# Vulnerabilities published in 2024


- [CVE-2024-34367](https://insights.sbomify.com/CVE-2024-34367/): WordPress Popup Box plugin <= 4.1.2 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-34366](https://insights.sbomify.com/CVE-2024-34366/): WordPress AltText.ai plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34365](https://insights.sbomify.com/CVE-2024-34365/): Apache Karaf Cave: Cave SSRF and arbitrary file access (critical 9.1)
- [CVE-2024-34364](https://insights.sbomify.com/CVE-2024-34364/): Envoy OOM vector from HTTP async client with unbounded response buffer for mirror response (medium 5.7)
- [CVE-2024-34363](https://insights.sbomify.com/CVE-2024-34363/): Envoy can crash due to uncaught nlohmann JSON exception (high 7.5)
- [CVE-2024-34362](https://insights.sbomify.com/CVE-2024-34362/): Envoy affected by a crash (use-after-free) in EnvoyQuicServerStream (medium 5.9)
- [CVE-2024-34361](https://insights.sbomify.com/CVE-2024-34361/): Pi-hole Blind Server-Side Request Forgery (SSRF) vulnerability can lead to Remote Code Execution (RCE) (high 8.6)
- [CVE-2024-34360](https://insights.sbomify.com/CVE-2024-34360/): Previous ATX is not checked to be the newest valid ATX by Smesher when validating incoming ATX (high 8.2)
- [CVE-2024-3436](https://insights.sbomify.com/CVE-2024-3436/): SourceCodester Prison Management System Avatar edit-photo.php unrestricted upload (medium 6.3)
- [CVE-2024-34359](https://insights.sbomify.com/CVE-2024-34359/): llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model Metadata (critical 9.7)
- [CVE-2024-34358](https://insights.sbomify.com/CVE-2024-34358/): TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController (medium 5.3)
- [CVE-2024-34357](https://insights.sbomify.com/CVE-2024-34357/): TYPO3 vulnerable to Cross-Site Scripting in ShowImageController (medium 5.4)
- [CVE-2024-34356](https://insights.sbomify.com/CVE-2024-34356/): TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module (medium 5.4)
- [CVE-2024-34355](https://insights.sbomify.com/CVE-2024-34355/): TYPO3 vulnerable to an HTML Injection in the History Module (low 3.5)
- [CVE-2024-34354](https://insights.sbomify.com/CVE-2024-34354/): CMSaasStarter: JWT Token Not Verified on Server Session (medium 6.5)
- [CVE-2024-34353](https://insights.sbomify.com/CVE-2024-34353/): matrix-sdk-crypto contains a log exposure of private key of the server-side key backup (medium 5.5)
- [CVE-2024-34352](https://insights.sbomify.com/CVE-2024-34352/): Arbitrary file write vulnerability in 1Panel (medium 6.5)
- [CVE-2024-34351](https://insights.sbomify.com/CVE-2024-34351/): Next.js Server-Side Request Forgery in Server Actions (high 7.5)
- [CVE-2024-34350](https://insights.sbomify.com/CVE-2024-34350/): Next.js Vulnerable to HTTP Request Smuggling (high 7.5)
- [CVE-2024-3435](https://insights.sbomify.com/CVE-2024-3435/): Path Traversal in parisneo/lollms-webui (high 8.4)
- [CVE-2024-34349](https://insights.sbomify.com/CVE-2024-34349/): Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel (medium 4.8)
- [CVE-2024-34347](https://insights.sbomify.com/CVE-2024-34347/): @hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCE (high 8.4)
- [CVE-2024-34346](https://insights.sbomify.com/CVE-2024-34346/): Deno contains a permission escalation via open of privileged files with missing `--deny` flag (high 8.5)
- [CVE-2024-34345](https://insights.sbomify.com/CVE-2024-34345/): @cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability (high 8.1)
- [CVE-2024-34344](https://insights.sbomify.com/CVE-2024-34344/): Remote code execution via the browser when running the test locally in nuxt (high 8.8)
- [CVE-2024-34343](https://insights.sbomify.com/CVE-2024-34343/): Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxt (medium 6.3)
- [CVE-2024-34342](https://insights.sbomify.com/CVE-2024-34342/): react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF (high 7.1)
- [CVE-2024-34341](https://insights.sbomify.com/CVE-2024-34341/): The Trix Editor Contains an Arbitrary Code Execution Vulnerability (medium 5.4)
- [CVE-2024-34340](https://insights.sbomify.com/CVE-2024-34340/): Authentication Bypass when using using older password hashes (critical 9.1)
- [CVE-2024-3434](https://insights.sbomify.com/CVE-2024-3434/): CP Plus Wi-Fi Camera User Management improper authorization (medium 5.4)
- [CVE-2024-34338](https://insights.sbomify.com/CVE-2024-34338/): Command injection in tenda:o3 firmware (high 7.2)
- [CVE-2024-34336](https://insights.sbomify.com/CVE-2024-34336/): Information disclosure in ordat:ordat.erp (medium 5.3)
- [CVE-2024-34335](https://insights.sbomify.com/CVE-2024-34335/): Cross-site scripting in ordat:ordat.erp (medium 6.1)
- [CVE-2024-34334](https://insights.sbomify.com/CVE-2024-34334/): SQL injection in ordat:ordat.erp (critical 9.3)
- [CVE-2024-34332](https://insights.sbomify.com/CVE-2024-34332/): An issue in SiSoftware SANDRA v31.66 (SANDRA.sys 15.18.1.1) and before allows an attacker to escalate privileges via a crafted buffer sent t (high 7.8)
- [CVE-2024-34331](https://insights.sbomify.com/CVE-2024-34331/): A lack of code signature verification in Parallels Desktop for Mac v19.3.0 and below allows attackers to escalate privileges via a crafted m (critical 9.8)
- [CVE-2024-3433](https://insights.sbomify.com/CVE-2024-3433/): PuneethReddyHC Event Management register.php cross site scripting (low 3.5)
- [CVE-2024-34329](https://insights.sbomify.com/CVE-2024-34329/): Insecure permissions in Entrust Datacard XPS Card Printer Driver 8.5 and earlier without the dxp1-patch-E24-004 patch allows unauthenticated (high 8.4)
- [CVE-2024-34328](https://insights.sbomify.com/CVE-2024-34328/): An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL. (medium 6.3)
- [CVE-2024-34327](https://insights.sbomify.com/CVE-2024-34327/): SQL injection in sielox:anyware (medium 6.5)
- [CVE-2024-34326](https://insights.sbomify.com/CVE-2024-34326/): ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/M (medium 6.1)
- [CVE-2024-34324](https://insights.sbomify.com/CVE-2024-34324/): An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character (critical 9.1)
- [CVE-2024-34323](https://insights.sbomify.com/CVE-2024-34323/): ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. (critical 10.0)
- [CVE-2024-34321](https://insights.sbomify.com/CVE-2024-34321/): ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes p (medium 6.1)
- [CVE-2024-34320](https://insights.sbomify.com/CVE-2024-34320/): ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints. (critical 9.8)
- [CVE-2024-3432](https://insights.sbomify.com/CVE-2024-3432/): PuneethReddyHC Event Management register.php sql injection (medium 5.5)
- [CVE-2024-34319](https://insights.sbomify.com/CVE-2024-34319/): A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the applic (medium 6.5)
- [CVE-2024-34315](https://insights.sbomify.com/CVE-2024-34315/): Path traversal in cmseasy:cmseasy (high 7.5)
- [CVE-2024-34314](https://insights.sbomify.com/CVE-2024-34314/): Path traversal in cmseasy:cmseasy (high 7.5)
- [CVE-2024-34313](https://insights.sbomify.com/CVE-2024-34313/): An issue in VPL Jail System up to v4.0.2 allows attackers to execute a directory traversal via a crafted request to a public endpoint. (critical 9.8)
- [CVE-2024-34312](https://insights.sbomify.com/CVE-2024-34312/): Cross-site scripting in moodle:virtual programming lab (medium 6.1)
- [CVE-2024-34310](https://insights.sbomify.com/CVE-2024-34310/): Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter. (high 8.8)
- [CVE-2024-3431](https://insights.sbomify.com/CVE-2024-3431/): EyouCMS Backend deserialization (medium 4.7)
- [CVE-2024-34308](https://insights.sbomify.com/CVE-2024-34308/): Memory corruption in totolink:lr350 firmware (high 8.8)
- [CVE-2024-3430](https://insights.sbomify.com/CVE-2024-3430/): QKSMS Backup File androidmanifest.xml backup (low 2.4)
- [CVE-2024-3429](https://insights.sbomify.com/CVE-2024-3429/): Path Traversal in parisneo/lollms (critical 9.8)
- [CVE-2024-3428](https://insights.sbomify.com/CVE-2024-3428/): SourceCodester Online Courseware edit.php cross site scripting (low 3.5)
- [CVE-2024-34274](https://insights.sbomify.com/CVE-2024-34274/): OpenBD 20210306203917-6cbe797 is vulnerable to Deserialization of Untrusted Data. (low 3.9)
- [CVE-2024-34273](https://insights.sbomify.com/CVE-2024-34273/): njwt Prototype Pollution vulnerability (medium 5.9)
- [CVE-2024-3427](https://insights.sbomify.com/CVE-2024-3427/): SourceCodester Online Courseware addq.php cross site scripting (low 3.5)
- [CVE-2024-34268](https://insights.sbomify.com/CVE-2024-34268/): EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth connections. (high 7.1)
- [CVE-2024-3426](https://insights.sbomify.com/CVE-2024-3426/): SourceCodester Online Courseware editt.php cross site scripting (low 3.5)
- [CVE-2024-34257](https://insights.sbomify.com/CVE-2024-34257/): Command injection in totolink:ex1800t firmware (critical 9.8)
- [CVE-2024-34256](https://insights.sbomify.com/CVE-2024-34256/): SQL injection in ofcms project:ofcms (critical 9.8)
- [CVE-2024-34255](https://insights.sbomify.com/CVE-2024-34255/): Cross-site scripting in jizhicms:jizhicms (medium 6.1)
- [CVE-2024-34252](https://insights.sbomify.com/CVE-2024-34252/): pywasm3 contains a global buffer overflow which leads to segmentation fault (high 7.5)
- [CVE-2024-34251](https://insights.sbomify.com/CVE-2024-34251/): Memory corruption in bytecodealliance:webassembly micro runtime (high 7.5)
- [CVE-2024-34250](https://insights.sbomify.com/CVE-2024-34250/): Memory corruption in bytecodealliance:webassembly micro runtime (medium 6.2)
- [CVE-2024-3425](https://insights.sbomify.com/CVE-2024-3425/): SourceCodester Online Courseware activateall.php sql injection (medium 6.3)
- [CVE-2024-34249](https://insights.sbomify.com/CVE-2024-34249/): pywasm3 contains a heap buffer overflow which leads to segmentation fault (critical 9.8)
- [CVE-2024-34246](https://insights.sbomify.com/CVE-2024-34246/): Memory corruption in wasm3 project:wasm3 (high 7.5)
- [CVE-2024-34245](https://insights.sbomify.com/CVE-2024-34245/): Path traversal in dedecms:dedecms (medium 6.5)
- [CVE-2024-34244](https://insights.sbomify.com/CVE-2024-34244/): Memory corruption in libmodbus:libmodbus (high 7.5)
- [CVE-2024-34243](https://insights.sbomify.com/CVE-2024-34243/): Konga is vulnerable to Cross Site Scripting (XSS) attacks (medium 5.4)
- [CVE-2024-34241](https://insights.sbomify.com/CVE-2024-34241/): Cross-site scripting in rocketsoft:rocket lms (medium 4.8)
- [CVE-2024-34240](https://insights.sbomify.com/CVE-2024-34240/): Cross-site scripting in qdocs:smart school (medium 6.1)
- [CVE-2024-3424](https://insights.sbomify.com/CVE-2024-3424/): SourceCodester Online Courseware listscore.php sql injection (medium 6.3)
- [CVE-2024-34235](https://insights.sbomify.com/CVE-2024-34235/): Denial of service in open5gs:open5gs (high 8.6)
- [CVE-2024-34231](https://insights.sbomify.com/CVE-2024-34231/): Cross-site scripting in sourcecodester:laboratory management system (high 7.1)
- [CVE-2024-34230](https://insights.sbomify.com/CVE-2024-34230/): Cross-site scripting in sourcecodester:laboratory management system (medium 6.1)
- [CVE-2024-3423](https://insights.sbomify.com/CVE-2024-3423/): SourceCodester Online Courseware activateteach.php sql injection (medium 6.3)
- [CVE-2024-34226](https://insights.sbomify.com/CVE-2024-34226/): SQL injection in oretnom23:visitor management system (critical 9.4)
- [CVE-2024-34225](https://insights.sbomify.com/CVE-2024-34225/): Cross-site scripting in oretnom23:computer laboratory management system (medium 6.1)
- [CVE-2024-34224](https://insights.sbomify.com/CVE-2024-34224/): Cross-site scripting in oretnom23:computer laboratory management system (high 7.3)
- [CVE-2024-34223](https://insights.sbomify.com/CVE-2024-34223/): Missing authorization in oretnom23:human resource management system (medium 4.3)
- [CVE-2024-34222](https://insights.sbomify.com/CVE-2024-34222/): SQL injection in oretnom23:human resource management system (medium 5.9)
- [CVE-2024-34221](https://insights.sbomify.com/CVE-2024-34221/): Privilege escalation in oretnom23:human resource management system (high 8.8)
- [CVE-2024-34220](https://insights.sbomify.com/CVE-2024-34220/): SQL injection in oretnom23:human resource management system (high 7.5)
- [CVE-2024-3422](https://insights.sbomify.com/CVE-2024-3422/): SourceCodester Online Courseware activatestud.php sql injection (medium 6.3)
- [CVE-2024-34219](https://insights.sbomify.com/CVE-2024-34219/): Hardcoded credentials in totolink:cp450 firmware (high 8.6)
- [CVE-2024-34218](https://insights.sbomify.com/CVE-2024-34218/): Command injection in totolink:cp450 firmware (low 3.8)
- [CVE-2024-34217](https://insights.sbomify.com/CVE-2024-34217/): Memory corruption in totolink:cp450 firmware (high 7.7)
- [CVE-2024-34215](https://insights.sbomify.com/CVE-2024-34215/): Memory corruption in totolink:cp450 firmware (high 7.3)
- [CVE-2024-34213](https://insights.sbomify.com/CVE-2024-34213/): Memory corruption in totolink:cp450 firmware (critical 9.8)
- [CVE-2024-34212](https://insights.sbomify.com/CVE-2024-34212/): Memory corruption in totolink:cp450 firmware (high 7.3)
- [CVE-2024-34211](https://insights.sbomify.com/CVE-2024-34211/): Hardcoded credentials in totolink:cp450 firmware (high 8.8)
- [CVE-2024-34210](https://insights.sbomify.com/CVE-2024-34210/): Command injection in totolink:cp450 firmware (high 7.3)
- [CVE-2024-3421](https://insights.sbomify.com/CVE-2024-3421/): SourceCodester Online Courseware deactivatestud.php sql injection (medium 6.3)
- [CVE-2024-34209](https://insights.sbomify.com/CVE-2024-34209/): Memory corruption in totolink:cp450 firmware (critical 9.8)
- [CVE-2024-34207](https://insights.sbomify.com/CVE-2024-34207/): Memory corruption in totolink:cp450 firmware (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/355/