVE-2024-54806](https://insights.sbomify.com/CVE-2024-54806/): Command injection in netgear:wnr854t firmware (critical 9.8)
- [CVE-2024-54805](https://insights.sbomify.com/CVE-2024-54805/): Command injection in netgear:wnr854t firmware (critical 9.8)
- [CVE-2024-54804](https://insights.sbomify.com/CVE-2024-54804/): Command injection in netgear:wnr854t firmware (critical 9.8)
- [CVE-2024-54803](https://insights.sbomify.com/CVE-2024-54803/): Command injection in netgear:wnr854t firmware (critical 9.8)
- [CVE-2024-54802](https://insights.sbomify.com/CVE-2024-54802/): Memory corruption in netgear:wnr854t firmware (critical 9.8)
- [CVE-2024-54795](https://insights.sbomify.com/CVE-2024-54795/): Cross-site scripting in eng:spagobi (medium 5.4)
- [CVE-2024-54794](https://insights.sbomify.com/CVE-2024-54794/): Code injection in eng:spagobi (critical 9.1)
- [CVE-2024-54792](https://insights.sbomify.com/CVE-2024-54792/): Cross-site request forgery in eng:spagobi (medium 6.1)
- [CVE-2024-54790](https://insights.sbomify.com/CVE-2024-54790/): SQL injection in phpgurukul:pre-school enrollment system (high 7.5)
- [CVE-2024-5479](https://insights.sbomify.com/CVE-2024-5479/): Easy Pixels by JEVNET <= 2.13 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-54780](https://insights.sbomify.com/CVE-2024-54780/): Command injection in netgate:pfsense ce (high 8.8)
- [CVE-2024-5478](https://insights.sbomify.com/CVE-2024-5478/): Cross-site Scripting (XSS) in SAML metadata endpoint in lunary-ai/lunary (high 7.4)
- [CVE-2024-54779](https://insights.sbomify.com/CVE-2024-54779/): Cross-site scripting in netgate:pfsense ce (medium 5.4)
- [CVE-2024-54775](https://insights.sbomify.com/CVE-2024-54775/): Dcat-Admin Cross-Site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2024-54774](https://insights.sbomify.com/CVE-2024-54774/): Dcat Admin Cross-site Scripting (XSS) vulnerability (medium 4.8)
- [CVE-2024-54772](https://insights.sbomify.com/CVE-2024-54772/): Information disclosure in mikrotik:routeros (medium 5.4)
- [CVE-2024-5477](https://insights.sbomify.com/CVE-2024-5477/): Other in Certain HP PC Products (high 7.3)
- [CVE-2024-54767](https://insights.sbomify.com/CVE-2024-54767/): An access control issue in the component /juis_boxinfo.xml of AVM FRITZ!Box 7530 AX v7.59 allows attackers to obtain sensitive information w (high 7.5)
- [CVE-2024-54764](https://insights.sbomify.com/CVE-2024-54764/): An access control issue in the component /login/hostinfo2.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. (medium 6.5)
- [CVE-2024-54763](https://insights.sbomify.com/CVE-2024-54763/): An access control issue in the component /login/hostinfo.cgi of ipTIME A2004 v12.17.0 allows attackers to obtain sensitive information without authentication. (medium 6.5)
- [CVE-2024-54762](https://insights.sbomify.com/CVE-2024-54762/): SQL injection in ruoyi:ruoyi (medium 6.3)
- [CVE-2024-54761](https://insights.sbomify.com/CVE-2024-54761/): SQL injection in bigantsoft:bigant office messenger 5 (medium 6.3)
- [CVE-2024-54756](https://insights.sbomify.com/CVE-2024-54756/): A remote code execution (RCE) vulnerability in the ZScript function of ZDoom Team GZDoom v4.13.1 allows attackers to execute arbitrary code (critical 9.8)
- [CVE-2024-54751](https://insights.sbomify.com/CVE-2024-54751/): COMFAST CF-WR630AX v2.7.0.2 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. (critical 9.8)
- [CVE-2024-54750](https://insights.sbomify.com/CVE-2024-54750/): Ubiquiti U6-LR 6.6.65 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. (critical 9.8)
- [CVE-2024-5475](https://insights.sbomify.com/CVE-2024-5475/): Responsive video embed < 0.5.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-54749](https://insights.sbomify.com/CVE-2024-54749/): Ubiquiti U7-Pro 7.0.35 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root. (high 7.5)
- [CVE-2024-54747](https://insights.sbomify.com/CVE-2024-54747/): Hardcoded credentials in wavlink:wn531p3 firmware (critical 9.8)
- [CVE-2024-54745](https://insights.sbomify.com/CVE-2024-54745/): Hardcoded credentials in wavlink:wn701ae firmware (critical 9.8)
- [CVE-2024-5474](https://insights.sbomify.com/CVE-2024-5474/): Information disclosure in Dolby Vision Provisioning software (medium 5.5)
- [CVE-2024-54731](https://insights.sbomify.com/CVE-2024-54731/): Denial of service in CPDF (medium 4.0)
- [CVE-2024-54730](https://insights.sbomify.com/CVE-2024-54730/): Flatnotes <v5.3.1 is vulnerable to denial of service through the upload image function. (high 7.5)
- [CVE-2024-5473](https://insights.sbomify.com/CVE-2024-5473/): Simple Photoswipe <= 0.1 - Admin+ Stored XSS (medium 4.0)
- [CVE-2024-54728](https://insights.sbomify.com/CVE-2024-54728/): Incorrect access control in BYD QIN PLUS DM-i Dilink OS 3.0_13.1.7.2204050.1 allows unauthorized attackers to access system logcat logs. (medium 6.5)
- [CVE-2024-54724](https://insights.sbomify.com/CVE-2024-54724/): PHPYun before 7.0.2 is vulnerable to code execution through backdoor-restricted arbitrary file writing and file inclusion. (critical 9.8)
- [CVE-2024-5472](https://insights.sbomify.com/CVE-2024-5472/): WP QuickLaTeX < 3.8.7 - Admin+ Stored XSS in Background Color field (high 7.1)
- [CVE-2024-5471](https://insights.sbomify.com/CVE-2024-5471/): Agent takeover (high 8.8)
- [CVE-2024-5470](https://insights.sbomify.com/CVE-2024-5470/): Improper Access Control in GitLab (low 3.8)
- [CVE-2024-5469](https://insights.sbomify.com/CVE-2024-5469/): Uncontrolled Resource Consumption in GitLab (low 3.1)
- [CVE-2024-54687](https://insights.sbomify.com/CVE-2024-54687/): Cross-site scripting in vtiger:vtiger crm (medium 6.1)
- [CVE-2024-54683](https://insights.sbomify.com/CVE-2024-54683/): netfilter: IDLETIMER: Fix for possible ABBA deadlock (medium 5.5)
- [CVE-2024-54682](https://insights.sbomify.com/CVE-2024-54682/): Zipbomb DoS via Missing Slack Import Validation (medium 6.5)
- [CVE-2024-54681](https://insights.sbomify.com/CVE-2024-54681/): Ossur Mobile Logic Application Command Injection (low 2.0)
- [CVE-2024-5468](https://insights.sbomify.com/CVE-2024-5468/): Missing authorization in Pearl – Header Builder (medium 6.5)
- [CVE-2024-54679](https://insights.sbomify.com/CVE-2024-54679/): Missing authorization in cyberpanel:cyberpanel (medium 4.3)
- [CVE-2024-54678](https://insights.sbomify.com/CVE-2024-54678/): Deserialization in SIMATIC PCS neo V4.1 (high 8.6)
- [CVE-2024-54677](https://insights.sbomify.com/CVE-2024-54677/): Apache Tomcat: DoS in examples web application (medium 5.3)
- [CVE-2024-54676](https://insights.sbomify.com/CVE-2024-54676/): Apache OpenMeetings: Deserialisation of untrusted data in cluster mode (critical 9.8)
- [CVE-2024-54675](https://insights.sbomify.com/CVE-2024-54675/): app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow. (medium 6.1)
- [CVE-2024-54674](https://insights.sbomify.com/CVE-2024-54674/): app/View/GalaxyClusters/cluster_export_misp_galaxy.ctp in MISP through 2.5.2 has stored XSS when exporting custom clusters into the misp-galaxy format. (medium 6.1)
- [CVE-2024-5467](https://insights.sbomify.com/CVE-2024-5467/): SQL Injection (high 8.3)
- [CVE-2024-54663](https://insights.sbomify.com/CVE-2024-54663/): Path traversal in synacor:zimbra collaboration suite (high 7.5)
- [CVE-2024-54662](https://insights.sbomify.com/CVE-2024-54662/): Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod. (critical 9.1)
- [CVE-2024-54661](https://insights.sbomify.com/CVE-2024-54661/): Other in socat (critical 9.8)
- [CVE-2024-54660](https://insights.sbomify.com/CVE-2024-54660/): A JNDI injection issue was discovered in Cloudera JDBC Connector for Hive before 2.6.26 and JDBC Connector for Impala before 2.6.35. (high 8.7)
- [CVE-2024-5466](https://insights.sbomify.com/CVE-2024-5466/): Remote Code Execution (high 8.8)
- [CVE-2024-54658](https://insights.sbomify.com/CVE-2024-54658/): Denial of service in Safari (medium 6.5)
- [CVE-2024-5465](https://insights.sbomify.com/CVE-2024-5465/): Other in EMUI (medium 5.9)
- [CVE-2024-5464](https://insights.sbomify.com/CVE-2024-5464/): Missing authorization in EMUI (medium 4.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/196/