# Vulnerabilities published in 2024


- [CVE-2024-46241](https://insights.sbomify.com/CVE-2024-46241/): Cross-site scripting in phpgurukul:dairy farm shop management system (medium 5.9)
- [CVE-2024-46240](https://insights.sbomify.com/CVE-2024-46240/): Cross-site scripting in o-dyn:collabtive (medium 4.8)
- [CVE-2024-4624](https://insights.sbomify.com/CVE-2024-4624/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-46239](https://insights.sbomify.com/CVE-2024-46239/): Cross-site scripting in phpgurukul:hospital management system (medium 5.9)
- [CVE-2024-46238](https://insights.sbomify.com/CVE-2024-46238/): Cross-site scripting in phpgurukul:hospital management system (medium 5.9)
- [CVE-2024-46237](https://insights.sbomify.com/CVE-2024-46237/): Cross-site scripting in phpgurukul:hospital management system (medium 4.8)
- [CVE-2024-46236](https://insights.sbomify.com/CVE-2024-46236/): Cross-site scripting in codeastro:membership management system (medium 5.4)
- [CVE-2024-4623](https://insights.sbomify.com/CVE-2024-4623/): Cross-site scripting in Blogmentor – Blog Layouts for Elementor (medium 6.4)
- [CVE-2024-46226](https://insights.sbomify.com/CVE-2024-46226/): Cross-site scripting in helpdeskz:helpdeskz (medium 4.8)
- [CVE-2024-4622](https://insights.sbomify.com/CVE-2024-4622/): alpitronic Hypercharger EV Charger Use of Default Credentials (high 8.3)
- [CVE-2024-46215](https://insights.sbomify.com/CVE-2024-46215/): A vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub_445BDC() function within the /usr/sbin/goahead progr (medium 6.5)
- [CVE-2024-46213](https://insights.sbomify.com/CVE-2024-46213/): Code injection in redaxo:redaxo (high 7.2)
- [CVE-2024-46212](https://insights.sbomify.com/CVE-2024-46212/): Path traversal in redaxo (medium 4.9)
- [CVE-2024-46210](https://insights.sbomify.com/CVE-2024-46210/): File upload in redaxo:redaxo (high 7.2)
- [CVE-2024-4621](https://insights.sbomify.com/CVE-2024-4621/): ArForms < 6.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-46209](https://insights.sbomify.com/CVE-2024-46209/): REDAXO CMS Cross-site Scripting vulnerability (medium 5.4)
- [CVE-2024-4620](https://insights.sbomify.com/CVE-2024-4620/): ArForms < 6.6 - Unauthenticated RCE (critical 9.8)
- [CVE-2024-4619](https://insights.sbomify.com/CVE-2024-4619/): Cross-site scripting in Elementor Website Builder – more than just a page builder (medium 6.4)
- [CVE-2024-4618](https://insights.sbomify.com/CVE-2024-4618/): Cross-site scripting in Exclusive Addons for Elementor (medium 6.4)
- [CVE-2024-4617](https://insights.sbomify.com/CVE-2024-4617/): Rank Math SEO with AI Best SEO Tools <= 1.0.218 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-4616](https://insights.sbomify.com/CVE-2024-4616/): Widget Bundle <= 2.0.0 - Unauthencated Reflected XSS (medium 6.1)
- [CVE-2024-4615](https://insights.sbomify.com/CVE-2024-4615/): Cross-site scripting in EleSpare – News, Magazine and Blog Addons for Elementor (medium 6.4)
- [CVE-2024-4612](https://insights.sbomify.com/CVE-2024-4612/): URL Redirection to Untrusted Site ('Open Redirect') in GitLab (medium 6.4)
- [CVE-2024-4611](https://insights.sbomify.com/CVE-2024-4611/): AppPresser <= 4.3.2 - Improper Missing Encryption Exception Handling to Authentication Bypass (high 8.1)
- [CVE-2024-46103](https://insights.sbomify.com/CVE-2024-46103/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2024-46101](https://insights.sbomify.com/CVE-2024-46101/): File upload in gdidees:gdidees cms (critical 9.8)
- [CVE-2024-4610](https://insights.sbomify.com/CVE-2024-4610/): Arm Mali GPU Kernel Driver Use-After-Free (high 7.4, exploited in the wild)
- [CVE-2024-46097](https://insights.sbomify.com/CVE-2024-46097/): Missing authorization in testlink:testlink (high 8.1)
- [CVE-2024-4609](https://insights.sbomify.com/CVE-2024-4609/): Rockwell Automation Datalog Function within in FactoryTalk® View SE contains SQL Injection Vulnerability (high 8.8)
- [CVE-2024-46089](https://insights.sbomify.com/CVE-2024-46089/): Command injection in 74cms:74cms (medium 6.3)
- [CVE-2024-46088](https://insights.sbomify.com/CVE-2024-46088/): An arbitrary file upload vulnerability in the ProductAction.entphone interface of Zhejiang University Entersoft Customer Resource Management (critical 9.8)
- [CVE-2024-46086](https://insights.sbomify.com/CVE-2024-46086/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-46085](https://insights.sbomify.com/CVE-2024-46085/): Cross-site request forgery in frogcms project:frogcms (high 8.8)
- [CVE-2024-46084](https://insights.sbomify.com/CVE-2024-46084/): Command injection in scriptcase:scriptcase (high 8.0)
- [CVE-2024-46083](https://insights.sbomify.com/CVE-2024-46083/): Cross-site scripting in scriptcase:scriptcase (medium 5.4)
- [CVE-2024-46082](https://insights.sbomify.com/CVE-2024-46082/): Cross-site scripting in scriptcase:scriptcase (medium 5.4)
- [CVE-2024-46081](https://insights.sbomify.com/CVE-2024-46081/): Cross-site scripting in scriptcase:scriptcase (medium 5.4)
- [CVE-2024-46080](https://insights.sbomify.com/CVE-2024-46080/): Code injection in scriptcase:scriptcase (high 8.0)
- [CVE-2024-4608](https://insights.sbomify.com/CVE-2024-4608/): Cross-site scripting in SellKit – Funnel builder and checkout optimizer for WooCommerce to sell more, faster (medium 6.4)
- [CVE-2024-46079](https://insights.sbomify.com/CVE-2024-46079/): Cross-site scripting in scriptcase:scriptcase (medium 6.1)
- [CVE-2024-46078](https://insights.sbomify.com/CVE-2024-46078/): SQL injection in adonesevangelista:sports management system (high 7.5)
- [CVE-2024-46077](https://insights.sbomify.com/CVE-2024-46077/): Cross-site scripting in mayurik:online tours and travels management system (medium 5.4)
- [CVE-2024-46076](https://insights.sbomify.com/CVE-2024-46076/): Code injection in ruoyi:ruoyi (critical 9.8)
- [CVE-2024-46073](https://insights.sbomify.com/CVE-2024-46073/): A reflected Cross-Site Scripting (XSS) vulnerability exists in the login page of IceHRM v32.4.0.OS. (medium 6.1)
- [CVE-2024-4607](https://insights.sbomify.com/CVE-2024-4607/): Mali GPU Kernel Driver allows improper GPU memory processing operations (high 7.8)
- [CVE-2024-46062](https://insights.sbomify.com/CVE-2024-46062/): Privilege escalation in conda:miniconda3 (high 7.8)
- [CVE-2024-46060](https://insights.sbomify.com/CVE-2024-46060/): Privilege escalation in anaconda:anaconda3 (high 7.8)
- [CVE-2024-4606](https://insights.sbomify.com/CVE-2024-4606/): Deserialization in Ultimate Store Kit Elementor Addons (medium 5.4)
- [CVE-2024-46055](https://insights.sbomify.com/CVE-2024-46055/): Cross-site scripting in davidguva:openvidreview (medium 4.8)
- [CVE-2024-46054](https://insights.sbomify.com/CVE-2024-46054/): Missing authorization in davidguva:openvidreview (critical 9.8)
- [CVE-2024-4605](https://insights.sbomify.com/CVE-2024-4605/): Breakdance <= 1.7.1 - Authenticated (Contributor+) Remote Code Execution (high 8.8)
- [CVE-2024-46049](https://insights.sbomify.com/CVE-2024-46049/): Memory corruption in tenda:o6 firmware (medium 5.7)
- [CVE-2024-46048](https://insights.sbomify.com/CVE-2024-46048/): Command injection in tenda:fh451 firmware (high 8.8)
- [CVE-2024-46047](https://insights.sbomify.com/CVE-2024-46047/): Memory corruption in tenda:fh451 firmware (medium 6.5)
- [CVE-2024-46046](https://insights.sbomify.com/CVE-2024-46046/): Memory corruption in tenda:fh451 firmware (medium 6.5)
- [CVE-2024-46045](https://insights.sbomify.com/CVE-2024-46045/): Memory corruption in tenda:ch22 firmware (medium 5.7)
- [CVE-2024-46044](https://insights.sbomify.com/CVE-2024-46044/): Memory corruption in tenda:ch22 firmware (medium 5.7)
- [CVE-2024-46041](https://insights.sbomify.com/CVE-2024-46041/): IoT Haat Smart Plug IH-IN-16A-S v5.16.1 is vulnerable to Authentication Bypass by Capture-replay. (high 8.8)
- [CVE-2024-46040](https://insights.sbomify.com/CVE-2024-46040/): IoT Haat Smart Plug IH-IN-16A-S IH-IN-16A-S v5.16.1 suffers from Insufficient Session Expiration. (medium 6.5)
- [CVE-2024-4604](https://insights.sbomify.com/CVE-2024-4604/): Open Redirect in Magarsus Consultancy's SSO (medium 6.1)
- [CVE-2024-4603](https://insights.sbomify.com/CVE-2024-4603/): Excessive time spent checking DSA keys and parameters (medium 5.3)
- [CVE-2024-4602](https://insights.sbomify.com/CVE-2024-4602/): Embed Peertube Playlist < 1.10 - Editor+ Stored XSS (medium 5.4)
- [CVE-2024-4601](https://insights.sbomify.com/CVE-2024-4601/): Improper Authentication vulnerability in Socomec Net Vision (medium 6.7)
- [CVE-2024-4600](https://insights.sbomify.com/CVE-2024-4600/): Cross-Site Request Forgery vulnerability in Socomec Net Vision (high 7.1)
- [CVE-2024-45999](https://insights.sbomify.com/CVE-2024-45999/): SQL injection in magicbug:cloudlog (medium 6.6)
- [CVE-2024-45993](https://insights.sbomify.com/CVE-2024-45993/): Memory corruption in giflib project:giflib (medium 6.5)
- [CVE-2024-4599](https://insights.sbomify.com/CVE-2024-4599/): Denial of service vulnerability in LAN Messenger (high 7.5)
- [CVE-2024-45989](https://insights.sbomify.com/CVE-2024-45989/): Monica AI Assistant desktop application v2.3.0 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. (medium 4.0)
- [CVE-2024-45987](https://insights.sbomify.com/CVE-2024-45987/): Cross-site request forgery in online voting system project:online voting system (medium 6.5)
- [CVE-2024-45986](https://insights.sbomify.com/CVE-2024-45986/): Cross-site scripting in projectworlds:online voting system project (medium 5.4)
- [CVE-2024-45985](https://insights.sbomify.com/CVE-2024-45985/): Cross-site scripting in varunsardana004:blood bank and donation management system (medium 4.7)
- [CVE-2024-45984](https://insights.sbomify.com/CVE-2024-45984/): Cross-site scripting in varunsardana004:blood bank and donation management system (medium 4.7)
- [CVE-2024-45983](https://insights.sbomify.com/CVE-2024-45983/): Cross-site request forgery in kishan0725:hospital management system (medium 6.3)
- [CVE-2024-45982](https://insights.sbomify.com/CVE-2024-45982/): A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a c (high 8.8)
- [CVE-2024-45981](https://insights.sbomify.com/CVE-2024-45981/): A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with (high 8.8)
- [CVE-2024-45980](https://insights.sbomify.com/CVE-2024-45980/): A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a craft (high 8.8)
- [CVE-2024-4598](https://insights.sbomify.com/CVE-2024-4598/): Information Disclosure in Multiple WSO2 Products Due to Improper Handling in Enrich Mediator (medium 6.5)
- [CVE-2024-45979](https://insights.sbomify.com/CVE-2024-45979/): A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with (high 8.8)
- [CVE-2024-45971](https://insights.sbomify.com/CVE-2024-45971/): Memory corruption in mz-automation:libiec61850 (critical 9.8)
- [CVE-2024-45970](https://insights.sbomify.com/CVE-2024-45970/): Memory corruption in mz-automation:libiec61850 (critical 9.8)
- [CVE-2024-4597](https://insights.sbomify.com/CVE-2024-4597/): Cross-Site Request Forgery (CSRF) in GitLab (medium 5.7)
- [CVE-2024-45969](https://insights.sbomify.com/CVE-2024-45969/): NULL pointer dereference in the MMS Client in MZ Automation LibIEC1850 before commit 7afa40390b26ad1f4cf93deaa0052fe7e357ef33 allows a malic (high 7.5)
- [CVE-2024-45967](https://insights.sbomify.com/CVE-2024-45967/): Pagekit Cross-site Scripting vulnerability (medium 4.7)
- [CVE-2024-45965](https://insights.sbomify.com/CVE-2024-45965/): Cross-site scripting in Contao (medium 6.4)
- [CVE-2024-45964](https://insights.sbomify.com/CVE-2024-45964/): Zenario Cross Site Scripting in the Image library (medium 4.8)
- [CVE-2024-45962](https://insights.sbomify.com/CVE-2024-45962/): October allows an admin account to upload PDF containing malicious JavaScript (medium 4.7)
- [CVE-2024-45960](https://insights.sbomify.com/CVE-2024-45960/): Zenario allows authenticated admin users to upload PDF files containing malicious code (medium 4.8)
- [CVE-2024-4596](https://insights.sbomify.com/CVE-2024-4596/): Kimai Session information disclosure (low 3.7)
- [CVE-2024-45955](https://insights.sbomify.com/CVE-2024-45955/): SQL injection in rocketsoftware:zena (high 7.3)
- [CVE-2024-4595](https://insights.sbomify.com/CVE-2024-4595/): SEMCMS function.php locate sql injection (medium 6.3)
- [CVE-2024-45944](https://insights.sbomify.com/CVE-2024-45944/): Code injection in j2eefast:j2eefast (critical 9.8)
- [CVE-2024-4594](https://insights.sbomify.com/CVE-2024-4594/): DedeCMS sys_safe.php cross-site request forgery (medium 4.3)
- [CVE-2024-45933](https://insights.sbomify.com/CVE-2024-45933/): OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting (XSS) which allows attackers to execute arbitrary code via the Title and summary f (medium 6.6)
- [CVE-2024-45932](https://insights.sbomify.com/CVE-2024-45932/): Krayin CRM vulnerable to Cross Site Scripting (XSS) via the organization name (high 7.1)
- [CVE-2024-4593](https://insights.sbomify.com/CVE-2024-4593/): DedeCMS sys_multiserv.php cross-site request forgery (medium 4.3)
- [CVE-2024-45920](https://insights.sbomify.com/CVE-2024-45920/): Cross-site scripting in solvait:solvait (medium 5.4)
- [CVE-2024-4592](https://insights.sbomify.com/CVE-2024-4592/): DedeCMS sys_group_edit.php cross-site request forgery (medium 4.3)
- [CVE-2024-45919](https://insights.sbomify.com/CVE-2024-45919/): Privilege escalation in solvait:solvait (medium 6.5)
- [CVE-2024-45918](https://insights.sbomify.com/CVE-2024-45918/): Fujian Kelixin Communication Command and Dispatch Platform <=7.6.6.4391 is vulnerable to SQL Injection via /client/get_gis_fence.php. (critical 9.8)
- [CVE-2024-4591](https://insights.sbomify.com/CVE-2024-4591/): DedeCMS sys_group_add.php cross-site request forgery (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/262/