# Vulnerabilities published in 2024


- [CVE-2024-33493](https://insights.sbomify.com/CVE-2024-33493/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2024-33492](https://insights.sbomify.com/CVE-2024-33492/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2024-33491](https://insights.sbomify.com/CVE-2024-33491/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2024-33490](https://insights.sbomify.com/CVE-2024-33490/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2024-3349](https://insights.sbomify.com/CVE-2024-3349/): SourceCodester Aplaya Beach Resort Online Reservation System login.php sql injection (high 7.3)
- [CVE-2024-33489](https://insights.sbomify.com/CVE-2024-33489/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2024-33485](https://insights.sbomify.com/CVE-2024-33485/): SQL Injection vulnerability in CASAP Automated Enrollment System using PHP/MySQLi with Source Code V1.0 allows a remote attacker to obtain s (critical 9.8)
- [CVE-2024-3348](https://insights.sbomify.com/CVE-2024-3348/): SourceCodester Aplaya Beach Resort Online Reservation System index.php sql injection (high 7.3)
- [CVE-2024-33471](https://insights.sbomify.com/CVE-2024-33471/): An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request. (high 7.2)
- [CVE-2024-33470](https://insights.sbomify.com/CVE-2024-33470/): An issue in the SMTP Email Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to credentials in plaintext via a passback attack. (medium 4.9)
- [CVE-2024-3347](https://insights.sbomify.com/CVE-2024-3347/): SourceCodester Airline Ticket Reservation System activate_jet_details_form_handler.php sql injection (high 7.3)
- [CVE-2024-33469](https://insights.sbomify.com/CVE-2024-33469/): An issue in Team Amaze Amaze File Manager v.3.8.5 and fixed in v.3.10 allows a local attacker to execute arbitrary code via the onCreate met (high 7.9)
- [CVE-2024-33465](https://insights.sbomify.com/CVE-2024-33465/): Cross Site Scripting vulnerability in MajorDoMo before v.0662e5e allows an attacker to escalate privileges via the the thumb/thumb.php component. (high 7.1)
- [CVE-2024-3346](https://insights.sbomify.com/CVE-2024-3346/): Byzoro Smart S80 webmailattach.php os command injection (medium 6.3)
- [CVE-2024-33454](https://insights.sbomify.com/CVE-2024-33454/): Memory corruption in espressif:esp-idf (medium 6.5)
- [CVE-2024-33453](https://insights.sbomify.com/CVE-2024-33453/): Memory corruption in espressif:esp-idf (high 8.1)
- [CVE-2024-33452](https://insights.sbomify.com/CVE-2024-33452/): Other in openresty:lua-nginx-module (high 7.7)
- [CVE-2024-33450](https://insights.sbomify.com/CVE-2024-33450/): SQL Injection in Finereport v.8.0 allows a remote attacker to obtain sensitive information (high 7.5)
- [CVE-2024-3345](https://insights.sbomify.com/CVE-2024-3345/): ShopLentor <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via woolentorsearch Shortcode (medium 6.4)
- [CVE-2024-33449](https://insights.sbomify.com/CVE-2024-33449/): An SSRF issue in the PDFMyURL service allows a remote attacker to obtain sensitive information and execute arbitrary code via a POST request (critical 9.8)
- [CVE-2024-33445](https://insights.sbomify.com/CVE-2024-33445/): Code injection in hisiphp:hisiphp (critical 9.8)
- [CVE-2024-33444](https://insights.sbomify.com/CVE-2024-33444/): SQL injection in onethink:onethink (critical 9.8)
- [CVE-2024-33443](https://insights.sbomify.com/CVE-2024-33443/): Code injection in onethink:onethink (high 7.1)
- [CVE-2024-33442](https://insights.sbomify.com/CVE-2024-33442/): Code injection in flusity:flusity (medium 4.3)
- [CVE-2024-3344](https://insights.sbomify.com/CVE-2024-3344/): Cross-site scripting in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (medium 6.4)
- [CVE-2024-33439](https://insights.sbomify.com/CVE-2024-33439/): An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters. (critical 9.1)
- [CVE-2024-33438](https://insights.sbomify.com/CVE-2024-33438/): File upload in cubecart:cubecart (high 8.0)
- [CVE-2024-33437](https://insights.sbomify.com/CVE-2024-33437/): Information disclosure in mikegualtieri:css exfil protection (high 7.5)
- [CVE-2024-33436](https://insights.sbomify.com/CVE-2024-33436/): Information disclosure in mikegualtieri:css exfil protection (medium 5.3)
- [CVE-2024-33435](https://insights.sbomify.com/CVE-2024-33435/): Insecure Permissions vulnerability in Guangzhou Yingshi Electronic Technology Co. (critical 9.8)
- [CVE-2024-33434](https://insights.sbomify.com/CVE-2024-33434/): tiagorlampert CHAOS vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2024-33433](https://insights.sbomify.com/CVE-2024-33433/): Cross-site scripting in totolink:x2000r firmware (medium 4.8)
- [CVE-2024-33431](https://insights.sbomify.com/CVE-2024-33431/): Denial of service in stsaz:phiola (medium 6.5)
- [CVE-2024-33430](https://insights.sbomify.com/CVE-2024-33430/): Memory corruption in stsaz:phiola (high 8.8)
- [CVE-2024-3343](https://insights.sbomify.com/CVE-2024-3343/): Cross-site scripting in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (medium 6.4)
- [CVE-2024-33429](https://insights.sbomify.com/CVE-2024-33429/): Memory corruption in stsaz:phiola (high 7.1)
- [CVE-2024-33428](https://insights.sbomify.com/CVE-2024-33428/): Memory corruption in stsaz:phiola (high 8.8)
- [CVE-2024-33424](https://insights.sbomify.com/CVE-2024-33424/): Cross-site scripting in cmsimple:cmsimple (medium 6.1)
- [CVE-2024-33423](https://insights.sbomify.com/CVE-2024-33423/): Cross-site scripting in cmsimple:cmsimple (high 7.4)
- [CVE-2024-3342](https://insights.sbomify.com/CVE-2024-3342/): Timetable and Event Schedule by MotoPress <= 2.4.11 - Authenticated (Contributor+) SQL Injection (critical 9.9)
- [CVE-2024-33411](https://insights.sbomify.com/CVE-2024-33411/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33410](https://insights.sbomify.com/CVE-2024-33410/): SQL injection in campcodes:complete web-based school management system (high 8.1)
- [CVE-2024-3341](https://insights.sbomify.com/CVE-2024-3341/): Cross-site scripting in Shortcodes and extra features for Phlox theme (medium 6.4)
- [CVE-2024-33409](https://insights.sbomify.com/CVE-2024-33409/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33408](https://insights.sbomify.com/CVE-2024-33408/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33407](https://insights.sbomify.com/CVE-2024-33407/): SQL injection in campcodes:complete web-based school management system (medium 5.9)
- [CVE-2024-33406](https://insights.sbomify.com/CVE-2024-33406/): SQL injection in campcodes:complete web-based school management system (high 7.3)
- [CVE-2024-33405](https://insights.sbomify.com/CVE-2024-33405/): SQL injection in campcodes:complete web-based school management system (high 8.6)
- [CVE-2024-33404](https://insights.sbomify.com/CVE-2024-33404/): SQL injection in campcodes:complete web-based school management system (high 8.3)
- [CVE-2024-33403](https://insights.sbomify.com/CVE-2024-33403/): SQL injection in campcodes:complete web-based school management system (critical 9.8)
- [CVE-2024-33402](https://insights.sbomify.com/CVE-2024-33402/): SQL injection in campcodes:complete web-based school management system (high 8.1)
- [CVE-2024-33401](https://insights.sbomify.com/CVE-2024-33401/): Cross-site scripting in dedecms:dedecms (medium 4.4)
- [CVE-2024-3340](https://insights.sbomify.com/CVE-2024-3340/): Cross-site scripting in Colibri Page Builder (medium 5.4)
- [CVE-2024-33398](https://insights.sbomify.com/CVE-2024-33398/): piraeus-operator allows attacker to impersonate service account (high 7.5)
- [CVE-2024-33396](https://insights.sbomify.com/CVE-2024-33396/): karmada vulnerable to arbitrary code execution via a crafted command (high 8.4)
- [CVE-2024-33394](https://insights.sbomify.com/CVE-2024-33394/): kubevirt allows a local attacker to execute arbitrary code via a crafted command (medium 5.9)
- [CVE-2024-33393](https://insights.sbomify.com/CVE-2024-33393/): An issue in spidernet-io spiderpool v.0.9.3 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component. (medium 6.2)
- [CVE-2024-33383](https://insights.sbomify.com/CVE-2024-33383/): Path traversal in xxyopen:novel-plus (high 7.5)
- [CVE-2024-33382](https://insights.sbomify.com/CVE-2024-33382/): Denial of service in open5gs:open5gs (medium 5.3)
- [CVE-2024-3338](https://insights.sbomify.com/CVE-2024-3338/): Colibri Page Builder <= 1.0.262 - Authenticated (Author+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-33377](https://insights.sbomify.com/CVE-2024-33377/): Other in lb-link:bl-w1210m firmware (high 8.1)
- [CVE-2024-33375](https://insights.sbomify.com/CVE-2024-33375/): Information disclosure in lb-link:bl-w1210m firmware (critical 9.8)
- [CVE-2024-33374](https://insights.sbomify.com/CVE-2024-33374/): Incorrect access control in the UART/Serial interface on the LB-LINK BL-W1210M v2.0 router allows attackers to access the root terminal without authentication. (critical 9.8)
- [CVE-2024-33373](https://insights.sbomify.com/CVE-2024-33373/): Security feature bypass in lb-link:bl-w1210m firmware (medium 6.3)
- [CVE-2024-33371](https://insights.sbomify.com/CVE-2024-33371/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2024-3337](https://insights.sbomify.com/CVE-2024-3337/): Cross-site scripting in Colibri Page Builder (medium 6.4)
- [CVE-2024-33369](https://insights.sbomify.com/CVE-2024-33369/): Path traversal in plasmoapp:rpshare (high 8.8)
- [CVE-2024-33368](https://insights.sbomify.com/CVE-2024-33368/): Command injection in plasmoapp:rpshare (high 8.8)
- [CVE-2024-33365](https://insights.sbomify.com/CVE-2024-33365/): Memory corruption in tenda:ac10 firmware (high 7.5)
- [CVE-2024-33350](https://insights.sbomify.com/CVE-2024-33350/): Path traversal in taogogo:taocms (critical 9.8)
- [CVE-2024-33345](https://insights.sbomify.com/CVE-2024-33345/): Null dereference in dlink:dir-823g firmware (medium 6.5)
- [CVE-2024-33344](https://insights.sbomify.com/CVE-2024-33344/): Command injection in dlink:dir-822\+ firmware (critical 9.8)
- [CVE-2024-33343](https://insights.sbomify.com/CVE-2024-33343/): Command injection in dlink:dir-822\+ firmware (high 8.8)
- [CVE-2024-33342](https://insights.sbomify.com/CVE-2024-33342/): Command injection in dlink:dir-822\+ firmware (high 7.5)
- [CVE-2024-3334](https://insights.sbomify.com/CVE-2024-3334/): USB Security Feature Bypass in Digital Guardian Windows Agent Prior to version 8.2.0 (medium 4.3)
- [CVE-2024-33338](https://insights.sbomify.com/CVE-2024-33338/): Cross-site scripting in jizhicms:jizhicms (high 7.3)
- [CVE-2024-33335](https://insights.sbomify.com/CVE-2024-33335/): SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary code via a crafted file. (medium 6.3)
- [CVE-2024-33332](https://insights.sbomify.com/CVE-2024-33332/): Information disclosure in bladex:springblade (high 7.5)
- [CVE-2024-3333](https://insights.sbomify.com/CVE-2024-3333/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-33329](https://insights.sbomify.com/CVE-2024-33329/): A hardcoded privileged ID within Lumisxp v15.0.x to v16.1.x allows attackers to bypass authentication and access internal pages and other sensitive information. (high 7.5)
- [CVE-2024-33328](https://insights.sbomify.com/CVE-2024-33328/): A cross-site scripting (XSS) vulnerability in the component main.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to execute arbitrary web (medium 6.1)
- [CVE-2024-33327](https://insights.sbomify.com/CVE-2024-33327/): A cross-site scripting (XSS) vulnerability in the component UrlAccessibilityEvaluation.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to (medium 6.1)
- [CVE-2024-33326](https://insights.sbomify.com/CVE-2024-33326/): A cross-site scripting (XSS) vulnerability in the component XsltResultControllerHtml.jsp of Lumisxp v15.0.x to v16.1.x allows attackers to e (medium 6.1)
- [CVE-2024-3332](https://insights.sbomify.com/CVE-2024-3332/): bt: host/smp: DoS caused by null pointer dereference (medium 6.5)
- [CVE-2024-3331](https://insights.sbomify.com/CVE-2024-3331/): Spotfire: NTLM token leakage (medium 6.8)
- [CVE-2024-33309](https://insights.sbomify.com/CVE-2024-33309/): An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to obtain sensitive information vi (high 7.5)
- [CVE-2024-33308](https://insights.sbomify.com/CVE-2024-33308/): An issue in TVS Motor Company Limited TVS Connet Android v.4.5.1 and iOS v.5.0.0 allows a remote attacker to escalate privileges via the Eme (critical 9.1)
- [CVE-2024-33307](https://insights.sbomify.com/CVE-2024-33307/): Cross-site scripting in sourcecodester:laboratory management system (medium 5.4)
- [CVE-2024-33306](https://insights.sbomify.com/CVE-2024-33306/): Cross-site scripting in sourcecodester:laboratory management system (high 7.4)
- [CVE-2024-33305](https://insights.sbomify.com/CVE-2024-33305/): Cross-site scripting in sourcecodester:laboratory management system (medium 6.1)
- [CVE-2024-33304](https://insights.sbomify.com/CVE-2024-33304/): Cross-site scripting in oretnom23:product show room site (medium 6.1)
- [CVE-2024-33303](https://insights.sbomify.com/CVE-2024-33303/): Cross-site scripting in oretnom23:product show room site (high 8.2)
- [CVE-2024-33302](https://insights.sbomify.com/CVE-2024-33302/): Cross-site scripting in oretnom23:product show room site (medium 5.3)
- [CVE-2024-33300](https://insights.sbomify.com/CVE-2024-33300/): Cross-site scripting in typora:typora (high 7.3)
- [CVE-2024-3330](https://insights.sbomify.com/CVE-2024-3330/): Spotfire Remote Code Execution Vulnerability (critical 9.9)
- [CVE-2024-33299](https://insights.sbomify.com/CVE-2024-33299/): Microweber Cross-site Scripting vulnerability (medium 4.7)
- [CVE-2024-33298](https://insights.sbomify.com/CVE-2024-33298/): Microweber Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-33297](https://insights.sbomify.com/CVE-2024-33297/): Microweber Cross-site Scripting vulnerability (medium 4.7)
- [CVE-2024-33294](https://insights.sbomify.com/CVE-2024-33294/): An issue in Library System using PHP/MySQli with Source Code V1.0 allows a remote attacker to execute arbitrary code via the _FAILE variable (critical 9.1)
- [CVE-2024-33292](https://insights.sbomify.com/CVE-2024-33292/): SQL Injection vulnerability in Realisation MGSD v.1.0 allows a remote attacker to obtain sensitive information via the id parameter. (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/362/