# Vulnerabilities published in 2024


- [CVE-2024-50706](https://insights.sbomify.com/CVE-2024-50706/): SQL injection in uniguest:tripleplay (critical 9.8)
- [CVE-2024-50705](https://insights.sbomify.com/CVE-2024-50705/): Cross-site scripting in uniguest:tripleplay (high 7.1)
- [CVE-2024-50704](https://insights.sbomify.com/CVE-2024-50704/): Code injection in uniguest:tripleplay (critical 10.0)
- [CVE-2024-50703](https://insights.sbomify.com/CVE-2024-50703/): TeamPass privileges issue (medium 5.4)
- [CVE-2024-50702](https://insights.sbomify.com/CVE-2024-50702/): TeamPass mail_me operation authorization issue (medium 5.4)
- [CVE-2024-50701](https://insights.sbomify.com/CVE-2024-50701/): TeamPass does not properly check whether a folder is in a user's allowed folders list (medium 4.3)
- [CVE-2024-50699](https://insights.sbomify.com/CVE-2024-50699/): Hardcoded credentials in tp-link:tl-wr845n firmware (high 8.0)
- [CVE-2024-50698](https://insights.sbomify.com/CVE-2024-50698/): Memory corruption in sungrowpower:winet-s firmware (critical 9.8)
- [CVE-2024-50697](https://insights.sbomify.com/CVE-2024-50697/): Memory corruption in sungrowpower:winet-s firmware (high 8.1)
- [CVE-2024-50696](https://insights.sbomify.com/CVE-2024-50696/): Security feature bypass in sungrowpower:winet-s firmware (high 7.5)
- [CVE-2024-50695](https://insights.sbomify.com/CVE-2024-50695/): Memory corruption in sungrowpower:winet-s firmware (critical 9.8)
- [CVE-2024-50694](https://insights.sbomify.com/CVE-2024-50694/): Memory corruption in sungrowpower:winet-s firmware (critical 9.8)
- [CVE-2024-50693](https://insights.sbomify.com/CVE-2024-50693/): Missing authorization in sungrowpower:isolarcloud (critical 9.1)
- [CVE-2024-50692](https://insights.sbomify.com/CVE-2024-50692/): Hardcoded credentials in sungrowpower:winet-s firmware (medium 5.4)
- [CVE-2024-50691](https://insights.sbomify.com/CVE-2024-50691/): Security feature bypass in sungrowpower:isolarcloud (high 7.4)
- [CVE-2024-50690](https://insights.sbomify.com/CVE-2024-50690/): Hardcoded credentials in sungrowpower:winet-s firmware (medium 6.5)
- [CVE-2024-5069](https://insights.sbomify.com/CVE-2024-5069/): SourceCodester Simple Online Mens Salon Management System view_service.php sql injection (medium 5.3)
- [CVE-2024-50689](https://insights.sbomify.com/CVE-2024-50689/): Missing authorization in sungrowpower:isolarcloud (critical 9.1)
- [CVE-2024-50688](https://insights.sbomify.com/CVE-2024-50688/): Hardcoded credentials in sungrowpower:isolarcloud (critical 9.8)
- [CVE-2024-50687](https://insights.sbomify.com/CVE-2024-50687/): Missing authorization in sungrowpower:isolarcloud (critical 9.1)
- [CVE-2024-50686](https://insights.sbomify.com/CVE-2024-50686/): Missing authorization in sungrowpower:isolarcloud (critical 9.1)
- [CVE-2024-50685](https://insights.sbomify.com/CVE-2024-50685/): Missing authorization in sungrowpower:isolarcloud (critical 9.1)
- [CVE-2024-50684](https://insights.sbomify.com/CVE-2024-50684/): Weak cryptography in sungrowpower:isolarcloud (medium 6.5)
- [CVE-2024-50677](https://insights.sbomify.com/CVE-2024-50677/): Cross-site scripting in oroinc:oroplatform (medium 6.1)
- [CVE-2024-50672](https://insights.sbomify.com/CVE-2024-50672/): A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administ (critical 9.8)
- [CVE-2024-50671](https://insights.sbomify.com/CVE-2024-50671/): Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User roles to obtain email add (medium 4.3)
- [CVE-2024-5067](https://insights.sbomify.com/CVE-2024-5067/): Exposure of Sensitive Information to an Unauthorized Actor in GitLab (medium 4.4)
- [CVE-2024-50667](https://insights.sbomify.com/CVE-2024-50667/): Memory corruption in trendnet:tew-820ap firmware (critical 9.8)
- [CVE-2024-50665](https://insights.sbomify.com/CVE-2024-50665/): Null dereference in gpac:gpac (medium 5.5)
- [CVE-2024-50664](https://insights.sbomify.com/CVE-2024-50664/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2024-50660](https://insights.sbomify.com/CVE-2024-50660/): File upload in ipublishmedia:adportal (critical 9.8)
- [CVE-2024-5066](https://insights.sbomify.com/CVE-2024-5066/): PHPGurukul Online Course Registration System pincode-verification.php sql injection (medium 5.3)
- [CVE-2024-50659](https://insights.sbomify.com/CVE-2024-50659/): Cross-site scripting in ipublishmedia:adportal (medium 6.1)
- [CVE-2024-50658](https://insights.sbomify.com/CVE-2024-50658/): Code injection in ipublishmedia:adportal (critical 9.8)
- [CVE-2024-50657](https://insights.sbomify.com/CVE-2024-50657/): An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCodeViewModel class, spec (medium 6.8)
- [CVE-2024-50656](https://insights.sbomify.com/CVE-2024-50656/): Cross-site scripting in angeljudesuarez:placement management system (medium 6.1)
- [CVE-2024-50655](https://insights.sbomify.com/CVE-2024-50655/): Cross-site scripting in emlog:emlog (medium 6.1)
- [CVE-2024-50654](https://insights.sbomify.com/CVE-2024-50654/): Business logic in pickmall:lilishop (high 7.5)
- [CVE-2024-50653](https://insights.sbomify.com/CVE-2024-50653/): Business logic in crmeb:crmeb (high 7.5)
- [CVE-2024-50652](https://insights.sbomify.com/CVE-2024-50652/): File upload in geeeeeeeek:java shop (medium 6.3)
- [CVE-2024-50651](https://insights.sbomify.com/CVE-2024-50651/): Missing authorization in geeeeeeeek:java shop (medium 6.5)
- [CVE-2024-50650](https://insights.sbomify.com/CVE-2024-50650/): Missing authorization in timgreen:python book (high 7.5)
- [CVE-2024-5065](https://insights.sbomify.com/CVE-2024-5065/): PHPGurukul Online Course Registration System sql injection (medium 6.9)
- [CVE-2024-50649](https://insights.sbomify.com/CVE-2024-50649/): File upload in timgreen:python book (critical 9.8)
- [CVE-2024-50648](https://insights.sbomify.com/CVE-2024-50648/): File upload in guchengwuyue:yshopmall (critical 9.8)
- [CVE-2024-50647](https://insights.sbomify.com/CVE-2024-50647/): The python_food ordering system V1.0 has an unauthorized vulnerability that leads to the leakage of sensitive user information. (high 7.5)
- [CVE-2024-50645](https://insights.sbomify.com/CVE-2024-50645/): MallChat v1.0-SNAPSHOT has an authentication bypass vulnerability. (critical 9.8)
- [CVE-2024-50644](https://insights.sbomify.com/CVE-2024-50644/): zhisheng17 blog 3.0.1-SNAPSHOT has an authentication bypass vulnerability. (critical 9.8)
- [CVE-2024-50641](https://insights.sbomify.com/CVE-2024-50641/): An authentication bypass vulnerability in PandoraNext-TokensTool v0.6.8 and before. (high 8.1)
- [CVE-2024-50640](https://insights.sbomify.com/CVE-2024-50640/): jeewx-boot 1.3 has an authentication bypass vulnerability in the preHandle function (critical 9.8)
- [CVE-2024-5064](https://insights.sbomify.com/CVE-2024-5064/): PHPGurukul Online Course Registration System news-details.php sql injection (medium 6.9)
- [CVE-2024-50637](https://insights.sbomify.com/CVE-2024-50637/): UnoPim Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2024-50636](https://insights.sbomify.com/CVE-2024-50636/): PyMOL 2.5.0 contains a vulnerability in its "Run Script" function, which allows the execution of arbitrary Python code embedded within .PYM files. (critical 9.8)
- [CVE-2024-50634](https://insights.sbomify.com/CVE-2024-50634/): Weak cryptography in sbond:watcharr (high 8.8)
- [CVE-2024-50633](https://insights.sbomify.com/CVE-2024-50633/): Indico Insecure Access (not scored)
- [CVE-2024-50631](https://insights.sbomify.com/CVE-2024-50631/): SQL injection in Synology Drive Server (high 7.5)
- [CVE-2024-50630](https://insights.sbomify.com/CVE-2024-50630/): Auth bypass in Synology Drive Server (high 7.5)
- [CVE-2024-5063](https://insights.sbomify.com/CVE-2024-5063/): PHPGurukul Online Course Registration System index.php sql injection (medium 6.9)
- [CVE-2024-50629](https://insights.sbomify.com/CVE-2024-50629/): Path traversal in BeeStation OS (BSM) (medium 5.3)
- [CVE-2024-50628](https://insights.sbomify.com/CVE-2024-50628/): Missing authorization in digi:connectport lts firmware (high 8.8)
- [CVE-2024-50627](https://insights.sbomify.com/CVE-2024-50627/): File upload in digi:connectport lts firmware (high 8.8)
- [CVE-2024-50626](https://insights.sbomify.com/CVE-2024-50626/): Path traversal in digi:connectport lts firmware (high 8.8)
- [CVE-2024-50625](https://insights.sbomify.com/CVE-2024-50625/): File upload in digi:connectport lts firmware (high 8.0)
- [CVE-2024-50624](https://insights.sbomify.com/CVE-2024-50624/): ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle attackers to trigger use of an attacker-controlled mail server because c (medium 5.9)
- [CVE-2024-50623](https://insights.sbomify.com/CVE-2024-50623/): Cleo Multiple Products Unrestricted File Upload (critical 9.8, exploited in the wild)
- [CVE-2024-50620](https://insights.sbomify.com/CVE-2024-50620/): File upload in cipplanner:cipace (high 8.8)
- [CVE-2024-5062](https://insights.sbomify.com/CVE-2024-5062/): Reflected XSS through survey redirect parameter in zenml-io/zenml (medium 5.3)
- [CVE-2024-50619](https://insights.sbomify.com/CVE-2024-50619/): Privilege escalation in cipplanner:cipace (high 8.8)
- [CVE-2024-50618](https://insights.sbomify.com/CVE-2024-50618/): Auth bypass in cipplanner:cipace (medium 4.3)
- [CVE-2024-50617](https://insights.sbomify.com/CVE-2024-50617/): Missing authorization in cipplanner:cipace (high 7.5)
- [CVE-2024-50616](https://insights.sbomify.com/CVE-2024-50616/): Ironman PowerShell Universal 5.x before 5.0.12 allows an authenticated attacker to elevate their privileges and view job information. (high 8.8)
- [CVE-2024-50615](https://insights.sbomify.com/CVE-2024-50615/): Denial of service in tinyxml2 project:tinyxml2 (medium 6.5)
- [CVE-2024-50614](https://insights.sbomify.com/CVE-2024-50614/): Denial of service in tinyxml2 project:tinyxml2 (medium 6.5)
- [CVE-2024-50613](https://insights.sbomify.com/CVE-2024-50613/): Denial of service in libsndfile project:libsndfile (medium 6.5)
- [CVE-2024-50612](https://insights.sbomify.com/CVE-2024-50612/): Memory corruption in libsndfile project:libsndfile (medium 5.3)
- [CVE-2024-50611](https://insights.sbomify.com/CVE-2024-50611/): CycloneDX cdxgen may execute code contained within build-related files (high 7.2)
- [CVE-2024-50610](https://insights.sbomify.com/CVE-2024-50610/): Integer overflow in gnu:gnu scientific library (low 3.6)
- [CVE-2024-5061](https://insights.sbomify.com/CVE-2024-5061/): Enfold <= 6.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wrapper_class and class Parameters (medium 6.4)
- [CVE-2024-50609](https://insights.sbomify.com/CVE-2024-50609/): Null dereference in treasuredata:fluent bit (high 7.5)
- [CVE-2024-50608](https://insights.sbomify.com/CVE-2024-50608/): Null dereference in treasuredata:fluent bit (high 7.5)
- [CVE-2024-50603](https://insights.sbomify.com/CVE-2024-50603/): Aviatrix Controllers OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2024-50602](https://insights.sbomify.com/CVE-2024-50602/): Denial of service in debian:debian linux (medium 5.9)
- [CVE-2024-50601](https://insights.sbomify.com/CVE-2024-50601/): Persistent and reflected XSS vulnerabilities in the themeMode cookie and _h URL parameter of Axigen Mail Server up to version 10.5.28 allow (medium 6.1)
- [CVE-2024-50600](https://insights.sbomify.com/CVE-2024-50600/): Memory corruption in samsung:exynos 1080 firmware (high 7.5)
- [CVE-2024-5060](https://insights.sbomify.com/CVE-2024-5060/): Cross-site scripting in LottieFiles – JSON Based Animation Lottie & Bodymovin for Elementor (medium 6.4)
- [CVE-2024-50599](https://insights.sbomify.com/CVE-2024-50599/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2024-50597](https://insights.sbomify.com/CVE-2024-50597/): Integer overflow in X-CUBE-AZRT-H7RS (medium 4.3)
- [CVE-2024-50596](https://insights.sbomify.com/CVE-2024-50596/): Integer overflow in X-CUBE-AZRT-H7RS (medium 4.3)
- [CVE-2024-50595](https://insights.sbomify.com/CVE-2024-50595/): Integer overflow in X-CUBE-AZRT-H7RS (medium 4.3)
- [CVE-2024-50594](https://insights.sbomify.com/CVE-2024-50594/): Integer overflow in X-CUBE-AZRT-H7RS (medium 4.3)
- [CVE-2024-50593](https://insights.sbomify.com/CVE-2024-50593/): Hardcoded Service Password (high 7.8)
- [CVE-2024-50592](https://insights.sbomify.com/CVE-2024-50592/): Local Privilege Escalation via Race Condition (high 7.0)
- [CVE-2024-50591](https://insights.sbomify.com/CVE-2024-50591/): Local Privilege Escalation via Command Injection (high 7.8)
- [CVE-2024-50590](https://insights.sbomify.com/CVE-2024-50590/): Local Privilege Escalation via Weak Service Binary Permissions (high 7.8)
- [CVE-2024-5059](https://insights.sbomify.com/CVE-2024-5059/): WordPress Event Monster Plugin <= 1.4.0 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-50589](https://insights.sbomify.com/CVE-2024-50589/): Unprotected FHIR API (high 7.5)
- [CVE-2024-50588](https://insights.sbomify.com/CVE-2024-50588/): Unprotected Exposed Firebird Database with default credentials (critical 9.8)
- [CVE-2024-50585](https://insights.sbomify.com/CVE-2024-50585/): Reflected Cross-Site Scripting (medium 4.7)
- [CVE-2024-50584](https://insights.sbomify.com/CVE-2024-50584/): SQL Injection (medium 4.4)
- [CVE-2024-50583](https://insights.sbomify.com/CVE-2024-50583/): Privilege escalation in Naver Whale browser Installer (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/226/