# Vulnerabilities published in 2024


- [CVE-2024-46632](https://insights.sbomify.com/CVE-2024-46632/): Memory corruption in assimp:assimp (medium 4.3)
- [CVE-2024-4663](https://insights.sbomify.com/CVE-2024-4663/): OSM Map Widget for Elementor <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (medium 6.4)
- [CVE-2024-46628](https://insights.sbomify.com/CVE-2024-46628/): Command injection in tendacn:g3 firmware (high 8.0)
- [CVE-2024-46627](https://insights.sbomify.com/CVE-2024-46627/): Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. (critical 9.1)
- [CVE-2024-46626](https://insights.sbomify.com/CVE-2024-46626/): SQL injection in os4ed:opensis (high 8.8)
- [CVE-2024-46625](https://insights.sbomify.com/CVE-2024-46625/): An authenticated arbitrary file upload vulnerability in the /documentCache/upload endpoint of InfoDom Performa 365 v4.0.1 allows attackers t (high 8.8)
- [CVE-2024-46624](https://insights.sbomify.com/CVE-2024-46624/): An issue in InfoDom Performa 365 v4.0.1 allows authenticated attackers to elevate their privileges to Administrator via a crafted payload sent to /api/users. (high 8.8)
- [CVE-2024-46622](https://insights.sbomify.com/CVE-2024-46622/): An Escalation of Privilege security vulnerability was found in SecureAge Security Suite software 7.0.x before 7.0.38, 7.1.x before 7.1.11, 8 (critical 9.8)
- [CVE-2024-4662](https://insights.sbomify.com/CVE-2024-4662/): Oxygen Builder <= 4.8.2 - Authenticated (Contributor+) Remote Code Execution (high 8.8)
- [CVE-2024-46613](https://insights.sbomify.com/CVE-2024-46613/): Integer overflow in weechat:weechat (medium 4.3)
- [CVE-2024-46612](https://insights.sbomify.com/CVE-2024-46612/): Hardcoded credentials in thecosy:icecms (critical 9.8)
- [CVE-2024-46610](https://insights.sbomify.com/CVE-2024-46610/): Missing authorization in thecosy:icecms (high 7.6)
- [CVE-2024-4661](https://insights.sbomify.com/CVE-2024-4661/): WP Reset <= 2.02 - Missing Authorization to License Key Modification (medium 4.3)
- [CVE-2024-46609](https://insights.sbomify.com/CVE-2024-46609/): Missing authorization in thecosy:icecms (high 7.5)
- [CVE-2024-46607](https://insights.sbomify.com/CVE-2024-46607/): Auth bypass in thecosy:icecms (high 7.6)
- [CVE-2024-46606](https://insights.sbomify.com/CVE-2024-46606/): Cross-site scripting in piwigo:piwigo (medium 5.4)
- [CVE-2024-46605](https://insights.sbomify.com/CVE-2024-46605/): Cross-site scripting in piwigo:piwigo (medium 6.1)
- [CVE-2024-46603](https://insights.sbomify.com/CVE-2024-46603/): XML external entity in elspec-ltd:g5dfr firmware (high 7.5)
- [CVE-2024-46602](https://insights.sbomify.com/CVE-2024-46602/): XML external entity in elspec-ltd:g5dfr firmware (high 7.5)
- [CVE-2024-46601](https://insights.sbomify.com/CVE-2024-46601/): Memory corruption in elspec-ltd:g5dfr firmware (high 7.5)
- [CVE-2024-46600](https://insights.sbomify.com/CVE-2024-46600/): Cross-site request forgery in timgreen:dingfanzu cms (medium 4.7)
- [CVE-2024-4660](https://insights.sbomify.com/CVE-2024-4660/): Missing Authorization in GitLab (medium 6.5)
- [CVE-2024-46598](https://insights.sbomify.com/CVE-2024-46598/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46597](https://insights.sbomify.com/CVE-2024-46597/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46596](https://insights.sbomify.com/CVE-2024-46596/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46595](https://insights.sbomify.com/CVE-2024-46595/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46594](https://insights.sbomify.com/CVE-2024-46594/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46593](https://insights.sbomify.com/CVE-2024-46593/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46592](https://insights.sbomify.com/CVE-2024-46592/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46591](https://insights.sbomify.com/CVE-2024-46591/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46590](https://insights.sbomify.com/CVE-2024-46590/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46589](https://insights.sbomify.com/CVE-2024-46589/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46588](https://insights.sbomify.com/CVE-2024-46588/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46586](https://insights.sbomify.com/CVE-2024-46586/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46585](https://insights.sbomify.com/CVE-2024-46585/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46584](https://insights.sbomify.com/CVE-2024-46584/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46583](https://insights.sbomify.com/CVE-2024-46583/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46582](https://insights.sbomify.com/CVE-2024-46582/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46581](https://insights.sbomify.com/CVE-2024-46581/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46580](https://insights.sbomify.com/CVE-2024-46580/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-4658](https://insights.sbomify.com/CVE-2024-4658/): SQLi in TE Informatics' Nova CMS (medium 6.9)
- [CVE-2024-46571](https://insights.sbomify.com/CVE-2024-46571/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-4657](https://insights.sbomify.com/CVE-2024-4657/): Strored XSS in Talent Software's BAP Automation (critical 9.3)
- [CVE-2024-46568](https://insights.sbomify.com/CVE-2024-46568/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46567](https://insights.sbomify.com/CVE-2024-46567/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46566](https://insights.sbomify.com/CVE-2024-46566/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46565](https://insights.sbomify.com/CVE-2024-46565/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46564](https://insights.sbomify.com/CVE-2024-46564/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46561](https://insights.sbomify.com/CVE-2024-46561/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46560](https://insights.sbomify.com/CVE-2024-46560/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-4656](https://insights.sbomify.com/CVE-2024-4656/): Import and export users and customers <= 1.26.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-46559](https://insights.sbomify.com/CVE-2024-46559/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46558](https://insights.sbomify.com/CVE-2024-46558/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46557](https://insights.sbomify.com/CVE-2024-46557/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46556](https://insights.sbomify.com/CVE-2024-46556/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46555](https://insights.sbomify.com/CVE-2024-46555/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46554](https://insights.sbomify.com/CVE-2024-46554/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46553](https://insights.sbomify.com/CVE-2024-46553/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46552](https://insights.sbomify.com/CVE-2024-46552/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46551](https://insights.sbomify.com/CVE-2024-46551/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-46550](https://insights.sbomify.com/CVE-2024-46550/): Memory corruption in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-4655](https://insights.sbomify.com/CVE-2024-4655/): Ultimate Blocks < 3.1.9 - Contributor+ Stored XSS (medium 6.3)
- [CVE-2024-46549](https://insights.sbomify.com/CVE-2024-46549/): An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connections by impersonating (high 7.6)
- [CVE-2024-46548](https://insights.sbomify.com/CVE-2024-46548/): TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eavesdrop on communicati (medium 6.3)
- [CVE-2024-46547](https://insights.sbomify.com/CVE-2024-46547/): A vulnerability was found in Romain Bourdon Wampserver all versions (discovered in v3.2.3 and v3.2.6) where unauthorized users could access (high 7.5)
- [CVE-2024-46546](https://insights.sbomify.com/CVE-2024-46546/): Memory corruption in nextu:fleta ax1500 firmware (high 7.3)
- [CVE-2024-46544](https://insights.sbomify.com/CVE-2024-46544/): Apache Tomcat Connectors: mod_jk: local users can view and modify configuration (medium 5.9)
- [CVE-2024-46542](https://insights.sbomify.com/CVE-2024-46542/): SQL injection in Data Insight (medium 6.5)
- [CVE-2024-46540](https://insights.sbomify.com/CVE-2024-46540/): File upload in emlog:emlog (medium 6.3)
- [CVE-2024-4654](https://insights.sbomify.com/CVE-2024-4654/): BlueNet Technology Clinical Browsing System cloudInterface.php sql injection (medium 6.3)
- [CVE-2024-46539](https://insights.sbomify.com/CVE-2024-46539/): Insecure permissions in the Bluetooth Low Energy (BLE) component of Fire-Boltt Artillery Smart Watch NJ-R6E-10.3 allow attackers to cause a (high 8.2)
- [CVE-2024-46538](https://insights.sbomify.com/CVE-2024-46538/): Cross-site scripting in netgate:pfsense (critical 9.3)
- [CVE-2024-46535](https://insights.sbomify.com/CVE-2024-46535/): SQL injection in ketr:jepaas (critical 9.8)
- [CVE-2024-46532](https://insights.sbomify.com/CVE-2024-46532/): SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in the PayController.class.php component. (critical 9.8)
- [CVE-2024-46531](https://insights.sbomify.com/CVE-2024-46531/): SQL injection in phpgurukul:vehicle record system (medium 6.3)
- [CVE-2024-4653](https://insights.sbomify.com/CVE-2024-4653/): BlueNet Technology Clinical Browsing System outIndex.php sql injection (medium 6.3)
- [CVE-2024-46528](https://insights.sbomify.com/CVE-2024-46528/): KubeSphere IDOR vulnerability (medium 4.3)
- [CVE-2024-4652](https://insights.sbomify.com/CVE-2024-4652/): Campcodes Complete Web-Based School Management System show_teacher2.php cross site scripting (low 3.5)
- [CVE-2024-46511](https://insights.sbomify.com/CVE-2024-46511/): LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attacker to execute arbitr (high 7.5)
- [CVE-2024-46510](https://insights.sbomify.com/CVE-2024-46510/): SQL injection in esafenet:cdg (high 7.6)
- [CVE-2024-4651](https://insights.sbomify.com/CVE-2024-4651/): Campcodes Complete Web-Based School Management System student_attendance_history1.php cross site scripting (low 3.5)
- [CVE-2024-46508](https://insights.sbomify.com/CVE-2024-46508/): Hardcoded credentials in yeti-platform:yeti (high 7.5)
- [CVE-2024-46507](https://insights.sbomify.com/CVE-2024-46507/): Code injection in yeti-platform:yeti (high 7.3)
- [CVE-2024-46506](https://insights.sbomify.com/CVE-2024-46506/): Auth bypass in NetAlertX (critical 10.0)
- [CVE-2024-46505](https://insights.sbomify.com/CVE-2024-46505/): Infoblox BloxOne v2.4 was discovered to contain a business logic flaw due to thick client vulnerabilities. (critical 9.1)
- [CVE-2024-4650](https://insights.sbomify.com/CVE-2024-4650/): Campcodes Complete Web-Based School Management System student_due_payment.php cross site scripting (low 3.5)
- [CVE-2024-46494](https://insights.sbomify.com/CVE-2024-46494/): Cross-site scripting in typecho:typecho (medium 5.4)
- [CVE-2024-4649](https://insights.sbomify.com/CVE-2024-4649/): Campcodes Complete Web-Based School Management System student_exam_mark_insert_form1.php cross site scripting (low 3.5)
- [CVE-2024-46489](https://insights.sbomify.com/CVE-2024-46489/): Remote command execution in promptr (high 8.8)
- [CVE-2024-46488](https://insights.sbomify.com/CVE-2024-46488/): Heap-based Buffer Overflow in sqlite-vec (critical 9.1)
- [CVE-2024-46486](https://insights.sbomify.com/CVE-2024-46486/): Command injection in tp-link:tl-wdr5620 firmware (high 8.0)
- [CVE-2024-46485](https://insights.sbomify.com/CVE-2024-46485/): Cross-site request forgery in timgreen:dingfanzu cms (medium 6.3)
- [CVE-2024-46484](https://insights.sbomify.com/CVE-2024-46484/): Command injection in trendnet:tv-ip410 firmware (critical 9.8)
- [CVE-2024-46483](https://insights.sbomify.com/CVE-2024-46483/): Xlight FTP Server <3.9.4.3 has an integer overflow vulnerability in the packet parsing logic of the SFTP server, which can lead to a heap ov (critical 9.8)
- [CVE-2024-46482](https://insights.sbomify.com/CVE-2024-46482/): An arbitrary file upload vulnerability in the Ticket Generation function of Ladybird Web Solution Faveo-Helpdesk v2.0.3 allows attackers to (high 8.2)
- [CVE-2024-46481](https://insights.sbomify.com/CVE-2024-46481/): Open redirect in Supravizio BPM (high 7.2)
- [CVE-2024-46480](https://insights.sbomify.com/CVE-2024-46480/): Information disclosure in Supravizio BPM (high 8.4)
- [CVE-2024-4648](https://insights.sbomify.com/CVE-2024-4648/): Campcodes Complete Web-Based School Management System student_exam_mark_update_form.php cross site scripting (low 3.5)
- [CVE-2024-46479](https://insights.sbomify.com/CVE-2024-46479/): File upload in Supravizio BPM (critical 9.9)
- [CVE-2024-46478](https://insights.sbomify.com/CVE-2024-46478/): Memory corruption in htmldoc project:htmldoc (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/260/