# Vulnerabilities published in 2024


- [CVE-2024-47153](https://insights.sbomify.com/CVE-2024-47153/): Information disclosure in Magic OS (medium 6.2)
- [CVE-2024-47151](https://insights.sbomify.com/CVE-2024-47151/): File upload in Magic OS (medium 6.3)
- [CVE-2024-47150](https://insights.sbomify.com/CVE-2024-47150/): Information disclosure in Magic OS (low 3.3)
- [CVE-2024-4715](https://insights.sbomify.com/CVE-2024-4715/): Campcodes Complete Web-Based School Management System update_grade.php cross site scripting (medium 5.3)
- [CVE-2024-47149](https://insights.sbomify.com/CVE-2024-47149/): Privilege escalation in Magic OS (low 3.3)
- [CVE-2024-47148](https://insights.sbomify.com/CVE-2024-47148/): Privilege escalation in Magic OS (medium 4.0)
- [CVE-2024-47146](https://insights.sbomify.com/CVE-2024-47146/): Ruijie Reyee OS Resource Leak (high 7.1)
- [CVE-2024-47145](https://insights.sbomify.com/CVE-2024-47145/): Unauthorized access on archived channels via file links (low 3.1)
- [CVE-2024-47143](https://insights.sbomify.com/CVE-2024-47143/): dma-debug: fix a possible deadlock on radix_lock (medium 5.5)
- [CVE-2024-47142](https://insights.sbomify.com/CVE-2024-47142/): Information disclosure in IXG-2C7 (medium 5.5)
- [CVE-2024-47141](https://insights.sbomify.com/CVE-2024-47141/): pinmux: Use sequential access to access desc->pinmux data (medium 5.5)
- [CVE-2024-47140](https://insights.sbomify.com/CVE-2024-47140/): Cross-site scripting in Observium (high 8.7)
- [CVE-2024-4714](https://insights.sbomify.com/CVE-2024-4714/): Campcodes Complete Web-Based School Management System update_subject.php cross site scripting (medium 5.3)
- [CVE-2024-47139](https://insights.sbomify.com/CVE-2024-47139/): F5 BIG-IQ Vulnerability (medium 4.8)
- [CVE-2024-47138](https://insights.sbomify.com/CVE-2024-47138/): mySCADA myPRO Missing Authentication for Critical Function (critical 9.3)
- [CVE-2024-47137](https://insights.sbomify.com/CVE-2024-47137/): Liteos_a has an out-of-bounds Write vulnerability (high 8.4)
- [CVE-2024-47136](https://insights.sbomify.com/CVE-2024-47136/): Memory corruption in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) (high 7.8)
- [CVE-2024-47135](https://insights.sbomify.com/CVE-2024-47135/): Memory corruption in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) (high 7.8)
- [CVE-2024-47134](https://insights.sbomify.com/CVE-2024-47134/): Memory corruption in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) (high 7.8)
- [CVE-2024-47133](https://insights.sbomify.com/CVE-2024-47133/): Command injection in UD-LT1 (high 7.2)
- [CVE-2024-47131](https://insights.sbomify.com/CVE-2024-47131/): Delta Electronics DIAScreen Stack-based Buffer Overflow (high 8.4)
- [CVE-2024-47130](https://insights.sbomify.com/CVE-2024-47130/): Missing Authentication for Critical Function in goTenna Pro (high 8.7)
- [CVE-2024-4713](https://insights.sbomify.com/CVE-2024-4713/): Campcodes Complete Web-Based School Management System all_teacher.php cross site scripting (medium 5.3)
- [CVE-2024-47129](https://insights.sbomify.com/CVE-2024-47129/): Observable Response Discrepancy in goTenna Pro (medium 5.3)
- [CVE-2024-47128](https://insights.sbomify.com/CVE-2024-47128/): Insertion of Sensitive Information Into Sent Data in goTenna Pro (medium 5.3)
- [CVE-2024-47127](https://insights.sbomify.com/CVE-2024-47127/): Weak Authentication in goTenna Pro (medium 6.0)
- [CVE-2024-47126](https://insights.sbomify.com/CVE-2024-47126/): Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in goTenna Pro (high 7.1)
- [CVE-2024-47125](https://insights.sbomify.com/CVE-2024-47125/): Improper Restriction of Communication Channel to Intended Endpoints in goTenna Pro (high 7.6)
- [CVE-2024-47124](https://insights.sbomify.com/CVE-2024-47124/): Cleartext Transmission of Sensitive Information in goTenna Pro (low 2.3)
- [CVE-2024-47123](https://insights.sbomify.com/CVE-2024-47123/): Missing Support for Integrity Check in goTenna Pro (medium 6.0)
- [CVE-2024-47122](https://insights.sbomify.com/CVE-2024-47122/): Insecure Storage of Sensitive Information in goTenna Pro (medium 5.1)
- [CVE-2024-47121](https://insights.sbomify.com/CVE-2024-47121/): Weak Passwords Requirements in goTenna Pro (medium 6.0)
- [CVE-2024-47120](https://insights.sbomify.com/CVE-2024-47120/): IBM Security Verify Information Queue code execution (medium 6.4)
- [CVE-2024-4712](https://insights.sbomify.com/CVE-2024-4712/): Arbitrary File Creation in PaperCut NG/MF Web Print Image Handler (high 7.8)
- [CVE-2024-47119](https://insights.sbomify.com/CVE-2024-47119/): IBM Storage Defender - Resiliency Service improper certificate validation (medium 5.9)
- [CVE-2024-47118](https://insights.sbomify.com/CVE-2024-47118/): Memory corruption in Db2 (medium 6.5)
- [CVE-2024-47117](https://insights.sbomify.com/CVE-2024-47117/): IBM Carbon Design System cross-site scripting (medium 5.4)
- [CVE-2024-47116](https://insights.sbomify.com/CVE-2024-47116/): IBM Sterling B2B Integrator cross-site scripting (medium 5.4)
- [CVE-2024-47115](https://insights.sbomify.com/CVE-2024-47115/): IBM AIX command execution (high 7.8)
- [CVE-2024-47113](https://insights.sbomify.com/CVE-2024-47113/): IBM ICP - Voice Gateway XML injection (high 8.1)
- [CVE-2024-4711](https://insights.sbomify.com/CVE-2024-4711/): WordPress Infinite Scroll – Ajax Load More <= 7.1.1 - Authenticated (Contributor+) Cross-Site Scripting (medium 6.4)
- [CVE-2024-47109](https://insights.sbomify.com/CVE-2024-47109/): IBM Sterling File Gateway information disclosure (medium 5.3)
- [CVE-2024-47107](https://insights.sbomify.com/CVE-2024-47107/): IBM QRadar SIEM cross-site scripting (medium 6.4)
- [CVE-2024-47106](https://insights.sbomify.com/CVE-2024-47106/): IBM Jazz for Service Management information disclosure (medium 5.3)
- [CVE-2024-47104](https://insights.sbomify.com/CVE-2024-47104/): IBM i incorrect privilege assignment (medium 6.8)
- [CVE-2024-47103](https://insights.sbomify.com/CVE-2024-47103/): IBM Sterling B2B Integrator cross-site scripting (medium 4.8)
- [CVE-2024-47102](https://insights.sbomify.com/CVE-2024-47102/): IBM AIX denial of service (medium 5.5)
- [CVE-2024-47100](https://insights.sbomify.com/CVE-2024-47100/): Cross-site request forgery in SIMATIC S7-1200 CPU 1211C AC/DC/Rly (high 7.2)
- [CVE-2024-4710](https://insights.sbomify.com/CVE-2024-4710/): Uber Menu <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes (medium 6.4)
- [CVE-2024-47097](https://insights.sbomify.com/CVE-2024-47097/): Reflected Cross-Site Scripting in Follet School Solutions Destiny (medium 5.1)
- [CVE-2024-47096](https://insights.sbomify.com/CVE-2024-47096/): Reflected Cross-Site Scripting in Follet School Solutions Destiny (medium 5.1)
- [CVE-2024-47095](https://insights.sbomify.com/CVE-2024-47095/): Reflected Cross-Site Scripting in Follet School Solutions Destiny (medium 5.1)
- [CVE-2024-47094](https://insights.sbomify.com/CVE-2024-47094/): Logging of sitesecret to automations log (medium 5.7)
- [CVE-2024-47093](https://insights.sbomify.com/CVE-2024-47093/): Fix various XSS issues and potential RCE (high 8.8)
- [CVE-2024-47092](https://insights.sbomify.com/CVE-2024-47092/): Insecure deserialization and improper certificate validation in Checkmk Exchange plugin check-mk-api (high 7.7)
- [CVE-2024-47091](https://insights.sbomify.com/CVE-2024-47091/): Privilege escalation via mk_mysql agent plugin on Windows (medium 5.2)
- [CVE-2024-47090](https://insights.sbomify.com/CVE-2024-47090/): XSS via WYSIWYG editor (medium 5.1)
- [CVE-2024-4709](https://insights.sbomify.com/CVE-2024-4709/): Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 6.4)
- [CVE-2024-47089](https://insights.sbomify.com/CVE-2024-47089/): Unauthorized Transaction Manipulation Vulnerability (high 8.7)
- [CVE-2024-47088](https://insights.sbomify.com/CVE-2024-47088/): User Enumeration vulnerability (critical 9.3)
- [CVE-2024-47087](https://insights.sbomify.com/CVE-2024-47087/): Information Disclosure Vulnerability (high 8.7)
- [CVE-2024-47086](https://insights.sbomify.com/CVE-2024-47086/): OTP Bypass Vulnerability (high 8.7)
- [CVE-2024-47085](https://insights.sbomify.com/CVE-2024-47085/): Parameter Manipulation Vulnerability (high 8.7)
- [CVE-2024-47084](https://insights.sbomify.com/CVE-2024-47084/): CORS origin validation is not performed when the request has a cookie in Gradio (medium 6.9)
- [CVE-2024-47083](https://insights.sbomify.com/CVE-2024-47083/): Power Platform Terraform Provider has Improper Masking of Secrets in Logs (high 8.8)
- [CVE-2024-47082](https://insights.sbomify.com/CVE-2024-47082/): Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability (medium 4.6)
- [CVE-2024-47081](https://insights.sbomify.com/CVE-2024-47081/): Requests vulnerable to .netrc credentials leak via malicious URLs (medium 5.3)
- [CVE-2024-47080](https://insights.sbomify.com/CVE-2024-47080/): matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeserver (high 8.7)
- [CVE-2024-4708](https://insights.sbomify.com/CVE-2024-4708/): mySCADA myPRO Use of Hard-coded Password (critical 9.3)
- [CVE-2024-47079](https://insights.sbomify.com/CVE-2024-47079/): Unauthorized usage of remote hardware module because of missing channel verification (medium 6.4)
- [CVE-2024-47078](https://insights.sbomify.com/CVE-2024-47078/): Meshtastic firmware Authentication/Authorization Bypass via MQTT (high 8.1)
- [CVE-2024-47077](https://insights.sbomify.com/CVE-2024-47077/): authentik cross-provider token validation problems (medium 6.5)
- [CVE-2024-47076](https://insights.sbomify.com/CVE-2024-47076/): libcupsfilters's cfGetPrinterAttributes5 does not validate IPP attributes returned from an IPP server (high 8.6)
- [CVE-2024-47075](https://insights.sbomify.com/CVE-2024-47075/): DOM Clobbering gadgets found in layui that lead to Cross-site Scripting (medium 6.4)
- [CVE-2024-47074](https://insights.sbomify.com/CVE-2024-47074/): Dataease PostgreSQL Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability (critical 9.3)
- [CVE-2024-47073](https://insights.sbomify.com/CVE-2024-47073/): Dataease arbitrary interface access vulnerability (critical 9.3)
- [CVE-2024-47072](https://insights.sbomify.com/CVE-2024-47072/): XStream is vulnerable to a Denial of Service attack due to stack overflow from a manipulated binary input stream (high 7.5)
- [CVE-2024-47071](https://insights.sbomify.com/CVE-2024-47071/): OSS Endpoint Manager allows unauthorized access to read system files (medium 6.8)
- [CVE-2024-47070](https://insights.sbomify.com/CVE-2024-47070/): authentik vulnerable to password authentication bypass via X-Forwarded-For HTTP header (critical 9.1)
- [CVE-2024-4707](https://insights.sbomify.com/CVE-2024-4707/): Cross-site scripting in Materialis Companion (medium 6.4)
- [CVE-2024-47069](https://insights.sbomify.com/CVE-2024-47069/): Oveleon Cookiebar reflected Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-47068](https://insights.sbomify.com/CVE-2024-47068/): DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS (medium 6.1)
- [CVE-2024-47067](https://insights.sbomify.com/CVE-2024-47067/): Alist Contains a Reflected Cross-Site Scripting Vulnerability (medium 5.1)
- [CVE-2024-47066](https://insights.sbomify.com/CVE-2024-47066/): Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) (critical 9.0)
- [CVE-2024-47065](https://insights.sbomify.com/CVE-2024-47065/): Traceroute_APP responses are not rate-limited. (low 2.7)
- [CVE-2024-47064](https://insights.sbomify.com/CVE-2024-47064/): Computer Vision Annotation Tool (CVAT) contains a reflected XSS via request endpoints (medium 6.3)
- [CVE-2024-47063](https://insights.sbomify.com/CVE-2024-47063/): Computer Vision Annotation Tool (CVAT) contains a stored XSS via the quality report data endpoint (medium 6.2)
- [CVE-2024-47062](https://insights.sbomify.com/CVE-2024-47062/): Multiple SQL Injections and ORM Leak in navidrome (critical 9.4)
- [CVE-2024-47061](https://insights.sbomify.com/CVE-2024-47061/): Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejs (high 8.3)
- [CVE-2024-47060](https://insights.sbomify.com/CVE-2024-47060/): Unauthorized Access After Organization or Project Deactivation in Zitadel (medium 4.3)
- [CVE-2024-4706](https://insights.sbomify.com/CVE-2024-4706/): Cross-site scripting in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) (medium 6.4)
- [CVE-2024-47059](https://insights.sbomify.com/CVE-2024-47059/): Users enumeration - weak password login (medium 4.3)
- [CVE-2024-47058](https://insights.sbomify.com/CVE-2024-47058/): Cross-site Scripting (XSS) - stored (edit form HTML field) (low 2.9)
- [CVE-2024-47057](https://insights.sbomify.com/CVE-2024-47057/): User name enumeration possible due to response time difference on password reset form (medium 5.3)
- [CVE-2024-47056](https://insights.sbomify.com/CVE-2024-47056/): Mautic does not shield .env files from web traffic (medium 5.1)
- [CVE-2024-47055](https://insights.sbomify.com/CVE-2024-47055/): Segment cloning doesn't have a proper permission check (medium 4.3)
- [CVE-2024-47053](https://insights.sbomify.com/CVE-2024-47053/): Improper Authorization in Reporting API (high 7.7)
- [CVE-2024-47051](https://insights.sbomify.com/CVE-2024-47051/): Remote Code Execution & File Deletion in Asset Uploads (critical 9.1)
- [CVE-2024-47050](https://insights.sbomify.com/CVE-2024-47050/): XSS in contact/company tracking (no authentication) (medium 5.4)
- [CVE-2024-4705](https://insights.sbomify.com/CVE-2024-4705/): Testimonials Widget <= 4.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via testimonials Shortcode (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/255/