# Vulnerabilities published in 2024


- [CVE-2024-48730](https://insights.sbomify.com/CVE-2024-48730/): The default configuration in ETSI Open-Source MANO (OSM) v.14.x, v.15.x, v.16.x, v.17.x does not impose any restrictions on the authenticati (medium 6.5)
- [CVE-2024-4873](https://insights.sbomify.com/CVE-2024-4873/): Replace Image <= 1.1.10 - Insecure Direct Object Reference (medium 4.3)
- [CVE-2024-48729](https://insights.sbomify.com/CVE-2024-48729/): An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacke (high 7.1)
- [CVE-2024-4872](https://insights.sbomify.com/CVE-2024-4872/): Code injection in MicroSCADA Pro SYS600 (critical 9.9)
- [CVE-2024-48714](https://insights.sbomify.com/CVE-2024-48714/): Memory corruption in tp-link:tl-wdr7660 firmware (medium 6.5)
- [CVE-2024-48713](https://insights.sbomify.com/CVE-2024-48713/): Memory corruption in tp-link:tl-wdr7660 firmware (medium 6.5)
- [CVE-2024-48712](https://insights.sbomify.com/CVE-2024-48712/): Memory corruption in tp-link:tl-wdr7660 firmware (medium 6.5)
- [CVE-2024-48710](https://insights.sbomify.com/CVE-2024-48710/): Memory corruption in tp-link:tl-wdr7660 firmware (medium 6.5)
- [CVE-2024-4871](https://insights.sbomify.com/CVE-2024-4871/): Foreman: host ssh key not being checked in remote execution (medium 6.8)
- [CVE-2024-48709](https://insights.sbomify.com/CVE-2024-48709/): Cross-site scripting in codeastro:membership management system (medium 5.4)
- [CVE-2024-48708](https://insights.sbomify.com/CVE-2024-48708/): Cross-site scripting in o-dyn:collabtive (medium 5.4)
- [CVE-2024-48707](https://insights.sbomify.com/CVE-2024-48707/): Cross-site scripting in o-dyn:collabtive (medium 5.4)
- [CVE-2024-48706](https://insights.sbomify.com/CVE-2024-48706/): Cross-site scripting in o-dyn:collabtive (medium 5.4)
- [CVE-2024-48705](https://insights.sbomify.com/CVE-2024-48705/): Command injection in wavlink:wl-wn531p3 firmware (medium 6.5)
- [CVE-2024-48704](https://insights.sbomify.com/CVE-2024-48704/): Cross-site scripting in phpgurukul:medical card generation system (medium 6.1)
- [CVE-2024-48703](https://insights.sbomify.com/CVE-2024-48703/): Cross-site scripting in anujk305:medical card generation system (medium 4.8)
- [CVE-2024-48702](https://insights.sbomify.com/CVE-2024-48702/): Cross-site scripting in phpgurukul:old age home management system (medium 5.4)
- [CVE-2024-48700](https://insights.sbomify.com/CVE-2024-48700/): Code injection in kliqqi:kliqqi cms (high 7.2)
- [CVE-2024-4870](https://insights.sbomify.com/CVE-2024-4870/): Frontend Registration – Contact Form 7 <= 5.1 - Authenticated (Editor+) Privilege Escalation (high 7.2)
- [CVE-2024-48694](https://insights.sbomify.com/CVE-2024-48694/): File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arb (critical 9.8)
- [CVE-2024-4869](https://insights.sbomify.com/CVE-2024-4869/): Cross-site scripting in Cookie Banner for GDPR / CCPA – WPLP Cookie Consent (high 7.2)
- [CVE-2024-4868](https://insights.sbomify.com/CVE-2024-4868/): Cross-site scripting in Extensions for Elementor (medium 6.4)
- [CVE-2024-4867](https://insights.sbomify.com/CVE-2024-4867/): Cross-Site Scripting via Developer Portal in WSO2 API Manager Enables UI Modification and Information Retrieval (medium 5.4)
- [CVE-2024-48662](https://insights.sbomify.com/CVE-2024-48662/): Cross Site Scripting vulnerability in AdGuard Application v.7.18.1 (4778) and before allows an attacker to execute arbitrary code via a craf (medium 6.1)
- [CVE-2024-4866](https://insights.sbomify.com/CVE-2024-4866/): Cross-site scripting in UltraAddons for Elementor (medium 6.4)
- [CVE-2024-48659](https://insights.sbomify.com/CVE-2024-48659/): Command injection in dcnetworks:dcme-320-l firmware (critical 9.8)
- [CVE-2024-48657](https://insights.sbomify.com/CVE-2024-48657/): SQL injection in princelycesar:hospital management system (high 8.1)
- [CVE-2024-48656](https://insights.sbomify.com/CVE-2024-48656/): Cross-site scripting in angeljudesuarez:student management system (medium 5.4)
- [CVE-2024-48655](https://insights.sbomify.com/CVE-2024-48655/): Code injection in totaljs:total.js (high 8.8)
- [CVE-2024-48654](https://insights.sbomify.com/CVE-2024-48654/): Cross Site Scripting vulnerability in Blood Bank v.1 allows a remote attacker to execute arbitrary code via a crafted script to the login.php component. (medium 6.1)
- [CVE-2024-48652](https://insights.sbomify.com/CVE-2024-48652/): camaleon_cms affected by cross site scripting (medium 4.8)
- [CVE-2024-48651](https://insights.sbomify.com/CVE-2024-48651/): In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplement (high 7.5)
- [CVE-2024-4865](https://insights.sbomify.com/CVE-2024-4865/): Happy Addons for Elementor <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id Parameter (medium 6.4)
- [CVE-2024-48648](https://insights.sbomify.com/CVE-2024-48648/): Cross-site scripting in sage:sage frp 1000 (medium 6.1)
- [CVE-2024-48647](https://insights.sbomify.com/CVE-2024-48647/): Path traversal in sage:sage frp 1000 (high 7.2)
- [CVE-2024-48646](https://insights.sbomify.com/CVE-2024-48646/): File upload in sage:sage frp 1000 (high 8.1)
- [CVE-2024-48645](https://insights.sbomify.com/CVE-2024-48645/): In Minecraft mod "Command Block IDE" up to and including version 0.4.9, a missing authorization (CWE-862) allows any user to modify "functio (high 7.5)
- [CVE-2024-48644](https://insights.sbomify.com/CVE-2024-48644/): Accounts enumeration vulnerability in the Login Component of Reolink Duo 2 WiFi Camera (Firmware Version v3.0.0.1889_23031701) allows remote (medium 5.3)
- [CVE-2024-48638](https://insights.sbomify.com/CVE-2024-48638/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-48637](https://insights.sbomify.com/CVE-2024-48637/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-48636](https://insights.sbomify.com/CVE-2024-48636/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-48635](https://insights.sbomify.com/CVE-2024-48635/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-48634](https://insights.sbomify.com/CVE-2024-48634/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-48633](https://insights.sbomify.com/CVE-2024-48633/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-48632](https://insights.sbomify.com/CVE-2024-48632/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-48631](https://insights.sbomify.com/CVE-2024-48631/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-48630](https://insights.sbomify.com/CVE-2024-48630/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-4863](https://insights.sbomify.com/CVE-2024-4863/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-48629](https://insights.sbomify.com/CVE-2024-48629/): Command injection in dlink:dir-878 firmware (high 8.0)
- [CVE-2024-48624](https://insights.sbomify.com/CVE-2024-48624/): Cross-site scripting in domainmod:domainmod (medium 5.3)
- [CVE-2024-48623](https://insights.sbomify.com/CVE-2024-48623/): Cross-site scripting in domainmod:domainmod (medium 5.3)
- [CVE-2024-48622](https://insights.sbomify.com/CVE-2024-48622/): Cross-site scripting in domainmod:domainmod (medium 6.6)
- [CVE-2024-4862](https://insights.sbomify.com/CVE-2024-4862/): Cross-site scripting in WPBITS Addons For Elementor Page Builder (medium 6.4)
- [CVE-2024-48615](https://insights.sbomify.com/CVE-2024-48615/): Null dereference in libarchive:libarchive (high 7.5)
- [CVE-2024-48605](https://insights.sbomify.com/CVE-2024-48605/): Other in helakuru:helakuru (high 7.8)
- [CVE-2024-4860](https://insights.sbomify.com/CVE-2024-4860/): Cross-site scripting in rebelcode:rss aggregator (medium 5.4)
- [CVE-2024-48597](https://insights.sbomify.com/CVE-2024-48597/): SQL injection in angeljudesuarez:online clinic management system (high 8.1)
- [CVE-2024-48594](https://insights.sbomify.com/CVE-2024-48594/): File upload in fast5:prison management system (high 8.8)
- [CVE-2024-48591](https://insights.sbomify.com/CVE-2024-48591/): Cross-site scripting in inflectra:spirateam (medium 6.1)
- [CVE-2024-48590](https://insights.sbomify.com/CVE-2024-48590/): Server-side request forgery in inflectra:spirateam (critical 9.8)
- [CVE-2024-4859](https://insights.sbomify.com/CVE-2024-4859/): Cross-site scripting in solidus (medium 5.7)
- [CVE-2024-48589](https://insights.sbomify.com/CVE-2024-48589/): Cross Site Scripting vulnerability in Gilnei Moraes phpABook v.0.9 allows a remote attacker to execute arbitrary code via the rol parameter (medium 6.3)
- [CVE-2024-48581](https://insights.sbomify.com/CVE-2024-48581/): File upload in mayurik:best courier management system (critical 9.8)
- [CVE-2024-48580](https://insights.sbomify.com/CVE-2024-48580/): SQL injection in mayurik:best courier management system (critical 9.8)
- [CVE-2024-4858](https://insights.sbomify.com/CVE-2024-4858/): Testimonial Carousel For Elementor <= 10.2.0 - Missing Authorization to Limited Setting Update (medium 5.3)
- [CVE-2024-48579](https://insights.sbomify.com/CVE-2024-48579/): SQL injection in mayurik:best house rental management system (critical 9.8)
- [CVE-2024-48573](https://insights.sbomify.com/CVE-2024-48573/): SQL injection in aquila-cms:aquilacms (critical 9.8)
- [CVE-2024-48572](https://insights.sbomify.com/CVE-2024-48572/): Information disclosure in aquila-cms:aquilacms (medium 5.3)
- [CVE-2024-48570](https://insights.sbomify.com/CVE-2024-48570/): SQL injection in phpgurukul:client management system (high 7.5)
- [CVE-2024-4857](https://insights.sbomify.com/CVE-2024-4857/): FS Product Inquiry <= 1.1.1 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-48569](https://insights.sbomify.com/CVE-2024-48569/): Proactive Risk Manager version 9.1.1.0 is affected by multiple Cross-Site Scripting (XSS) vulnerabilities in the add/edit form fields, at th (medium 5.4)
- [CVE-2024-4856](https://insights.sbomify.com/CVE-2024-4856/): FS Product Inquiry <= 1.1.1 - Reflected XSS (high 8.2)
- [CVE-2024-4855](https://insights.sbomify.com/CVE-2024-4855/): Use After Free in editcap (low 3.6)
- [CVE-2024-48548](https://insights.sbomify.com/CVE-2024-48548/): The APK file in Cloud Smart Lock v2.0.1 has a leaked a URL that can call an API for binding physical devices. (critical 9.3)
- [CVE-2024-48547](https://insights.sbomify.com/CVE-2024-48547/): Incorrect access control in the firmware update and download processes of DreamCatcher Life v1.8.7 allows attackers to access sensitive info (high 8.4)
- [CVE-2024-48546](https://insights.sbomify.com/CVE-2024-48546/): Incorrect access control in the firmware update and download processes of Wear Sync v1.2.0 allows attackers to access sensitive information (high 8.4)
- [CVE-2024-48545](https://insights.sbomify.com/CVE-2024-48545/): Incorrect access control in the firmware update and download processes of IVY Smart v4.5.0 allows attackers to access sensitive information (high 8.4)
- [CVE-2024-48544](https://insights.sbomify.com/CVE-2024-48544/): Incorrect access control in the firmware update and download processes of Sylvania Smart Home v3.0.3 allows attackers to access sensitive in (high 8.4)
- [CVE-2024-48542](https://insights.sbomify.com/CVE-2024-48542/): Incorrect access control in the firmware update and download processes of Yamaha Headphones Controller v1.6.7 allows attackers to access sen (high 8.4)
- [CVE-2024-48541](https://insights.sbomify.com/CVE-2024-48541/): Incorrect access control in the firmware update and download processes of Ruochan Smart v4.4.7 allows attackers to access sensitive informat (high 8.4)
- [CVE-2024-48540](https://insights.sbomify.com/CVE-2024-48540/): Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code and data within the APK file. (medium 6.2)
- [CVE-2024-4854](https://insights.sbomify.com/CVE-2024-4854/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 6.4)
- [CVE-2024-48539](https://insights.sbomify.com/CVE-2024-48539/): Neye3C v4.5.2.0 was discovered to contain a hardcoded encryption key in the firmware update mechanism. (critical 9.8)
- [CVE-2024-48538](https://insights.sbomify.com/CVE-2024-48538/): Incorrect access control in the firmware update and download processes of Neye3C v4.5.2.0 allows attackers to access sensitive information b (critical 9.8)
- [CVE-2024-48536](https://insights.sbomify.com/CVE-2024-48536/): Missing authorization in esoftplanner:esoft planner (high 7.5)
- [CVE-2024-48535](https://insights.sbomify.com/CVE-2024-48535/): Cross-site scripting in esoftplanner:esoft planner (medium 6.1)
- [CVE-2024-48534](https://insights.sbomify.com/CVE-2024-48534/): Cross-site scripting in esoftplanner:esoft planner (medium 6.1)
- [CVE-2024-48533](https://insights.sbomify.com/CVE-2024-48533/): Information disclosure in esoftplanner:esoft planner (medium 5.3)
- [CVE-2024-48531](https://insights.sbomify.com/CVE-2024-48531/): Cross-site scripting in esoftplanner:esoft planner (medium 6.1)
- [CVE-2024-48530](https://insights.sbomify.com/CVE-2024-48530/): Denial of service in esoftplanner:esoft planner (high 7.5)
- [CVE-2024-4853](https://insights.sbomify.com/CVE-2024-4853/): Mismatched Memory Management Routines in editcap (low 3.6)
- [CVE-2024-48519](https://insights.sbomify.com/CVE-2024-48519/): Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial (medium 6.2)
- [CVE-2024-48514](https://insights.sbomify.com/CVE-2024-48514/): Remote code execution in php-heic-to-jpg (critical 9.8)
- [CVE-2024-48510](https://insights.sbomify.com/CVE-2024-48510/): DotNetZip Directory Traversal vulnerability (critical 9.1)
- [CVE-2024-4851](https://insights.sbomify.com/CVE-2024-4851/): SSRF Vulnerability in stangirard/quivr (high 7.7)
- [CVE-2024-48509](https://insights.sbomify.com/CVE-2024-48509/): SQL injection in lang-learn-guy:learning with texts (critical 9.8)
- [CVE-2024-4849](https://insights.sbomify.com/CVE-2024-4849/): WordPress Automatic <= 3.94.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via autoplay Parameter (medium 6.4)
- [CVE-2024-4847](https://insights.sbomify.com/CVE-2024-4847/): SQL injection in Alt Text AI – Automatically generate image alt text for SEO and accessibility (high 8.8)
- [CVE-2024-48465](https://insights.sbomify.com/CVE-2024-48465/): The MRBS version 1.5.0 has an SQL injection vulnerability in the edit_entry_handler.php file, specifically in the rooms%5B%5D parameter (critical 9.8)
- [CVE-2024-48463](https://insights.sbomify.com/CVE-2024-48463/): Open redirect in usebruno:bruno (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/244/