# Vulnerabilities published in 2024 - [CVE-2024-4729](https://insights.sbomify.com/CVE-2024-4729/): Campcodes Legal Case Management System expense-type cross site scripting (medium 5.3) - [CVE-2024-4728](https://insights.sbomify.com/CVE-2024-4728/): Campcodes Legal Case Management System court cross site scripting (medium 5.3) - [CVE-2024-47273](https://insights.sbomify.com/CVE-2024-47273/): Path traversal in Hyper Backup (medium 4.3) - [CVE-2024-47272](https://insights.sbomify.com/CVE-2024-47272/): Missing authorization in Surveillance Station (low 2.7) - [CVE-2024-47271](https://insights.sbomify.com/CVE-2024-47271/): Information disclosure in Surveillance Station (medium 4.9) - [CVE-2024-47270](https://insights.sbomify.com/CVE-2024-47270/): Missing authorization in Surveillance Station (low 2.7) - [CVE-2024-4727](https://insights.sbomify.com/CVE-2024-4727/): Campcodes Legal Case Management System court-type cross site scripting (medium 5.3) - [CVE-2024-47269](https://insights.sbomify.com/CVE-2024-47269/): Information disclosure in Surveillance Station (medium 4.9) - [CVE-2024-47268](https://insights.sbomify.com/CVE-2024-47268/): Missing authorization in Surveillance Station (medium 4.9) - [CVE-2024-47267](https://insights.sbomify.com/CVE-2024-47267/): Path traversal in Surveillance Station (low 2.7) - [CVE-2024-47266](https://insights.sbomify.com/CVE-2024-47266/): Path traversal in Active Backup for Business (low 2.7) - [CVE-2024-47265](https://insights.sbomify.com/CVE-2024-47265/): Path traversal in Active Backup for Business (medium 6.5) - [CVE-2024-47264](https://insights.sbomify.com/CVE-2024-47264/): Path traversal in Active Backup for Business (medium 4.9) - [CVE-2024-47263](https://insights.sbomify.com/CVE-2024-47263/): Path traversal in Hyper Backup (medium 4.1) - [CVE-2024-47262](https://insights.sbomify.com/CVE-2024-47262/): Race condition in AXIS OS (medium 5.3) - [CVE-2024-47261](https://insights.sbomify.com/CVE-2024-47261/): File upload in AXIS OS (medium 4.3) - [CVE-2024-47260](https://insights.sbomify.com/CVE-2024-47260/): Denial of service in AXIS OS (medium 6.5) - [CVE-2024-4726](https://insights.sbomify.com/CVE-2024-4726/): Campcodes Legal Case Management System clients cross site scripting (medium 5.3) - [CVE-2024-47259](https://insights.sbomify.com/CVE-2024-47259/): Command injection in AXIS OS (low 3.5) - [CVE-2024-47258](https://insights.sbomify.com/CVE-2024-47258/): Security feature bypass in 2N Access Commander (high 8.1) - [CVE-2024-47257](https://insights.sbomify.com/CVE-2024-47257/): Denial of service in AXIS P1428-E Network Camera (high 7.5) - [CVE-2024-47256](https://insights.sbomify.com/CVE-2024-47256/): Hardcoded credentials in 2N Access Commander (medium 6.0) - [CVE-2024-47255](https://insights.sbomify.com/CVE-2024-47255/): Privilege escalation in 2N Access Commander (medium 4.7) - [CVE-2024-47254](https://insights.sbomify.com/CVE-2024-47254/): Privilege escalation in 2N Access Commander (medium 6.3) - [CVE-2024-47253](https://insights.sbomify.com/CVE-2024-47253/): Path traversal in 2N Access Commander (high 7.2) - [CVE-2024-47252](https://insights.sbomify.com/CVE-2024-47252/): Apache HTTP Server: mod_ssl error log variable escaping (high 7.5) - [CVE-2024-47250](https://insights.sbomify.com/CVE-2024-47250/): Apache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound access (medium 5.0) - [CVE-2024-4725](https://insights.sbomify.com/CVE-2024-4725/): Campcodes Legal Case Management System client_user cross site scripting (medium 5.3) - [CVE-2024-47249](https://insights.sbomify.com/CVE-2024-47249/): Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler (medium 5.0) - [CVE-2024-47248](https://insights.sbomify.com/CVE-2024-47248/): Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack (medium 6.3) - [CVE-2024-47241](https://insights.sbomify.com/CVE-2024-47241/): Security feature bypass in Secure Connect Gateway (SCG) 5.0 Appliance - SRS (medium 5.5) - [CVE-2024-47240](https://insights.sbomify.com/CVE-2024-47240/): Misconfiguration in Secure Connect Gateway (SCG) 5.0 Appliance - SRS (medium 5.5) - [CVE-2024-4724](https://insights.sbomify.com/CVE-2024-4724/): Campcodes Legal Case Management System case-type cross site scripting (medium 5.3) - [CVE-2024-47239](https://insights.sbomify.com/CVE-2024-47239/): Denial of service in PowerScale OneFS (medium 6.5) - [CVE-2024-47238](https://insights.sbomify.com/CVE-2024-47238/): Other in Dell Client Platform BIOS (high 7.5) - [CVE-2024-4723](https://insights.sbomify.com/CVE-2024-4723/): Campcodes Legal Case Management System case-status cross site scripting (medium 5.3) - [CVE-2024-47227](https://insights.sbomify.com/CVE-2024-47227/): Cross-site scripting in iredmail:iredadmin (medium 6.1) - [CVE-2024-47226](https://insights.sbomify.com/CVE-2024-47226/): Cross-site scripting in netbox:netbox (medium 5.4) - [CVE-2024-47224](https://insights.sbomify.com/CVE-2024-47224/): Other in mitel:micollab (medium 6.5) - [CVE-2024-47223](https://insights.sbomify.com/CVE-2024-47223/): SQL injection in mitel:micollab (critical 9.4) - [CVE-2024-47222](https://insights.sbomify.com/CVE-2024-47222/): Server-side request forgery in myoffice:my office sdk (critical 9.8) - [CVE-2024-47221](https://insights.sbomify.com/CVE-2024-47221/): Auth bypass in rapidscada:rapid scada (high 7.5) - [CVE-2024-4722](https://insights.sbomify.com/CVE-2024-4722/): Campcodes Complete Web-Based School Management System index.php cross site scripting (medium 5.3) - [CVE-2024-47219](https://insights.sbomify.com/CVE-2024-47219/): Command injection in vesoft:nebulagraph database (critical 9.8) - [CVE-2024-47218](https://insights.sbomify.com/CVE-2024-47218/): Auth bypass in vesoft:nebulagraph database (critical 9.8) - [CVE-2024-47217](https://insights.sbomify.com/CVE-2024-47217/): Denial of service in snowplow:iglu server (medium 6.5) - [CVE-2024-47215](https://insights.sbomify.com/CVE-2024-47215/): Denial of service in snowplow:snowbridge (high 7.5) - [CVE-2024-47214](https://insights.sbomify.com/CVE-2024-47214/): Denial of service in snowplow:iglu server (high 7.5) - [CVE-2024-47213](https://insights.sbomify.com/CVE-2024-47213/): Denial of service in snowplow:enrich (high 7.5) - [CVE-2024-47212](https://insights.sbomify.com/CVE-2024-47212/): Denial of service in snowplow:iglu server (high 7.5) - [CVE-2024-47211](https://insights.sbomify.com/CVE-2024-47211/): OpenStack Ironic fails to verify checksums of supplied image_source URLs (medium 5.3) - [CVE-2024-47210](https://insights.sbomify.com/CVE-2024-47210/): Gladys Assistant before 4.45.1 allows Privilege Escalation (a user changing their own role) because req.body.role can be used in updateMySel (high 8.8) - [CVE-2024-4721](https://insights.sbomify.com/CVE-2024-4721/): Campcodes Complete Web-Based School Management System add_student_subject.php cross site scripting (medium 5.3) - [CVE-2024-47208](https://insights.sbomify.com/CVE-2024-47208/): Apache OFBiz: URLs allowing remote use of Groovy expressions, leading to RCE (critical 9.8) - [CVE-2024-4720](https://insights.sbomify.com/CVE-2024-4720/): Campcodes Complete Web-Based School Management System approve_petty_cash.php cross site scripting (medium 5.3) - [CVE-2024-47197](https://insights.sbomify.com/CVE-2024-47197/): Maven Archetype Plugin: Maven Archetype integration-test may package local settings into the published artifact, possibly containing credentials (high 7.5) - [CVE-2024-47196](https://insights.sbomify.com/CVE-2024-47196/): Privilege escalation in ModelSim (medium 5.4) - [CVE-2024-47195](https://insights.sbomify.com/CVE-2024-47195/): Privilege escalation in ModelSim (medium 5.4) - [CVE-2024-47194](https://insights.sbomify.com/CVE-2024-47194/): Privilege escalation in ModelSim (medium 5.4) - [CVE-2024-47193](https://insights.sbomify.com/CVE-2024-47193/): WithSecure Elements Agent for Mac before 24.3, MDR before 24.3, and Elements Client Security for Mac before 16.10 allow a remote Denial of Service. (medium 5.5) - [CVE-2024-47192](https://insights.sbomify.com/CVE-2024-47192/): Missing authorization in mahara:mahara (medium 5.3) - [CVE-2024-47191](https://insights.sbomify.com/CVE-2024-47191/): pam_oath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running (high 7.1) - [CVE-2024-47190](https://insights.sbomify.com/CVE-2024-47190/): Northern.tech Hosted Mender before 2024.07.11 allows SSRF. (low 2.7) - [CVE-2024-4719](https://insights.sbomify.com/CVE-2024-4719/): Campcodes Complete Web-Based School Management System delete_record.php cross site scripting (medium 5.3) - [CVE-2024-47189](https://insights.sbomify.com/CVE-2024-47189/): SQL injection in mitel:micollab (high 7.7) - [CVE-2024-47188](https://insights.sbomify.com/CVE-2024-47188/): Suricata http/byte-ranges: missing hashtable random seed leads to potential DoS (high 7.5) - [CVE-2024-47187](https://insights.sbomify.com/CVE-2024-47187/): Suricata datasets: missing hashtable random seed leads to potential DoS (high 7.5) - [CVE-2024-47186](https://insights.sbomify.com/CVE-2024-47186/): Filament has unvalidated ColorColumn and ColorEntry values that can be used for Cross-site Scripting (medium 6.1) - [CVE-2024-47184](https://insights.sbomify.com/CVE-2024-47184/): Ampache vulnerable to Stored XSS via Democratic Playlist Name (medium 6.1) - [CVE-2024-47183](https://insights.sbomify.com/CVE-2024-47183/): Parse Server's custom object ID allows to acquire role privileges (high 8.1) - [CVE-2024-47182](https://insights.sbomify.com/CVE-2024-47182/): Dozzle uses unsafe hash for passwords (medium 4.8) - [CVE-2024-47181](https://insights.sbomify.com/CVE-2024-47181/): Unaligned memory access in RPL option processing in Contiki-NG (high 7.5) - [CVE-2024-47180](https://insights.sbomify.com/CVE-2024-47180/): Shields.io Remote Code Execution vulnerability in Dynamic JSON/TOML/YAML badges (high 8.8) - [CVE-2024-4718](https://insights.sbomify.com/CVE-2024-4718/): Campcodes Complete Web-Based School Management System delete_student_grade_subject.php cross site scripting (medium 5.3) - [CVE-2024-47179](https://insights.sbomify.com/CVE-2024-47179/): Supply chain in RSSHub (high 8.8) - [CVE-2024-47178](https://insights.sbomify.com/CVE-2024-47178/): basic-auth-connect's callback uses time unsafe string comparison (high 8.7) - [CVE-2024-47176](https://insights.sbomify.com/CVE-2024-47176/): cups-browsed binds to `INADDR_ANY:631`, trusting any packet from any source (medium 5.3) - [CVE-2024-47175](https://insights.sbomify.com/CVE-2024-47175/): libppd's ppdCreatePPDFromIPP2 function does not sanitize IPP attributes when creating the PPD buffer (high 8.6) - [CVE-2024-47174](https://insights.sbomify.com/CVE-2024-47174/): Credential leak when credentials are used with `` (medium 5.9) - [CVE-2024-47173](https://insights.sbomify.com/CVE-2024-47173/): Aimeos GraphQL API admin interface denial of service vulnerability in SaaS and marketplace setups (medium 5.5) - [CVE-2024-47172](https://insights.sbomify.com/CVE-2024-47172/): Computer Vision Annotation Tool (CVAT) access control is broken in several PATCH endpoints (medium 5.4) - [CVE-2024-47171](https://insights.sbomify.com/CVE-2024-47171/): Agnai vulnerable to Relative Path Traversal in Image Upload (medium 4.3) - [CVE-2024-47170](https://insights.sbomify.com/CVE-2024-47170/): Agnai File Disclosure Vulnerability: JSON via Path Traversal (medium 4.3) - [CVE-2024-4717](https://insights.sbomify.com/CVE-2024-4717/): Campcodes Complete Web-Based School Management System update_classroom.php cross site scripting (medium 5.3) - [CVE-2024-47169](https://insights.sbomify.com/CVE-2024-47169/): Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal (high 8.8) - [CVE-2024-47168](https://insights.sbomify.com/CVE-2024-47168/): The `enable_monitoring` flag set to `False` does not disable monitoring in Gradio (low 2.3) - [CVE-2024-47167](https://insights.sbomify.com/CVE-2024-47167/): SSRF in the path parameter of /queue/join in Gradio (medium 6.9) - [CVE-2024-47166](https://insights.sbomify.com/CVE-2024-47166/): One-level read path traversal in `/custom_component` in Gradio (low 2.3) - [CVE-2024-47165](https://insights.sbomify.com/CVE-2024-47165/): CORS origin validation accepts the null origin in Gradio (medium 6.9) - [CVE-2024-47164](https://insights.sbomify.com/CVE-2024-47164/): The `is_in_or_equal` function may be bypassed in Gradio (low 2.3) - [CVE-2024-47162](https://insights.sbomify.com/CVE-2024-47162/): Information disclosure in YouTrack (medium 4.1) - [CVE-2024-47161](https://insights.sbomify.com/CVE-2024-47161/): Information disclosure in TeamCity (medium 4.3) - [CVE-2024-47160](https://insights.sbomify.com/CVE-2024-47160/): Missing authorization in YouTrack (medium 4.3) - [CVE-2024-4716](https://insights.sbomify.com/CVE-2024-4716/): Campcodes Complete Web-Based School Management System update_exam.php cross site scripting (medium 5.3) - [CVE-2024-47159](https://insights.sbomify.com/CVE-2024-47159/): Missing authorization in YouTrack (medium 4.3) - [CVE-2024-47158](https://insights.sbomify.com/CVE-2024-47158/): Code injection in N-LINE (high 7.4) - [CVE-2024-47157](https://insights.sbomify.com/CVE-2024-47157/): Privilege escalation in Magic OS (low 2.9) - [CVE-2024-47156](https://insights.sbomify.com/CVE-2024-47156/): Information Leak Vulnerability in Honor Product (low 3.3) - [CVE-2024-47155](https://insights.sbomify.com/CVE-2024-47155/): Information disclosure in Magic OS (medium 5.5) - [CVE-2024-47154](https://insights.sbomify.com/CVE-2024-47154/): Information disclosure in Magic OS (medium 5.5) --- From sbomify Insights: https://insights.sbomify.com/years/2024/page/254/