# Vulnerabilities published in 2024


- [CVE-2024-42986](https://insights.sbomify.com/CVE-2024-42986/): Memory corruption in tenda:fh1206 firmware (high 7.5)
- [CVE-2024-42985](https://insights.sbomify.com/CVE-2024-42985/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-42984](https://insights.sbomify.com/CVE-2024-42984/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-42983](https://insights.sbomify.com/CVE-2024-42983/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-42982](https://insights.sbomify.com/CVE-2024-42982/): Memory corruption in tenda:fh1206 firmware (medium 5.3)
- [CVE-2024-42981](https://insights.sbomify.com/CVE-2024-42981/): Memory corruption in tenda:fh1206 firmware (high 7.5)
- [CVE-2024-42980](https://insights.sbomify.com/CVE-2024-42980/): Memory corruption in tenda:fh1206 firmware (high 7.5)
- [CVE-2024-4298](https://insights.sbomify.com/CVE-2024-4298/): HGiga iSherlock - Command Injection (high 7.2)
- [CVE-2024-42979](https://insights.sbomify.com/CVE-2024-42979/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-42978](https://insights.sbomify.com/CVE-2024-42978/): Command injection in tenda:fh1206 firmware (critical 9.8)
- [CVE-2024-42977](https://insights.sbomify.com/CVE-2024-42977/): Memory corruption in tenda:fh1206 firmware (high 7.5)
- [CVE-2024-42976](https://insights.sbomify.com/CVE-2024-42976/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-42974](https://insights.sbomify.com/CVE-2024-42974/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-42973](https://insights.sbomify.com/CVE-2024-42973/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-4297](https://insights.sbomify.com/CVE-2024-4297/): HGiga iSherlock - Arbitrary File Download (medium 4.9)
- [CVE-2024-42969](https://insights.sbomify.com/CVE-2024-42969/): Memory corruption in tenda:fh1206 firmware (high 7.5)
- [CVE-2024-42968](https://insights.sbomify.com/CVE-2024-42968/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-42967](https://insights.sbomify.com/CVE-2024-42967/): Missing authorization in totolink:lr350 firmware (critical 9.8)
- [CVE-2024-42966](https://insights.sbomify.com/CVE-2024-42966/): Missing authorization in totolink:n350rt firmware (critical 9.8)
- [CVE-2024-4296](https://insights.sbomify.com/CVE-2024-4296/): HGiga iSherlock - Arbitrary File Download (medium 4.9)
- [CVE-2024-42955](https://insights.sbomify.com/CVE-2024-42955/): Memory corruption in tenda:fh1201 firmware (medium 6.5)
- [CVE-2024-42954](https://insights.sbomify.com/CVE-2024-42954/): Memory corruption in tendacn:fh1201 firmware (medium 6.5)
- [CVE-2024-42953](https://insights.sbomify.com/CVE-2024-42953/): Memory corruption in tendacn:fh1201 firmware (medium 6.5)
- [CVE-2024-42952](https://insights.sbomify.com/CVE-2024-42952/): Memory corruption in tenda:fh1201 firmware (high 7.5)
- [CVE-2024-42951](https://insights.sbomify.com/CVE-2024-42951/): Memory corruption in tenda:fh1201 firmware (high 7.5)
- [CVE-2024-42950](https://insights.sbomify.com/CVE-2024-42950/): Memory corruption in tenda:fh1201 firmware (high 7.5)
- [CVE-2024-4295](https://insights.sbomify.com/CVE-2024-4295/): Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via hash (critical 9.8)
- [CVE-2024-42949](https://insights.sbomify.com/CVE-2024-42949/): Memory corruption in tendacn:fh1201 firmware (medium 6.5)
- [CVE-2024-42948](https://insights.sbomify.com/CVE-2024-42948/): Memory corruption in tenda:fh1201 firmware (high 7.5)
- [CVE-2024-42947](https://insights.sbomify.com/CVE-2024-42947/): Command injection in tenda:fh1201 firmware (critical 9.8)
- [CVE-2024-42946](https://insights.sbomify.com/CVE-2024-42946/): Memory corruption in tenda:fh1201 firmware (medium 6.5)
- [CVE-2024-42945](https://insights.sbomify.com/CVE-2024-42945/): Memory corruption in tendacn:fh1201 firmware (medium 6.5)
- [CVE-2024-42944](https://insights.sbomify.com/CVE-2024-42944/): Memory corruption in tenda:fh1201 firmware (medium 6.5)
- [CVE-2024-42943](https://insights.sbomify.com/CVE-2024-42943/): Memory corruption in tenda:fh1201 firmware (high 7.5)
- [CVE-2024-42942](https://insights.sbomify.com/CVE-2024-42942/): Memory corruption in tendacn:fh1201 firmware (medium 6.5)
- [CVE-2024-42941](https://insights.sbomify.com/CVE-2024-42941/): Memory corruption in tenda:fh1201 firmware (high 7.5)
- [CVE-2024-42940](https://insights.sbomify.com/CVE-2024-42940/): Memory corruption in tenda:fh1201 firmware (medium 5.7)
- [CVE-2024-4294](https://insights.sbomify.com/CVE-2024-4294/): PHPGurukul Doctor Appointment Management System view-appointment-detail.php resource injection (medium 6.3)
- [CVE-2024-42939](https://insights.sbomify.com/CVE-2024-42939/): Cross-site scripting in yzncms:yzncms (medium 4.6)
- [CVE-2024-42936](https://insights.sbomify.com/CVE-2024-42936/): Code injection in ruijie:reyee os (critical 9.8)
- [CVE-2024-42934](https://insights.sbomify.com/CVE-2024-42934/): OpenIPMI before 2.0.36 has an out-of-bounds array access (for authentication type) in the ipmi_sim simulator, resulting in denial of service (medium 5.0)
- [CVE-2024-42930](https://insights.sbomify.com/CVE-2024-42930/): Open redirect in pbootcms:pbootcms (medium 6.1)
- [CVE-2024-4293](https://insights.sbomify.com/CVE-2024-4293/): PHPGurukul Doctor Appointment Management System appointment-bwdates-reports-details.php cross site scripting (low 3.5)
- [CVE-2024-42922](https://insights.sbomify.com/CVE-2024-42922/): Command injection in aapanel:aapanel (medium 6.5)
- [CVE-2024-4292](https://insights.sbomify.com/CVE-2024-4292/): Contemporary Controls BASrouter BACnet BASRT-B Device-Communication-Control Service denial of service (medium 6.5)
- [CVE-2024-42919](https://insights.sbomify.com/CVE-2024-42919/): Missing authorization in escanav:escan management console (critical 9.8)
- [CVE-2024-42918](https://insights.sbomify.com/CVE-2024-42918/): Cross-site scripting in adonesevangelista:online accreditation management system (medium 5.4)
- [CVE-2024-42915](https://insights.sbomify.com/CVE-2024-42915/): A host header injection vulnerability in Staff Appraisal System v1.0 allows attackers to obtain the password reset token via user interactio (high 8.0)
- [CVE-2024-42914](https://insights.sbomify.com/CVE-2024-42914/): Other in arrowjs:arrowcms (critical 9.1)
- [CVE-2024-42913](https://insights.sbomify.com/CVE-2024-42913/): SQL injection in ruoyi:ruoyi (medium 5.4)
- [CVE-2024-42912](https://insights.sbomify.com/CVE-2024-42912/): A cross-site scripting (XSS) vulnerability in META-INF Kft. (medium 5.4)
- [CVE-2024-42911](https://insights.sbomify.com/CVE-2024-42911/): ECOVACS Robotics Deebot T20 OMNI and T20e OMNI before 1.24.0 was discovered to contain a WiFi Remote Code Execution vulnerability. (high 7.4)
- [CVE-2024-4291](https://insights.sbomify.com/CVE-2024-4291/): Tenda A301 setBlackRule formAddMacfilterRule stack-based overflow (high 8.8)
- [CVE-2024-42906](https://insights.sbomify.com/CVE-2024-42906/): Cross-site scripting in testlink:testlink (medium 4.1)
- [CVE-2024-42905](https://insights.sbomify.com/CVE-2024-42905/): Beijing Digital China Cloud Technology Co., Ltd. (critical 9.8)
- [CVE-2024-42904](https://insights.sbomify.com/CVE-2024-42904/): Cross-site scripting in syspass:syspass (medium 6.1)
- [CVE-2024-42903](https://insights.sbomify.com/CVE-2024-42903/): Other in limesurvey:limesurvey (medium 6.5)
- [CVE-2024-42902](https://insights.sbomify.com/CVE-2024-42902/): Code injection in limesurvey:limesurvey (high 8.8)
- [CVE-2024-42901](https://insights.sbomify.com/CVE-2024-42901/): Code injection in limesurvey:limesurvey (medium 4.8)
- [CVE-2024-42900](https://insights.sbomify.com/CVE-2024-42900/): Cross-site scripting in ruoyi:ruoyi (medium 6.1)
- [CVE-2024-4290](https://insights.sbomify.com/CVE-2024-4290/): Sailthru Triggermail <= 1.1 - Admin+ Stored XSS (high 7.1)
- [CVE-2024-42898](https://insights.sbomify.com/CVE-2024-42898/): Cross-site scripting in nagios:nagios xi (medium 5.4)
- [CVE-2024-4289](https://insights.sbomify.com/CVE-2024-4289/): Sailthru Triggermail <= 1.1 - Reflected XSS (medium 6.1)
- [CVE-2024-42885](https://insights.sbomify.com/CVE-2024-42885/): SQL injection in esafenet:cdg (critical 9.1)
- [CVE-2024-4288](https://insights.sbomify.com/CVE-2024-4288/): Cross-site scripting in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin (medium 6.4)
- [CVE-2024-4287](https://insights.sbomify.com/CVE-2024-4287/): Improper Input Validation in mintplex-labs/anything-llm (high 8.1)
- [CVE-2024-42861](https://insights.sbomify.com/CVE-2024-42861/): Denial of service in linuxptp project:linuxptp (high 7.5)
- [CVE-2024-4286](https://insights.sbomify.com/CVE-2024-4286/): Improper Neutralization of Special Elements in mintplex-labs/anything-llm (medium 4.9)
- [CVE-2024-42852](https://insights.sbomify.com/CVE-2024-42852/): Cross Site Scripting vulnerability in AcuToWeb server v.10.5.0.7577C8b allows a remote attacker to execute arbitrary code via the index.php component. (medium 6.1)
- [CVE-2024-42851](https://insights.sbomify.com/CVE-2024-42851/): Memory corruption in aertherwide:exiftags (high 8.4)
- [CVE-2024-42850](https://insights.sbomify.com/CVE-2024-42850/): Silverpeas vulnerable to password complexity rule bypass (critical 9.8)
- [CVE-2024-42849](https://insights.sbomify.com/CVE-2024-42849/): Denial of service in silverpeas:silverpeas (medium 6.5)
- [CVE-2024-42845](https://insights.sbomify.com/CVE-2024-42845/): An eval Injection vulnerability in the component invesalius/reader/dicom.py of InVesalius 3.1.99991 through 3.1.99998 allows attackers to ex (high 8.0)
- [CVE-2024-42844](https://insights.sbomify.com/CVE-2024-42844/): A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232. (high 8.1)
- [CVE-2024-42843](https://insights.sbomify.com/CVE-2024-42843/): SQL injection in projectworlds:online examination system (critical 9.8)
- [CVE-2024-4284](https://insights.sbomify.com/CVE-2024-4284/): Denial of Service in mintplex-labs/anything-llm (medium 4.9)
- [CVE-2024-42835](https://insights.sbomify.com/CVE-2024-42835/): langflow has vulnerability in PythonCodeTool component (critical 9.8)
- [CVE-2024-42834](https://insights.sbomify.com/CVE-2024-42834/): A stored cross-site scripting (XSS) vulnerability in the Create Customer API in Incognito Service Activation Center (SAC) UI v14.11 allows a (medium 6.1)
- [CVE-2024-42831](https://insights.sbomify.com/CVE-2024-42831/): A reflected cross-site scripting (XSS) vulnerability in Elaine's Realtime CRM Automation v6.18.17 allows attackers to execute arbitrary Java (medium 6.1)
- [CVE-2024-4283](https://insights.sbomify.com/CVE-2024-4283/): URL Redirection to Untrusted Site ('Open Redirect') in GitLab (medium 6.4)
- [CVE-2024-4282](https://insights.sbomify.com/CVE-2024-4282/): Weak TLS Ciphers on Brocade SANnav OVA SSH port 22 (high 8.2)
- [CVE-2024-42818](https://insights.sbomify.com/CVE-2024-42818/): FastAPI Admin Cross-site Scripting vulnerability in the Config-Create function (medium 6.1)
- [CVE-2024-42816](https://insights.sbomify.com/CVE-2024-42816/): FastAPI Admin cross-site scripting (XSS) vulnerability in the Create Product function (medium 6.1)
- [CVE-2024-42815](https://insights.sbomify.com/CVE-2024-42815/): Memory corruption in tp-link:re365 firmware (critical 9.8)
- [CVE-2024-42813](https://insights.sbomify.com/CVE-2024-42813/): Memory corruption in trendnet:tew-752dru firmware (critical 9.8)
- [CVE-2024-42812](https://insights.sbomify.com/CVE-2024-42812/): Memory corruption in dlink:dir-860l firmware (critical 9.8)
- [CVE-2024-4281](https://insights.sbomify.com/CVE-2024-4281/): Link Library <= 7.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via link-library Shortcode (medium 6.4)
- [CVE-2024-4280](https://insights.sbomify.com/CVE-2024-4280/): White Label CMS <= 2.7.3 - Missing Authorization to Plugin Settings Reset (medium 5.3)
- [CVE-2024-42798](https://insights.sbomify.com/CVE-2024-42798/): Privilege escalation in lopalopa:music management system (high 7.6)
- [CVE-2024-42797](https://insights.sbomify.com/CVE-2024-42797/): Missing authorization in lopalopa:music management system (critical 9.8)
- [CVE-2024-42796](https://insights.sbomify.com/CVE-2024-42796/): Missing authorization in lopalopa:music management system (medium 5.9)
- [CVE-2024-42795](https://insights.sbomify.com/CVE-2024-42795/): Missing authorization in lopalopa:music management system (medium 4.2)
- [CVE-2024-42794](https://insights.sbomify.com/CVE-2024-42794/): Missing authorization in lopalopa:music management system (medium 4.7)
- [CVE-2024-42793](https://insights.sbomify.com/CVE-2024-42793/): Cross-site request forgery in lopalopa:music management system (medium 5.4)
- [CVE-2024-42792](https://insights.sbomify.com/CVE-2024-42792/): Cross-site request forgery in lopalopa:music management system (low 3.5)
- [CVE-2024-42791](https://insights.sbomify.com/CVE-2024-42791/): Cross-site request forgery in lopalopa:music management system (high 8.8)
- [CVE-2024-42790](https://insights.sbomify.com/CVE-2024-42790/): Cross-site scripting in lopalopa:music management system (medium 6.1)
- [CVE-2024-4279](https://insights.sbomify.com/CVE-2024-4279/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 6.5)
- [CVE-2024-42789](https://insights.sbomify.com/CVE-2024-42789/): Cross-site scripting in lopalopa:music management system (medium 6.3)
- [CVE-2024-42788](https://insights.sbomify.com/CVE-2024-42788/): Cross-site scripting in lopalopa:music management system (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/287/