# Vulnerabilities published in 2024


- [CVE-2024-35397](https://insights.sbomify.com/CVE-2024-35397/): Command injection in totolink:cp900l firmware (high 8.8)
- [CVE-2024-35396](https://insights.sbomify.com/CVE-2024-35396/): Hardcoded credentials in totolink:cp900l firmware (critical 9.8)
- [CVE-2024-35395](https://insights.sbomify.com/CVE-2024-35395/): Hardcoded credentials in totolink:cp900l firmware (high 8.8)
- [CVE-2024-3539](https://insights.sbomify.com/CVE-2024-3539/): Campcodes Church Management System addgiving.php sql injection (medium 6.3)
- [CVE-2024-35388](https://insights.sbomify.com/CVE-2024-35388/): Memory corruption in totolink:nr1800x firmware (high 8.8)
- [CVE-2024-35387](https://insights.sbomify.com/CVE-2024-35387/): Memory corruption in totolink:lr350 firmware (critical 9.8)
- [CVE-2024-35386](https://insights.sbomify.com/CVE-2024-35386/): Denial of service in cesanta:mjs (high 7.5)
- [CVE-2024-35385](https://insights.sbomify.com/CVE-2024-35385/): Memory corruption in cesanta:mjs (medium 4.3)
- [CVE-2024-35384](https://insights.sbomify.com/CVE-2024-35384/): Denial of service in cesanta:mjs (medium 5.5)
- [CVE-2024-3538](https://insights.sbomify.com/CVE-2024-3538/): Campcodes Church Management System addTithes.php sql injection (medium 6.3)
- [CVE-2024-35375](https://insights.sbomify.com/CVE-2024-35375/): File upload in dedecms:dedecms (critical 9.8)
- [CVE-2024-35374](https://insights.sbomify.com/CVE-2024-35374/): Mocodo vulnerable to SQL injection in `/web/generate.php` (critical 9.8)
- [CVE-2024-35373](https://insights.sbomify.com/CVE-2024-35373/): Code injection in mocodo:mocodo online (critical 9.8)
- [CVE-2024-35371](https://insights.sbomify.com/CVE-2024-35371/): Ant-Media-Server vulnerable to Improper Output Neutralization for Logs (high 7.5)
- [CVE-2024-3537](https://insights.sbomify.com/CVE-2024-3537/): Campcodes Church Management System admin_user.php sql injection (medium 6.3)
- [CVE-2024-35369](https://insights.sbomify.com/CVE-2024-35369/): Integer overflow in ffmpeg:ffmpeg (medium 5.5)
- [CVE-2024-35368](https://insights.sbomify.com/CVE-2024-35368/): Memory corruption in ffmpeg:ffmpeg (critical 9.8)
- [CVE-2024-35367](https://insights.sbomify.com/CVE-2024-35367/): Memory corruption in ffmpeg:ffmpeg (critical 9.1)
- [CVE-2024-35366](https://insights.sbomify.com/CVE-2024-35366/): Integer overflow in ffmpeg:ffmpeg (critical 9.1)
- [CVE-2024-35365](https://insights.sbomify.com/CVE-2024-35365/): Memory corruption in ffmpeg:ffmpeg (high 8.8)
- [CVE-2024-35362](https://insights.sbomify.com/CVE-2024-35362/): Cross-site scripting in shopex:ecshop (medium 5.4)
- [CVE-2024-35361](https://insights.sbomify.com/CVE-2024-35361/): MTab Bookmark v1.9.5 has an SQL injection vulnerability in /LinkStore/getIcon. (critical 9.8)
- [CVE-2024-3536](https://insights.sbomify.com/CVE-2024-3536/): Campcodes Church Management System delete_log.php sql injection (medium 6.3)
- [CVE-2024-35359](https://insights.sbomify.com/CVE-2024-35359/): SQL injection in dino physics school assistant project:dino physics school assistant (medium 5.4)
- [CVE-2024-35358](https://insights.sbomify.com/CVE-2024-35358/): SQL injection in dino physics school assistant project:dino physics school assistant (medium 6.5)
- [CVE-2024-35357](https://insights.sbomify.com/CVE-2024-35357/): SQL injection in dino physics school assistant project:dino physics school assistant (medium 5.3)
- [CVE-2024-35356](https://insights.sbomify.com/CVE-2024-35356/): SQL injection in dino physics school assistant project:dino physics school assistant (medium 6.3)
- [CVE-2024-35355](https://insights.sbomify.com/CVE-2024-35355/): SQL injection in dino physics school assistant project:dino physics school assistant (critical 9.8)
- [CVE-2024-35354](https://insights.sbomify.com/CVE-2024-35354/): SQL injection in dino physics school assistant project:dino physics school assistant (critical 9.8)
- [CVE-2024-35353](https://insights.sbomify.com/CVE-2024-35353/): Missing authorization in dino physics school assistant project:dino physics school assistant (critical 9.8)
- [CVE-2024-35352](https://insights.sbomify.com/CVE-2024-35352/): Cross-site scripting in dino physics school assistant project:dino physics school assistant (medium 6.1)
- [CVE-2024-35351](https://insights.sbomify.com/CVE-2024-35351/): Cross-site scripting in dino physics school assistant project:dino physics school assistant (medium 5.4)
- [CVE-2024-35350](https://insights.sbomify.com/CVE-2024-35350/): SQL injection in dino physics school assistant project:dino physics school assistant (critical 9.8)
- [CVE-2024-3535](https://insights.sbomify.com/CVE-2024-3535/): Campcodes Church Management System index.php sql injection (high 7.3)
- [CVE-2024-35349](https://insights.sbomify.com/CVE-2024-35349/): SQL injection in dino physics school assistant project:dino physics school assistant (critical 9.8)
- [CVE-2024-35345](https://insights.sbomify.com/CVE-2024-35345/): Cross-site scripting in dino physics school assistant project:dino physics school assistant (medium 5.4)
- [CVE-2024-35344](https://insights.sbomify.com/CVE-2024-35344/): Certain Anpviz products contain a hardcoded cryptographic key stored in the firmware of the device. (critical 9.9)
- [CVE-2024-35343](https://insights.sbomify.com/CVE-2024-35343/): Certain Anpviz products allow unauthenticated users to download arbitrary files from the device's filesystem via a HTTP GET request to the /playback/ URI. (critical 9.8)
- [CVE-2024-35342](https://insights.sbomify.com/CVE-2024-35342/): Certain Anpviz products allow unauthenticated users to modify or disable camera related settings such as microphone volume, speaker volume, (medium 4.6)
- [CVE-2024-35341](https://insights.sbomify.com/CVE-2024-35341/): Certain Anpviz products allow unauthenticated users to download the running configuration of the device via a HTTP GET request to /ConfigFil (high 7.5)
- [CVE-2024-35340](https://insights.sbomify.com/CVE-2024-35340/): Command injection in tenda:fh1206 firmware (high 8.6)
- [CVE-2024-3534](https://insights.sbomify.com/CVE-2024-3534/): Campcodes Church Management System login.php sql injection (high 7.3)
- [CVE-2024-35339](https://insights.sbomify.com/CVE-2024-35339/): Command injection in tenda:fh1206 firmware (critical 9.8)
- [CVE-2024-35338](https://insights.sbomify.com/CVE-2024-35338/): Hardcoded credentials in tendacn:i29 firmware (critical 9.8)
- [CVE-2024-35333](https://insights.sbomify.com/CVE-2024-35333/): A stack-buffer-overflow vulnerability exists in the read_charset_decl function of html2xhtml 1.3. (high 8.4)
- [CVE-2024-3533](https://insights.sbomify.com/CVE-2024-3533/): Campcodes Complete Online Student Management System academic_year_view.php cross site scripting (low 3.5)
- [CVE-2024-35324](https://insights.sbomify.com/CVE-2024-35324/): File upload in douchat:douchat (critical 9.8)
- [CVE-2024-35322](https://insights.sbomify.com/CVE-2024-35322/): Cross-site scripting in airc:mynet (medium 6.1)
- [CVE-2024-35321](https://insights.sbomify.com/CVE-2024-35321/): Cross-site scripting in airc:mynet (medium 4.3)
- [CVE-2024-3532](https://insights.sbomify.com/CVE-2024-3532/): Campcodes Complete Online Student Management System attendance_view.php cross site scripting (low 3.5)
- [CVE-2024-35315](https://insights.sbomify.com/CVE-2024-35315/): Privilege escalation in mitel:micollab (medium 5.6)
- [CVE-2024-35314](https://insights.sbomify.com/CVE-2024-35314/): Command injection in mitel:micollab (critical 9.8)
- [CVE-2024-35313](https://insights.sbomify.com/CVE-2024-35313/): In Tor Arti before 1.2.3, circuits sometimes incorrectly have a length of 3 (with full vanguards), aka TROVE-2024-004. (high 7.3)
- [CVE-2024-35312](https://insights.sbomify.com/CVE-2024-35312/): In Tor Arti before 1.2.3, STUB circuits incorrectly have a length of 2 (with lite vanguards), aka TROVE-2024-003. (medium 6.2)
- [CVE-2024-35311](https://insights.sbomify.com/CVE-2024-35311/): Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 hav (low 3.3)
- [CVE-2024-3531](https://insights.sbomify.com/CVE-2024-3531/): Campcodes Complete Online Student Management System courses_view.php cross site scripting (low 3.5)
- [CVE-2024-35308](https://insights.sbomify.com/CVE-2024-35308/): Post-auth Arbitrary File Read in the Server Plugins Section (high 8.3)
- [CVE-2024-35307](https://insights.sbomify.com/CVE-2024-35307/): Argument Injection Leading to Remote Code Execution in Realtime Graph Extension (critical 9.4)
- [CVE-2024-35306](https://insights.sbomify.com/CVE-2024-35306/): OS Command injection in Ajax PHP files through HTTP Request (high 8.7)
- [CVE-2024-35305](https://insights.sbomify.com/CVE-2024-35305/): Unauth Time-Based SQL Injection via API (high 8.9)
- [CVE-2024-35304](https://insights.sbomify.com/CVE-2024-35304/): System command injection through Netflow function (critical 9.3)
- [CVE-2024-35303](https://insights.sbomify.com/CVE-2024-35303/): Memory corruption in Tecnomatix Plant Simulation V2302 (high 7.3)
- [CVE-2024-35302](https://insights.sbomify.com/CVE-2024-35302/): Cross-site scripting in TeamCity (medium 5.4)
- [CVE-2024-35301](https://insights.sbomify.com/CVE-2024-35301/): Missing authorization in TeamCity (medium 5.5)
- [CVE-2024-35300](https://insights.sbomify.com/CVE-2024-35300/): Cross-site scripting in TeamCity (low 3.5)
- [CVE-2024-3530](https://insights.sbomify.com/CVE-2024-3530/): Campcodes Complete Online Student Management System Marks_view.php cross site scripting (low 3.5)
- [CVE-2024-35299](https://insights.sbomify.com/CVE-2024-35299/): Security feature bypass in YouTrack (medium 5.9)
- [CVE-2024-35298](https://insights.sbomify.com/CVE-2024-35298/): Open redirect in 'ZOZOTOWN' App for Android (medium 4.3)
- [CVE-2024-35297](https://insights.sbomify.com/CVE-2024-35297/): Cross-site scripting in WP Booking (medium 4.7)
- [CVE-2024-35296](https://insights.sbomify.com/CVE-2024-35296/): Apache Traffic Server: Invalid Accept-Encoding can force forwarding requests (high 8.2)
- [CVE-2024-35295](https://insights.sbomify.com/CVE-2024-35295/): Missing authorization in Perfect Harmony GH180 (medium 5.2)
- [CVE-2024-35294](https://insights.sbomify.com/CVE-2024-35294/): Schneider Elektronik Series 700 prone to missing authentication for traffic capture function (medium 6.5)
- [CVE-2024-35293](https://insights.sbomify.com/CVE-2024-35293/): Schneider Elektronik Series 700 prone to missing authentication for critical reset function (critical 9.1)
- [CVE-2024-35292](https://insights.sbomify.com/CVE-2024-35292/): Weak cryptography in SIMATIC S7-200 SMART CPU CR40 (high 8.8)
- [CVE-2024-35291](https://insights.sbomify.com/CVE-2024-35291/): Cross-site scripting in Splunk Config Explorer (medium 6.1)
- [CVE-2024-3529](https://insights.sbomify.com/CVE-2024-3529/): Campcodes Complete Online Student Management System students_view.php cross site scripting (low 3.5)
- [CVE-2024-35288](https://insights.sbomify.com/CVE-2024-35288/): Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occu (high 7.8)
- [CVE-2024-35287](https://insights.sbomify.com/CVE-2024-35287/): Privilege escalation in mitel:micollab (medium 6.7)
- [CVE-2024-35286](https://insights.sbomify.com/CVE-2024-35286/): SQL injection in mitel:micollab (critical 9.8)
- [CVE-2024-35285](https://insights.sbomify.com/CVE-2024-35285/): Command injection in mitel:micollab (critical 9.8)
- [CVE-2024-35284](https://insights.sbomify.com/CVE-2024-35284/): Cross-site scripting in mitel:micontact center business (medium 5.4)
- [CVE-2024-35283](https://insights.sbomify.com/CVE-2024-35283/): Cross-site scripting in mitel:micontact center business (medium 6.1)
- [CVE-2024-35282](https://insights.sbomify.com/CVE-2024-35282/): Information disclosure in FortiClientiOS (low 3.9)
- [CVE-2024-35281](https://insights.sbomify.com/CVE-2024-35281/): Code injection in FortiClientMac (low 2.3)
- [CVE-2024-35280](https://insights.sbomify.com/CVE-2024-35280/): Cross-site scripting in FortiDeceptor (medium 5.1)
- [CVE-2024-3528](https://insights.sbomify.com/CVE-2024-3528/): Campcodes Complete Online Student Management System units_view.php cross site scripting (low 3.5)
- [CVE-2024-35279](https://insights.sbomify.com/CVE-2024-35279/): Memory corruption in FortiOS (high 7.7)
- [CVE-2024-35278](https://insights.sbomify.com/CVE-2024-35278/): SQL injection in FortiPortal (medium 4.1)
- [CVE-2024-35277](https://insights.sbomify.com/CVE-2024-35277/): Missing authorization in FortiManager (high 8.4)
- [CVE-2024-35276](https://insights.sbomify.com/CVE-2024-35276/): Memory corruption in FortiAnalyzer (medium 5.0)
- [CVE-2024-35275](https://insights.sbomify.com/CVE-2024-35275/): SQL injection in FortiAnalyzer (medium 6.5)
- [CVE-2024-35274](https://insights.sbomify.com/CVE-2024-35274/): Path traversal in FortiAnalyzer (low 2.2)
- [CVE-2024-35273](https://insights.sbomify.com/CVE-2024-35273/): Memory corruption in FortiAnalyzer (high 7.0)
- [CVE-2024-35272](https://insights.sbomify.com/CVE-2024-35272/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-35271](https://insights.sbomify.com/CVE-2024-35271/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-35270](https://insights.sbomify.com/CVE-2024-35270/): Windows iSCSI Service Denial of Service Vulnerability (medium 5.3)
- [CVE-2024-35267](https://insights.sbomify.com/CVE-2024-35267/): Azure DevOps Server Spoofing Vulnerability (high 7.6)
- [CVE-2024-35266](https://insights.sbomify.com/CVE-2024-35266/): Azure DevOps Server Spoofing Vulnerability (high 7.6)
- [CVE-2024-35265](https://insights.sbomify.com/CVE-2024-35265/): Windows Perception Service Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2024-35264](https://insights.sbomify.com/CVE-2024-35264/): .NET and Visual Studio Remote Code Execution Vulnerability (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/347/