# Vulnerabilities published in 2024


- [CVE-2024-48981](https://insights.sbomify.com/CVE-2024-48981/): Memory corruption in arm:mbed (high 7.5)
- [CVE-2024-4898](https://insights.sbomify.com/CVE-2024-4898/): Missing authorization in InstaWP Connect – 1-click WP Staging & Migration (critical 9.8)
- [CVE-2024-48974](https://insights.sbomify.com/CVE-2024-48974/): Life2000 Ventilator does not perform proper file integrity checks when adopting firmware updates (critical 9.3)
- [CVE-2024-48973](https://insights.sbomify.com/CVE-2024-48973/): Debug port on Life2000 Ventilator serial interface is enabled by default (critical 9.3)
- [CVE-2024-48971](https://insights.sbomify.com/CVE-2024-48971/): Clinician Password and Serial Number Clinician Password are hard-coded in Life2000 Ventilator (critical 9.3)
- [CVE-2024-48970](https://insights.sbomify.com/CVE-2024-48970/): Life2000 Ventilator microcontroller lacks memory protection (critical 9.3)
- [CVE-2024-4897](https://insights.sbomify.com/CVE-2024-4897/): Remote Code Execution in parisneo/lollms-webui (high 8.4)
- [CVE-2024-48967](https://insights.sbomify.com/CVE-2024-48967/): Life2000 ventilator and Service PC lack sufficient audit logging capabilities (critical 10.0)
- [CVE-2024-48966](https://insights.sbomify.com/CVE-2024-48966/): Life2000 service tools for test and calibration do not support user authentication (critical 10.0)
- [CVE-2024-48964](https://insights.sbomify.com/CVE-2024-48964/): OS Command Injection in Snyk gradle plugin (high 7.5)
- [CVE-2024-48963](https://insights.sbomify.com/CVE-2024-48963/): OS Command Injection in Snyk php plugin (high 7.5)
- [CVE-2024-48962](https://insights.sbomify.com/CVE-2024-48962/): Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE) (high 8.9)
- [CVE-2024-4896](https://insights.sbomify.com/CVE-2024-4896/): WPB Elementor Addons <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter (medium 6.4)
- [CVE-2024-48958](https://insights.sbomify.com/CVE-2024-48958/): Memory corruption in libarchive:libarchive (high 7.8)
- [CVE-2024-48957](https://insights.sbomify.com/CVE-2024-48957/): Memory corruption in libarchive:libarchive (high 7.8)
- [CVE-2024-48956](https://insights.sbomify.com/CVE-2024-48956/): Serviceware Processes 6.0 through 7.3 before 7.4 allows attackers without valid authentication to send a specially crafted HTTP request to a (critical 9.8)
- [CVE-2024-48955](https://insights.sbomify.com/CVE-2024-48955/): Broken access control in NetAdmin 4.030319 returns data with functionalities on the endpoint that "assembles" the functionalities menus, the (high 8.1)
- [CVE-2024-48954](https://insights.sbomify.com/CVE-2024-48954/): Command injection in logpoint:siem (medium 6.4)
- [CVE-2024-48953](https://insights.sbomify.com/CVE-2024-48953/): Missing authorization in logpoint:siem (high 7.5)
- [CVE-2024-48952](https://insights.sbomify.com/CVE-2024-48952/): Hardcoded credentials in logpoint:soar (medium 6.4)
- [CVE-2024-48951](https://insights.sbomify.com/CVE-2024-48951/): Server-side request forgery in logpoint:siem (high 7.5)
- [CVE-2024-48950](https://insights.sbomify.com/CVE-2024-48950/): Auth bypass in logpoint:siem (high 7.5)
- [CVE-2024-4895](https://insights.sbomify.com/CVE-2024-4895/): Cross-site scripting in wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin (medium 4.7)
- [CVE-2024-48949](https://insights.sbomify.com/CVE-2024-48949/): Elliptic's verify function omits uniqueness validation (critical 9.1)
- [CVE-2024-48948](https://insights.sbomify.com/CVE-2024-48948/): Valid ECDSA signatures erroneously rejected in Elliptic (medium 4.8)
- [CVE-2024-48944](https://insights.sbomify.com/CVE-2024-48944/): Apache Kylin: SSRF vulnerability in the diagnosis api (medium 6.5)
- [CVE-2024-48942](https://insights.sbomify.com/CVE-2024-48942/): Auth bypass in syracom:secure login (critical 9.1)
- [CVE-2024-48941](https://insights.sbomify.com/CVE-2024-48941/): Security feature bypass in syracom:secure login (critical 9.1)
- [CVE-2024-4894](https://insights.sbomify.com/CVE-2024-4894/): ITPison OMICARD EDM - Server-Side Request Forgery (medium 5.3)
- [CVE-2024-48939](https://insights.sbomify.com/CVE-2024-48939/): Insufficient validation performed on the REST API License file in Paxton Net2 before 6.07.14023.5015 (SR4) enables use of the REST API with (high 7.5)
- [CVE-2024-48938](https://insights.sbomify.com/CVE-2024-48938/): Denial of service in znuny:znuny (high 7.5)
- [CVE-2024-48937](https://insights.sbomify.com/CVE-2024-48937/): Cross-site scripting in znuny:znuny (medium 6.1)
- [CVE-2024-48936](https://insights.sbomify.com/CVE-2024-48936/): Missing authorization in schedmd:slurm (medium 5.0)
- [CVE-2024-48933](https://insights.sbomify.com/CVE-2024-48933/): Cross-site scripting in lemonldap-ng:lemonldap\ (medium 6.1)
- [CVE-2024-48932](https://insights.sbomify.com/CVE-2024-48932/): ZimaOS Unauthenticated API Discloses Usernames (medium 5.3)
- [CVE-2024-48931](https://insights.sbomify.com/CVE-2024-48931/): ZimaOS Arbitrary File Read via Parameter Manipulation (high 7.5)
- [CVE-2024-48930](https://insights.sbomify.com/CVE-2024-48930/): secp256k1-node vulnerable to private key extraction over ECDH (high 8.7)
- [CVE-2024-4893](https://insights.sbomify.com/CVE-2024-4893/): DigiWin EasyFlow .NET - SQL Injection (critical 9.8)
- [CVE-2024-48929](https://insights.sbomify.com/CVE-2024-48929/): Umbraco CMS Has Incomplete Server Termination During Explicit Sign-Out (medium 4.2)
- [CVE-2024-48928](https://insights.sbomify.com/CVE-2024-48928/): Piwigo's secret key can be brute forced (low 2.7)
- [CVE-2024-48927](https://insights.sbomify.com/CVE-2024-48927/): Potential Code Execution Risk When Viewing SVG Files in Full Screen in Backoffice (medium 4.6)
- [CVE-2024-48926](https://insights.sbomify.com/CVE-2024-48926/): Umbraco CMS logout page displayed before session expiration (medium 4.2)
- [CVE-2024-48925](https://insights.sbomify.com/CVE-2024-48925/): Umbraco CMS Improper Access Control Vulnerability Allows Low-Privilege Users to Access Webhook API (not scored)
- [CVE-2024-48924](https://insights.sbomify.com/CVE-2024-48924/): MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow (high 8.7)
- [CVE-2024-48921](https://insights.sbomify.com/CVE-2024-48921/): Kyverno's PolicyException objects can be created in any namespace by default (high 8.7)
- [CVE-2024-48920](https://insights.sbomify.com/CVE-2024-48920/): PutongOJ: unprivileged users can escalate privileges by constructing requests (critical 9.1)
- [CVE-2024-4892](https://insights.sbomify.com/CVE-2024-4892/): BuddyPress <= 12.4.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-48919](https://insights.sbomify.com/CVE-2024-48919/): RCE via Prompt Injection Into Cursor's Terminal Cmd-K (critical 9.2)
- [CVE-2024-48918](https://insights.sbomify.com/CVE-2024-48918/): Lack of Input Validation in RDS Light - Potential for Injection Attacks and Memory Tampering (high 8.1)
- [CVE-2024-48917](https://insights.sbomify.com/CVE-2024-48917/): XXE in PHPSpreadsheet's XLSX reader (high 7.5)
- [CVE-2024-48916](https://insights.sbomify.com/CVE-2024-48916/): Ceph is vulnerable to authentication bypass through RadosGW (high 8.1)
- [CVE-2024-48915](https://insights.sbomify.com/CVE-2024-48915/): Agent Dart missing certificate verification checks (high 8.7)
- [CVE-2024-48914](https://insights.sbomify.com/CVE-2024-48914/): Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy (critical 9.1)
- [CVE-2024-48913](https://insights.sbomify.com/CVE-2024-48913/): Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header. (medium 5.9)
- [CVE-2024-48912](https://insights.sbomify.com/CVE-2024-48912/): GLPI vulnerable to authenticated insecure account deletion (high 7.2)
- [CVE-2024-48911](https://insights.sbomify.com/CVE-2024-48911/): OpenCanary Executes Commands From Potentially Writable Config File (medium 5.8)
- [CVE-2024-48910](https://insights.sbomify.com/CVE-2024-48910/): DOMPurify vulnerable to tampering by prototype polution (critical 9.1)
- [CVE-2024-4891](https://insights.sbomify.com/CVE-2024-4891/): Cross-site scripting in Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (medium 6.4)
- [CVE-2024-48909](https://insights.sbomify.com/CVE-2024-48909/): SpiceDB calls to LookupResources using LookupResources2 with caveats may return context is missing when it is not (low 2.0)
- [CVE-2024-48908](https://insights.sbomify.com/CVE-2024-48908/): lychee-action vulnerable to arbitrary code injection in composite action (medium 6.9)
- [CVE-2024-48907](https://insights.sbomify.com/CVE-2024-48907/): Server-side request forgery in sematell:replyone (high 7.5)
- [CVE-2024-48906](https://insights.sbomify.com/CVE-2024-48906/): Cross-site scripting in sematell:replyone (medium 6.1)
- [CVE-2024-48905](https://insights.sbomify.com/CVE-2024-48905/): Missing authorization in sematell:replyone (critical 9.1)
- [CVE-2024-48904](https://insights.sbomify.com/CVE-2024-48904/): Command injection in Trend Micro Cloud Edge (critical 9.8)
- [CVE-2024-48903](https://insights.sbomify.com/CVE-2024-48903/): Privilege escalation in Trend Micro Deep Security Agent (high 7.8)
- [CVE-2024-48902](https://insights.sbomify.com/CVE-2024-48902/): Missing authorization in YouTrack (medium 5.4)
- [CVE-2024-48901](https://insights.sbomify.com/CVE-2024-48901/): Moodle: idor when fetching report schedules (medium 4.3)
- [CVE-2024-48900](https://insights.sbomify.com/CVE-2024-48900/): Moodle: idor when accessing list of badge recipients (medium 4.3)
- [CVE-2024-4890](https://insights.sbomify.com/CVE-2024-4890/): Blind SQL Injection in berriai/litellm (medium 4.9)
- [CVE-2024-48899](https://insights.sbomify.com/CVE-2024-48899/): Moodle: idor when accessing list of course badges (medium 4.3)
- [CVE-2024-48898](https://insights.sbomify.com/CVE-2024-48898/): Moodle: some users can delete audiences of other reports (medium 6.5)
- [CVE-2024-48897](https://insights.sbomify.com/CVE-2024-48897/): Moodle: idor in edit/delete rss feed (medium 6.5)
- [CVE-2024-48896](https://insights.sbomify.com/CVE-2024-48896/): Moodle: users' names returned in messaging error message (medium 4.3)
- [CVE-2024-48895](https://insights.sbomify.com/CVE-2024-48895/): Command injection in Rakuten Turbo 5G (high 8.8)
- [CVE-2024-48894](https://insights.sbomify.com/CVE-2024-48894/): Information disclosure in DIRIS Digiware M-70 (medium 5.9)
- [CVE-2024-48893](https://insights.sbomify.com/CVE-2024-48893/): Cross-site scripting in FortiSOAR (medium 6.4)
- [CVE-2024-48892](https://insights.sbomify.com/CVE-2024-48892/): Path traversal in FortiSOAR (medium 6.4)
- [CVE-2024-48891](https://insights.sbomify.com/CVE-2024-48891/): Command injection in FortiSOAR on-premise (medium 6.6)
- [CVE-2024-48890](https://insights.sbomify.com/CVE-2024-48890/): Command injection in FortiSOAR (medium 6.3)
- [CVE-2024-4889](https://insights.sbomify.com/CVE-2024-4889/): Code Injection in berriai/litellm (high 7.2)
- [CVE-2024-48889](https://insights.sbomify.com/CVE-2024-48889/): Command injection in FortiManager (high 7.2)
- [CVE-2024-48887](https://insights.sbomify.com/CVE-2024-48887/): Auth bypass in FortiSwitch (critical 9.3)
- [CVE-2024-48886](https://insights.sbomify.com/CVE-2024-48886/): Auth bypass in FortiOS (high 8.0)
- [CVE-2024-48885](https://insights.sbomify.com/CVE-2024-48885/): Path traversal in FortiRecorder (medium 5.2)
- [CVE-2024-48884](https://insights.sbomify.com/CVE-2024-48884/): Path traversal in FortiManager (medium 6.7)
- [CVE-2024-48883](https://insights.sbomify.com/CVE-2024-48883/): Information disclosure in samsung:exynos 1080 firmware (medium 4.3)
- [CVE-2024-48882](https://insights.sbomify.com/CVE-2024-48882/): Denial of service in DIRIS Digiware M-70 (high 8.6)
- [CVE-2024-48881](https://insights.sbomify.com/CVE-2024-48881/): bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again (medium 5.5)
- [CVE-2024-4888](https://insights.sbomify.com/CVE-2024-4888/): Arbitrary File Deletion in BerriAI/litellm (medium 6.5)
- [CVE-2024-48878](https://insights.sbomify.com/CVE-2024-48878/): SQL Injection (high 8.3)
- [CVE-2024-48877](https://insights.sbomify.com/CVE-2024-48877/): Memory corruption in xls2csv (high 8.4)
- [CVE-2024-48876](https://insights.sbomify.com/CVE-2024-48876/): stackdepot: fix stack_depot_save_flags() in NMI context (medium 5.5)
- [CVE-2024-48875](https://insights.sbomify.com/CVE-2024-48875/): btrfs: don't take dev_replace rwsem on task already holding it (medium 5.5)
- [CVE-2024-48874](https://insights.sbomify.com/CVE-2024-48874/): Ruijie Reyee OS Server-Side Request Forgery (critical 9.3)
- [CVE-2024-48873](https://insights.sbomify.com/CVE-2024-48873/): wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (medium 5.5)
- [CVE-2024-48872](https://insights.sbomify.com/CVE-2024-48872/): Bypass of "Max failed attempts" restriction via race condition (medium 4.8)
- [CVE-2024-48871](https://insights.sbomify.com/CVE-2024-48871/): Planet Technology Planet WGS-804HPT Stack-based Buffer Overflow (critical 9.3)
- [CVE-2024-48870](https://insights.sbomify.com/CVE-2024-48870/): Cross-site scripting in Sharp Digital Full-color MFPs and Monochrome MFPs (medium 6.2)
- [CVE-2024-4887](https://insights.sbomify.com/CVE-2024-4887/): Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Local File Inclusion (high 7.5)
- [CVE-2024-48869](https://insights.sbomify.com/CVE-2024-48869/): Privilege escalation in Intel(R) Xeon(R) 6 processor with E-cores when using Intel(R) Trust Domain Extensions (Intel(R) TDX) or Intel(R) Software Guard Extensions (Intel(R) SGX) (medium 5.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/242/