# Vulnerabilities published in 2024


- [CVE-2024-30979](https://insights.sbomify.com/CVE-2024-30979/): Cross-site scripting in phpgurukul:cyber cafe management system (medium 5.9)
- [CVE-2024-30977](https://insights.sbomify.com/CVE-2024-30977/): An issue in Secnet Security Network Intelligent AC Management System v.1.02.040 allows a local attacker to escalate privileges via the password component. (high 7.8)
- [CVE-2024-30974](https://insights.sbomify.com/CVE-2024-30974/): SQL injection in tramyardg:autoexpress (high 7.3)
- [CVE-2024-30973](https://insights.sbomify.com/CVE-2024-30973/): An issue in V-SOL G/EPON ONU HG323AC-B with firmware version V2.0.08-210715 allows an attacker to execute arbtirary code and obtain sensitiv (high 8.8)
- [CVE-2024-3097](https://insights.sbomify.com/CVE-2024-3097/): WordPress Gallery Plugin – NextGEN Gallery <= 3.59 - Missing Authorization to Unauthenticated Information Disclosure (medium 5.3)
- [CVE-2024-30965](https://insights.sbomify.com/CVE-2024-30965/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2024-30964](https://insights.sbomify.com/CVE-2024-30964/): Insecure Permissions vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allow (high 7.8)
- [CVE-2024-30963](https://insights.sbomify.com/CVE-2024-30963/): Buffer Overflow vulnerability in Open Robotics Robotic Operating System 2 (ROS2) navigation2- ROS2-humble and navigation 2-humble allows a l (high 7.8)
- [CVE-2024-30962](https://insights.sbomify.com/CVE-2024-30962/): Memory corruption in openrobotics:robot operating system (high 7.8)
- [CVE-2024-30961](https://insights.sbomify.com/CVE-2024-30961/): Code injection in openrobotics:robot operating system (high 7.8)
- [CVE-2024-3096](https://insights.sbomify.com/CVE-2024-3096/): PHP function password_verify can erroneously return true when argument contains NUL (medium 6.5)
- [CVE-2024-30953](https://insights.sbomify.com/CVE-2024-30953/): Cross-site scripting in htmly:htmly (medium 6.1)
- [CVE-2024-30952](https://insights.sbomify.com/CVE-2024-30952/): A stored cross-site scripting (XSS) vulnerability in PESCMS-TEAM v2.3.6 allows attackers to execute arbitrary web scripts or HTML via a craf (medium 6.1)
- [CVE-2024-30951](https://insights.sbomify.com/CVE-2024-30951/): Cross-site scripting in fudforum:fudforum (medium 6.1)
- [CVE-2024-30950](https://insights.sbomify.com/CVE-2024-30950/): Cross-site scripting in fudforum:fudforum (low 3.5)
- [CVE-2024-3095](https://insights.sbomify.com/CVE-2024-3095/): SSRF in Langchain Web Research Retriever in langchain-ai/langchain (medium 4.8)
- [CVE-2024-30949](https://insights.sbomify.com/CVE-2024-30949/): Memory corruption in newlib project:newlib (critical 9.8)
- [CVE-2024-30946](https://insights.sbomify.com/CVE-2024-30946/): Cross-site request forgery in dedecms:dedecms (medium 5.5)
- [CVE-2024-3094](https://insights.sbomify.com/CVE-2024-3094/): Xz: malicious code in distributed source (critical 10.0)
- [CVE-2024-30939](https://insights.sbomify.com/CVE-2024-30939/): Auth bypass in yealink:vp59 firmware (medium 6.8)
- [CVE-2024-30938](https://insights.sbomify.com/CVE-2024-30938/): SQL injection in sem-cms:semcms (critical 9.8)
- [CVE-2024-30931](https://insights.sbomify.com/CVE-2024-30931/): Stored Cross Site Scripting vulnerability in Emby Media Server Emby Media Server 4.8.3.0 allows a remote attacker to escalate privileges via (medium 6.1)
- [CVE-2024-30929](https://insights.sbomify.com/CVE-2024-30929/): Cross-site scripting in derbynet:derbynet (high 8.0)
- [CVE-2024-30928](https://insights.sbomify.com/CVE-2024-30928/): SQL injection in derbynet:derbynet (high 8.1)
- [CVE-2024-30927](https://insights.sbomify.com/CVE-2024-30927/): Cross-site scripting in derbynet:derbynet (medium 6.3)
- [CVE-2024-30926](https://insights.sbomify.com/CVE-2024-30926/): Cross-site scripting in derbynet:derbynet (medium 4.6)
- [CVE-2024-30925](https://insights.sbomify.com/CVE-2024-30925/): Cross-site scripting in derbynet:derbynet (medium 6.5)
- [CVE-2024-30924](https://insights.sbomify.com/CVE-2024-30924/): Cross-site scripting in derbynet:derbynet (medium 4.6)
- [CVE-2024-30923](https://insights.sbomify.com/CVE-2024-30923/): SQL injection in derbynet:derbynet (critical 9.8)
- [CVE-2024-30922](https://insights.sbomify.com/CVE-2024-30922/): SQL injection in derbynet:derbynet (critical 9.8)
- [CVE-2024-30921](https://insights.sbomify.com/CVE-2024-30921/): Cross-site scripting in derbynet:derbynet (medium 5.4)
- [CVE-2024-30920](https://insights.sbomify.com/CVE-2024-30920/): Cross-site scripting in derbynet:derbynet (high 7.4)
- [CVE-2024-3092](https://insights.sbomify.com/CVE-2024-3092/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2024-30917](https://insights.sbomify.com/CVE-2024-30917/): Memory corruption in eprosima:fast dds (medium 5.5)
- [CVE-2024-30916](https://insights.sbomify.com/CVE-2024-30916/): Denial of service in eprosima:fast dds (medium 4.0)
- [CVE-2024-30915](https://insights.sbomify.com/CVE-2024-30915/): Denial of service in objectcomputing:opendds (medium 4.3)
- [CVE-2024-3091](https://insights.sbomify.com/CVE-2024-3091/): PHPGurukul Emergency Ambulance Hiring Portal Search Request Page search.php cross site scripting (low 2.4)
- [CVE-2024-3090](https://insights.sbomify.com/CVE-2024-3090/): PHPGurukul Emergency Ambulance Hiring Portal Add Ambulance Page add-ambulance.php cross site scripting (low 2.4)
- [CVE-2024-30896](https://insights.sbomify.com/CVE-2024-30896/): InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with r (critical 9.1)
- [CVE-2024-30891](https://insights.sbomify.com/CVE-2024-30891/): Command injection in tenda:ac18 firmware (high 8.8)
- [CVE-2024-30890](https://insights.sbomify.com/CVE-2024-30890/): Cross-site scripting in ed01-cms project:ed01-cms (medium 4.7)
- [CVE-2024-3089](https://insights.sbomify.com/CVE-2024-3089/): PHPGurukul Emergency Ambulance Hiring Portal Manage Ambulance Page manage-ambulance.php cross-site request forgery (medium 4.3)
- [CVE-2024-30889](https://insights.sbomify.com/CVE-2024-30889/): Cross-site scripting in web-audimex:audimexee (medium 5.4)
- [CVE-2024-30886](https://insights.sbomify.com/CVE-2024-30886/): Cross-site scripting in hadsky:hadsky (medium 5.4)
- [CVE-2024-30885](https://insights.sbomify.com/CVE-2024-30885/): Cross-site scripting in hadsky:hadsky (medium 6.1)
- [CVE-2024-30884](https://insights.sbomify.com/CVE-2024-30884/): Cross-site scripting in discuz:discuzx (high 7.1)
- [CVE-2024-30883](https://insights.sbomify.com/CVE-2024-30883/): Cross-site scripting in rageframe:rageframe (medium 4.7)
- [CVE-2024-30880](https://insights.sbomify.com/CVE-2024-30880/): Cross-site scripting in rageframe:rageframe (medium 5.4)
- [CVE-2024-3088](https://insights.sbomify.com/CVE-2024-3088/): PHPGurukul Emergency Ambulance Hiring Portal Forgot Password Page forgot-password.php sql injection (high 7.3)
- [CVE-2024-30879](https://insights.sbomify.com/CVE-2024-30879/): Cross-site scripting in rageframe:rageframe (medium 6.1)
- [CVE-2024-30878](https://insights.sbomify.com/CVE-2024-30878/): Cross-site scripting in rageframe:rageframe (medium 6.1)
- [CVE-2024-30875](https://insights.sbomify.com/CVE-2024-30875/): Cross Site Scripting vulnerability in JavaScript Library jquery-ui v.1.13.1 allows a remote attacker to obtain sensitive information and exe (high 7.1)
- [CVE-2024-30872](https://insights.sbomify.com/CVE-2024-30872/): SQL injection in netentsec:ns-asg firmware (medium 5.1)
- [CVE-2024-30871](https://insights.sbomify.com/CVE-2024-30871/): SQL injection in netentsec:ns-asg firmware (high 8.8)
- [CVE-2024-30870](https://insights.sbomify.com/CVE-2024-30870/): SQL injection in netentsec:ns-asg firmware (high 8.8)
- [CVE-2024-3087](https://insights.sbomify.com/CVE-2024-3087/): PHPGurukul Emergency Ambulance Hiring Portal Ambulance Tracking Page ambulance-tracking.php sql injection (high 7.3)
- [CVE-2024-30868](https://insights.sbomify.com/CVE-2024-30868/): SQL injection in netentsec:ns-asg firmware (critical 9.8)
- [CVE-2024-30867](https://insights.sbomify.com/CVE-2024-30867/): SQL injection in netentsec:ns-asg firmware (critical 9.8)
- [CVE-2024-30866](https://insights.sbomify.com/CVE-2024-30866/): SQL injection in netentsec:ns-asg firmware (medium 5.4)
- [CVE-2024-30865](https://insights.sbomify.com/CVE-2024-30865/): SQL injection in netentsec:ns-asg firmware (critical 9.8)
- [CVE-2024-30864](https://insights.sbomify.com/CVE-2024-30864/): SQL injection in netentsec:ns-asg firmware (medium 6.3)
- [CVE-2024-30863](https://insights.sbomify.com/CVE-2024-30863/): SQL injection in netentsec:ns-asg firmware (medium 6.3)
- [CVE-2024-30862](https://insights.sbomify.com/CVE-2024-30862/): SQL injection in netentsec:ns-asg firmware (high 8.8)
- [CVE-2024-30861](https://insights.sbomify.com/CVE-2024-30861/): SQL injection in netentsec:ns-asg firmware (medium 5.3)
- [CVE-2024-30860](https://insights.sbomify.com/CVE-2024-30860/): SQL injection in netentsec:ns-asg firmware (high 8.8)
- [CVE-2024-3086](https://insights.sbomify.com/CVE-2024-3086/): PHPGurukul Emergency Ambulance Hiring Portal Ambulance Tracking Page ambulance-tracking.php cross site scripting (medium 4.3)
- [CVE-2024-30859](https://insights.sbomify.com/CVE-2024-30859/): SQL injection in netentsec:ns-asg firmware (high 8.8)
- [CVE-2024-30858](https://insights.sbomify.com/CVE-2024-30858/): SQL injection in netentsec:ns-asg firmware (critical 9.8)
- [CVE-2024-30855](https://insights.sbomify.com/CVE-2024-30855/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2024-30851](https://insights.sbomify.com/CVE-2024-30851/): Path traversal in codesiddhant:jasmin-ransomware (medium 6.5)
- [CVE-2024-3085](https://insights.sbomify.com/CVE-2024-3085/): PHPGurukul Emergency Ambulance Hiring Portal Admin Login Page login.php sql injection (high 7.3)
- [CVE-2024-30849](https://insights.sbomify.com/CVE-2024-30849/): File upload in donbermoy:complete e-commerce site (critical 9.8)
- [CVE-2024-30848](https://insights.sbomify.com/CVE-2024-30848/): Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject arbitrary web script (medium 6.1)
- [CVE-2024-30845](https://insights.sbomify.com/CVE-2024-30845/): Cross-site scripting in rainbow external link network disk project:rainbow external link network disk (medium 6.1)
- [CVE-2024-30840](https://insights.sbomify.com/CVE-2024-30840/): Memory corruption in tenda:ac15 firmware (medium 6.5)
- [CVE-2024-3084](https://insights.sbomify.com/CVE-2024-3084/): PHPGurukul Emergency Ambulance Hiring Portal Hire an Ambulance Page cross site scripting (medium 4.3)
- [CVE-2024-3083](https://insights.sbomify.com/CVE-2024-3083/): Cross-site request forgery in Sensor Net Connect V2 (high 8.3)
- [CVE-2024-3082](https://insights.sbomify.com/CVE-2024-3082/): Information disclosure in Sensor Net Connect V2 (medium 4.2)
- [CVE-2024-3081](https://insights.sbomify.com/CVE-2024-3081/): EasyCorp EasyAdmin Autocomplete autocomplete.js cross site scripting (low 3.5)
- [CVE-2024-30809](https://insights.sbomify.com/CVE-2024-30809/): Use after free in axiosys:bento4 (high 7.5)
- [CVE-2024-30808](https://insights.sbomify.com/CVE-2024-30808/): Use after free in axiosys:bento4 (low 2.7)
- [CVE-2024-30807](https://insights.sbomify.com/CVE-2024-30807/): Use after free in axiosys:bento4 (high 7.5)
- [CVE-2024-30806](https://insights.sbomify.com/CVE-2024-30806/): Memory corruption in axiosys:bento4 (medium 6.5)
- [CVE-2024-30804](https://insights.sbomify.com/CVE-2024-30804/): An issue discovered in the DeviceIoControl component in ASUS Fan_Xpert before v.10013 allows an attacker to execute arbitrary code via crafted IOCTL requests. (critical 9.8)
- [CVE-2024-30802](https://insights.sbomify.com/CVE-2024-30802/): An issue in Vehicle Management System 7.31.0.3_20230412 allows an attacker to escalate privileges via the login.html component. (critical 9.8)
- [CVE-2024-30801](https://insights.sbomify.com/CVE-2024-30801/): SQL Injection vulnerability in Cloud based customer service management platform v.1.0.0 allows a local attacker to execute arbitrary code vi (medium 5.5)
- [CVE-2024-30800](https://insights.sbomify.com/CVE-2024-30800/): Security feature bypass in dronecode:px4 drone autopilot (medium 5.6)
- [CVE-2024-3080](https://insights.sbomify.com/CVE-2024-3080/): ASUS Router - Improper Authentication (critical 9.8)
- [CVE-2024-30799](https://insights.sbomify.com/CVE-2024-30799/): Memory corruption in dronecode:px4 drone autopilot (medium 4.4)
- [CVE-2024-3079](https://insights.sbomify.com/CVE-2024-3079/): ASUS Router - Stack-based Buffer Overflow (high 7.2)
- [CVE-2024-3078](https://insights.sbomify.com/CVE-2024-3078/): Qdrant Full Snapshot REST API snapshots.rs path traversal (medium 5.5)
- [CVE-2024-3077](https://insights.sbomify.com/CVE-2024-3077/): Bluetooth: integer underflow in gatt_find_info_rsp (medium 6.8)
- [CVE-2024-3076](https://insights.sbomify.com/CVE-2024-3076/): MM-email2image <= 0.2.5 - Stored XSS via CSRF (low 3.8)
- [CVE-2024-3075](https://insights.sbomify.com/CVE-2024-3075/): MM-email2image <= 0.2.5 - Contributor+ Stored XSS (high 8.1)
- [CVE-2024-3074](https://insights.sbomify.com/CVE-2024-3074/): Elementor ImageBox <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-3073](https://insights.sbomify.com/CVE-2024-3073/): Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI (low 2.7)
- [CVE-2024-3072](https://insights.sbomify.com/CVE-2024-3072/): ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update (medium 4.3)
- [CVE-2024-3071](https://insights.sbomify.com/CVE-2024-3071/): ACF On-The-Go <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update (medium 4.3)
- [CVE-2024-3070](https://insights.sbomify.com/CVE-2024-3070/): Last Viewed Posts by WPBeginner <= 1.0.0 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2024-3068](https://insights.sbomify.com/CVE-2024-3068/): Custom Field Suite <= 2.6.5 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/381/