# Vulnerabilities published in 2024


- [CVE-2024-3387](https://insights.sbomify.com/CVE-2024-3387/): PAN-OS: Weak Certificate Strength in Panorama Software Leads to Sensitive Information Disclosure (medium 5.3)
- [CVE-2024-33869](https://insights.sbomify.com/CVE-2024-33869/): Path traversal in artifex:ghostscript (medium 5.3)
- [CVE-2024-33868](https://insights.sbomify.com/CVE-2024-33868/): Other in linqi:linqi (critical 9.8)
- [CVE-2024-33867](https://insights.sbomify.com/CVE-2024-33867/): Hardcoded credentials in linqi:linqi (medium 4.8)
- [CVE-2024-33866](https://insights.sbomify.com/CVE-2024-33866/): Cross-site scripting in linqi:linqi (medium 5.5)
- [CVE-2024-33865](https://insights.sbomify.com/CVE-2024-33865/): Information disclosure in linqi:linqi (high 7.5)
- [CVE-2024-33864](https://insights.sbomify.com/CVE-2024-33864/): Server-side request forgery in linqi:linqi (medium 5.9)
- [CVE-2024-33863](https://insights.sbomify.com/CVE-2024-33863/): Path traversal in linqi:linqi (critical 9.8)
- [CVE-2024-33862](https://insights.sbomify.com/CVE-2024-33862/): OPCFoundation.NetStandard.Opc.Ua.Core buffer-management vulnerability (high 7.5)
- [CVE-2024-33860](https://insights.sbomify.com/CVE-2024-33860/): Path traversal in logpoint:siem (medium 6.5)
- [CVE-2024-3386](https://insights.sbomify.com/CVE-2024-3386/): PAN-OS: Predefined Decryption Exclusions Does Not Work as Intended (medium 5.3)
- [CVE-2024-33859](https://insights.sbomify.com/CVE-2024-33859/): Cross-site scripting in logpoint:siem (medium 6.1)
- [CVE-2024-33858](https://insights.sbomify.com/CVE-2024-33858/): Path traversal in logpoint:siem (medium 5.3)
- [CVE-2024-33857](https://insights.sbomify.com/CVE-2024-33857/): Server-side request forgery in logpoint:siem (critical 9.6)
- [CVE-2024-33856](https://insights.sbomify.com/CVE-2024-33856/): Information disclosure in logpoint:siem (medium 5.3)
- [CVE-2024-33854](https://insights.sbomify.com/CVE-2024-33854/): SQL injection in centreon:centreon web (critical 9.1)
- [CVE-2024-33853](https://insights.sbomify.com/CVE-2024-33853/): SQL injection in centreon:centreon web (critical 9.1)
- [CVE-2024-33852](https://insights.sbomify.com/CVE-2024-33852/): SQL injection in centreon:centreon web (critical 9.1)
- [CVE-2024-33851](https://insights.sbomify.com/CVE-2024-33851/): mdanter/ecc affected by timing vulnerability in cryptographic side-channels (medium 4.3)
- [CVE-2024-33850](https://insights.sbomify.com/CVE-2024-33850/): Missing authorization in pexip:pexip infinity (medium 4.3)
- [CVE-2024-3385](https://insights.sbomify.com/CVE-2024-3385/): PAN-OS: Firewall Denial of Service (DoS) when GTP Security is Disabled (high 7.5)
- [CVE-2024-33849](https://insights.sbomify.com/CVE-2024-33849/): ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key. (medium 6.5)
- [CVE-2024-33848](https://insights.sbomify.com/CVE-2024-33848/): Denial of service in Intel(R) RAID Web Console software (medium 6.5)
- [CVE-2024-33847](https://insights.sbomify.com/CVE-2024-33847/): f2fs: compress: don't allow unaligned truncation on released compress inode (high 7.1)
- [CVE-2024-33844](https://insights.sbomify.com/CVE-2024-33844/): Denial of service in parrot:anafi firmware (high 7.5)
- [CVE-2024-3384](https://insights.sbomify.com/CVE-2024-3384/): PAN-OS: Firewall Denial of Service (DoS) via Malformed NTLM Packets (high 7.5)
- [CVE-2024-33836](https://insights.sbomify.com/CVE-2024-33836/): In the module "JA Marketplace" (jamarketplace) up to version 9.0.1 from JA Module for PrestaShop, a guest can upload files with extensions .php. (critical 9.8)
- [CVE-2024-33835](https://insights.sbomify.com/CVE-2024-33835/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-33832](https://insights.sbomify.com/CVE-2024-33832/): OneNav v0.9.35-20240318 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /index.php?c=api&method=get_link_info. (medium 6.3)
- [CVE-2024-33831](https://insights.sbomify.com/CVE-2024-33831/): A stored cross-site scripting (XSS) vulnerability in the Advanced Expectation - Response module of yapi v1.10.2 allows attackers to execute (high 7.4)
- [CVE-2024-33830](https://insights.sbomify.com/CVE-2024-33830/): Cross-site request forgery in idccms:idccms (high 8.1)
- [CVE-2024-3383](https://insights.sbomify.com/CVE-2024-3383/): PAN-OS: Improper Group Membership Change Vulnerability in Cloud Identity Engine (CIE) (high 7.4)
- [CVE-2024-33829](https://insights.sbomify.com/CVE-2024-33829/): Cross-site request forgery in idccms:idccms (medium 5.4)
- [CVE-2024-33820](https://insights.sbomify.com/CVE-2024-33820/): Memory corruption in totolink:a3002r firmware (high 7.5)
- [CVE-2024-3382](https://insights.sbomify.com/CVE-2024-3382/): PAN-OS: Firewall Denial of Service (DoS) via a Burst of Crafted Packets (high 7.5)
- [CVE-2024-33819](https://insights.sbomify.com/CVE-2024-33819/): Globitel KSA SpeechLog v8.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Save Query function. (medium 4.6)
- [CVE-2024-33818](https://insights.sbomify.com/CVE-2024-33818/): Globitel KSA SpeechLog v8.1 was discovered to contain an Insecure Direct Object Reference (IDOR) via the userID parameter. (high 7.5)
- [CVE-2024-33809](https://insights.sbomify.com/CVE-2024-33809/): Memory corruption in pingcap:tidb (medium 6.5)
- [CVE-2024-33808](https://insights.sbomify.com/CVE-2024-33808/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33807](https://insights.sbomify.com/CVE-2024-33807/): SQL injection in campcodes:complete web-based school management system (medium 5.4)
- [CVE-2024-33806](https://insights.sbomify.com/CVE-2024-33806/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33805](https://insights.sbomify.com/CVE-2024-33805/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33804](https://insights.sbomify.com/CVE-2024-33804/): SQL injection in campcodes:complete web-based school management system (medium 6.3)
- [CVE-2024-33803](https://insights.sbomify.com/CVE-2024-33803/): SQL injection in campcodes:complete web-based school management system (medium 5.4)
- [CVE-2024-33802](https://insights.sbomify.com/CVE-2024-33802/): SQL injection in campcodes:complete web-based school management system (medium 6.5)
- [CVE-2024-33801](https://insights.sbomify.com/CVE-2024-33801/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33800](https://insights.sbomify.com/CVE-2024-33800/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33799](https://insights.sbomify.com/CVE-2024-33799/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33793](https://insights.sbomify.com/CVE-2024-33793/): Command injection in netis-systems:mex605 firmware (medium 5.3)
- [CVE-2024-33792](https://insights.sbomify.com/CVE-2024-33792/): Command injection in netis-systems:mex605 firmware (critical 9.8)
- [CVE-2024-33791](https://insights.sbomify.com/CVE-2024-33791/): Cross-site scripting in netis-systems:mex605 firmware (medium 4.6)
- [CVE-2024-3379](https://insights.sbomify.com/CVE-2024-3379/): Incorrect Authorization in lunary-ai/lunary (critical 9.6)
- [CVE-2024-33789](https://insights.sbomify.com/CVE-2024-33789/): Command injection in linksys:e5600 firmware (critical 9.8)
- [CVE-2024-33788](https://insights.sbomify.com/CVE-2024-33788/): Command injection in linksys:e5600 firmware (high 8.0)
- [CVE-2024-33787](https://insights.sbomify.com/CVE-2024-33787/): Hengan Weighing Management Information Query Platform 2019-2021 53.25 was discovered to contain a SQL injection vulnerability via the tuser_ (high 8.2)
- [CVE-2024-33786](https://insights.sbomify.com/CVE-2024-33786/): An arbitrary file upload vulnerability in Zhongcheng Kexin Ticketing Management Platform 20.04 allows attackers to execute arbitrary code vi (critical 9.8)
- [CVE-2024-33783](https://insights.sbomify.com/CVE-2024-33783/): Memory corruption in csiro:multi-protocol spdz (medium 6.5)
- [CVE-2024-33782](https://insights.sbomify.com/CVE-2024-33782/): Memory corruption in csiro:multi-protocol spdz (high 7.5)
- [CVE-2024-33781](https://insights.sbomify.com/CVE-2024-33781/): Memory corruption in csiro:multi-protocol spdz (high 7.5)
- [CVE-2024-33780](https://insights.sbomify.com/CVE-2024-33780/): Memory corruption in csiro:multi-protocol spdz (medium 6.5)
- [CVE-2024-3378](https://insights.sbomify.com/CVE-2024-3378/): iboss Secure Web Gateway Login Portal login cross site scripting (medium 4.3)
- [CVE-2024-33775](https://insights.sbomify.com/CVE-2024-33775/): Privilege escalation in nagios:nagios xi (high 8.8)
- [CVE-2024-33774](https://insights.sbomify.com/CVE-2024-33774/): Memory corruption in dlink:dir-619l firmware (medium 6.5)
- [CVE-2024-33773](https://insights.sbomify.com/CVE-2024-33773/): Memory corruption in dlink:dir-619l firmware (medium 6.5)
- [CVE-2024-33772](https://insights.sbomify.com/CVE-2024-33772/): Memory corruption in dlink:dir-619l firmware (medium 5.7)
- [CVE-2024-33771](https://insights.sbomify.com/CVE-2024-33771/): Memory corruption in dlink:dir-619l firmware (medium 6.5)
- [CVE-2024-3377](https://insights.sbomify.com/CVE-2024-3377/): SourceCodester Computer Laboratory Management System cross site scripting (medium 4.3)
- [CVE-2024-33768](https://insights.sbomify.com/CVE-2024-33768/): Memory corruption in sammycage:lunasvg (critical 9.8)
- [CVE-2024-33767](https://insights.sbomify.com/CVE-2024-33767/): Memory corruption in sammycage:lunasvg (medium 5.0)
- [CVE-2024-33766](https://insights.sbomify.com/CVE-2024-33766/): Denial of service in sammycage:lunasvg (medium 5.3)
- [CVE-2024-33764](https://insights.sbomify.com/CVE-2024-33764/): Memory corruption in sammycage:lunasvg (medium 5.5)
- [CVE-2024-33763](https://insights.sbomify.com/CVE-2024-33763/): Memory corruption in sammycage:lunasvg (high 7.5)
- [CVE-2024-3376](https://insights.sbomify.com/CVE-2024-3376/): SourceCodester Computer Laboratory Management System config.php redirect (high 7.3)
- [CVE-2024-33753](https://insights.sbomify.com/CVE-2024-33753/): Section Camera V2.5.5.3116-S50-SMA-B20160811 and earlier versions allow the accounts and passwords of administrators and users to be changed (high 8.2)
- [CVE-2024-33752](https://insights.sbomify.com/CVE-2024-33752/): File upload in emlog:emlog (medium 6.3)
- [CVE-2024-3375](https://insights.sbomify.com/CVE-2024-3375/): Broken Access Control in Havelsan's Dialogue (critical 9.4)
- [CVE-2024-33749](https://insights.sbomify.com/CVE-2024-33749/): Missing authorization in dedecms:dedecms (critical 9.1)
- [CVE-2024-33748](https://insights.sbomify.com/CVE-2024-33748/): MS Basic Cross-site Scripting vulnerability (medium 4.1)
- [CVE-2024-3374](https://insights.sbomify.com/CVE-2024-3374/): MongoDB Server (mongod) may crash when generating ftdc (medium 5.3)
- [CVE-2024-3373](https://insights.sbomify.com/CVE-2024-3373/): SQLi in RSM Design's Website Template (critical 9.2)
- [CVE-2024-33724](https://insights.sbomify.com/CVE-2024-33724/): SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php. (medium 5.4)
- [CVE-2024-33722](https://insights.sbomify.com/CVE-2024-33722/): SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[]. (medium 6.3)
- [CVE-2024-3372](https://insights.sbomify.com/CVE-2024-3372/): MongoDB Server may have unexpected application behaviour due to invalid BSON (high 7.5)
- [CVE-2024-3371](https://insights.sbomify.com/CVE-2024-3371/): Insufficient validation of external input in Compass may enable MITM attacks (high 7.1)
- [CVE-2024-33700](https://insights.sbomify.com/CVE-2024-33700/): Denial of service in WBR-6012 (high 7.5)
- [CVE-2024-3370](https://insights.sbomify.com/CVE-2024-3370/): SQLi in Egebilgi Software's Website Template (high 8.8)
- [CVE-2024-33699](https://insights.sbomify.com/CVE-2024-33699/): Auth bypass in WBR-6012 (critical 9.9)
- [CVE-2024-33698](https://insights.sbomify.com/CVE-2024-33698/): Memory corruption in Opcenter Quality (critical 9.3)
- [CVE-2024-33697](https://insights.sbomify.com/CVE-2024-33697/): WordPress CF7 File Download plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33696](https://insights.sbomify.com/CVE-2024-33696/): WordPress WordPress Ad Widget plugin <= 2.20.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33695](https://insights.sbomify.com/CVE-2024-33695/): WordPress Fan Page Widget by ThemeNcode plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33694](https://insights.sbomify.com/CVE-2024-33694/): WordPress Meks ThemeForest Smart Widget plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33693](https://insights.sbomify.com/CVE-2024-33693/): WordPress Meks Smart Social Widget plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33692](https://insights.sbomify.com/CVE-2024-33692/): WordPress Smart Recent Posts Widget plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33691](https://insights.sbomify.com/CVE-2024-33691/): Cross-site request forgery in OptinMonster (medium 4.3)
- [CVE-2024-33690](https://insights.sbomify.com/CVE-2024-33690/): WordPress Financio theme <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3369](https://insights.sbomify.com/CVE-2024-3369/): code-projects Car Rental add-vehicle.php unrestricted upload (medium 6.3)
- [CVE-2024-33689](https://insights.sbomify.com/CVE-2024-33689/): WordPress Radio Station plugin <= 2.5.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-33688](https://insights.sbomify.com/CVE-2024-33688/): WordPress Teluro theme <= 1.0.31 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-33687](https://insights.sbomify.com/CVE-2024-33687/): Security feature bypass in NJ Series CPU Unit (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/359/