# Vulnerabilities published in 2024


- [CVE-2024-34083](https://insights.sbomify.com/CVE-2024-34083/): STARTTLS unencrypted commands injection (medium 5.4)
- [CVE-2024-34082](https://insights.sbomify.com/CVE-2024-34082/): Grav Arbitrary File Read to Account Takeover (high 8.5)
- [CVE-2024-34081](https://insights.sbomify.com/CVE-2024-34081/): MantisBT Cross-site Scripting vulnerability (medium 6.6)
- [CVE-2024-34080](https://insights.sbomify.com/CVE-2024-34080/): MantisBT Vulnerable to Exposure of Sensitive Information to an Unauthorized Actor (medium 5.3)
- [CVE-2024-3408](https://insights.sbomify.com/CVE-2024-3408/): Authentication Bypass and RCE in man-group/dtale (critical 9.8)
- [CVE-2024-34079](https://insights.sbomify.com/CVE-2024-34079/): octo-sts allows unauthenticated attackers to cause unbounded CPU and memory usage (low 3.7)
- [CVE-2024-34078](https://insights.sbomify.com/CVE-2024-34078/): html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalization (medium 6.1)
- [CVE-2024-34077](https://insights.sbomify.com/CVE-2024-34077/): MantisBT user account takeover in the signup/reset password process (high 7.3)
- [CVE-2024-34075](https://insights.sbomify.com/CVE-2024-34075/): kurwov vulnerable to Denial of Service due to improper data sanitization (medium 6.2)
- [CVE-2024-34074](https://insights.sbomify.com/CVE-2024-34074/): Frappe vuilnerable to an open redirect on login page (medium 6.1)
- [CVE-2024-34073](https://insights.sbomify.com/CVE-2024-34073/): Command Injection in sagemaker-python-sdk (high 7.8)
- [CVE-2024-34072](https://insights.sbomify.com/CVE-2024-34072/): Deserialization of Untrusted Data in sagemaker-python-sdk (high 7.8)
- [CVE-2024-34071](https://insights.sbomify.com/CVE-2024-34071/): Open Redirect Bypass Protection (medium 6.1)
- [CVE-2024-34070](https://insights.sbomify.com/CVE-2024-34070/): Froxlor Vulnerable to Blind XSS Leading to Froxlor Application Compromise (critical 9.7)
- [CVE-2024-3407](https://insights.sbomify.com/CVE-2024-3407/): WP Prayer <= 2.0.9 - Arbitrary Prayer Deletion via CSRF (medium 5.3)
- [CVE-2024-34069](https://insights.sbomify.com/CVE-2024-34069/): Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution (high 7.5)
- [CVE-2024-34068](https://insights.sbomify.com/CVE-2024-34068/): Server-side Request Forgery during remote file pull in Pterodactyl wings (medium 6.4)
- [CVE-2024-34067](https://insights.sbomify.com/CVE-2024-34067/): Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel (medium 6.1)
- [CVE-2024-34066](https://insights.sbomify.com/CVE-2024-34066/): Arbitrary File Write/Read in Pterodactyl wings (high 8.5)
- [CVE-2024-34065](https://insights.sbomify.com/CVE-2024-34065/): @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass (high 7.1)
- [CVE-2024-34064](https://insights.sbomify.com/CVE-2024-34064/): Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter (medium 5.4)
- [CVE-2024-34063](https://insights.sbomify.com/CVE-2024-34063/): Degraded secret zeroization capabilities in vodozemac (low 2.5)
- [CVE-2024-34062](https://insights.sbomify.com/CVE-2024-34062/): tqdm CLI arguments injection attack (medium 4.8)
- [CVE-2024-34061](https://insights.sbomify.com/CVE-2024-34061/): Reflected cross site scripting in changedetection.io (medium 4.3)
- [CVE-2024-34060](https://insights.sbomify.com/CVE-2024-34060/): Arbitrary File Write in IRIS EVTX Pipeline (high 8.8)
- [CVE-2024-3406](https://insights.sbomify.com/CVE-2024-3406/): WP Prayer <= 2.0.9 - Email Settings Update via CSRF (high 8.8)
- [CVE-2024-34058](https://insights.sbomify.com/CVE-2024-34058/): The WebTop package for NethServer 7 and 8 allows stored XSS (for example, via the Subject field if an e-mail message). (high 8.8)
- [CVE-2024-34057](https://insights.sbomify.com/CVE-2024-34057/): Memory corruption in siemens:sicam a8000 firmware (high 8.2)
- [CVE-2024-34055](https://insights.sbomify.com/CVE-2024-34055/): Denial of service in cyrusimap:cyrus imap (medium 6.5)
- [CVE-2024-34051](https://insights.sbomify.com/CVE-2024-34051/): Reflected Cross-Site Scripting (XSS) in Dolibarr (medium 4.6)
- [CVE-2024-34050](https://insights.sbomify.com/CVE-2024-34050/): Denial of service in onosproject:traffic steering xapplication (high 7.5)
- [CVE-2024-3405](https://insights.sbomify.com/CVE-2024-3405/): WP Prayer <= 2.0.9 - Settings Update via CSRF (high 7.6)
- [CVE-2024-34049](https://insights.sbomify.com/CVE-2024-34049/): Memory corruption in onosproject:traffic steering xapplication (high 7.5)
- [CVE-2024-34048](https://insights.sbomify.com/CVE-2024-34048/): Memory corruption in o-ran-sc:ric-plt-e2mgr (critical 9.8)
- [CVE-2024-34047](https://insights.sbomify.com/CVE-2024-34047/): Memory corruption in o-ran-sc:ric-plt-e2mgr (medium 4.3)
- [CVE-2024-34046](https://insights.sbomify.com/CVE-2024-34046/): The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->sctpParams->e2tCounters[IN_SU (high 7.5)
- [CVE-2024-34045](https://insights.sbomify.com/CVE-2024-34045/): The O-RAN E2T I-Release Prometheus metric Increment function can crash in sctpThread.cpp for message.peerInfo->counters[IN_INITI][MSG_COUNTE (high 7.5)
- [CVE-2024-34044](https://insights.sbomify.com/CVE-2024-34044/): The O-RAN E2T I-Release buildPrometheusList function can have a NULL pointer dereference because peerInfo can be NULL. (medium 5.3)
- [CVE-2024-34043](https://insights.sbomify.com/CVE-2024-34043/): Denial of service in linuxfoundation:ric-app-kpimon-go (medium 5.3)
- [CVE-2024-3404](https://insights.sbomify.com/CVE-2024-3404/): Improper Access Control in gaizhenbiao/chuanhuchatgpt (medium 6.5)
- [CVE-2024-34036](https://insights.sbomify.com/CVE-2024-34036/): An issue was discovered in O-RAN Near Realtime RIC I-Release. (medium 4.3)
- [CVE-2024-34035](https://insights.sbomify.com/CVE-2024-34035/): An issue was discovered in O-RAN Near Realtime RIC H-Release. (medium 5.7)
- [CVE-2024-34034](https://insights.sbomify.com/CVE-2024-34034/): An issue was discovered in FlexRIC 2.0.0. (medium 5.7)
- [CVE-2024-34033](https://insights.sbomify.com/CVE-2024-34033/): Path Traversal vulnerability in Delta Electronics DIAEnergie (high 8.8)
- [CVE-2024-34032](https://insights.sbomify.com/CVE-2024-34032/): SQL Injection in Delta Electronics DIAEnergie (high 8.8)
- [CVE-2024-34031](https://insights.sbomify.com/CVE-2024-34031/): SQL Injection vulnerability in Delta Electronics DIAEnergie (high 8.8)
- [CVE-2024-34030](https://insights.sbomify.com/CVE-2024-34030/): PCI: of_property: Return error for int_map allocation failure (medium 4.7)
- [CVE-2024-3403](https://insights.sbomify.com/CVE-2024-3403/): Local File Inclusion in imartinez/privategpt (high 7.5)
- [CVE-2024-34029](https://insights.sbomify.com/CVE-2024-34029/): AD/LDAP Group Members Leak (medium 4.3)
- [CVE-2024-34028](https://insights.sbomify.com/CVE-2024-34028/): Privilege escalation in Intel(R) Graphics Offline Compiler for OpenCL(TM) Code software for Windows (medium 5.4)
- [CVE-2024-34027](https://insights.sbomify.com/CVE-2024-34027/): f2fs: compress: fix to cover {reserve,release}_compress_blocks() w/ cp_rwsem lock (high 7.8)
- [CVE-2024-34026](https://insights.sbomify.com/CVE-2024-34026/): Memory corruption in OpenPLC v3 (critical 9.0)
- [CVE-2024-34025](https://insights.sbomify.com/CVE-2024-34025/): CyberPower PowerPanel business Use of Hard-coded Password (critical 9.8)
- [CVE-2024-34024](https://insights.sbomify.com/CVE-2024-34024/): Information disclosure in FUJITSU Business Application ID Link Manager II (medium 6.3)
- [CVE-2024-34023](https://insights.sbomify.com/CVE-2024-34023/): Memory corruption in Intel(R) Graphics Drivers (medium 6.9)
- [CVE-2024-34022](https://insights.sbomify.com/CVE-2024-34022/): Privilege escalation in Thunderbolt(TM) Share software (medium 5.4)
- [CVE-2024-34021](https://insights.sbomify.com/CVE-2024-34021/): File upload in WMC-2LX-B (medium 6.8)
- [CVE-2024-34020](https://insights.sbomify.com/CVE-2024-34020/): A stack-based buffer overflow was found in the putSDN() function of mail.c in hcode through 2.1. (medium 6.5)
- [CVE-2024-3402](https://insights.sbomify.com/CVE-2024-3402/): Stored XSS vulnerability in gaizhenbiao/chuanhuchatgpt (medium 6.8)
- [CVE-2024-34019](https://insights.sbomify.com/CVE-2024-34019/): Privilege escalation in Acronis Snap Deploy (medium 6.7)
- [CVE-2024-34018](https://insights.sbomify.com/CVE-2024-34018/): Misconfiguration in Acronis Snap Deploy (medium 5.5)
- [CVE-2024-34017](https://insights.sbomify.com/CVE-2024-34017/): Privilege escalation in Acronis Snap Deploy (medium 6.7)
- [CVE-2024-34016](https://insights.sbomify.com/CVE-2024-34016/): Privilege escalation in Acronis Cyber Protect Cloud Agent (medium 6.5)
- [CVE-2024-34015](https://insights.sbomify.com/CVE-2024-34015/): Information disclosure in Acronis Backup plugin for cPanel & WHM (low 3.3)
- [CVE-2024-34014](https://insights.sbomify.com/CVE-2024-34014/): Path traversal in Acronis Backup extension for Plesk (medium 5.5)
- [CVE-2024-34013](https://insights.sbomify.com/CVE-2024-34013/): Command injection in Acronis True Image (high 7.8)
- [CVE-2024-34012](https://insights.sbomify.com/CVE-2024-34012/): Privilege escalation in Acronis Cloud Manager (medium 4.4)
- [CVE-2024-34011](https://insights.sbomify.com/CVE-2024-34011/): Privilege escalation in Acronis Cyber Protect Cloud Agent (medium 6.8)
- [CVE-2024-34010](https://insights.sbomify.com/CVE-2024-34010/): Privilege escalation in Acronis Cyber Protect 16 (high 8.2)
- [CVE-2024-34009](https://insights.sbomify.com/CVE-2024-34009/): moodle: ReCAPTCHA can be bypassed on the login page (high 7.5)
- [CVE-2024-34008](https://insights.sbomify.com/CVE-2024-34008/): moodle: CSRF risk in analytics management of models (low 3.5)
- [CVE-2024-34007](https://insights.sbomify.com/CVE-2024-34007/): moodle: logout CSRF in admin/tool/mfa/auth.php (high 8.8)
- [CVE-2024-34006](https://insights.sbomify.com/CVE-2024-34006/): moodle: unsanitized HTML in site log for config_log_created (medium 4.3)
- [CVE-2024-34005](https://insights.sbomify.com/CVE-2024-34005/): moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_data backup (medium 6.5)
- [CVE-2024-34004](https://insights.sbomify.com/CVE-2024-34004/): moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_wiki backup (medium 6.5)
- [CVE-2024-34003](https://insights.sbomify.com/CVE-2024-34003/): moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_workshop backup (medium 5.9)
- [CVE-2024-34002](https://insights.sbomify.com/CVE-2024-34002/): moodle: authenticated LFI risk in some misconfigured shared hosting environments via modified mod_feedback backup (medium 6.5)
- [CVE-2024-34001](https://insights.sbomify.com/CVE-2024-34001/): moodle: CSRF risk in admin preset tool management of presets (high 8.4)
- [CVE-2024-34000](https://insights.sbomify.com/CVE-2024-34000/): moodle: stored XSS in lesson overview report via user ID number (medium 4.3)
- [CVE-2024-3400](https://insights.sbomify.com/CVE-2024-3400/): Palo Alto Networks PAN-OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2024-33999](https://insights.sbomify.com/CVE-2024-33999/): moodle: unsafe direct use of $_SERVER['HTTP_REFERER'] in admin/tool/mfa/index.php (critical 9.8)
- [CVE-2024-33998](https://insights.sbomify.com/CVE-2024-33998/): moodle: stored XSS via user's name on participants page when opening some options (medium 5.4)
- [CVE-2024-33997](https://insights.sbomify.com/CVE-2024-33997/): moodle: stored XSS risk when editing another user's equation in equation editor (medium 6.1)
- [CVE-2024-33996](https://insights.sbomify.com/CVE-2024-33996/): moodle: broken access control when setting calendar event type (medium 6.2)
- [CVE-2024-33994](https://insights.sbomify.com/CVE-2024-33994/): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (high 7.1)
- [CVE-2024-33993](https://insights.sbomify.com/CVE-2024-33993/): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (high 7.1)
- [CVE-2024-33992](https://insights.sbomify.com/CVE-2024-33992/): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (high 7.1)
- [CVE-2024-33991](https://insights.sbomify.com/CVE-2024-33991/): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (high 7.1)
- [CVE-2024-33990](https://insights.sbomify.com/CVE-2024-33990/): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (high 7.1)
- [CVE-2024-33989](https://insights.sbomify.com/CVE-2024-33989/): Cross-Site Scripting (XSS) vulnerability in Janobe School Event Management System (high 7.1)
- [CVE-2024-33988](https://insights.sbomify.com/CVE-2024-33988/): Cross-Site Scripting (XSS) vulnerability in Janobe products (high 7.1)
- [CVE-2024-33987](https://insights.sbomify.com/CVE-2024-33987/): Cross-Site Scripting (XSS) vulnerability in Janobe products (high 7.1)
- [CVE-2024-33986](https://insights.sbomify.com/CVE-2024-33986/): Cross-Site Scripting (XSS) vulnerability in Janobe products (high 7.1)
- [CVE-2024-33985](https://insights.sbomify.com/CVE-2024-33985/): Cross-Site Scripting (XSS) vulnerability in Janobe products (high 7.1)
- [CVE-2024-33984](https://insights.sbomify.com/CVE-2024-33984/): Cross-Site Scripting (XSS) vulnerability in Janobe products (high 7.1)
- [CVE-2024-33983](https://insights.sbomify.com/CVE-2024-33983/): Cross-Site Scripting (XSS) vulnerability in Janobe products (high 7.1)
- [CVE-2024-33982](https://insights.sbomify.com/CVE-2024-33982/): Cross-Site Scripting (XSS) vulnerability in Janobe products (high 7.1)
- [CVE-2024-33981](https://insights.sbomify.com/CVE-2024-33981/): Cross-site Scripting in Janobe products (high 7.1)
- [CVE-2024-33980](https://insights.sbomify.com/CVE-2024-33980/): Cross-site Scripting in Janobe products (high 7.1)
- [CVE-2024-33979](https://insights.sbomify.com/CVE-2024-33979/): Cross-site Scripting in Janobe products (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/357/