# Vulnerabilities published in 2024 - [CVE-2024-41492](https://insights.sbomify.com/CVE-2024-41492/): Memory corruption in tenda:ax1806 firmware (high 7.5) - [CVE-2024-4149](https://insights.sbomify.com/CVE-2024-4149/): Floating Chat Widget < 3.2.3 - Admin+ Stored XSS (medium 6.1) - [CVE-2024-41482](https://insights.sbomify.com/CVE-2024-41482/): Cross-site scripting in typora:typora (medium 6.1) - [CVE-2024-41481](https://insights.sbomify.com/CVE-2024-41481/): Cross-site scripting in typora:typora (medium 6.1) - [CVE-2024-4148](https://insights.sbomify.com/CVE-2024-4148/): Redos (Regular Expression Denial of Service) in lunary-ai/lunary (high 7.5) - [CVE-2024-41476](https://insights.sbomify.com/CVE-2024-41476/): SQL injection in amttgroup:hibos (critical 9.8) - [CVE-2024-41475](https://insights.sbomify.com/CVE-2024-41475/): Misconfiguration in sir:gnuboard (critical 9.8) - [CVE-2024-41473](https://insights.sbomify.com/CVE-2024-41473/): Command injection in tendacn:fh1201 firmware (high 8.0) - [CVE-2024-4147](https://insights.sbomify.com/CVE-2024-4147/): Insufficient Access Control in lunary-ai/lunary (high 7.5) - [CVE-2024-41468](https://insights.sbomify.com/CVE-2024-41468/): Command injection in tendacn:fh1201 firmware (critical 9.8) - [CVE-2024-41466](https://insights.sbomify.com/CVE-2024-41466/): Memory corruption in tendacn:fh1201 firmware (high 7.5) - [CVE-2024-41465](https://insights.sbomify.com/CVE-2024-41465/): Memory corruption in tendacn:fh1201 firmware (high 7.5) - [CVE-2024-41464](https://insights.sbomify.com/CVE-2024-41464/): Memory corruption in tendacn:fh1201 firmware (critical 9.8) - [CVE-2024-41463](https://insights.sbomify.com/CVE-2024-41463/): Memory corruption in tendacn:fh1201 firmware (medium 4.3) - [CVE-2024-41462](https://insights.sbomify.com/CVE-2024-41462/): Memory corruption in tendacn:fh1201 firmware (medium 4.3) - [CVE-2024-41461](https://insights.sbomify.com/CVE-2024-41461/): Memory corruption in tendacn:fh1201 firmware (critical 9.8) - [CVE-2024-41460](https://insights.sbomify.com/CVE-2024-41460/): Memory corruption in tendacn:fh1201 firmware (medium 6.5) - [CVE-2024-4146](https://insights.sbomify.com/CVE-2024-4146/): Incorrect Authorization in lunary-ai/lunary (critical 9.8) - [CVE-2024-41459](https://insights.sbomify.com/CVE-2024-41459/): Memory corruption in tendacn:fh1201 firmware (high 8.8) - [CVE-2024-41454](https://insights.sbomify.com/CVE-2024-41454/): An arbitrary file upload vulnerability in the UI login page logo upload function of Process Maker pm4core-docker 4.1.21-RC7 allows attackers (medium 6.5) - [CVE-2024-41453](https://insights.sbomify.com/CVE-2024-41453/): A cross-site scripting (XSS) vulnerability in Process Maker pm4core-docker 4.1.21-RC7 allows attackers to execute arbitrary web scripts or H (medium 4.8) - [CVE-2024-4145](https://insights.sbomify.com/CVE-2024-4145/): Search & Replace < 3.2.2 - Admin+ SQL injection (low 3.8) - [CVE-2024-41447](https://insights.sbomify.com/CVE-2024-41447/): Alkacon OpenCMS stored cross-site scripting (XSS) vulnerability (medium 5.4) - [CVE-2024-41446](https://insights.sbomify.com/CVE-2024-41446/): OpenCMS cross-site scripting (XSS) vulnerability (medium 5.4) - [CVE-2024-41445](https://insights.sbomify.com/CVE-2024-41445/): Memory corruption in ihedvall:mdf library (medium 6.5) - [CVE-2024-41444](https://insights.sbomify.com/CVE-2024-41444/): SQL injection in seacms:seacms (critical 9.8) - [CVE-2024-41443](https://insights.sbomify.com/CVE-2024-41443/): Memory corruption in dbohdan:hicolor (medium 5.5) - [CVE-2024-41440](https://insights.sbomify.com/CVE-2024-41440/): Memory corruption in dbohdan:hicolor (medium 6.2) - [CVE-2024-4144](https://insights.sbomify.com/CVE-2024-4144/): Simple Basic Contact Form <= 20240502 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5) - [CVE-2024-41439](https://insights.sbomify.com/CVE-2024-41439/): Memory corruption in dbohdan:hicolor (medium 5.5) - [CVE-2024-41438](https://insights.sbomify.com/CVE-2024-41438/): Memory corruption in dbohdan:hicolor (medium 6.2) - [CVE-2024-41437](https://insights.sbomify.com/CVE-2024-41437/): Memory corruption in dbohdan:hicolor (medium 5.5) - [CVE-2024-41436](https://insights.sbomify.com/CVE-2024-41436/): Memory corruption in clickhouse:clickhouse (high 7.5) - [CVE-2024-41435](https://insights.sbomify.com/CVE-2024-41435/): Memory corruption in yugabyte:yugabytedb (high 7.5) - [CVE-2024-41434](https://insights.sbomify.com/CVE-2024-41434/): Denial of service in pingcap:tidb (medium 4.3) - [CVE-2024-41433](https://insights.sbomify.com/CVE-2024-41433/): Memory corruption in pingcap:tidb (critical 9.8) - [CVE-2024-41432](https://insights.sbomify.com/CVE-2024-41432/): Auth bypass in likeshop:likeshop (medium 5.3) - [CVE-2024-4143](https://insights.sbomify.com/CVE-2024-4143/): Certain HP PC products using AMI BIOS – Buffer Overflow (critical 9.8) - [CVE-2024-4142](https://insights.sbomify.com/CVE-2024-4142/): JFrog Artifactory Improper input validation within token creation flow (critical 9.0) - [CVE-2024-4141](https://insights.sbomify.com/CVE-2024-4141/): Out-of-bounds array write in Xpdf 4.05 due to incorrect bounds check (low 2.9) - [CVE-2024-4140](https://insights.sbomify.com/CVE-2024-4140/): Denial of service in Email-MIME (high 7.5) - [CVE-2024-4139](https://insights.sbomify.com/CVE-2024-4139/): Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) (medium 4.3) - [CVE-2024-41381](https://insights.sbomify.com/CVE-2024-41381/): Microweber Cross Site Scripting (XSS) vulnerability (medium 6.1) - [CVE-2024-41380](https://insights.sbomify.com/CVE-2024-41380/): Microweber Cross Site Scripting (XSS) vulnerability (medium 6.1) - [CVE-2024-4138](https://insights.sbomify.com/CVE-2024-4138/): Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) (medium 4.3) - [CVE-2024-41376](https://insights.sbomify.com/CVE-2024-41376/): Path traversal in dzzoffice:dzzoffice (high 8.8) - [CVE-2024-41375](https://insights.sbomify.com/CVE-2024-41375/): ICEcoder vulnerable to Cross Site Scripting (medium 6.1) - [CVE-2024-41374](https://insights.sbomify.com/CVE-2024-41374/): ICEcoder vulnerable to Cross Site Scripting (medium 6.1) - [CVE-2024-41373](https://insights.sbomify.com/CVE-2024-41373/): ICEcoder Path Traversal vulnerability (medium 6.3) - [CVE-2024-41372](https://insights.sbomify.com/CVE-2024-41372/): SQL injection in organizr:organizr (critical 9.8) - [CVE-2024-41371](https://insights.sbomify.com/CVE-2024-41371/): Cross-site scripting in organizr:organizr (medium 6.1) - [CVE-2024-41370](https://insights.sbomify.com/CVE-2024-41370/): SQL injection in organizr:organizr (critical 9.8) - [CVE-2024-41369](https://insights.sbomify.com/CVE-2024-41369/): Code injection in sourcefabric:phoniebox (critical 9.8) - [CVE-2024-41368](https://insights.sbomify.com/CVE-2024-41368/): Code injection in sourcefabric:phoniebox (critical 9.8) - [CVE-2024-41367](https://insights.sbomify.com/CVE-2024-41367/): Code injection in sourcefabric:phoniebox (critical 9.8) - [CVE-2024-41366](https://insights.sbomify.com/CVE-2024-41366/): Code injection in sourcefabric:phoniebox (critical 9.8) - [CVE-2024-41364](https://insights.sbomify.com/CVE-2024-41364/): Code injection in sourcefabric:phoniebox (critical 9.8) - [CVE-2024-41361](https://insights.sbomify.com/CVE-2024-41361/): Code injection in sourcefabric:phoniebox (critical 9.8) - [CVE-2024-41358](https://insights.sbomify.com/CVE-2024-41358/): Cross-site scripting in phpipam:phpipam (medium 6.1) - [CVE-2024-41357](https://insights.sbomify.com/CVE-2024-41357/): Cross-site scripting in phpipam:phpipam (high 7.1) - [CVE-2024-41356](https://insights.sbomify.com/CVE-2024-41356/): Cross-site scripting in phpipam:phpipam (medium 4.7) - [CVE-2024-41355](https://insights.sbomify.com/CVE-2024-41355/): Cross-site scripting in phpipam:phpipam (medium 6.5) - [CVE-2024-41354](https://insights.sbomify.com/CVE-2024-41354/): Cross-site scripting in phpipam:phpipam (high 7.1) - [CVE-2024-41353](https://insights.sbomify.com/CVE-2024-41353/): Cross-site scripting in phpipam:phpipam (high 7.1) - [CVE-2024-41351](https://insights.sbomify.com/CVE-2024-41351/): Cross-site scripting in baijunyao:bjyadmin (medium 6.1) - [CVE-2024-41350](https://insights.sbomify.com/CVE-2024-41350/): Cross-site scripting in baijunyao:bjyadmin (medium 6.1) - [CVE-2024-4135](https://insights.sbomify.com/CVE-2024-4135/): WP Latest Posts <= 5.0.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (medium 5.4) - [CVE-2024-41349](https://insights.sbomify.com/CVE-2024-41349/): Cross-site scripting in unmark:unmark (medium 6.1) - [CVE-2024-41348](https://insights.sbomify.com/CVE-2024-41348/): Cross-site scripting in jpatokal:openflights (medium 6.1) - [CVE-2024-41347](https://insights.sbomify.com/CVE-2024-41347/): Cross-site scripting in jpatokal:openflights (medium 6.1) - [CVE-2024-41346](https://insights.sbomify.com/CVE-2024-41346/): Cross-site scripting in jpatokal:openflights (medium 6.1) - [CVE-2024-41345](https://insights.sbomify.com/CVE-2024-41345/): Cross-site scripting in jpatokal:openflights (medium 6.1) - [CVE-2024-41344](https://insights.sbomify.com/CVE-2024-41344/): Cross-site request forgery in codeigniter:codeigniter (high 7.5) - [CVE-2024-41340](https://insights.sbomify.com/CVE-2024-41340/): File upload in draytek:vigor165 firmware (high 8.4) - [CVE-2024-41339](https://insights.sbomify.com/CVE-2024-41339/): File upload in draytek:vigor165 firmware (high 8.8) - [CVE-2024-41338](https://insights.sbomify.com/CVE-2024-41338/): Null dereference in draytek:vigor165 firmware (high 7.5) - [CVE-2024-41336](https://insights.sbomify.com/CVE-2024-41336/): Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior (high 7.5) - [CVE-2024-41335](https://insights.sbomify.com/CVE-2024-41335/): Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior (high 7.5) - [CVE-2024-41334](https://insights.sbomify.com/CVE-2024-41334/): Security feature bypass in draytek:vigor165 firmware (high 8.8) - [CVE-2024-41333](https://insights.sbomify.com/CVE-2024-41333/): Cross-site scripting in phpgurukul:tourism management system (medium 6.1) - [CVE-2024-41332](https://insights.sbomify.com/CVE-2024-41332/): Missing authorization in oretnom23:computer laboratory management system (medium 6.5) - [CVE-2024-4133](https://insights.sbomify.com/CVE-2024-4133/): ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.30 - Open Redirect (medium 6.1) - [CVE-2024-41320](https://insights.sbomify.com/CVE-2024-41320/): Command injection in totolink:a6000r firmware (high 8.8) - [CVE-2024-4132](https://insights.sbomify.com/CVE-2024-4132/): Privilege escalation in Lock Screen (high 7.8) - [CVE-2024-41319](https://insights.sbomify.com/CVE-2024-41319/): Command injection in totolink:a6000r firmware (high 8.8) - [CVE-2024-41318](https://insights.sbomify.com/CVE-2024-41318/): Command injection in totolink:a6000r firmware (critical 9.8) - [CVE-2024-41317](https://insights.sbomify.com/CVE-2024-41317/): Command injection in totolink:a6000r firmware (high 8.0) - [CVE-2024-41316](https://insights.sbomify.com/CVE-2024-41316/): Command injection in totolink:a6000r firmware (critical 9.8) - [CVE-2024-41315](https://insights.sbomify.com/CVE-2024-41315/): Command injection in totolink:a6000r firmware (medium 6.8) - [CVE-2024-41314](https://insights.sbomify.com/CVE-2024-41314/): Command injection in totolink:a6000r firmware (medium 6.8) - [CVE-2024-41311](https://insights.sbomify.com/CVE-2024-41311/): Memory corruption in debian:debian linux (high 8.1) - [CVE-2024-41310](https://insights.sbomify.com/CVE-2024-41310/): Path traversal in yanzhenjie:andserver (high 7.5) - [CVE-2024-4131](https://insights.sbomify.com/CVE-2024-4131/): Privilege escalation in Emulator (high 7.8) - [CVE-2024-41309](https://insights.sbomify.com/CVE-2024-41309/): Privilege escalation in enjayworld:enjay crm (high 8.4) - [CVE-2024-41308](https://insights.sbomify.com/CVE-2024-41308/): Privilege escalation in enjayworld:enjay crm (high 8.4) - [CVE-2024-41305](https://insights.sbomify.com/CVE-2024-41305/): Server-side request forgery in wondercms:wondercms (high 7.1) - [CVE-2024-41304](https://insights.sbomify.com/CVE-2024-41304/): File upload in wondercms:wondercms (medium 5.4) - [CVE-2024-4130](https://insights.sbomify.com/CVE-2024-4130/): Privilege escalation in App Store (high 7.8) - [CVE-2024-41290](https://insights.sbomify.com/CVE-2024-41290/): Weak cryptography in flatpress:flatpress (high 8.1) - [CVE-2024-4129](https://insights.sbomify.com/CVE-2024-4129/): Authentication bypass in Snow License Manager (high 8.8) --- From sbomify Insights: https://insights.sbomify.com/years/2024/page/299/