# Vulnerabilities published in 2024


- [CVE-2024-48868](https://insights.sbomify.com/CVE-2024-48868/): QTS, QuTS hero (high 8.7)
- [CVE-2024-48867](https://insights.sbomify.com/CVE-2024-48867/): QTS, QuTS hero (medium 5.3)
- [CVE-2024-48866](https://insights.sbomify.com/CVE-2024-48866/): QTS, QuTS hero (low 2.3)
- [CVE-2024-48865](https://insights.sbomify.com/CVE-2024-48865/): QTS, QuTS hero (high 7.3)
- [CVE-2024-48864](https://insights.sbomify.com/CVE-2024-48864/): File Station 5 (medium 5.3)
- [CVE-2024-48863](https://insights.sbomify.com/CVE-2024-48863/): License Center (high 7.7)
- [CVE-2024-48862](https://insights.sbomify.com/CVE-2024-48862/): QuLog Center (high 8.7)
- [CVE-2024-48861](https://insights.sbomify.com/CVE-2024-48861/): QHora (high 7.3)
- [CVE-2024-48860](https://insights.sbomify.com/CVE-2024-48860/): QHora (critical 9.5)
- [CVE-2024-4886](https://insights.sbomify.com/CVE-2024-4886/): BuddyBoss Platform < 2.6.0 - Subscriber+ Comment on Private Post via IDOR (medium 4.3)
- [CVE-2024-48859](https://insights.sbomify.com/CVE-2024-48859/): QTS, QuTS hero (medium 5.3)
- [CVE-2024-48858](https://insights.sbomify.com/CVE-2024-48858/): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (high 7.5)
- [CVE-2024-48857](https://insights.sbomify.com/CVE-2024-48857/): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (high 7.5)
- [CVE-2024-48856](https://insights.sbomify.com/CVE-2024-48856/): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (critical 9.8)
- [CVE-2024-48855](https://insights.sbomify.com/CVE-2024-48855/): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (medium 5.3)
- [CVE-2024-48854](https://insights.sbomify.com/CVE-2024-48854/): Vulnerabilities in TIFF and PCX Image Codecs Impact QNX Software Development Platform (medium 5.3)
- [CVE-2024-48853](https://insights.sbomify.com/CVE-2024-48853/): Authenticated Escalation to guest to root (critical 9.5)
- [CVE-2024-48852](https://insights.sbomify.com/CVE-2024-48852/): Information disclosures (medium 6.9)
- [CVE-2024-48851](https://insights.sbomify.com/CVE-2024-48851/): Remote Code Execution (high 7.5)
- [CVE-2024-48850](https://insights.sbomify.com/CVE-2024-48850/): Authenticated Absolute Path Traversal (high 7.5)
- [CVE-2024-4885](https://insights.sbomify.com/CVE-2024-4885/): Progress WhatsUp Gold Path Traversal (critical 9.8, exploited in the wild)
- [CVE-2024-48849](https://insights.sbomify.com/CVE-2024-48849/): Authentication and Authorization Issues (high 8.8)
- [CVE-2024-48848](https://insights.sbomify.com/CVE-2024-48848/): LARGECONTENT - device disk overutilization (high 7.0)
- [CVE-2024-48847](https://insights.sbomify.com/CVE-2024-48847/): MD5 bypass operation (high 8.8)
- [CVE-2024-48846](https://insights.sbomify.com/CVE-2024-48846/): Cross Side Request Forgery, CSRF (high 7.1)
- [CVE-2024-48845](https://insights.sbomify.com/CVE-2024-48845/): Weak Password Rules/Strength (critical 9.3)
- [CVE-2024-48844](https://insights.sbomify.com/CVE-2024-48844/): Denial of Service, DoS (high 7.2)
- [CVE-2024-48843](https://insights.sbomify.com/CVE-2024-48843/): Denial of Service, DoS (high 7.6)
- [CVE-2024-48842](https://insights.sbomify.com/CVE-2024-48842/): Hardcoded passwords (high 7.3)
- [CVE-2024-48841](https://insights.sbomify.com/CVE-2024-48841/): Remote Code Execution (RCE) Vulnerabilities (critical 10.0)
- [CVE-2024-48840](https://insights.sbomify.com/CVE-2024-48840/): Unauthorized Access (critical 9.3)
- [CVE-2024-4884](https://insights.sbomify.com/CVE-2024-4884/): WhatsUp Gold CommunityController Unrestricted File Upload Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-48839](https://insights.sbomify.com/CVE-2024-48839/): Remote Code Execution, RCE (critical 9.3)
- [CVE-2024-48838](https://insights.sbomify.com/CVE-2024-48838/): Information disclosure in SmartFabric OS10 Software (low 3.3)
- [CVE-2024-48837](https://insights.sbomify.com/CVE-2024-48837/): Privilege escalation in SmartFabric OS10 Software (high 7.8)
- [CVE-2024-48831](https://insights.sbomify.com/CVE-2024-48831/): Hardcoded credentials in SmartFabric OS10 Software (high 8.4)
- [CVE-2024-48830](https://insights.sbomify.com/CVE-2024-48830/): Command injection in SmartFabric OS10 Software (high 7.8)
- [CVE-2024-4883](https://insights.sbomify.com/CVE-2024-4883/): WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-48829](https://insights.sbomify.com/CVE-2024-48829/): Code injection in SmartFabric OS10 Software (medium 6.7)
- [CVE-2024-48828](https://insights.sbomify.com/CVE-2024-48828/): Privilege escalation in SmartFabric OS10 Software (medium 5.5)
- [CVE-2024-48827](https://insights.sbomify.com/CVE-2024-48827/): XML external entity in sbond:watcharr (high 8.8)
- [CVE-2024-48826](https://insights.sbomify.com/CVE-2024-48826/): Command injection in tenda:ac7 firmware (high 8.0)
- [CVE-2024-48825](https://insights.sbomify.com/CVE-2024-48825/): Command injection in tenda:ac7 firmware (high 8.0)
- [CVE-2024-48824](https://insights.sbomify.com/CVE-2024-48824/): An issue in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to obtain sensiti (high 7.5)
- [CVE-2024-48823](https://insights.sbomify.com/CVE-2024-48823/): Local file inclusion in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to es (critical 9.8)
- [CVE-2024-48822](https://insights.sbomify.com/CVE-2024-48822/): Privilege escalation in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote attacker to es (high 8.8)
- [CVE-2024-48821](https://insights.sbomify.com/CVE-2024-48821/): Cross Site Scripting vulnerability in Automatic Systems Maintenance SlimLane 29565_d74ecce0c1081d50546db573a499941b10799fb7 allows a remote (medium 6.1)
- [CVE-2024-4882](https://insights.sbomify.com/CVE-2024-4882/): URL Redirection to Arbitrary Site Exists in Sitefinity (medium 5.3)
- [CVE-2024-48818](https://insights.sbomify.com/CVE-2024-48818/): An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code. (critical 9.8)
- [CVE-2024-48814](https://insights.sbomify.com/CVE-2024-48814/): SQL injection in silverpeas:silverpeas (high 7.5)
- [CVE-2024-48813](https://insights.sbomify.com/CVE-2024-48813/): SQL injection vulnerability in employee-management-system-php-and-mysql-free-download.html taskmatic 1.0 allows a remote attacker to execute (high 8.8)
- [CVE-2024-4881](https://insights.sbomify.com/CVE-2024-4881/): Path Traversal in parisneo/lollms (high 7.5)
- [CVE-2024-48809](https://insights.sbomify.com/CVE-2024-48809/): Denial of service in opennetworking:onos-a1t (high 7.5)
- [CVE-2024-48807](https://insights.sbomify.com/CVE-2024-48807/): Cross-site scripting in phpgurukul:doctor appointment management system (medium 5.4)
- [CVE-2024-48806](https://insights.sbomify.com/CVE-2024-48806/): Buffer Overflow vulnerability in Neat Board NFC v.1.20240620.0015 allows a physically proximate attackers to escalate privileges via a craft (medium 6.8)
- [CVE-2024-48799](https://insights.sbomify.com/CVE-2024-48799/): An issue in LOREX TECHNOLOGY INC com.lorexcorp.lorexping 1.4.22 allows a remote attacker to obtain sensitive information via the firmware update process. (high 7.5)
- [CVE-2024-48798](https://insights.sbomify.com/CVE-2024-48798/): An issue in Hubble Connected (com.hubbleconnected.vervelife) 2.00.81 allows a remote attacker to obtain sensitive information via the firmware update process. (high 7.5)
- [CVE-2024-48797](https://insights.sbomify.com/CVE-2024-48797/): An issue in PCS Engineering Preston Cinema (com.prestoncinema.app) 0.2.0 allows a remote attacker to obtain sensitive information via the fi (high 7.5)
- [CVE-2024-48796](https://insights.sbomify.com/CVE-2024-48796/): An issue in EQUES com.eques.plug 1.0.1 allows a remote attacker to obtain sensitive information via the firmware update process. (high 7.5)
- [CVE-2024-48795](https://insights.sbomify.com/CVE-2024-48795/): An issue in Creative Labs Pte Ltd com.creative.apps.xficonnect 2.00.02 allows a remote attacker to obtain sensitive information via the firmware update process. (medium 5.3)
- [CVE-2024-48793](https://insights.sbomify.com/CVE-2024-48793/): An issue in INATRONIC com.inatronic.bmw 2.7.1 allows a remote attacker to obtain sensitive information via the firmware update process. (medium 5.9)
- [CVE-2024-48792](https://insights.sbomify.com/CVE-2024-48792/): An issue in Hideez com.hideez 2.7.8.3 allows a remote attacker to obtain sensitive information via the firmware update process. (high 7.5)
- [CVE-2024-48791](https://insights.sbomify.com/CVE-2024-48791/): An issue in Plug n Play Camera com.starvedia.mCamView.zwave 5.5.1 allows a remote attacker to obtain sensitive information via the firmware (high 7.5)
- [CVE-2024-48790](https://insights.sbomify.com/CVE-2024-48790/): An issue in ILIFE com.ilife.home.global 1.8.7 allows a remote attacker to obtain sensitive information via the firmware update process. (medium 5.3)
- [CVE-2024-4879](https://insights.sbomify.com/CVE-2024-4879/): ServiceNow Improper Input Validation (critical 9.3, exploited in the wild)
- [CVE-2024-48789](https://insights.sbomify.com/CVE-2024-48789/): An issue in INATRONIC com.inatronic.drivedeck.home 2.6.23 allows a remote attacker to obtain sensitve information via the firmware update process. (high 7.5)
- [CVE-2024-48788](https://insights.sbomify.com/CVE-2024-48788/): An issue in YESCAM (com.yescom.YesCam.zwave) 1.0.2 allows a remote attacker to obtain sensitive information via the firmware update process. (high 7.5)
- [CVE-2024-48787](https://insights.sbomify.com/CVE-2024-48787/): An issue in Revic Optics Revic Ops (us.revic.revicops) 1.12.5 allows a remote attacker to obtain sensitive information via the firmware update process. (critical 9.1)
- [CVE-2024-48786](https://insights.sbomify.com/CVE-2024-48786/): An issue in SWITCHBOT INC SwitchBot (com.theswitchbot.switchbot) 5.0.4 allows a remote attacker to obtain sensitive information via the firmware update process. (critical 9.1)
- [CVE-2024-48784](https://insights.sbomify.com/CVE-2024-48784/): An Incorrect Access Control issue in SAMPMAX com.sampmax.homemax 2.1.2.7 allows a remote attacker to obtain sensitive information via the fi (critical 9.8)
- [CVE-2024-48783](https://insights.sbomify.com/CVE-2024-48783/): Information disclosure in ruijie:nbr3000d-e firmware (medium 4.3)
- [CVE-2024-48782](https://insights.sbomify.com/CVE-2024-48782/): File Upload vulnerability in DYCMS Open-Source Version v2.0.9.41 allows a remote attacker to execute arbitrary code via the application only (critical 9.8)
- [CVE-2024-48781](https://insights.sbomify.com/CVE-2024-48781/): An issue in Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 allows a remote attacker to execute arbitrary code via a speciall (critical 9.8)
- [CVE-2024-48779](https://insights.sbomify.com/CVE-2024-48779/): An issue in Wanxing Technology's Yitu project Management Software 3.2.2 allows a remote attacker to execute arbitrary code via the platformp (critical 9.8)
- [CVE-2024-48778](https://insights.sbomify.com/CVE-2024-48778/): An issue in GIANT MANUFACTURING CO., LTD RideLink (tw.giant.ridelink) 2.0.7 allows a remote attacker to obtain sensitive information via the (critical 9.1)
- [CVE-2024-48777](https://insights.sbomify.com/CVE-2024-48777/): LEDVANCE com.ledvance.smartplus.eu 2.1.10 allows a remote attacker to obtain sensitive information via the firmware update process. (high 7.5)
- [CVE-2024-48776](https://insights.sbomify.com/CVE-2024-48776/): An issue in Shelly com.home.shelly 1.0.4 allows a remote attacker to obtain sensitive information via the firmware update process (high 7.5)
- [CVE-2024-48775](https://insights.sbomify.com/CVE-2024-48775/): An issue in Plug n Play Camera com.ezset.delaney 1.2.0 allows a remote attacker to obtain sensitive information via the firmware update process. (high 7.5)
- [CVE-2024-48774](https://insights.sbomify.com/CVE-2024-48774/): An issue in Fermax Asia Pacific Pte Ltd com.fermax.vida 2.4.6 allows a remote attacker to obtain sensitve information via the firmware update process. (high 7.5)
- [CVE-2024-48773](https://insights.sbomify.com/CVE-2024-48773/): An issue in WoFit v.7.2.3 allows a remote attacker to obtain sensitive information via the firmware update process (high 7.5)
- [CVE-2024-48772](https://insights.sbomify.com/CVE-2024-48772/): An issue in C-CHIP (com.cchip.cchipamaota) v.1.2.8 allows a remote attacker to obtain sensitive information via the firmware update process. (critical 9.1)
- [CVE-2024-48771](https://insights.sbomify.com/CVE-2024-48771/): An issue in almando GmbH Almando Play APP (com.almando.play) 1.8.2 allows a remote attacker to obtain sensitive information via the firmware (high 7.5)
- [CVE-2024-48770](https://insights.sbomify.com/CVE-2024-48770/): An issue in Plug n Play Camera com.wisdomcity.zwave 1.1.0 allows a remote attacker to obtain sensitive information via the firmware update process. (high 8.2)
- [CVE-2024-4877](https://insights.sbomify.com/CVE-2024-4877/): Privilege escalation in OpenVPN (high 8.8)
- [CVE-2024-48769](https://insights.sbomify.com/CVE-2024-48769/): An issue in BURG-WCHTER KG de.burgwachter.keyapp.app 4.5.0 allows a remote attacker to obtain sensitve information via the firmware update process. (critical 9.1)
- [CVE-2024-48768](https://insights.sbomify.com/CVE-2024-48768/): An issue in almaodo GmbH appinventor.ai_google.almando_control 2.3.1 allows a remote attacker to obtain sensitive information via the firmwa (high 7.5)
- [CVE-2024-48766](https://insights.sbomify.com/CVE-2024-48766/): Path traversal in NetAlertX (high 8.6)
- [CVE-2024-48761](https://insights.sbomify.com/CVE-2024-48761/): Cross-site scripting in celk:celk saude (high 8.8)
- [CVE-2024-48760](https://insights.sbomify.com/CVE-2024-48760/): File upload in gestioip:gestioip (critical 9.8)
- [CVE-2024-4876](https://insights.sbomify.com/CVE-2024-4876/): HT Mega – Absolute Addons For Elementor <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-48758](https://insights.sbomify.com/CVE-2024-48758/): Cross-site request forgery in timgreen:dingfanzu cms (medium 6.1)
- [CVE-2024-4875](https://insights.sbomify.com/CVE-2024-4875/): HT Mega – Absolute Addons For Elementor <= 2.5.2 - Missing Authorization to Options Update (medium 4.3)
- [CVE-2024-48747](https://insights.sbomify.com/CVE-2024-48747/): An issue in alist-tvbox v1.7.1 allows a remote attacker to execute arbitrary code via the /atv-cli file. (medium 6.8)
- [CVE-2024-48746](https://insights.sbomify.com/CVE-2024-48746/): An issue in Lens Visual integration with Power BI v.4.0.0.3 allows a remote attacker to execute arbitrary code via the Natural language proc (critical 9.8)
- [CVE-2024-48744](https://insights.sbomify.com/CVE-2024-48744/): Cross-site scripting in phpgurukul:teachers record management system (medium 6.1)
- [CVE-2024-48743](https://insights.sbomify.com/CVE-2024-48743/): Cross-site scripting in telestream:sentry (medium 6.5)
- [CVE-2024-4874](https://insights.sbomify.com/CVE-2024-4874/): Bricks Builder <= 1.9.8 - Insecure Direct Object Reference (medium 4.3)
- [CVE-2024-48735](https://insights.sbomify.com/CVE-2024-48735/): Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access i (high 7.7)
- [CVE-2024-48734](https://insights.sbomify.com/CVE-2024-48734/): Unrestricted file upload in /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath} in SAS Studio 9.4 allows remote attacker to upload malicious files. (high 8.8)
- [CVE-2024-48733](https://insights.sbomify.com/CVE-2024-48733/): SQL injection vulnerability in /SASStudio/sasexec/sessions/{sessionID}/sql in SAS Studio 9.4 allows remote attacker to execute arbitrary SQL (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/243/