# Vulnerabilities published in 2024


- [CVE-2024-4590](https://insights.sbomify.com/CVE-2024-4590/): DedeCMS sys_info.php cross-site request forgery (medium 4.3)
- [CVE-2024-45894](https://insights.sbomify.com/CVE-2024-45894/): Path traversal in bluecms project:bluecms (medium 4.9)
- [CVE-2024-45893](https://insights.sbomify.com/CVE-2024-45893/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-45891](https://insights.sbomify.com/CVE-2024-45891/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-45890](https://insights.sbomify.com/CVE-2024-45890/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-4589](https://insights.sbomify.com/CVE-2024-4589/): DedeCMS mytag_edit.php cross-site request forgery (medium 4.3)
- [CVE-2024-45889](https://insights.sbomify.com/CVE-2024-45889/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-45888](https://insights.sbomify.com/CVE-2024-45888/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-45887](https://insights.sbomify.com/CVE-2024-45887/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-45885](https://insights.sbomify.com/CVE-2024-45885/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-45884](https://insights.sbomify.com/CVE-2024-45884/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-45882](https://insights.sbomify.com/CVE-2024-45882/): Command injection in draytek:vigor3900 firmware (high 8.0)
- [CVE-2024-45880](https://insights.sbomify.com/CVE-2024-45880/): A command injection vulnerability exists in Motorola CX2L router v1.0.2 and below. (high 8.0)
- [CVE-2024-4588](https://insights.sbomify.com/CVE-2024-4588/): DedeCMS mytag_add.php cross-site request forgery (medium 4.3)
- [CVE-2024-45879](https://insights.sbomify.com/CVE-2024-45879/): The file upload function in the "QWKalkulation" tool of baltic-it TOPqw Webportal v1.35.287.1 (fixed in version 1.35.291), in /Apps/TOPqw/QW (medium 6.1)
- [CVE-2024-45878](https://insights.sbomify.com/CVE-2024-45878/): The "Stammdaten" menu of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.291), in /Apps/TOPqw/qwStammdaten.aspx, is vulnerable (medium 6.1)
- [CVE-2024-45877](https://insights.sbomify.com/CVE-2024-45877/): baltic-it TOPqw Webportal v1.35.283.2 is vulnerable to Incorrect Access Control in the User Management function in /Apps/TOPqw/BenutzerManagement.aspx. (medium 6.5)
- [CVE-2024-45876](https://insights.sbomify.com/CVE-2024-45876/): The login form of baltic-it TOPqw Webportal v1.35.283.2 (fixed in version 1.35.283.4) at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. (medium 6.5)
- [CVE-2024-45875](https://insights.sbomify.com/CVE-2024-45875/): The create user function in baltic-it TOPqw Webportal 1.35.287.1 (fixed in version1.35.291), in /Apps/TOPqw/BenutzerManagement.aspx/SaveNewU (medium 5.4)
- [CVE-2024-45874](https://insights.sbomify.com/CVE-2024-45874/): A DLL hijacking vulnerability in VegaBird Vooki 5.2.9 allows attackers to execute arbitrary code / maintain persistence via placing a crafte (critical 9.8)
- [CVE-2024-45873](https://insights.sbomify.com/CVE-2024-45873/): A DLL hijacking vulnerability in VegaBird Yaazhini 2.0.2 allows attackers to execute arbitrary code / maintain persistence via placing a cra (critical 9.8)
- [CVE-2024-45872](https://insights.sbomify.com/CVE-2024-45872/): Memory corruption in bandisoft:bandiview (medium 6.3)
- [CVE-2024-45871](https://insights.sbomify.com/CVE-2024-45871/): Denial of service in bandisoft:bandiview (medium 6.3)
- [CVE-2024-45870](https://insights.sbomify.com/CVE-2024-45870/): Memory corruption in bandisoft:bandiview (medium 6.5)
- [CVE-2024-4587](https://insights.sbomify.com/CVE-2024-4587/): DedeCMS tpl.php cross-site request forgery (medium 4.3)
- [CVE-2024-45863](https://insights.sbomify.com/CVE-2024-45863/): Null dereference in Facebook Thrift (medium 5.3)
- [CVE-2024-45862](https://insights.sbomify.com/CVE-2024-45862/): Cleartext Storage of Sensitive Information in Kastle Systems Access Control System (high 8.7)
- [CVE-2024-45861](https://insights.sbomify.com/CVE-2024-45861/): Use of Hard-coded Credentials in Kastle Systems Access Control System (critical 9.2)
- [CVE-2024-4586](https://insights.sbomify.com/CVE-2024-4586/): DedeCMS shops_delivery.php cross-site request forgery (medium 4.3)
- [CVE-2024-45858](https://insights.sbomify.com/CVE-2024-45858/): Guardrails has an arbitrary code execution vulnerability (high 7.8)
- [CVE-2024-45857](https://insights.sbomify.com/CVE-2024-45857/): Cleanlab Deserialization of Untrusted Data vulnerability (high 7.8)
- [CVE-2024-45856](https://insights.sbomify.com/CVE-2024-45856/): MindsDB Cross-site Scripting vulnerability (critical 9.0)
- [CVE-2024-45855](https://insights.sbomify.com/CVE-2024-45855/): MindsDB Deserialization of Untrusted Data vulnerability (high 7.1)
- [CVE-2024-45854](https://insights.sbomify.com/CVE-2024-45854/): MindsDB Deserialization of Untrusted Data vulnerability (high 7.1)
- [CVE-2024-45853](https://insights.sbomify.com/CVE-2024-45853/): MindsDB Deserialization of Untrusted Data vulnerability (high 7.1)
- [CVE-2024-45852](https://insights.sbomify.com/CVE-2024-45852/): MindsDB Deserialization of Untrusted Data vulnerability (high 8.8)
- [CVE-2024-45851](https://insights.sbomify.com/CVE-2024-45851/): MindsDB Eval Injection vulnerability (high 8.8)
- [CVE-2024-45850](https://insights.sbomify.com/CVE-2024-45850/): MindsDB Eval Injection vulnerability (high 8.8)
- [CVE-2024-4585](https://insights.sbomify.com/CVE-2024-4585/): DedeCMS member_type.php cross-site request forgery (medium 4.3)
- [CVE-2024-45849](https://insights.sbomify.com/CVE-2024-45849/): MindsDB Eval Injection vulnerability (high 8.8)
- [CVE-2024-45848](https://insights.sbomify.com/CVE-2024-45848/): MindsDB Eval Injection vulnerability (high 8.8)
- [CVE-2024-45847](https://insights.sbomify.com/CVE-2024-45847/): MindsDB Eval Injection vulnerability (high 8.8)
- [CVE-2024-45846](https://insights.sbomify.com/CVE-2024-45846/): MindsDB Eval Injection vulnerability (high 8.8)
- [CVE-2024-45844](https://insights.sbomify.com/CVE-2024-45844/): BIG-IP monitors vulnerability (high 8.6)
- [CVE-2024-45843](https://insights.sbomify.com/CVE-2024-45843/): Weak SSRF Filtering (low 3.1)
- [CVE-2024-45842](https://insights.sbomify.com/CVE-2024-45842/): Path traversal in Sharp Digital Full-color MFPs and Monochrome MFPs (medium 5.3)
- [CVE-2024-45841](https://insights.sbomify.com/CVE-2024-45841/): Information disclosure in UD-LT1 (medium 6.5)
- [CVE-2024-4584](https://insights.sbomify.com/CVE-2024-4584/): Faraday GM8181/GM828x command_port.ini information disclosure (medium 5.3)
- [CVE-2024-45838](https://insights.sbomify.com/CVE-2024-45838/): goTenna Pro ATAK Plugin Cleartext Transmission of Sensitive Information (low 2.3)
- [CVE-2024-45837](https://insights.sbomify.com/CVE-2024-45837/): Hardcoded credentials in IX-BA (medium 5.4)
- [CVE-2024-45836](https://insights.sbomify.com/CVE-2024-45836/): Cross-site scripting in CS-QR10 (medium 6.1)
- [CVE-2024-45835](https://insights.sbomify.com/CVE-2024-45835/): Insufficient Electron Fuses Configuration (low 2.5)
- [CVE-2024-45833](https://insights.sbomify.com/CVE-2024-45833/): Mobile password gets saved in dictionary under conditions (medium 4.5)
- [CVE-2024-45832](https://insights.sbomify.com/CVE-2024-45832/): Ossur Mobile Logic Application Use of Hard-coded Credentials (low 2.0)
- [CVE-2024-4583](https://insights.sbomify.com/CVE-2024-4583/): Faraday GM8181/GM828x Request information disclosure (medium 5.3)
- [CVE-2024-45829](https://insights.sbomify.com/CVE-2024-45829/): Memory corruption in Sharp Digital Full-color MFPs and Monochrome MFPs (medium 4.9)
- [CVE-2024-45828](https://insights.sbomify.com/CVE-2024-45828/): i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request (medium 5.5)
- [CVE-2024-45827](https://insights.sbomify.com/CVE-2024-45827/): Command injection in Mesh Wi-Fi router RP562B (high 8.0)
- [CVE-2024-45826](https://insights.sbomify.com/CVE-2024-45826/): ThinManager® Code Execution Vulnerability (high 8.5)
- [CVE-2024-45825](https://insights.sbomify.com/CVE-2024-45825/): 5015-U8IHFT Denial-of-Service Vulnerability via CIP Message (high 8.7)
- [CVE-2024-45824](https://insights.sbomify.com/CVE-2024-45824/): FactoryTalk® View Site Edition Remote Code Execution Vulnerability via Lack of Input Validation (critical 9.2)
- [CVE-2024-45823](https://insights.sbomify.com/CVE-2024-45823/): FactoryTalk® Batch View™ Authentication Bypass Vulnerability via shared secrets (critical 9.2)
- [CVE-2024-4582](https://insights.sbomify.com/CVE-2024-4582/): Faraday GM8181/GM828x NTP Service os command injection (high 7.3)
- [CVE-2024-45819](https://insights.sbomify.com/CVE-2024-45819/): libxl leaks data to PVH guests via ACPI tables (medium 5.5)
- [CVE-2024-45818](https://insights.sbomify.com/CVE-2024-45818/): Deadlock in x86 HVM standard VGA handling (medium 6.5)
- [CVE-2024-45817](https://insights.sbomify.com/CVE-2024-45817/): x86: Deadlock in vlapic_error() (high 7.3)
- [CVE-2024-45816](https://insights.sbomify.com/CVE-2024-45816/): Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend (medium 6.5)
- [CVE-2024-45815](https://insights.sbomify.com/CVE-2024-45815/): Prototype pollution in @backstage/plugin-catalog-backend (medium 6.5)
- [CVE-2024-45813](https://insights.sbomify.com/CVE-2024-45813/): ReDoS vulnerability in multiparametric routes in find-my-way (medium 5.3)
- [CVE-2024-45812](https://insights.sbomify.com/CVE-2024-45812/): DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite (medium 6.4)
- [CVE-2024-45811](https://insights.sbomify.com/CVE-2024-45811/): server.fs.deny bypassed when using ?import&raw in vite (medium 4.8)
- [CVE-2024-45810](https://insights.sbomify.com/CVE-2024-45810/): Envoy crashes for LocalReply in http async client (medium 6.5)
- [CVE-2024-4581](https://insights.sbomify.com/CVE-2024-4581/): Cross-site scripting in Slider Revolution (medium 6.4)
- [CVE-2024-45809](https://insights.sbomify.com/CVE-2024-45809/): Jwt filter crash in the clear route cache with remote JWKs in envoy (medium 5.3)
- [CVE-2024-45808](https://insights.sbomify.com/CVE-2024-45808/): Malicious log injection via access logs in envoy (medium 6.5)
- [CVE-2024-45807](https://insights.sbomify.com/CVE-2024-45807/): oghttp2 crash on OnBeginHeadersForStream in envoy (high 7.5)
- [CVE-2024-45806](https://insights.sbomify.com/CVE-2024-45806/): Potential manipulate `x-envoy` headers from external sources in envoy (medium 6.5)
- [CVE-2024-45805](https://insights.sbomify.com/CVE-2024-45805/): OpenCTI leaks support information due to inadequate access control (medium 4.3)
- [CVE-2024-45803](https://insights.sbomify.com/CVE-2024-45803/): Cross site scripting (XSS) Vulnerability on route /wireui/button?label=Content in wireui (medium 5.1)
- [CVE-2024-45802](https://insights.sbomify.com/CVE-2024-45802/): Squid Denial of Service (high 7.5)
- [CVE-2024-45801](https://insights.sbomify.com/CVE-2024-45801/): Tampering by prototype polution in DOMPurify (high 7.3)
- [CVE-2024-45800](https://insights.sbomify.com/CVE-2024-45800/): Multiple mXSS found in snappymail HTML parser (medium 5.0)
- [CVE-2024-4580](https://insights.sbomify.com/CVE-2024-4580/): Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits (medium 6.4)
- [CVE-2024-45799](https://insights.sbomify.com/CVE-2024-45799/): Javascript Injection in Vending Info/Buyers Info Module in FluxCP (high 7.3)
- [CVE-2024-45798](https://insights.sbomify.com/CVE-2024-45798/): Multiple Poisoned Pipeline Execution (PPE) vulnerabilities (critical 10.0)
- [CVE-2024-45797](https://insights.sbomify.com/CVE-2024-45797/): LibHTP's unbounded header handling leads to denial service (high 7.5)
- [CVE-2024-45796](https://insights.sbomify.com/CVE-2024-45796/): Suricata defrag: off by one can lead to policy bypass (medium 5.3)
- [CVE-2024-45795](https://insights.sbomify.com/CVE-2024-45795/): Suricata detect/datasets: reachable assertion with unimplemented rule option (high 7.5)
- [CVE-2024-45794](https://insights.sbomify.com/CVE-2024-45794/): SQL Injection in CreateUser API in devtron (high 8.3)
- [CVE-2024-45793](https://insights.sbomify.com/CVE-2024-45793/): Cross-site Scripting from in Confidant API call (medium 4.8)
- [CVE-2024-45792](https://insights.sbomify.com/CVE-2024-45792/): MantisBT vulnerable to information disclosure with user profiles (medium 5.3)
- [CVE-2024-45791](https://insights.sbomify.com/CVE-2024-45791/): Apache HertzBeat: Exposure sensitive token via http GET method with query string (high 7.5)
- [CVE-2024-45790](https://insights.sbomify.com/CVE-2024-45790/): User Enumeration vulnerability (critical 9.3)
- [CVE-2024-45789](https://insights.sbomify.com/CVE-2024-45789/): Parameter Tampering Vulnerability (medium 6.9)
- [CVE-2024-45788](https://insights.sbomify.com/CVE-2024-45788/): No Rate Limiting Vulnerability (high 8.7)
- [CVE-2024-45787](https://insights.sbomify.com/CVE-2024-45787/): Information Disclosure Vulnerability (high 8.7)
- [CVE-2024-45786](https://insights.sbomify.com/CVE-2024-45786/): Improper Authorization Vulnerability (high 8.7)
- [CVE-2024-45785](https://insights.sbomify.com/CVE-2024-45785/): Auth bypass in MUSASI (high 7.5)
- [CVE-2024-45784](https://insights.sbomify.com/CVE-2024-45784/): Apache Airflow: Sensitive configuration values are not masked in the logs by default (high 7.5)
- [CVE-2024-45783](https://insights.sbomify.com/CVE-2024-45783/): Grub2: fs/hfs+: refcount can be decremented twice (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/263/