# Vulnerabilities published in 2024 - [CVE-2024-31807](https://insights.sbomify.com/CVE-2024-31807/): Code injection in totolink:ex200 firmware (critical 9.8) - [CVE-2024-31806](https://insights.sbomify.com/CVE-2024-31806/): Missing authorization in totolink:ex200 firmware (medium 6.5) - [CVE-2024-31805](https://insights.sbomify.com/CVE-2024-31805/): Missing authorization in totolink:ex200 firmware (medium 6.5) - [CVE-2024-31804](https://insights.sbomify.com/CVE-2024-31804/): An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component. (medium 6.7) - [CVE-2024-31803](https://insights.sbomify.com/CVE-2024-31803/): Buffer Overflow vulnerability in emp-ot v.0.2.4 allows a remote attacker to execute arbitrary code via the FerretCOT::read_pre_data128_from_file function. (medium 6.2) - [CVE-2024-31802](https://insights.sbomify.com/CVE-2024-31802/): DESIGNA ABACUS v.18 and before allows an attacker to bypass the payment process via a crafted QR code. (medium 6.3) - [CVE-2024-31801](https://insights.sbomify.com/CVE-2024-31801/): Directory Traversal vulnerability in NEXSYS-ONE before v.Rev.15320 allows a remote attacker to obtain sensitive information via a crafted request. (high 7.5) - [CVE-2024-31800](https://insights.sbomify.com/CVE-2024-31800/): Auth bypass in gncchome:gncc c2 firmware (medium 6.8) - [CVE-2024-3180](https://insights.sbomify.com/CVE-2024-3180/): Concrete CMS Stored XSS in blocks of type file (low 3.1) - [CVE-2024-31799](https://insights.sbomify.com/CVE-2024-31799/): Information disclosure in gncchome:gncc c2 firmware (medium 4.6) - [CVE-2024-31798](https://insights.sbomify.com/CVE-2024-31798/): Hardcoded credentials in gncchome:gncc c2 firmware (medium 6.4) - [CVE-2024-3179](https://insights.sbomify.com/CVE-2024-3179/): Concrete CMS Stored XSS in the Custom Class page editing (low 3.1) - [CVE-2024-31784](https://insights.sbomify.com/CVE-2024-31784/): Code injection in typora:typora (medium 6.1) - [CVE-2024-31783](https://insights.sbomify.com/CVE-2024-31783/): Cross-site scripting in typora:typora (medium 6.1) - [CVE-2024-3178](https://insights.sbomify.com/CVE-2024-3178/): Concrete CMS Cross-site Scripting (XSS) in the Advanced File Search Filter (low 3.1) - [CVE-2024-31777](https://insights.sbomify.com/CVE-2024-31777/): File upload in openeclass:openeclass (critical 9.8) - [CVE-2024-31771](https://insights.sbomify.com/CVE-2024-31771/): Privilege escalation in totalav:totalav (high 7.8) - [CVE-2024-3177](https://insights.sbomify.com/CVE-2024-3177/): Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin (low 2.7) - [CVE-2024-31760](https://insights.sbomify.com/CVE-2024-31760/): An issue in sanluan flipped-aurora gin-vue-admin 2.4.x allows an attacker to escalate privileges via the Session Expiration component. (medium 4.7) - [CVE-2024-3176](https://insights.sbomify.com/CVE-2024-3176/): Memory corruption in Chrome (high 8.8) - [CVE-2024-31759](https://insights.sbomify.com/CVE-2024-31759/): Privilege escalation in publiccms:publiccms (high 8.8) - [CVE-2024-31757](https://insights.sbomify.com/CVE-2024-31757/): An issue in TeraByte Unlimited Image for Windows v.3.64.0.0 and before and fixed in v.4.0.0.0 allows a local attacker to escalate privileges (high 7.8) - [CVE-2024-31756](https://insights.sbomify.com/CVE-2024-31756/): An issue in MarvinTest Solutions Hardware Access Driver v.5.0.3.0 and before and fixed in v.5.0.4.0 allows a local attacker to escalate priv (high 7.8) - [CVE-2024-31755](https://insights.sbomify.com/CVE-2024-31755/): Null dereference in cjson project:cjson (high 7.6) - [CVE-2024-31750](https://insights.sbomify.com/CVE-2024-31750/): SQL injection in f-logic:datacube3 firmware (critical 9.8) - [CVE-2024-3175](https://insights.sbomify.com/CVE-2024-3175/): Privilege escalation in Chrome (high 8.8) - [CVE-2024-31747](https://insights.sbomify.com/CVE-2024-31747/): Security feature bypass in yealink:vp59 firmware (low 2.1) - [CVE-2024-31744](https://insights.sbomify.com/CVE-2024-31744/): In Jasper 4.2.2, the jpc_streamlist_remove function in src/libjasper/jpc/jpc_dec.c:2407 has an assertion failure vulnerability, allowing att (high 7.5) - [CVE-2024-31741](https://insights.sbomify.com/CVE-2024-31741/): Cross-site scripting in 1234n:minicms (medium 6.1) - [CVE-2024-3174](https://insights.sbomify.com/CVE-2024-3174/): Memory corruption in Chrome (high 8.8) - [CVE-2024-3173](https://insights.sbomify.com/CVE-2024-3173/): Privilege escalation in Chrome (high 7.8) - [CVE-2024-3172](https://insights.sbomify.com/CVE-2024-3172/): Code injection in Chrome (high 8.8) - [CVE-2024-31714](https://insights.sbomify.com/CVE-2024-31714/): Buffer Overflow vulnerability in Waxlab wax v.0.9-3 and before allows an attacker to cause a denial of service via the Lua library component. (high 7.5) - [CVE-2024-3171](https://insights.sbomify.com/CVE-2024-3171/): Use after free in Chrome (high 7.5) - [CVE-2024-31705](https://insights.sbomify.com/CVE-2024-31705/): An issue in Infotel Conseil GLPI v.10.X.X and after allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input. (critical 9.8) - [CVE-2024-3170](https://insights.sbomify.com/CVE-2024-3170/): Use after free in Chrome (high 8.8) - [CVE-2024-31695](https://insights.sbomify.com/CVE-2024-31695/): A misconfiguration in the fingerprint authentication mechanism of Binance: BTC, Crypto and NFTS v2.85.4, allows attackers to bypass authenti (critical 9.8) - [CVE-2024-3169](https://insights.sbomify.com/CVE-2024-3169/): Use after free in Chrome (high 8.8) - [CVE-2024-31684](https://insights.sbomify.com/CVE-2024-31684/): Incorrect access control in the fingerprint authentication mechanism of Bitdefender Mobile Security v4.11.3-gms allows attackers to bypass f (low 3.5) - [CVE-2024-31682](https://insights.sbomify.com/CVE-2024-31682/): Incorrect access control in the fingerprint authentication mechanism of Phone Cleaner: Boost & Clean v2.2.0 allows attackers to bypass finge (critical 9.8) - [CVE-2024-31680](https://insights.sbomify.com/CVE-2024-31680/): File Upload vulnerability in Shibang Communications Co., Ltd. (high 8.8) - [CVE-2024-3168](https://insights.sbomify.com/CVE-2024-3168/): Use after free in Chrome (high 8.8) - [CVE-2024-31678](https://insights.sbomify.com/CVE-2024-31678/): SQL injection in razormist:loan management system (critical 9.8) - [CVE-2024-31673](https://insights.sbomify.com/CVE-2024-31673/): SQL injection in kliqqi:kliqqi cms (critical 9.8) - [CVE-2024-31670](https://insights.sbomify.com/CVE-2024-31670/): Memory corruption in rizin:rizin (medium 6.3) - [CVE-2024-3167](https://insights.sbomify.com/CVE-2024-3167/): Ocean Extra <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4) - [CVE-2024-31669](https://insights.sbomify.com/CVE-2024-31669/): Denial of service in rizin:rizin (high 7.5) - [CVE-2024-31668](https://insights.sbomify.com/CVE-2024-31668/): Command injection in rizin:rizin (critical 9.1) - [CVE-2024-31666](https://insights.sbomify.com/CVE-2024-31666/): Code injection in flusity:flusity (critical 9.8) - [CVE-2024-3166](https://insights.sbomify.com/CVE-2024-3166/): Cross-Site Scripting (XSS) Vulnerability in mintplex-labs/anything-llm (low 3.4) - [CVE-2024-31652](https://insights.sbomify.com/CVE-2024-31652/): Cross-site scripting in oretnom23:cosmetics and beauty product online store (medium 6.1) - [CVE-2024-31651](https://insights.sbomify.com/CVE-2024-31651/): Cross-site scripting in oretnom23:cosmetics and beauty product online store (medium 6.1) - [CVE-2024-31650](https://insights.sbomify.com/CVE-2024-31650/): Cross-site scripting in oretnom23:cosmetics and beauty product online store (critical 9.6) - [CVE-2024-3165](https://insights.sbomify.com/CVE-2024-3165/): Database Credential Exposure in the Logs (medium 4.5) - [CVE-2024-31649](https://insights.sbomify.com/CVE-2024-31649/): Cross-site scripting in oretnom23:cosmetics and beauty product online store (medium 5.4) - [CVE-2024-31648](https://insights.sbomify.com/CVE-2024-31648/): Cross-site scripting in munyweki:insurance management system (medium 6.1) - [CVE-2024-3164](https://insights.sbomify.com/CVE-2024-3164/): Missing authorization in dotCMS core (medium 4.5) - [CVE-2024-31636](https://insights.sbomify.com/CVE-2024-31636/): LIEF obtain sensitive information via the name parameter (low 3.9) - [CVE-2024-31634](https://insights.sbomify.com/CVE-2024-31634/): Cross-site scripting in xunruicms:xunruicms (medium 6.1) - [CVE-2024-3163](https://insights.sbomify.com/CVE-2024-3163/): Easy Property Listings < 3.5.4 - Arbitrary Contact Deletion via CSRF (medium 4.3) - [CVE-2024-31621](https://insights.sbomify.com/CVE-2024-31621/): Flowise vulnerable to code injection via api/v1 (high 7.6) - [CVE-2024-3162](https://insights.sbomify.com/CVE-2024-3162/): Jeg Elementor Kit <= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial (medium 6.4) - [CVE-2024-31617](https://insights.sbomify.com/CVE-2024-31617/): Denial of service in litespeedtech:openlitespeed (medium 5.3) - [CVE-2024-31616](https://insights.sbomify.com/CVE-2024-31616/): An issue discovered in RG-RSR10-01G-T(W)-S and RG-RSR10-01G-T(WA)-S routers with firmware version RSR10-01G-T-S_RSR_3.0(1)B9P2, Release(0715 (high 8.8) - [CVE-2024-31615](https://insights.sbomify.com/CVE-2024-31615/): File upload in thinkcmf:thinkcmf (critical 9.8) - [CVE-2024-31613](https://insights.sbomify.com/CVE-2024-31613/): Cross-site request forgery in bosscms:bosscms (medium 5.4) - [CVE-2024-31612](https://insights.sbomify.com/CVE-2024-31612/): Cross-site request forgery in emlog:emlog (medium 5.4) - [CVE-2024-31611](https://insights.sbomify.com/CVE-2024-31611/): Other in seacms:seacms (critical 9.1) - [CVE-2024-31610](https://insights.sbomify.com/CVE-2024-31610/): File upload in code-projects:simple school management system (medium 6.3) - [CVE-2024-3161](https://insights.sbomify.com/CVE-2024-3161/): Jeg Elementor Kit <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (medium 6.4) - [CVE-2024-31609](https://insights.sbomify.com/CVE-2024-31609/): Cross-site scripting in bosscms:bosscms (high 7.1) - [CVE-2024-31601](https://insights.sbomify.com/CVE-2024-31601/): An issue in Beijing Panabit Network Software Co., Ltd Panalog big data analysis platform v. (critical 9.8) - [CVE-2024-3160](https://insights.sbomify.com/CVE-2024-3160/): Intelbras HDCVI 1016 HTTP GET Request cap.js information disclosure (medium 5.3) - [CVE-2024-3159](https://insights.sbomify.com/CVE-2024-3159/): Memory corruption in Chrome (high 8.8) - [CVE-2024-31587](https://insights.sbomify.com/CVE-2024-31587/): SecuSTATION Camera V2.5.5.3116-S50-SMA-B20160811A and lower allows an unauthenticated attacker to download device configuration files via a crafted request. (medium 6.5) - [CVE-2024-31586](https://insights.sbomify.com/CVE-2024-31586/): Cross-site scripting in oretnom23:computer laboratory management system (medium 6.1) - [CVE-2024-31585](https://insights.sbomify.com/CVE-2024-31585/): Memory corruption in fedoraproject:fedora (medium 5.3) - [CVE-2024-31584](https://insights.sbomify.com/CVE-2024-31584/): Memory corruption in linuxfoundation:pytorch (medium 5.5) - [CVE-2024-31583](https://insights.sbomify.com/CVE-2024-31583/): Pytorch use-after-free vulnerability (high 7.8) - [CVE-2024-31582](https://insights.sbomify.com/CVE-2024-31582/): Memory corruption in fedoraproject:fedora (high 7.8) - [CVE-2024-31581](https://insights.sbomify.com/CVE-2024-31581/): Memory corruption in fedoraproject:fedora (critical 9.8) - [CVE-2024-31580](https://insights.sbomify.com/CVE-2024-31580/): PyTorch heap buffer overflow vulnerability (medium 4.0) - [CVE-2024-3158](https://insights.sbomify.com/CVE-2024-3158/): Use after free in Chrome (high 8.8) - [CVE-2024-31578](https://insights.sbomify.com/CVE-2024-31578/): Use after free in fedoraproject:fedora (high 7.5) - [CVE-2024-31574](https://insights.sbomify.com/CVE-2024-31574/): Cross-site scripting in twcms:twcms (medium 5.0) - [CVE-2024-31573](https://insights.sbomify.com/CVE-2024-31573/): XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets (medium 4.0) - [CVE-2024-31570](https://insights.sbomify.com/CVE-2024-31570/): Memory corruption in freeimage project:freeimage (critical 9.8) - [CVE-2024-3157](https://insights.sbomify.com/CVE-2024-3157/): Memory corruption in Chrome (high 8.1) - [CVE-2024-3156](https://insights.sbomify.com/CVE-2024-3156/): Memory corruption in Chrome (high 8.8) - [CVE-2024-31556](https://insights.sbomify.com/CVE-2024-31556/): Reportico Web fails to invalidate cookies upon logout (high 7.8) - [CVE-2024-31552](https://insights.sbomify.com/CVE-2024-31552/): CuteHttpFileServer v.3.1 version has an arbitrary file download vulnerability, which allows attackers to download arbitrary files on the ser (high 7.1) - [CVE-2024-31551](https://insights.sbomify.com/CVE-2024-31551/): Path traversal in cmseasy:cmseasy (high 7.5) - [CVE-2024-3155](https://insights.sbomify.com/CVE-2024-3155/): Cross-site scripting in Post Grid (medium 6.4) - [CVE-2024-31547](https://insights.sbomify.com/CVE-2024-31547/): SQL injection in oretnom23:computer laboratory management system (critical 9.1) - [CVE-2024-31546](https://insights.sbomify.com/CVE-2024-31546/): SQL injection in oretnom23:computer laboratory management system (critical 9.8) - [CVE-2024-31545](https://insights.sbomify.com/CVE-2024-31545/): SQL injection in oretnom23:computer laboratory management system (critical 9.4) - [CVE-2024-31544](https://insights.sbomify.com/CVE-2024-31544/): Cross-site scripting in oretnom23:computer laboratory management system (medium 5.4) - [CVE-2024-3154](https://insights.sbomify.com/CVE-2024-3154/): Cri-o: arbitrary command injection via pod annotation (high 7.2) - [CVE-2024-3153](https://insights.sbomify.com/CVE-2024-3153/): Uncontrolled Resource Consumption in mintplex-labs/anything-llm (medium 6.5) - [CVE-2024-31525](https://insights.sbomify.com/CVE-2024-31525/): Peppermint Ticket Management 0.4.6 is vulnerable to Incorrect Access Control. (high 7.2) --- From sbomify Insights: https://insights.sbomify.com/years/2024/page/375/