# Vulnerabilities published in 2024


- [CVE-2024-41674](https://insights.sbomify.com/CVE-2024-41674/): CKAN may leak Solr credentials via error message in package_search action (medium 5.3)
- [CVE-2024-41673](https://insights.sbomify.com/CVE-2024-41673/): Decidim has a cross-site scripting vulnerability in the version control page (high 7.1)
- [CVE-2024-41672](https://insights.sbomify.com/CVE-2024-41672/): DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabled (high 7.5)
- [CVE-2024-41671](https://insights.sbomify.com/CVE-2024-41671/): twisted.web has disordered HTTP pipeline response (high 8.3)
- [CVE-2024-41670](https://insights.sbomify.com/CVE-2024-41670/): PayPal Official Module for PrestaShop has Improperly Implemented Security Check for Standard (high 7.5)
- [CVE-2024-4167](https://insights.sbomify.com/CVE-2024-4167/): Tenda 4G300 sub_422AA4 stack-based overflow (high 8.8)
- [CVE-2024-41668](https://insights.sbomify.com/CVE-2024-41668/): cBioPortal Proxy Endpoint Vulnerabliity (high 8.3)
- [CVE-2024-41667](https://insights.sbomify.com/CVE-2024-41667/): OpenAM FreeMarker template injection (high 8.8)
- [CVE-2024-41666](https://insights.sbomify.com/CVE-2024-41666/): The Argo CD web terminal session does not handle the revocation of user permissions properly. (medium 4.7)
- [CVE-2024-41665](https://insights.sbomify.com/CVE-2024-41665/): Ampache Stored Cross-site Scripting Vulnerability (medium 5.5)
- [CVE-2024-41664](https://insights.sbomify.com/CVE-2024-41664/): Blind SSRF via Canarytoken Webhook (medium 5.4)
- [CVE-2024-41663](https://insights.sbomify.com/CVE-2024-41663/): Canarytoken "Cloned Website" Vulnerable to Stored Cross-Site Scripting (low 3.5)
- [CVE-2024-41662](https://insights.sbomify.com/CVE-2024-41662/): VNote vulnerable to Markdown XSS, which leads to RCE (high 8.6)
- [CVE-2024-41660](https://insights.sbomify.com/CVE-2024-41660/): slpd-lite unauthenticated memory corruption (critical 9.8)
- [CVE-2024-4166](https://insights.sbomify.com/CVE-2024-4166/): Tenda 4G300 sub_41E858 stack-based overflow (high 8.8)
- [CVE-2024-41659](https://insights.sbomify.com/CVE-2024-41659/): GHSL-2024-034: memos CORS Misconfiguration in server.go (high 8.1)
- [CVE-2024-41658](https://insights.sbomify.com/CVE-2024-41658/): GHSL-2024-036: Reflected XSS in QrCodePage.js (medium 6.1)
- [CVE-2024-41657](https://insights.sbomify.com/CVE-2024-41657/): GHSL-2024-035: Casdoor CORS misconfiguration (high 8.1)
- [CVE-2024-41656](https://insights.sbomify.com/CVE-2024-41656/): Sentry vulnerable to stored Cross-Site Scripting (XSS) (high 7.1)
- [CVE-2024-41655](https://insights.sbomify.com/CVE-2024-41655/): TF2 Item Format Regular Expression Denial of Service vulnerability (high 7.5)
- [CVE-2024-41651](https://insights.sbomify.com/CVE-2024-41651/): Code injection in prestashop:prestashop (critical 9.8)
- [CVE-2024-41650](https://insights.sbomify.com/CVE-2024-41650/): Misconfiguration in openrobotics:robot operating system (high 7.1)
- [CVE-2024-4165](https://insights.sbomify.com/CVE-2024-4165/): Tenda G3 modifyDhcpRule stack-based overflow (high 8.8)
- [CVE-2024-41649](https://insights.sbomify.com/CVE-2024-41649/): Privilege escalation in openrobotics:robot operating system (critical 9.8)
- [CVE-2024-41648](https://insights.sbomify.com/CVE-2024-41648/): Misconfiguration in openrobotics:robot operating system (high 7.1)
- [CVE-2024-41647](https://insights.sbomify.com/CVE-2024-41647/): Misconfiguration in openrobotics:robot operating system (critical 9.8)
- [CVE-2024-41646](https://insights.sbomify.com/CVE-2024-41646/): Misconfiguration in openrobotics:robot operating system (critical 9.8)
- [CVE-2024-41645](https://insights.sbomify.com/CVE-2024-41645/): Misconfiguration in openrobotics:robot operating system (critical 9.8)
- [CVE-2024-41644](https://insights.sbomify.com/CVE-2024-41644/): Misconfiguration in openrobotics:robot operating system (critical 9.8)
- [CVE-2024-41643](https://insights.sbomify.com/CVE-2024-41643/): An issue in Arris NVG443B 9.3.0h3d36 allows a physically proximate attacker to execute arbitrary code via the cshell login component. (medium 6.8)
- [CVE-2024-41640](https://insights.sbomify.com/CVE-2024-41640/): Cross Site Scripting (XSS) vulnerability in AML Surety Eco up to 3.5 allows an attacker to run arbitrary code via crafted GET request using the id parameter. (medium 6.1)
- [CVE-2024-4164](https://insights.sbomify.com/CVE-2024-4164/): Tenda G3 ModifyPppAuthWhiteMac formModifyPppAuthWhiteMac stack-based overflow (high 8.8)
- [CVE-2024-41637](https://insights.sbomify.com/CVE-2024-41637/): RaspAP allows an attacker to escalate privileges (high 8.3)
- [CVE-2024-41631](https://insights.sbomify.com/CVE-2024-41631/): Buffer Overflow vulnerability in host-host NEUQ_board v.1.0 allows a remote attacker to cause a denial of service via the password.h component. (high 7.5)
- [CVE-2024-41630](https://insights.sbomify.com/CVE-2024-41630/): Memory corruption in tenda:ac18 firmware (high 7.6)
- [CVE-2024-4163](https://insights.sbomify.com/CVE-2024-4163/): Privilege Escalation on Skylab IIoT Gateway (IGX) (high 8.0)
- [CVE-2024-41629](https://insights.sbomify.com/CVE-2024-41629/): Information disclosure in ti:fusion digital power designer (medium 6.6)
- [CVE-2024-41628](https://insights.sbomify.com/CVE-2024-41628/): Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9 (high 7.5)
- [CVE-2024-41624](https://insights.sbomify.com/CVE-2024-41624/): Incorrect access control in Himalaya Xiaoya nano smart speaker rom_version 1.6.96 allows a remote attacker to have an unspecified impact. (medium 6.3)
- [CVE-2024-41623](https://insights.sbomify.com/CVE-2024-41623/): Code injection in d3dsecurity:d8801 firmware (critical 9.8)
- [CVE-2024-41622](https://insights.sbomify.com/CVE-2024-41622/): Command injection in dlink:dir-846w firmware (high 8.8)
- [CVE-2024-4162](https://insights.sbomify.com/CVE-2024-4162/): KW Watcher Vulnerability ALlows Malicious Read Access to Memory (medium 4.4)
- [CVE-2024-41618](https://insights.sbomify.com/CVE-2024-41618/): Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to SQL Injection in the `transaction_delete_group` function. (critical 9.8)
- [CVE-2024-41617](https://insights.sbomify.com/CVE-2024-41617/): Money Manager EX WebApp (web-money-manager-ex) 1.2.2 is vulnerable to Incorrect Access Control. (critical 9.8)
- [CVE-2024-41616](https://insights.sbomify.com/CVE-2024-41616/): Hardcoded credentials in dlink:dir-300 firmware (high 8.8)
- [CVE-2024-41614](https://insights.sbomify.com/CVE-2024-41614/): Cross-site scripting in symphony-cms:symphony cms (medium 4.8)
- [CVE-2024-41613](https://insights.sbomify.com/CVE-2024-41613/): Cross-site scripting in symphony-cms:symphony cms (medium 6.1)
- [CVE-2024-41611](https://insights.sbomify.com/CVE-2024-41611/): Hardcoded credentials in dlink:dir-860l firmware (critical 9.8)
- [CVE-2024-41610](https://insights.sbomify.com/CVE-2024-41610/): Hardcoded credentials in dlink:dir-820lw firmware (critical 9.8)
- [CVE-2024-4161](https://insights.sbomify.com/CVE-2024-4161/): Syslog traffic sent in clear-text (high 8.6)
- [CVE-2024-41605](https://insights.sbomify.com/CVE-2024-41605/): In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an update file with a Trojan (high 8.4)
- [CVE-2024-41603](https://insights.sbomify.com/CVE-2024-41603/): Cross-site request forgery in denkgroot:spina (critical 9.6)
- [CVE-2024-41602](https://insights.sbomify.com/CVE-2024-41602/): Cross-site request forgery in denkgroot:spina (high 8.8)
- [CVE-2024-41601](https://insights.sbomify.com/CVE-2024-41601/): Insecure Permissions vulnerability in lin-CMS v.0.2.0 and before allows a remote attacker to obtain sensitive information via the login meth (high 7.5)
- [CVE-2024-41600](https://insights.sbomify.com/CVE-2024-41600/): Missing authorization in talelin:lin-cms-spring-boot (high 7.5)
- [CVE-2024-4160](https://insights.sbomify.com/CVE-2024-4160/): Download Manager <= 3.2.90 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm-all-packages Shortcode (medium 6.4)
- [CVE-2024-41599](https://insights.sbomify.com/CVE-2024-41599/): Cross-site scripting in ruoyi:ruoyi (medium 6.1)
- [CVE-2024-41597](https://insights.sbomify.com/CVE-2024-41597/): ProcessWire Cross Site Request Forgery vulnerability (medium 4.2)
- [CVE-2024-41596](https://insights.sbomify.com/CVE-2024-41596/): Memory corruption in draytek:vigor1000b firmware (high 8.0)
- [CVE-2024-41595](https://insights.sbomify.com/CVE-2024-41595/): Memory corruption in draytek:vigor3910 firmware (high 8.0)
- [CVE-2024-41594](https://insights.sbomify.com/CVE-2024-41594/): Weak cryptography in draytek:vigor1000b firmware (high 7.5)
- [CVE-2024-41593](https://insights.sbomify.com/CVE-2024-41593/): Memory corruption in draytek:vigor1000b firmware (critical 9.8)
- [CVE-2024-41592](https://insights.sbomify.com/CVE-2024-41592/): Memory corruption in draytek:vigor1000b firmware (high 8.0)
- [CVE-2024-41591](https://insights.sbomify.com/CVE-2024-41591/): Cross-site scripting in draytek:vigor1000b firmware (medium 6.1)
- [CVE-2024-41590](https://insights.sbomify.com/CVE-2024-41590/): Memory corruption in draytek:vigor1000b firmware (high 8.0)
- [CVE-2024-4159](https://insights.sbomify.com/CVE-2024-4159/): Protection mechanisms (medium 4.3)
- [CVE-2024-41589](https://insights.sbomify.com/CVE-2024-41589/): Weak cryptography in draytek:vigor3910 firmware (high 8.8)
- [CVE-2024-41588](https://insights.sbomify.com/CVE-2024-41588/): Memory corruption in draytek:vigor1000b firmware (high 8.0)
- [CVE-2024-41587](https://insights.sbomify.com/CVE-2024-41587/): Cross-site scripting in draytek:vigor1000b firmware (medium 5.4)
- [CVE-2024-41586](https://insights.sbomify.com/CVE-2024-41586/): Memory corruption in draytek:vigor3910 firmware (high 8.0)
- [CVE-2024-41585](https://insights.sbomify.com/CVE-2024-41585/): Command injection in draytek:vigor3910 firmware (medium 6.8)
- [CVE-2024-41584](https://insights.sbomify.com/CVE-2024-41584/): Cross-site scripting in draytek:vigor3910 firmware (medium 4.7)
- [CVE-2024-41583](https://insights.sbomify.com/CVE-2024-41583/): Cross-site scripting in draytek:vigor3910 firmware (medium 4.7)
- [CVE-2024-4158](https://insights.sbomify.com/CVE-2024-4158/): Blocksy <= 2.0.42 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-41579](https://insights.sbomify.com/CVE-2024-41579/): DTStack Taier 1.4.0 allows remote attackers to specify the jobName parameter in the console listNames function to cause a SQL injection vuln (critical 9.8)
- [CVE-2024-41577](https://insights.sbomify.com/CVE-2024-41577/): An arbitrary file upload vulnerability in the Ueditor component of productinfoquick v1.0 allows attackers to execute arbitrary code via uplo (critical 9.8)
- [CVE-2024-41572](https://insights.sbomify.com/CVE-2024-41572/): Cross-site scripting in lang-learn-guy:learning with texts (medium 6.1)
- [CVE-2024-41570](https://insights.sbomify.com/CVE-2024-41570/): Server-side request forgery in havocframework:havoc (critical 9.8)
- [CVE-2024-4157](https://insights.sbomify.com/CVE-2024-4157/): Deserialization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (high 7.5)
- [CVE-2024-41565](https://insights.sbomify.com/CVE-2024-41565/): Business logic in mezz:justenoughitems (medium 4.3)
- [CVE-2024-41564](https://insights.sbomify.com/CVE-2024-41564/): Business logic in emilyploszaj:emi (medium 4.3)
- [CVE-2024-4156](https://insights.sbomify.com/CVE-2024-4156/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-41551](https://insights.sbomify.com/CVE-2024-41551/): SQL injection in campcodes:supplier management system (high 7.3)
- [CVE-2024-41550](https://insights.sbomify.com/CVE-2024-41550/): SQL injection in campcodes:supplier management system (high 7.2)
- [CVE-2024-4154](https://insights.sbomify.com/CVE-2024-4154/): Incorrect Synchronization in lunary-ai/lunary (high 7.1)
- [CVE-2024-41519](https://insights.sbomify.com/CVE-2024-41519/): Cross-site scripting in mecodia:feripro (medium 5.4)
- [CVE-2024-41518](https://insights.sbomify.com/CVE-2024-41518/): Missing authorization in mecodia:feripro (high 7.5)
- [CVE-2024-41517](https://insights.sbomify.com/CVE-2024-41517/): Missing authorization in mecodia:feripro (medium 5.3)
- [CVE-2024-41516](https://insights.sbomify.com/CVE-2024-41516/): Cross-site scripting in 4pace:cadclick (medium 5.4)
- [CVE-2024-41515](https://insights.sbomify.com/CVE-2024-41515/): Cross-site scripting in 4pace:cadclick (medium 5.4)
- [CVE-2024-41514](https://insights.sbomify.com/CVE-2024-41514/): Cross-site scripting in 4pace:cadclick (medium 5.4)
- [CVE-2024-41513](https://insights.sbomify.com/CVE-2024-41513/): Cross-site scripting in 4pace:cadclick (medium 5.4)
- [CVE-2024-41512](https://insights.sbomify.com/CVE-2024-41512/): SQL injection in 4pace:cadclick (high 8.8)
- [CVE-2024-41511](https://insights.sbomify.com/CVE-2024-41511/): Path traversal in 4pace:cadclick (low 3.9)
- [CVE-2024-4151](https://insights.sbomify.com/CVE-2024-4151/): Improper Access Control in lunary-ai/lunary (high 8.3)
- [CVE-2024-41505](https://insights.sbomify.com/CVE-2024-41505/): Cross-site scripting in jetimob:imobiliaria (medium 6.1)
- [CVE-2024-41504](https://insights.sbomify.com/CVE-2024-41504/): Cross-site scripting in jetimob:imobiliaria (medium 6.1)
- [CVE-2024-41503](https://insights.sbomify.com/CVE-2024-41503/): Cross-site scripting in jetimob:imobiliaria (medium 6.1)
- [CVE-2024-41502](https://insights.sbomify.com/CVE-2024-41502/): Cross-site scripting in jetimob:imobiliaria (medium 6.1)
- [CVE-2024-4150](https://insights.sbomify.com/CVE-2024-4150/): Simple Basic Contact Form <= 20221201 - Reflected Cross-Site Scripting (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/298/