# Vulnerabilities published in 2024


- [CVE-2024-33288](https://insights.sbomify.com/CVE-2024-33288/): Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page. (high 7.3)
- [CVE-2024-33278](https://insights.sbomify.com/CVE-2024-33278/): Buffer Overflow vulnerability in ASUS router RT-AX88U with firmware versions v3.0.0.4.388_24198 allows a remote attacker to execute arbitrar (critical 9.8)
- [CVE-2024-33276](https://insights.sbomify.com/CVE-2024-33276/): SQL Injection vulnerability in FME Modules preorderandnotication v.3.1.0 and before allows a remote attacker to run arbitrary SQL commands v (critical 9.8)
- [CVE-2024-33275](https://insights.sbomify.com/CVE-2024-33275/): SQL injection vulnerability in Webbax supernewsletter v.1.4.21 and before allows a remote attacker to escalate privileges via the Super News (critical 9.8)
- [CVE-2024-33274](https://insights.sbomify.com/CVE-2024-33274/): Directory Traversal vulnerability in FME Modules customfields v.2.2.7 and before allows a remote attacker to obtain sensitive information vi (high 7.5)
- [CVE-2024-33273](https://insights.sbomify.com/CVE-2024-33273/): SQL injection vulnerability in shipup before v.3.3.0 allows a remote attacker to escalate privileges via the getShopID function. (critical 9.8)
- [CVE-2024-33272](https://insights.sbomify.com/CVE-2024-33272/): SQL injection vulnerability in KnowBand for PrestaShop autosuggest before 2.0.0 allows an attacker to run arbitrary SQL commands via the Aut (medium 6.8)
- [CVE-2024-33271](https://insights.sbomify.com/CVE-2024-33271/): An issue in FME Modules eventsmanager before 4.4.0 allows an attacker to obtain sensitive information from the ps_customer component. (high 7.5)
- [CVE-2024-33270](https://insights.sbomify.com/CVE-2024-33270/): An issue in FME Modules fileuploads v.2.0.3 and before and fixed in v2.0.4 allows a remote attacker to obtain sensitive information via the (high 7.5)
- [CVE-2024-33269](https://insights.sbomify.com/CVE-2024-33269/): SQL Injection vulnerability in Prestaddons flashsales 1.9.7 and before allows an attacker to run arbitrary SQL commands via the FsModel::getFlashSales method. (critical 9.8)
- [CVE-2024-33268](https://insights.sbomify.com/CVE-2024-33268/): SQL Injection vulnerability in Digincube mdgiftproduct before 1.4.1 allows an attacker to run arbitrary SQL commands via the MdGiftRule::addGiftToCart method. (critical 9.8)
- [CVE-2024-33267](https://insights.sbomify.com/CVE-2024-33267/): SQL Injection vulnerability in Hero hfheropayment v.1.2.5 and before allows an attacker to escalate privileges via the HfHeropaymentGatewayB (critical 9.8)
- [CVE-2024-33266](https://insights.sbomify.com/CVE-2024-33266/): SQL Injection vulnerability in Helloshop deliveryorderautoupdate v.2.8.1 and before allows an attacker to run arbitrary SQL commands via the (critical 9.8)
- [CVE-2024-33263](https://insights.sbomify.com/CVE-2024-33263/): Denial of service in bellard:quickjs (medium 4.0)
- [CVE-2024-33260](https://insights.sbomify.com/CVE-2024-33260/): Memory corruption in jerryscript:jerryscript (medium 5.1)
- [CVE-2024-33259](https://insights.sbomify.com/CVE-2024-33259/): Denial of service in jerryscript:jerryscript (medium 5.5)
- [CVE-2024-33258](https://insights.sbomify.com/CVE-2024-33258/): Memory corruption in jerryscript:jerryscript (high 7.1)
- [CVE-2024-33255](https://insights.sbomify.com/CVE-2024-33255/): Denial of service in jerryscript:jerryscript (medium 6.2)
- [CVE-2024-33253](https://insights.sbomify.com/CVE-2024-33253/): Cross-site scripting in openeclass:openeclass (medium 6.0)
- [CVE-2024-33250](https://insights.sbomify.com/CVE-2024-33250/): An issue in Open-Source Technology Committee SRS real-time video server RS/4.0.268(Leo) and SRS/4.0.195(Leo) allows a remote attacker to exe (high 7.2)
- [CVE-2024-3325](https://insights.sbomify.com/CVE-2024-3325/): JasperReports Server Driver upload vulnerability (high 8.6)
- [CVE-2024-33247](https://insights.sbomify.com/CVE-2024-33247/): SQL injection in oretnom23:employee task management system (high 8.8)
- [CVE-2024-33231](https://insights.sbomify.com/CVE-2024-33231/): Cross Site Scripting vulnerability in Ferozo Email version 1.1 allows a local attacker to execute arbitrary code via a crafted payload to th (medium 6.1)
- [CVE-2024-3323](https://insights.sbomify.com/CVE-2024-3323/): Reflected Cross Site Scripting (XSS) vulnerability (high 8.3)
- [CVE-2024-33228](https://insights.sbomify.com/CVE-2024-33228/): An issue in the component segwindrvx64.sys of Insyde Software Corp SEG Windows Driver v100.00.07.02 allows attackers to escalate privileges (high 8.4)
- [CVE-2024-33227](https://insights.sbomify.com/CVE-2024-33227/): An issue in the component ddcdrv.sys of Nicomsoft WinI2C/DDC v3.7.4.0 allows attackers to escalate privileges and execute arbitrary code via (high 8.8)
- [CVE-2024-33226](https://insights.sbomify.com/CVE-2024-33226/): An issue in the component Access64.sys of Wistron Corporation TBT Force Power Control v1.0.0.0 allows attackers to escalate privileges and e (critical 9.9)
- [CVE-2024-33225](https://insights.sbomify.com/CVE-2024-33225/): An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows att (high 7.8)
- [CVE-2024-33224](https://insights.sbomify.com/CVE-2024-33224/): An issue in the component rtkio64.sys of Realtek Semiconductor Corp Realtek lO Driver v1.008.0823.2017 allows attackers to escalate privileg (high 8.4)
- [CVE-2024-33223](https://insights.sbomify.com/CVE-2024-33223/): An issue in the component IOMap64.sys of ASUSTeK Computer Inc ASUS GPU TweakII v1.4.5.2 allows attackers to escalate privileges and execute (high 8.8)
- [CVE-2024-33222](https://insights.sbomify.com/CVE-2024-33222/): An issue in the component ATSZIO64.sys of ASUSTeK Computer Inc ASUS ATSZIO Driver v0.2.1.7 allows attackers to escalate privileges and execu (high 8.4)
- [CVE-2024-33221](https://insights.sbomify.com/CVE-2024-33221/): An issue in the component AsusBSItf.sys of ASUSTeK Computer Inc ASUS BIOS Flash Driver v3.2.12.0 allows attackers to escalate privileges and (high 7.8)
- [CVE-2024-33220](https://insights.sbomify.com/CVE-2024-33220/): Privilege escalation in asus:ai suite (high 8.8)
- [CVE-2024-3322](https://insights.sbomify.com/CVE-2024-3322/): Path Traversal in parisneo/lollms-webui (high 8.4)
- [CVE-2024-33219](https://insights.sbomify.com/CVE-2024-33219/): Privilege escalation in asus:sabertooth x99 firmware (high 7.8)
- [CVE-2024-33218](https://insights.sbomify.com/CVE-2024-33218/): An issue in the component AsUpIO64.sys of ASUSTeK Computer Inc ASUS USB 3.0 Boost Storage Driver 5.30.20.0 allows attackers to escalate priv (high 7.8)
- [CVE-2024-33217](https://insights.sbomify.com/CVE-2024-33217/): Memory corruption in tenda:fh1206 firmware (high 7.5)
- [CVE-2024-33215](https://insights.sbomify.com/CVE-2024-33215/): Memory corruption in tenda:fh1206 firmware (critical 9.8)
- [CVE-2024-33214](https://insights.sbomify.com/CVE-2024-33214/): Memory corruption in tenda:fh1206 firmware (high 7.5)
- [CVE-2024-33213](https://insights.sbomify.com/CVE-2024-33213/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-33212](https://insights.sbomify.com/CVE-2024-33212/): Memory corruption in tenda:fh1206 firmware (high 8.8)
- [CVE-2024-33211](https://insights.sbomify.com/CVE-2024-33211/): Memory corruption in tenda:fh1206 firmware (high 7.3)
- [CVE-2024-33210](https://insights.sbomify.com/CVE-2024-33210/): Cross-site scripting in flatpress:flatpress (medium 5.4)
- [CVE-2024-3321](https://insights.sbomify.com/CVE-2024-3321/): SourceCodester eLearning System Maintenance Module cross site scripting (low 3.5)
- [CVE-2024-33209](https://insights.sbomify.com/CVE-2024-33209/): Cross-site scripting in flatpress:flatpress (medium 5.4)
- [CVE-2024-3320](https://insights.sbomify.com/CVE-2024-3320/): SourceCodester eLearning System cross site scripting (low 3.5)
- [CVE-2024-3319](https://insights.sbomify.com/CVE-2024-3319/): Security implication in SailPoint Identity Security Cloud IdentityProfile API Endpoints (critical 9.1)
- [CVE-2024-33182](https://insights.sbomify.com/CVE-2024-33182/): Memory corruption in tendacn:ac18 firmware (high 8.3)
- [CVE-2024-33181](https://insights.sbomify.com/CVE-2024-33181/): Memory corruption in tenda:ac18 firmware (high 8.8)
- [CVE-2024-33180](https://insights.sbomify.com/CVE-2024-33180/): Memory corruption in tendacn:ac18 firmware (critical 9.8)
- [CVE-2024-3318](https://insights.sbomify.com/CVE-2024-3318/): SailPoint Identity Security Cloud Connector File Path Traversal Vulnerability (medium 4.2)
- [CVE-2024-3317](https://insights.sbomify.com/CVE-2024-3317/): SailPoint Identity Security Cloud Improper Access Control (medium 6.5)
- [CVE-2024-33164](https://insights.sbomify.com/CVE-2024-33164/): SQL injection in j2eefast:j2eefast (critical 9.8)
- [CVE-2024-33161](https://insights.sbomify.com/CVE-2024-33161/): SQL injection in j2eefast:j2eefast (medium 5.3)
- [CVE-2024-3316](https://insights.sbomify.com/CVE-2024-3316/): SourceCodester Computer Laboratory Management System view_category.php sql injection (medium 6.3)
- [CVE-2024-33155](https://insights.sbomify.com/CVE-2024-33155/): SQL injection in j2eefast:j2eefast (critical 9.8)
- [CVE-2024-33153](https://insights.sbomify.com/CVE-2024-33153/): SQL injection in j2eefast:j2eefast (critical 9.8)
- [CVE-2024-3315](https://insights.sbomify.com/CVE-2024-3315/): SourceCodester Computer Laboratory Management System user.php sql injection (medium 6.3)
- [CVE-2024-33149](https://insights.sbomify.com/CVE-2024-33149/): SQL injection in j2eefast:j2eefast (high 8.1)
- [CVE-2024-33148](https://insights.sbomify.com/CVE-2024-33148/): SQL injection in j2eefast:j2eefast (high 7.3)
- [CVE-2024-33147](https://insights.sbomify.com/CVE-2024-33147/): SQL injection in j2eefast:j2eefast (high 8.8)
- [CVE-2024-33146](https://insights.sbomify.com/CVE-2024-33146/): SQL injection in j2eefast:j2eefast (critical 9.1)
- [CVE-2024-33144](https://insights.sbomify.com/CVE-2024-33144/): SQL injection in j2eefast:j2eefast (high 8.8)
- [CVE-2024-3314](https://insights.sbomify.com/CVE-2024-3314/): SourceCodester Computer Laboratory Management System Users.php sql injection (medium 6.3)
- [CVE-2024-33139](https://insights.sbomify.com/CVE-2024-33139/): SQL injection in j2eefast:j2eefast (high 7.5)
- [CVE-2024-3313](https://insights.sbomify.com/CVE-2024-3313/): SUBNET PowerSYSTEM Server and Substation Server Reliance on Insufficiently Trustworthy Component (high 8.6)
- [CVE-2024-33124](https://insights.sbomify.com/CVE-2024-33124/): SQL injection in roothub:roothub (critical 9.8)
- [CVE-2024-33122](https://insights.sbomify.com/CVE-2024-33122/): SQL injection in roothub:roothub (medium 6.3)
- [CVE-2024-33121](https://insights.sbomify.com/CVE-2024-33121/): SQL injection in roothub:roothub (medium 6.3)
- [CVE-2024-33120](https://insights.sbomify.com/CVE-2024-33120/): File upload in roothub:roothub (critical 9.8)
- [CVE-2024-3312](https://insights.sbomify.com/CVE-2024-3312/): Easy Custom Auto Excerpt <= 2.4.12 - Sensitive Information Exposure (medium 5.3)
- [CVE-2024-33118](https://insights.sbomify.com/CVE-2024-33118/): Path traversal in luckyframe:luckyframeweb (high 7.5)
- [CVE-2024-33117](https://insights.sbomify.com/CVE-2024-33117/): Server-side request forgery in crmeb:crmeb java (medium 5.3)
- [CVE-2024-33113](https://insights.sbomify.com/CVE-2024-33113/): Cross-site scripting in dlink:dir-845l firmware (medium 5.3)
- [CVE-2024-33112](https://insights.sbomify.com/CVE-2024-33112/): Command injection in dlink:dir-845l firmware (high 7.5)
- [CVE-2024-33111](https://insights.sbomify.com/CVE-2024-33111/): Cross-site scripting in dlink:dir-845l firmware (medium 5.4)
- [CVE-2024-33110](https://insights.sbomify.com/CVE-2024-33110/): Auth bypass in dlink:dir-845l firmware (critical 9.1)
- [CVE-2024-3311](https://insights.sbomify.com/CVE-2024-3311/): Dreamer CMS ThemesController.java ZipUtils.unZipFiles path traversal (medium 6.3)
- [CVE-2024-33109](https://insights.sbomify.com/CVE-2024-33109/): Path traversal in ergophone:tiptel ip 286 firmware (critical 9.9)
- [CVE-2024-33103](https://insights.sbomify.com/CVE-2024-33103/): An arbitrary file upload vulnerability in the Media Manager component of DokuWiki 2024-02-06a allows attackers to execute arbitrary code by (medium 6.1)
- [CVE-2024-33102](https://insights.sbomify.com/CVE-2024-33102/): Cross-site scripting in thinksaas:thinksaas (medium 5.4)
- [CVE-2024-33101](https://insights.sbomify.com/CVE-2024-33101/): Cross-site scripting in thinksaas:thinksaas (medium 6.1)
- [CVE-2024-3309](https://insights.sbomify.com/CVE-2024-3309/): Qi Addons For Elementor <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown widget (medium 6.4)
- [CVE-2024-3308](https://insights.sbomify.com/CVE-2024-3308/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 6.4)
- [CVE-2024-33078](https://insights.sbomify.com/CVE-2024-33078/): Memory corruption in tencent:libpag (critical 9.8)
- [CVE-2024-33073](https://insights.sbomify.com/CVE-2024-33073/): Buffer Over-read in WLAN Host Communication (high 8.2)
- [CVE-2024-33071](https://insights.sbomify.com/CVE-2024-33071/): Buffer Over-read in WLAN Host Communication (high 7.5)
- [CVE-2024-33070](https://insights.sbomify.com/CVE-2024-33070/): Buffer Over-read in WLAN Host Communication (high 7.5)
- [CVE-2024-3307](https://insights.sbomify.com/CVE-2024-3307/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 6.4)
- [CVE-2024-33069](https://insights.sbomify.com/CVE-2024-33069/): Use After Free in WLAN Host (high 7.5)
- [CVE-2024-33068](https://insights.sbomify.com/CVE-2024-33068/): Use After Free in WLAN Host Communication (high 7.5)
- [CVE-2024-33067](https://insights.sbomify.com/CVE-2024-33067/): Buffer Over-read in Audio (medium 6.1)
- [CVE-2024-33066](https://insights.sbomify.com/CVE-2024-33066/): Improper Input Validation in WLAN Resource Manager (critical 9.8)
- [CVE-2024-33065](https://insights.sbomify.com/CVE-2024-33065/): Improper Input Validation in Camera (high 8.4)
- [CVE-2024-33064](https://insights.sbomify.com/CVE-2024-33064/): Buffer Over-read in WLAN Host Communication (high 8.2)
- [CVE-2024-33063](https://insights.sbomify.com/CVE-2024-33063/): Integer Overflow or Wraparound in WLAN Host Communication (high 7.5)
- [CVE-2024-33061](https://insights.sbomify.com/CVE-2024-33061/): Buffer Over-read in DSP Service (medium 6.8)
- [CVE-2024-33060](https://insights.sbomify.com/CVE-2024-33060/): Use After Free in DSP Service (high 8.4)
- [CVE-2024-3306](https://insights.sbomify.com/CVE-2024-3306/): IDOR in Utarit Information's SoliClub (high 8.8)
- [CVE-2024-33059](https://insights.sbomify.com/CVE-2024-33059/): Use After Free in Computer Vision (medium 6.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/363/