# Vulnerabilities published in 2024


- [CVE-2024-4521](https://insights.sbomify.com/CVE-2024-4521/): Campcodes Complete Web-Based School Management System teacher_salary_details2.php cross site scripting (low 3.5)
- [CVE-2024-45208](https://insights.sbomify.com/CVE-2024-45208/): Missing authorization in Director (critical 9.8)
- [CVE-2024-45207](https://insights.sbomify.com/CVE-2024-45207/): Code injection in Agent for Windows (high 7.0)
- [CVE-2024-45206](https://insights.sbomify.com/CVE-2024-45206/): Server-side request forgery in Service Provider Console (medium 6.5)
- [CVE-2024-45205](https://insights.sbomify.com/CVE-2024-45205/): Security feature bypass in UniFi iOS App (high 7.1)
- [CVE-2024-45204](https://insights.sbomify.com/CVE-2024-45204/): Information disclosure in Backup & Replication (high 7.7)
- [CVE-2024-45203](https://insights.sbomify.com/CVE-2024-45203/): Open redirect in "@cosme" App for Android (medium 4.3)
- [CVE-2024-45201](https://insights.sbomify.com/CVE-2024-45201/): LlamaIndex includes an exec call for `import {cls_name}` (high 8.8)
- [CVE-2024-45200](https://insights.sbomify.com/CVE-2024-45200/): In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to exploit a stack-based (medium 6.3)
- [CVE-2024-4520](https://insights.sbomify.com/CVE-2024-4520/): Improper Access Control in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-45199](https://insights.sbomify.com/CVE-2024-45199/): insightsoftware Hive JDBC through 2.6.13 has a remote code execution vulnerability. (high 8.8)
- [CVE-2024-45198](https://insights.sbomify.com/CVE-2024-45198/): insightsoftware Spark JDBC 2.6.21 has a remote code execution vulnerability. (high 8.8)
- [CVE-2024-45195](https://insights.sbomify.com/CVE-2024-45195/): Apache OFBiz Forced Browsing (critical 9.8, exploited in the wild)
- [CVE-2024-45194](https://insights.sbomify.com/CVE-2024-45194/): Cross-site scripting in synacor:zimbra collaboration suite (medium 4.8)
- [CVE-2024-45193](https://insights.sbomify.com/CVE-2024-45193/): Weak cryptography in matrix:olm (medium 4.3)
- [CVE-2024-45192](https://insights.sbomify.com/CVE-2024-45192/): Weak cryptography in matrix:olm (medium 5.3)
- [CVE-2024-45191](https://insights.sbomify.com/CVE-2024-45191/): Weak cryptography in matrix:olm (medium 5.3)
- [CVE-2024-45190](https://insights.sbomify.com/CVE-2024-45190/): Mage AI pipeline interaction request remote arbitrary file leak (medium 6.5)
- [CVE-2024-4519](https://insights.sbomify.com/CVE-2024-4519/): Campcodes Complete Web-Based School Management System teacher_salary_details3.php cross site scripting (low 3.5)
- [CVE-2024-45189](https://insights.sbomify.com/CVE-2024-45189/): Mage AI git content request remote arbitrary file leak (medium 6.5)
- [CVE-2024-45188](https://insights.sbomify.com/CVE-2024-45188/): Mage AI file content request remote arbitrary file leak (medium 6.5)
- [CVE-2024-45187](https://insights.sbomify.com/CVE-2024-45187/): Mage AI allows deleted users to use the terminal server with admin access, leading to remote code execution (high 7.1)
- [CVE-2024-45186](https://insights.sbomify.com/CVE-2024-45186/): FileSender before 2.49 allows server-side template injection (SSTI) for retrieving credentials. (critical 9.8)
- [CVE-2024-45185](https://insights.sbomify.com/CVE-2024-45185/): Memory corruption in samsung:exynos 1080 firmware (medium 5.1)
- [CVE-2024-45184](https://insights.sbomify.com/CVE-2024-45184/): Memory corruption in samsung:exynos 1080 firmware (medium 6.2)
- [CVE-2024-45183](https://insights.sbomify.com/CVE-2024-45183/): Memory corruption in samsung:exynos 1280 firmware (medium 6.5)
- [CVE-2024-45182](https://insights.sbomify.com/CVE-2024-45182/): Memory corruption in wibu:wibukey (medium 5.5)
- [CVE-2024-45181](https://insights.sbomify.com/CVE-2024-45181/): Memory corruption in wibu:wibukey (high 8.8)
- [CVE-2024-45180](https://insights.sbomify.com/CVE-2024-45180/): Cross-site scripting in squaredup:squaredup ds for scom (medium 5.4)
- [CVE-2024-4518](https://insights.sbomify.com/CVE-2024-4518/): Campcodes Complete Web-Based School Management System teacher_salary_invoice.php cross site scripting (low 3.5)
- [CVE-2024-45179](https://insights.sbomify.com/CVE-2024-45179/): Command injection in c-mor:c-mor video surveillance (high 7.2)
- [CVE-2024-45178](https://insights.sbomify.com/CVE-2024-45178/): Path traversal in c-mor:c-mor video surveillance (high 7.1)
- [CVE-2024-45177](https://insights.sbomify.com/CVE-2024-45177/): Cross-site scripting in c-mor:c-mor video surveillance (medium 5.4)
- [CVE-2024-45176](https://insights.sbomify.com/CVE-2024-45176/): Cross-site scripting in c-mor:c-mor video surveillance (medium 6.1)
- [CVE-2024-45175](https://insights.sbomify.com/CVE-2024-45175/): Information disclosure in c-mor:c-mor video surveillance (high 8.8)
- [CVE-2024-45174](https://insights.sbomify.com/CVE-2024-45174/): SQL injection in c-mor:c-mor video surveillance (high 8.1)
- [CVE-2024-45173](https://insights.sbomify.com/CVE-2024-45173/): Privilege escalation in c-mor:c-mor video surveillance (high 8.8)
- [CVE-2024-45172](https://insights.sbomify.com/CVE-2024-45172/): Cross-site request forgery in c-mor:c-mor video surveillance (medium 6.8)
- [CVE-2024-45171](https://insights.sbomify.com/CVE-2024-45171/): File upload in c-mor:c-mor video surveillance (high 8.8)
- [CVE-2024-45170](https://insights.sbomify.com/CVE-2024-45170/): Missing authorization in c-mor:c-mor video surveillance (high 8.1)
- [CVE-2024-4517](https://insights.sbomify.com/CVE-2024-4517/): Campcodes Complete Web-Based School Management System teacher_salary_invoice1.php cross site scripting (low 3.5)
- [CVE-2024-45169](https://insights.sbomify.com/CVE-2024-45169/): Memory corruption in uci:idol2 (critical 9.8)
- [CVE-2024-45168](https://insights.sbomify.com/CVE-2024-45168/): Missing authorization in uci:idol2 (critical 9.1)
- [CVE-2024-45167](https://insights.sbomify.com/CVE-2024-45167/): Denial of service in uci:idol2 (critical 9.8)
- [CVE-2024-45166](https://insights.sbomify.com/CVE-2024-45166/): Memory corruption in uci:idol2 (critical 9.8)
- [CVE-2024-45165](https://insights.sbomify.com/CVE-2024-45165/): Hardcoded credentials in uci:idol2 (medium 5.3)
- [CVE-2024-45164](https://insights.sbomify.com/CVE-2024-45164/): Missing authorization in akamai:secure internet access enterprise threatavert (medium 4.3)
- [CVE-2024-45163](https://insights.sbomify.com/CVE-2024-45163/): The Mirai botnet through 2024-08-19 mishandles simultaneous TCP connections to the CNC (command and control) server. (critical 9.1)
- [CVE-2024-45162](https://insights.sbomify.com/CVE-2024-45162/): A stack-based buffer overflow issue was discovered in the phddns client in Blu-Castle BCUM221E 1.0.0P220507 via the password field. (critical 9.8)
- [CVE-2024-45161](https://insights.sbomify.com/CVE-2024-45161/): A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507. (medium 4.6)
- [CVE-2024-45160](https://insights.sbomify.com/CVE-2024-45160/): Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via (critical 9.1)
- [CVE-2024-4516](https://insights.sbomify.com/CVE-2024-4516/): Campcodes Complete Web-Based School Management System timetable.php cross site scripting (low 3.5)
- [CVE-2024-45159](https://insights.sbomify.com/CVE-2024-45159/): Security feature bypass in trustedfirmware:mbed tls (critical 9.8)
- [CVE-2024-45158](https://insights.sbomify.com/CVE-2024-45158/): Memory corruption in trustedfirmware:mbed tls (critical 9.8)
- [CVE-2024-45157](https://insights.sbomify.com/CVE-2024-45157/): Weak cryptography in trustedfirmware:mbed tls (medium 5.1)
- [CVE-2024-45156](https://insights.sbomify.com/CVE-2024-45156/): Animate | NULL Pointer Dereference (CWE-476) (high 7.8)
- [CVE-2024-45155](https://insights.sbomify.com/CVE-2024-45155/): Animate | Access of Uninitialized Pointer (CWE-824) (high 7.8)
- [CVE-2024-45153](https://insights.sbomify.com/CVE-2024-45153/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-45152](https://insights.sbomify.com/CVE-2024-45152/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-45150](https://insights.sbomify.com/CVE-2024-45150/): Dimension | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-4515](https://insights.sbomify.com/CVE-2024-4515/): Campcodes Complete Web-Based School Management System timetable_grade_wise.php cross site scripting (low 3.5)
- [CVE-2024-45149](https://insights.sbomify.com/CVE-2024-45149/): Adobe Commerce | Improper Access Control (CWE-284) (low 2.7)
- [CVE-2024-45148](https://insights.sbomify.com/CVE-2024-45148/): Adobe Commerce | Improper Authentication (CWE-287) (high 8.8)
- [CVE-2024-45147](https://insights.sbomify.com/CVE-2024-45147/): Bridge | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-45146](https://insights.sbomify.com/CVE-2024-45146/): Dimension | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-45145](https://insights.sbomify.com/CVE-2024-45145/): Lightroom Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-45144](https://insights.sbomify.com/CVE-2024-45144/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-45143](https://insights.sbomify.com/CVE-2024-45143/): Substance3D - Stager | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-45142](https://insights.sbomify.com/CVE-2024-45142/): Substance3D - Stager | Write-what-where Condition (CWE-123) (high 7.8)
- [CVE-2024-45141](https://insights.sbomify.com/CVE-2024-45141/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-45140](https://insights.sbomify.com/CVE-2024-45140/): Substance3D - Stager | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-4514](https://insights.sbomify.com/CVE-2024-4514/): Campcodes Complete Web-Based School Management System timetable_insert_form.php cross site scripting (low 3.5)
- [CVE-2024-45139](https://insights.sbomify.com/CVE-2024-45139/): Substance3D - Stager | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-45138](https://insights.sbomify.com/CVE-2024-45138/): Substance3D - Stager | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-45137](https://insights.sbomify.com/CVE-2024-45137/): InDesign Desktop | Unrestricted Upload of File with Dangerous Type (CWE-434) (high 7.8)
- [CVE-2024-45136](https://insights.sbomify.com/CVE-2024-45136/): InCopy | Unrestricted Upload of File with Dangerous Type (CWE-434) (high 7.8)
- [CVE-2024-45135](https://insights.sbomify.com/CVE-2024-45135/): Adobe Commerce | Improper Access Control (CWE-284) (low 2.7)
- [CVE-2024-45134](https://insights.sbomify.com/CVE-2024-45134/): Adobe Commerce | Information Exposure (CWE-200) (low 2.7)
- [CVE-2024-45133](https://insights.sbomify.com/CVE-2024-45133/): Adobe Commerce | Improper Access Control (CWE-284) (low 2.7)
- [CVE-2024-45132](https://insights.sbomify.com/CVE-2024-45132/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 6.5)
- [CVE-2024-45131](https://insights.sbomify.com/CVE-2024-45131/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 5.4)
- [CVE-2024-45130](https://insights.sbomify.com/CVE-2024-45130/): Adobe Commerce | Improper Access Control (CWE-284) (medium 4.3)
- [CVE-2024-4513](https://insights.sbomify.com/CVE-2024-4513/): Campcodes Complete Web-Based School Management System timetable_update_form.php cross site scripting (low 3.5)
- [CVE-2024-45129](https://insights.sbomify.com/CVE-2024-45129/): Adobe Commerce | Improper Access Control (CWE-284) (medium 4.3)
- [CVE-2024-45128](https://insights.sbomify.com/CVE-2024-45128/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 5.4)
- [CVE-2024-45127](https://insights.sbomify.com/CVE-2024-45127/): Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79) (medium 4.8)
- [CVE-2024-45125](https://insights.sbomify.com/CVE-2024-45125/): Adobe Commerce | Incorrect Authorization (CWE-863) (medium 4.3)
- [CVE-2024-45124](https://insights.sbomify.com/CVE-2024-45124/): Adobe Commerce | Improper Access Control (CWE-284) (medium 5.3)
- [CVE-2024-45123](https://insights.sbomify.com/CVE-2024-45123/): Adobe Commerce | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-45122](https://insights.sbomify.com/CVE-2024-45122/): Adobe Commerce | Improper Access Control (CWE-284) (medium 4.3)
- [CVE-2024-45121](https://insights.sbomify.com/CVE-2024-45121/): Adobe Commerce | Improper Access Control (CWE-284) (medium 4.3)
- [CVE-2024-45120](https://insights.sbomify.com/CVE-2024-45120/): Adobe Commerce | Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) (low 3.1)
- [CVE-2024-4512](https://insights.sbomify.com/CVE-2024-4512/): SourceCodester Prison Management System edit-profile.php cross site scripting (low 3.5)
- [CVE-2024-45119](https://insights.sbomify.com/CVE-2024-45119/): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (medium 4.9)
- [CVE-2024-45118](https://insights.sbomify.com/CVE-2024-45118/): Adobe Commerce | Improper Access Control (CWE-284) (medium 6.5)
- [CVE-2024-45117](https://insights.sbomify.com/CVE-2024-45117/): Adobe Commerce | Improper Input Validation (CWE-20) (high 7.6)
- [CVE-2024-45116](https://insights.sbomify.com/CVE-2024-45116/): Adobe Commerce | Cross-site Scripting (XSS) (CWE-79) (high 8.1)
- [CVE-2024-45115](https://insights.sbomify.com/CVE-2024-45115/): Adobe Commerce | Improper Authentication (CWE-287) (critical 9.8)
- [CVE-2024-45114](https://insights.sbomify.com/CVE-2024-45114/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-45113](https://insights.sbomify.com/CVE-2024-45113/): ColdFusion | Improper Authentication (CWE-287) (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/269/