# Vulnerabilities published in 2024


- [CVE-2024-29471](https://insights.sbomify.com/CVE-2024-29471/): Cross-site scripting in zhyd:oneblog (medium 5.4)
- [CVE-2024-29470](https://insights.sbomify.com/CVE-2024-29470/): Cross-site scripting in zhyd:oneblog (medium 6.1)
- [CVE-2024-2947](https://insights.sbomify.com/CVE-2024-2947/): Cockpit: command injection when deleting a sosreport with a crafted name (high 7.3)
- [CVE-2024-29469](https://insights.sbomify.com/CVE-2024-29469/): Cross-site scripting in zhyd:oneblog (medium 6.1)
- [CVE-2024-29466](https://insights.sbomify.com/CVE-2024-29466/): Directory Traversal vulnerability in lsgwr spring boot online exam v.0.9 allows an attacker to execute arbitrary code via the FileTransUtil.java component. (high 8.8)
- [CVE-2024-29461](https://insights.sbomify.com/CVE-2024-29461/): Denial of service in projectfloodlight:open sdn controller (medium 6.3)
- [CVE-2024-29460](https://insights.sbomify.com/CVE-2024-29460/): Path traversal in dronecode:px4 drone autopilot (medium 6.6)
- [CVE-2024-2946](https://insights.sbomify.com/CVE-2024-2946/): Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (medium 6.4)
- [CVE-2024-2945](https://insights.sbomify.com/CVE-2024-2945/): Campcodes Online Examination System updateExaminee.php sql injection (medium 6.3)
- [CVE-2024-2944](https://insights.sbomify.com/CVE-2024-2944/): Campcodes Online Examination System deleteCourseExe.php sql injection (medium 6.3)
- [CVE-2024-29435](https://insights.sbomify.com/CVE-2024-29435/): Command injection in alldata:alldata (medium 4.1)
- [CVE-2024-29434](https://insights.sbomify.com/CVE-2024-29434/): Path traversal in alldata:alldata (high 8.3)
- [CVE-2024-29433](https://insights.sbomify.com/CVE-2024-29433/): Deserialization in alldata:alldata (critical 9.8)
- [CVE-2024-29432](https://insights.sbomify.com/CVE-2024-29432/): SQL injection in alldata:alldata (critical 9.8)
- [CVE-2024-2943](https://insights.sbomify.com/CVE-2024-2943/): Campcodes Online Examination System deleteExamExe.php sql injection (medium 6.3)
- [CVE-2024-29421](https://insights.sbomify.com/CVE-2024-29421/): xmedcon 0.23.0 and fixed in v.0.24.0 is vulnerable to Buffer Overflow via libs/dicom/basic.c which allows an attacker to execute arbitrary code. (medium 6.2)
- [CVE-2024-2942](https://insights.sbomify.com/CVE-2024-2942/): Campcodes Online Examination System deleteQuestionExe.php sql injection (medium 6.3)
- [CVE-2024-29419](https://insights.sbomify.com/CVE-2024-29419/): Cross-site scripting in totolink:x2000r firmware (medium 5.4)
- [CVE-2024-29417](https://insights.sbomify.com/CVE-2024-29417/): Insecure Permissions vulnerability in e-trust Horacius 1.0, 1.1, and 1.2 allows a local attacker to escalate privileges via the password reset function. (high 8.4)
- [CVE-2024-29415](https://insights.sbomify.com/CVE-2024-29415/): ip SSRF improper categorization in isPublic (high 8.1)
- [CVE-2024-29413](https://insights.sbomify.com/CVE-2024-29413/): Cross Site Scripting vulnerability in Webasyst v.2.9.9 allows a remote attacker to run arbitrary code via the Instant messenger field in the (medium 5.4)
- [CVE-2024-2941](https://insights.sbomify.com/CVE-2024-2941/): Campcodes Online Examination System loginExe.php sql injection (medium 6.3)
- [CVE-2024-29409](https://insights.sbomify.com/CVE-2024-29409/): nest allows a remote attacker to execute arbitrary code via the Content-Type header (medium 5.5)
- [CVE-2024-29404](https://insights.sbomify.com/CVE-2024-29404/): An issue in Razer Synapse 3 v.3.9.131.20813 and Synapse 3 App v.20240213 allows a local attacker to execute arbitrary code via the export pa (high 7.8)
- [CVE-2024-29402](https://insights.sbomify.com/CVE-2024-29402/): cskefu v7 suffers from Insufficient Session Expiration, which allows attackers to exploit the old session for malicious activity. (medium 4.3)
- [CVE-2024-29401](https://insights.sbomify.com/CVE-2024-29401/): Auth bypass in mindskip:xzs-mysql (critical 9.8)
- [CVE-2024-29400](https://insights.sbomify.com/CVE-2024-29400/): Information disclosure in ruoyi:ruoyi (high 7.5)
- [CVE-2024-2940](https://insights.sbomify.com/CVE-2024-2940/): Campcodes Online Examination System updateCourse.php cross site scripting (low 3.5)
- [CVE-2024-29399](https://insights.sbomify.com/CVE-2024-29399/): Code injection in gnu:savane (high 7.6)
- [CVE-2024-29392](https://insights.sbomify.com/CVE-2024-29392/): Silverpeas Core vulnerable to Cross Site Scripting (medium 5.4)
- [CVE-2024-29390](https://insights.sbomify.com/CVE-2024-29390/): SQL injection in anujk305:daily expenses management system (high 7.3)
- [CVE-2024-2939](https://insights.sbomify.com/CVE-2024-2939/): Campcodes Online Examination System updateExaminee.php cross site scripting (low 3.5)
- [CVE-2024-29387](https://insights.sbomify.com/CVE-2024-29387/): File upload in projeqtor:projeqtor (high 8.8)
- [CVE-2024-29386](https://insights.sbomify.com/CVE-2024-29386/): SQL injection in projeqtor:projeqtor (medium 5.4)
- [CVE-2024-29385](https://insights.sbomify.com/CVE-2024-29385/): Command injection in dlink:dir-845l firmware (critical 9.0)
- [CVE-2024-29384](https://insights.sbomify.com/CVE-2024-29384/): Information disclosure in mikegualtieri:css exfil protection (high 7.5)
- [CVE-2024-2938](https://insights.sbomify.com/CVE-2024-2938/): Campcodes Online Examination System updateCourse.php sql injection (medium 6.3)
- [CVE-2024-29376](https://insights.sbomify.com/CVE-2024-29376/): Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book (medium 6.4)
- [CVE-2024-29375](https://insights.sbomify.com/CVE-2024-29375/): CSV Injection vulnerability in Addactis IBNRS v.3.10.3.107 allows a remote attacker to execute arbitrary code via a crafted .ibnrs file to t (critical 9.8)
- [CVE-2024-29374](https://insights.sbomify.com/CVE-2024-29374/): Cross site scripting in moodle (medium 6.1)
- [CVE-2024-29371](https://insights.sbomify.com/CVE-2024-29371/): jose4j is vulnerable to DoS via compressed JWE content (high 7.5)
- [CVE-2024-29370](https://insights.sbomify.com/CVE-2024-29370/): Duplicate Advisory: python-jose denial of service via compressed JWE content (medium 5.3)
- [CVE-2024-2937](https://insights.sbomify.com/CVE-2024-2937/): Mali GPU Kernel Driver allows improper GPU memory processing operations (high 7.8)
- [CVE-2024-29368](https://insights.sbomify.com/CVE-2024-29368/): File upload in mozilo:mozilocms (medium 6.5)
- [CVE-2024-29366](https://insights.sbomify.com/CVE-2024-29366/): Command injection in dlink:dir-845l firmware (high 8.8)
- [CVE-2024-2936](https://insights.sbomify.com/CVE-2024-2936/): Sydney Toolbox <= 1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via _id (medium 6.4)
- [CVE-2024-2935](https://insights.sbomify.com/CVE-2024-2935/): SourceCodester Todo List in Kanban Board Add ToDo cross site scripting (medium 5.3)
- [CVE-2024-2934](https://insights.sbomify.com/CVE-2024-2934/): SourceCodester Todo List in Kanban Board delete-todo.php sql injection (medium 6.3)
- [CVE-2024-29338](https://insights.sbomify.com/CVE-2024-29338/): Cross-Site Request Forgery in Anchor CMS (low 2.4)
- [CVE-2024-2933](https://insights.sbomify.com/CVE-2024-2933/): Cross-site scripting in Page Builder Gutenberg Blocks – CoBlocks (medium 6.4)
- [CVE-2024-29320](https://insights.sbomify.com/CVE-2024-29320/): SQL injection in wallosapp:wallos (high 8.1)
- [CVE-2024-2932](https://insights.sbomify.com/CVE-2024-2932/): SourceCodester Online Chatting System update_room.php sql injection (medium 6.3)
- [CVE-2024-29319](https://insights.sbomify.com/CVE-2024-29319/): Server-side request forgery in personal-management-system:personal management system (low 3.8)
- [CVE-2024-29318](https://insights.sbomify.com/CVE-2024-29318/): Cross-site scripting in personal-management-system:personal management system (medium 5.4)
- [CVE-2024-29316](https://insights.sbomify.com/CVE-2024-29316/): Incorrect Access Control in NodeBB (medium 6.3)
- [CVE-2024-2931](https://insights.sbomify.com/CVE-2024-2931/): WPFront User Role Editor <= 3.2.1.11184 - Limited Information Exposure (medium 4.3)
- [CVE-2024-29309](https://insights.sbomify.com/CVE-2024-29309/): An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service. (high 7.7)
- [CVE-2024-29303](https://insights.sbomify.com/CVE-2024-29303/): SQL injection in mayurik:php task management system (critical 9.8)
- [CVE-2024-29302](https://insights.sbomify.com/CVE-2024-29302/): SQL injection in mayurik:php task management system (high 7.5)
- [CVE-2024-29301](https://insights.sbomify.com/CVE-2024-29301/): SQL injection in mayurik:php task management system (high 7.5)
- [CVE-2024-2930](https://insights.sbomify.com/CVE-2024-2930/): SourceCodester Music Gallery Site unrestricted upload (high 7.3)
- [CVE-2024-29296](https://insights.sbomify.com/CVE-2024-29296/): Portainer CE allows username enumeration through authentication response timing (medium 5.3)
- [CVE-2024-29292](https://insights.sbomify.com/CVE-2024-29292/): Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to exe (critical 9.1)
- [CVE-2024-29291](https://insights.sbomify.com/CVE-2024-29291/): An issue in Laravel Framework 8 through 11 might allow a remote attacker to discover database credentials in storage/logs/laravel.log. (not scored)
- [CVE-2024-2929](https://insights.sbomify.com/CVE-2024-2929/): Rockwell Automation Arena Simulation Vulnerable To Memory Corruption (high 7.8)
- [CVE-2024-2928](https://insights.sbomify.com/CVE-2024-2928/): Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow (high 7.5)
- [CVE-2024-29278](https://insights.sbomify.com/CVE-2024-29278/): funboot v1.1 is vulnerable to Cross Site Scripting (XSS) via the title field in "create a message ." (medium 6.5)
- [CVE-2024-29276](https://insights.sbomify.com/CVE-2024-29276/): An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDes (critical 9.8)
- [CVE-2024-29275](https://insights.sbomify.com/CVE-2024-29275/): SQL injection in seacms:seacms (critical 9.8)
- [CVE-2024-29273](https://insights.sbomify.com/CVE-2024-29273/): Cross-site scripting in dzzoffice:dzzoffice (medium 6.1)
- [CVE-2024-29272](https://insights.sbomify.com/CVE-2024-29272/): VvvebJs Arbitrary File Upload vulnerability (medium 6.5)
- [CVE-2024-29271](https://insights.sbomify.com/CVE-2024-29271/): VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability (medium 6.1)
- [CVE-2024-2927](https://insights.sbomify.com/CVE-2024-2927/): code-projects Mobile Shop Login Page Details.php sql injection (high 7.3)
- [CVE-2024-29269](https://insights.sbomify.com/CVE-2024-29269/): Command injection in telesquare:tlr-2005ksh firmware (high 8.8)
- [CVE-2024-2926](https://insights.sbomify.com/CVE-2024-2926/): Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Various Widgets (medium 6.4)
- [CVE-2024-2925](https://insights.sbomify.com/CVE-2024-2925/): Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder (medium 6.4)
- [CVE-2024-29244](https://insights.sbomify.com/CVE-2024-29244/): Memory corruption in szlbt:lbt-t300-mini1 firmware (medium 5.3)
- [CVE-2024-29243](https://insights.sbomify.com/CVE-2024-29243/): Memory corruption in szlbt:lbt-t300-mini1 firmware (critical 9.8)
- [CVE-2024-29241](https://insights.sbomify.com/CVE-2024-29241/): Missing authorization in Surveillance Station (critical 9.9)
- [CVE-2024-29240](https://insights.sbomify.com/CVE-2024-29240/): Missing authorization in Surveillance Station (medium 4.3)
- [CVE-2024-2924](https://insights.sbomify.com/CVE-2024-2924/): Creative Addons for Elementor <= 1.5.12 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-29239](https://insights.sbomify.com/CVE-2024-29239/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-29238](https://insights.sbomify.com/CVE-2024-29238/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-29237](https://insights.sbomify.com/CVE-2024-29237/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-29236](https://insights.sbomify.com/CVE-2024-29236/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-29235](https://insights.sbomify.com/CVE-2024-29235/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-29234](https://insights.sbomify.com/CVE-2024-29234/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-29233](https://insights.sbomify.com/CVE-2024-29233/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-29232](https://insights.sbomify.com/CVE-2024-29232/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-29231](https://insights.sbomify.com/CVE-2024-29231/): Other in Surveillance Station (medium 5.4)
- [CVE-2024-29230](https://insights.sbomify.com/CVE-2024-29230/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-2923](https://insights.sbomify.com/CVE-2024-2923/): Cross-site scripting in Magical Addons For Elementor ( Header Footer Builder, Free Elementor Widgets, Elementor Templates Library ) (medium 6.4)
- [CVE-2024-29229](https://insights.sbomify.com/CVE-2024-29229/): Missing authorization in Surveillance Station (high 7.7)
- [CVE-2024-29228](https://insights.sbomify.com/CVE-2024-29228/): Missing authorization in Surveillance Station (high 7.7)
- [CVE-2024-29227](https://insights.sbomify.com/CVE-2024-29227/): SQL injection in Surveillance Station (medium 5.4)
- [CVE-2024-29225](https://insights.sbomify.com/CVE-2024-29225/): Information disclosure in WMC-2LX-B (medium 4.3)
- [CVE-2024-29224](https://insights.sbomify.com/CVE-2024-29224/): Command injection in GoCast (critical 9.8)
- [CVE-2024-29223](https://insights.sbomify.com/CVE-2024-29223/): Privilege escalation in Intel(R) QuickAssist Technology software (medium 5.4)
- [CVE-2024-29222](https://insights.sbomify.com/CVE-2024-29222/): Memory corruption in Intel(R) Graphics Driver software (medium 5.8)
- [CVE-2024-29221](https://insights.sbomify.com/CVE-2024-29221/): Invite ID available to team admins even without the "Add Members" permission (medium 4.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/392/