# Vulnerabilities published in 2024


- [CVE-2024-50396](https://insights.sbomify.com/CVE-2024-50396/): QTS, QuTS hero (high 7.7)
- [CVE-2024-50395](https://insights.sbomify.com/CVE-2024-50395/): Media Streaming add-on (medium 6.9)
- [CVE-2024-50394](https://insights.sbomify.com/CVE-2024-50394/): Helpdesk (high 7.7)
- [CVE-2024-50393](https://insights.sbomify.com/CVE-2024-50393/): QTS, QuTS hero (high 8.7)
- [CVE-2024-50390](https://insights.sbomify.com/CVE-2024-50390/): QHora (high 7.7)
- [CVE-2024-5039](https://insights.sbomify.com/CVE-2024-5039/): Cross-site scripting in HUSKY – Products Filter Professional for WooCommerce (medium 6.4)
- [CVE-2024-50389](https://insights.sbomify.com/CVE-2024-50389/): QuRouter (critical 9.5)
- [CVE-2024-50388](https://insights.sbomify.com/CVE-2024-50388/): HBS 3 Hybrid Backup Sync (critical 9.5)
- [CVE-2024-50387](https://insights.sbomify.com/CVE-2024-50387/): SMB Service (critical 10.0)
- [CVE-2024-50386](https://insights.sbomify.com/CVE-2024-50386/): Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure (high 8.5)
- [CVE-2024-50385](https://insights.sbomify.com/CVE-2024-50385/): Denial of service in X-CUBE-AZRT-H7RS (medium 6.5)
- [CVE-2024-50384](https://insights.sbomify.com/CVE-2024-50384/): Denial of service in X-CUBE-AZRT-H7RS (medium 6.5)
- [CVE-2024-50383](https://insights.sbomify.com/CVE-2024-50383/): Weak cryptography in botan project:botan (medium 5.9)
- [CVE-2024-50382](https://insights.sbomify.com/CVE-2024-50382/): Weak cryptography in botan project:botan (medium 5.9)
- [CVE-2024-50381](https://insights.sbomify.com/CVE-2024-50381/): Missing Authentication for Critical Function in Snap One OVRC cloud (high 8.8)
- [CVE-2024-50380](https://insights.sbomify.com/CVE-2024-50380/): Authentication Bypass by Spoofing in Snap One OVRC cloud (high 8.7)
- [CVE-2024-5038](https://insights.sbomify.com/CVE-2024-5038/): Colibri Page Builder <= 1.0.276 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-50379](https://insights.sbomify.com/CVE-2024-50379/): Apache Tomcat: RCE due to TOCTOU issue in JSP compilation (critical 9.8)
- [CVE-2024-50378](https://insights.sbomify.com/CVE-2024-50378/): Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cli (medium 4.9)
- [CVE-2024-50377](https://insights.sbomify.com/CVE-2024-50377/): Hardcoded credentials in EKI-6333AC-1GPO (medium 6.5)
- [CVE-2024-50376](https://insights.sbomify.com/CVE-2024-50376/): Cross-site scripting in EKI-6333AC-1GPO (high 7.3)
- [CVE-2024-50375](https://insights.sbomify.com/CVE-2024-50375/): Auth bypass in EKI-6333AC-1GPO (critical 9.8)
- [CVE-2024-50374](https://insights.sbomify.com/CVE-2024-50374/): Command injection in EKI-6333AC-1GPO (critical 9.8)
- [CVE-2024-50373](https://insights.sbomify.com/CVE-2024-50373/): Command injection in EKI-6333AC-1GPO (critical 9.8)
- [CVE-2024-50372](https://insights.sbomify.com/CVE-2024-50372/): Command injection in EKI-6333AC-1GPO (critical 9.8)
- [CVE-2024-50371](https://insights.sbomify.com/CVE-2024-50371/): Command injection in EKI-6333AC-1GPO (critical 9.8)
- [CVE-2024-50370](https://insights.sbomify.com/CVE-2024-50370/): Command injection in EKI-6333AC-1GPO (critical 9.8)
- [CVE-2024-5037](https://insights.sbomify.com/CVE-2024-5037/): Openshift/telemeter: iss check during jwt authentication can be bypassed (high 7.5)
- [CVE-2024-50369](https://insights.sbomify.com/CVE-2024-50369/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50368](https://insights.sbomify.com/CVE-2024-50368/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50367](https://insights.sbomify.com/CVE-2024-50367/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50366](https://insights.sbomify.com/CVE-2024-50366/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50365](https://insights.sbomify.com/CVE-2024-50365/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50364](https://insights.sbomify.com/CVE-2024-50364/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50363](https://insights.sbomify.com/CVE-2024-50363/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50362](https://insights.sbomify.com/CVE-2024-50362/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50361](https://insights.sbomify.com/CVE-2024-50361/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50360](https://insights.sbomify.com/CVE-2024-50360/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-5036](https://insights.sbomify.com/CVE-2024-5036/): Cross-site scripting in Sina Extension for Elementor (medium 6.4)
- [CVE-2024-50359](https://insights.sbomify.com/CVE-2024-50359/): Command injection in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50358](https://insights.sbomify.com/CVE-2024-50358/): Other in EKI-6333AC-1GPO (high 7.2)
- [CVE-2024-50357](https://insights.sbomify.com/CVE-2024-50357/): Hardcoded credentials in FutureNet NXR-G050 series (critical 9.8)
- [CVE-2024-50356](https://insights.sbomify.com/CVE-2024-50356/): Press has a potential 2FA bypass (not scored)
- [CVE-2024-50355](https://insights.sbomify.com/CVE-2024-50355/): LibreNMS has a Persistent XSS from Insecure Input Sanitization Affects Multiple Endpoints (medium 4.8)
- [CVE-2024-50354](https://insights.sbomify.com/CVE-2024-50354/): Out-of-memory during deserialization with crafted inputs (medium 5.5)
- [CVE-2024-50353](https://insights.sbomify.com/CVE-2024-50353/): ICG.AspNetCore.Utilities.CloudStorage's Secure Token Durations Different Than Expected (medium 5.3)
- [CVE-2024-50352](https://insights.sbomify.com/CVE-2024-50352/): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/overview/services.inc.php (medium 4.8)
- [CVE-2024-50351](https://insights.sbomify.com/CVE-2024-50351/): LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/functions.php (medium 4.8)
- [CVE-2024-50350](https://insights.sbomify.com/CVE-2024-50350/): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php (medium 4.8)
- [CVE-2024-5035](https://insights.sbomify.com/CVE-2024-5035/): TP-Link Archer C5400X - RFTest Unauthenticated Command Injection (high 8.8)
- [CVE-2024-50349](https://insights.sbomify.com/CVE-2024-50349/): Git does not sanitize URLs when asking for credentials interactively (low 2.1)
- [CVE-2024-50348](https://insights.sbomify.com/CVE-2024-50348/): InstantCMS has a Cross Site Scripting Vulnerability (medium 5.4)
- [CVE-2024-50347](https://insights.sbomify.com/CVE-2024-50347/): Laravel Reverb has Missing API Signature Verification (medium 6.3)
- [CVE-2024-50346](https://insights.sbomify.com/CVE-2024-50346/): WebFeed HTML injection vulnerabilities (medium 5.1)
- [CVE-2024-50345](https://insights.sbomify.com/CVE-2024-50345/): Open redirect via browser-sanitized URLs in symfony/http-foundation (low 3.1)
- [CVE-2024-50344](https://insights.sbomify.com/CVE-2024-50344/): I, Librarian has a Stored XSS vulnerability in Supplemental Files (medium 4.6)
- [CVE-2024-50343](https://insights.sbomify.com/CVE-2024-50343/): Incorrect response from Validator when input ends with `\n` in symfony/validator (low 3.1)
- [CVE-2024-50342](https://insights.sbomify.com/CVE-2024-50342/): Internal address and port enumeration allowed by NoPrivateNetworkHttpClient in symfony/http-client (low 3.1)
- [CVE-2024-50341](https://insights.sbomify.com/CVE-2024-50341/): Security::login does not take into account custom user_checker in symfony/security-bundle (low 3.1)
- [CVE-2024-50340](https://insights.sbomify.com/CVE-2024-50340/): Ability to change environment from query in symfony/runtime (high 7.3)
- [CVE-2024-5034](https://insights.sbomify.com/CVE-2024-5034/): SULly < 4.3.1 - Plugin Reset via CSRF (high 8.8)
- [CVE-2024-50339](https://insights.sbomify.com/CVE-2024-50339/): GLPI vulnerable to unauthenticated session hijacking (critical 9.3)
- [CVE-2024-50338](https://insights.sbomify.com/CVE-2024-50338/): Carriage-return character in remote URL allows malicious repository to leak credentials in Git Credential Manager (high 7.4)
- [CVE-2024-50337](https://insights.sbomify.com/CVE-2024-50337/): Chamilo: Potential unauthenticated blind SSRF via openid function (medium 5.3)
- [CVE-2024-50336](https://insights.sbomify.com/CVE-2024-50336/): matrix-js-sdk has insufficient MXC URI validation which allows client-side path traversal (medium 5.3)
- [CVE-2024-50335](https://insights.sbomify.com/CVE-2024-50335/): Authenticated XSS in "Publish Key" Field Allowing Unauthorized Administrator User Creation in SuiteCRM (medium 4.9)
- [CVE-2024-50334](https://insights.sbomify.com/CVE-2024-50334/): Semicolon Path Injection on API /api;/config (high 8.7)
- [CVE-2024-50333](https://insights.sbomify.com/CVE-2024-50333/): RCE in ModuleBuilder in SuiteCRM (medium 6.6)
- [CVE-2024-50332](https://insights.sbomify.com/CVE-2024-50332/): Authenticated Blind SQL Injection in DeleteRelationShip in SuiteCRM (high 8.8)
- [CVE-2024-50331](https://insights.sbomify.com/CVE-2024-50331/): Memory corruption in Avalanche (high 7.5)
- [CVE-2024-50330](https://insights.sbomify.com/CVE-2024-50330/): SQL injection in Endpoint Manager (critical 9.8)
- [CVE-2024-5033](https://insights.sbomify.com/CVE-2024-5033/): SULly < 4.3.1 - Admin+ Stored XSS via CSRF (medium 5.9)
- [CVE-2024-50329](https://insights.sbomify.com/CVE-2024-50329/): Path traversal in Endpoint Manager (high 8.8)
- [CVE-2024-50328](https://insights.sbomify.com/CVE-2024-50328/): SQL injection in Endpoint Manager (high 7.2)
- [CVE-2024-50327](https://insights.sbomify.com/CVE-2024-50327/): SQL injection in Endpoint Manager (high 7.2)
- [CVE-2024-50326](https://insights.sbomify.com/CVE-2024-50326/): SQL injection in Endpoint Manager (high 7.2)
- [CVE-2024-50324](https://insights.sbomify.com/CVE-2024-50324/): Path traversal in Endpoint Manager (high 7.2)
- [CVE-2024-50323](https://insights.sbomify.com/CVE-2024-50323/): SQL injection in Endpoint Manager (high 7.8)
- [CVE-2024-50322](https://insights.sbomify.com/CVE-2024-50322/): Path traversal in Endpoint Manager (high 7.8)
- [CVE-2024-50321](https://insights.sbomify.com/CVE-2024-50321/): Denial of service in Avalanche (high 7.5)
- [CVE-2024-50320](https://insights.sbomify.com/CVE-2024-50320/): Denial of service in Avalanche (high 7.5)
- [CVE-2024-5032](https://insights.sbomify.com/CVE-2024-5032/): SULly < 4.3.1 - Reflected XSS (medium 4.7)
- [CVE-2024-50319](https://insights.sbomify.com/CVE-2024-50319/): Denial of service in Avalanche (high 7.5)
- [CVE-2024-50318](https://insights.sbomify.com/CVE-2024-50318/): Null dereference in Avalanche (high 7.5)
- [CVE-2024-50317](https://insights.sbomify.com/CVE-2024-50317/): Null dereference in Avalanche (high 7.5)
- [CVE-2024-50313](https://insights.sbomify.com/CVE-2024-50313/): Race condition in Mendix Runtime V10 (medium 6.9)
- [CVE-2024-50312](https://insights.sbomify.com/CVE-2024-50312/): Graphql: information disclosure via graphql introspection in openshift (medium 5.3)
- [CVE-2024-50311](https://insights.sbomify.com/CVE-2024-50311/): Graphql: denial of service (dos) vulnerability via graphql batching (medium 6.5)
- [CVE-2024-50310](https://insights.sbomify.com/CVE-2024-50310/): Missing authorization in SIMATIC CP 1543-1 V4.0 (high 8.7)
- [CVE-2024-5031](https://insights.sbomify.com/CVE-2024-5031/): MemberPress <= 1.11.29 - Authenticated (Contributor+) Blind Server-Side Request Forgery via mepr-user-file Shortcode (high 8.5)
- [CVE-2024-50307](https://insights.sbomify.com/CVE-2024-50307/): Code injection in Chatwork Desktop Application (Windows) (medium 5.5)
- [CVE-2024-50306](https://insights.sbomify.com/CVE-2024-50306/): Apache Traffic Server: Server process can fail to drop privilege (critical 9.1)
- [CVE-2024-50305](https://insights.sbomify.com/CVE-2024-50305/): Apache Traffic Server: Valid Host field value can cause crashes (high 7.5)
- [CVE-2024-50304](https://insights.sbomify.com/CVE-2024-50304/): ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (medium 5.5)
- [CVE-2024-50303](https://insights.sbomify.com/CVE-2024-50303/): resource,kexec: walk_system_ram_res_rev must retain resource flags (medium 5.5)
- [CVE-2024-50302](https://insights.sbomify.com/CVE-2024-50302/): Linux Kernel Use of Uninitialized Resource (medium 5.5, exploited in the wild)
- [CVE-2024-50301](https://insights.sbomify.com/CVE-2024-50301/): security/keys: fix slab-out-of-bounds in key_task_permission (high 7.8)
- [CVE-2024-50300](https://insights.sbomify.com/CVE-2024-50300/): regulator: rtq2208: Fix uninitialized use of regulator_config (high 7.8)
- [CVE-2024-5030](https://insights.sbomify.com/CVE-2024-5030/): CM Table Of Contents – WordPress TOC Plugin < 1.2.3 - Settings Reset via CSRF (low 3.8)
- [CVE-2024-50299](https://insights.sbomify.com/CVE-2024-50299/): sctp: properly validate chunk size in sctp_sf_ootb() (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/229/