# Vulnerabilities published in 2024


- [CVE-2024-28673](https://insights.sbomify.com/CVE-2024-28673/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2024-28672](https://insights.sbomify.com/CVE-2024-28672/): Cross-site request forgery in dedecms:dedecms (medium 5.4)
- [CVE-2024-28671](https://insights.sbomify.com/CVE-2024-28671/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2024-28670](https://insights.sbomify.com/CVE-2024-28670/): Cross-site request forgery in dedecms:dedecms (medium 6.1)
- [CVE-2024-2867](https://insights.sbomify.com/CVE-2024-2867/): Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 6.4)
- [CVE-2024-28669](https://insights.sbomify.com/CVE-2024-28669/): Cross-site request forgery in dedecms:dedecms (medium 5.4)
- [CVE-2024-28668](https://insights.sbomify.com/CVE-2024-28668/): Cross-site request forgery in dedecms:dedecms (medium 6.1)
- [CVE-2024-28667](https://insights.sbomify.com/CVE-2024-28667/): Cross-site request forgery in dedecms:dedecms (medium 6.1)
- [CVE-2024-28666](https://insights.sbomify.com/CVE-2024-28666/): Cross-site request forgery in dedecms:dedecms (medium 5.5)
- [CVE-2024-28665](https://insights.sbomify.com/CVE-2024-28665/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2024-28662](https://insights.sbomify.com/CVE-2024-28662/): Cross-site scripting in piwigo:piwigo (medium 5.4)
- [CVE-2024-2865](https://insights.sbomify.com/CVE-2024-2865/): SQLi in Mergen Soft Quality Management System (critical 9.8)
- [CVE-2024-28640](https://insights.sbomify.com/CVE-2024-28640/): Memory corruption in totolink:a7000r firmware (high 7.5)
- [CVE-2024-2864](https://insights.sbomify.com/CVE-2024-2864/): WordPress Youzify - Buddypress Moderation plugin <= 1.2.5 - Unauthenticated Cross Site Scripting (XSS) vulnerability (high 7.3)
- [CVE-2024-28639](https://insights.sbomify.com/CVE-2024-28639/): Memory corruption in totolink:a7000r firmware (critical 9.8)
- [CVE-2024-28635](https://insights.sbomify.com/CVE-2024-28635/): Cross-site scripting in Survey Creator (medium 6.1)
- [CVE-2024-2863](https://insights.sbomify.com/CVE-2024-2863/): Path traversal via file upload on LG LED Assistant (medium 5.3)
- [CVE-2024-28627](https://insights.sbomify.com/CVE-2024-28627/): An issue in Flipsnack v.18/03/2024 allows a local attacker to obtain sensitive information via the reader.gz.js file. (high 7.5)
- [CVE-2024-28623](https://insights.sbomify.com/CVE-2024-28623/): Cross-site scripting in ritecms:ritecms (medium 6.1)
- [CVE-2024-2862](https://insights.sbomify.com/CVE-2024-2862/): Password reset vulnerability without authorization on LG LED Assistant (critical 9.1)
- [CVE-2024-28613](https://insights.sbomify.com/CVE-2024-28613/): SQL injection in mayurik:php task management system (critical 9.8)
- [CVE-2024-2861](https://insights.sbomify.com/CVE-2024-2861/): ProfilePress <= 4.15.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ProfilePress User Panel Widget (medium 6.4)
- [CVE-2024-28607](https://insights.sbomify.com/CVE-2024-28607/): Server-side request forgery in IP-Utils (low 2.9)
- [CVE-2024-2860](https://insights.sbomify.com/CVE-2024-2860/): Auth bypass in Brocade SAnnav (high 7.8)
- [CVE-2024-28595](https://insights.sbomify.com/CVE-2024-28595/): SQL injection in walterjnr1:employee management system (critical 9.8)
- [CVE-2024-28593](https://insights.sbomify.com/CVE-2024-28593/): Cross-site Scripting in Moodle Chat (medium 5.4)
- [CVE-2024-2859](https://insights.sbomify.com/CVE-2024-2859/): By default, SANnav OVA is shipped with root user login enabled (CVE-2024-2859) (medium 6.8)
- [CVE-2024-28589](https://insights.sbomify.com/CVE-2024-28589/): An issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbi (medium 6.7)
- [CVE-2024-28584](https://insights.sbomify.com/CVE-2024-28584/): Null dereference in freeimage project:freeimage (low 3.3)
- [CVE-2024-28583](https://insights.sbomify.com/CVE-2024-28583/): Memory corruption in freeimage project:freeimage (high 7.8)
- [CVE-2024-28582](https://insights.sbomify.com/CVE-2024-28582/): Memory corruption in freeimage project:freeimage (high 8.4)
- [CVE-2024-28581](https://insights.sbomify.com/CVE-2024-28581/): Memory corruption in freeimage project:freeimage (high 8.4)
- [CVE-2024-28580](https://insights.sbomify.com/CVE-2024-28580/): Memory corruption in freeimage project:freeimage (high 8.4)
- [CVE-2024-2858](https://insights.sbomify.com/CVE-2024-2858/): Simple Buttons Creator <= 1.04 - Aribtrary Button Deletion via CSRF (medium 4.8)
- [CVE-2024-28579](https://insights.sbomify.com/CVE-2024-28579/): Memory corruption in freeimage project:freeimage (medium 6.2)
- [CVE-2024-28578](https://insights.sbomify.com/CVE-2024-28578/): Memory corruption in freeimage project:freeimage (high 8.4)
- [CVE-2024-28577](https://insights.sbomify.com/CVE-2024-28577/): Null dereference in freeimage project:freeimage (medium 5.5)
- [CVE-2024-28576](https://insights.sbomify.com/CVE-2024-28576/): Memory corruption in freeimage project:freeimage (medium 5.5)
- [CVE-2024-28575](https://insights.sbomify.com/CVE-2024-28575/): Memory corruption in freeimage project:freeimage (high 8.4)
- [CVE-2024-28574](https://insights.sbomify.com/CVE-2024-28574/): Memory corruption in freeimage project:freeimage (medium 6.2)
- [CVE-2024-28573](https://insights.sbomify.com/CVE-2024-28573/): Memory corruption in freeimage project:freeimage (medium 6.2)
- [CVE-2024-28572](https://insights.sbomify.com/CVE-2024-28572/): Memory corruption in freeimage project:freeimage (medium 6.2)
- [CVE-2024-28571](https://insights.sbomify.com/CVE-2024-28571/): Memory corruption in freeimage project:freeimage (medium 5.5)
- [CVE-2024-28570](https://insights.sbomify.com/CVE-2024-28570/): Memory corruption in freeimage project:freeimage (medium 5.5)
- [CVE-2024-2857](https://insights.sbomify.com/CVE-2024-2857/): Simple Buttons Creator <= 1.04 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-28569](https://insights.sbomify.com/CVE-2024-28569/): Memory corruption in freeimage project:freeimage (high 7.8)
- [CVE-2024-28568](https://insights.sbomify.com/CVE-2024-28568/): Memory corruption in freeimage project:freeimage (high 8.4)
- [CVE-2024-28567](https://insights.sbomify.com/CVE-2024-28567/): Memory corruption in freeimage project:freeimage (medium 6.2)
- [CVE-2024-28566](https://insights.sbomify.com/CVE-2024-28566/): Memory corruption in freeimage project:freeimage (high 8.4)
- [CVE-2024-28565](https://insights.sbomify.com/CVE-2024-28565/): Memory corruption in freeimage project:freeimage (medium 5.5)
- [CVE-2024-28564](https://insights.sbomify.com/CVE-2024-28564/): Memory corruption in freeimage project:freeimage (medium 6.2)
- [CVE-2024-28563](https://insights.sbomify.com/CVE-2024-28563/): Memory corruption in freeimage project:freeimage (medium 5.9)
- [CVE-2024-28562](https://insights.sbomify.com/CVE-2024-28562/): Memory corruption in freeimage project:freeimage (medium 6.8)
- [CVE-2024-28560](https://insights.sbomify.com/CVE-2024-28560/): SQL injection in niushop:b2b2c multi-business (medium 5.4)
- [CVE-2024-2856](https://insights.sbomify.com/CVE-2024-2856/): Tenda AC10 SetSysTimeCfg fromSetSysTime stack-based overflow (high 8.8)
- [CVE-2024-28559](https://insights.sbomify.com/CVE-2024-28559/): SQL injection in niushop:b2b2c multi-business (high 8.8)
- [CVE-2024-28558](https://insights.sbomify.com/CVE-2024-28558/): SQL injection in mayurik:petrol pump management (high 8.8)
- [CVE-2024-28557](https://insights.sbomify.com/CVE-2024-28557/): SQL injection in mayurik:php task management system (critical 9.8)
- [CVE-2024-28556](https://insights.sbomify.com/CVE-2024-28556/): SQL injection in mayurik:php task management system (critical 9.8)
- [CVE-2024-28553](https://insights.sbomify.com/CVE-2024-28553/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-28551](https://insights.sbomify.com/CVE-2024-28551/): Memory corruption in tenda:ac18 firmware (high 7.5)
- [CVE-2024-28550](https://insights.sbomify.com/CVE-2024-28550/): Memory corruption in tenda:ac18 firmware (medium 4.3)
- [CVE-2024-2855](https://insights.sbomify.com/CVE-2024-2855/): Tenda AC15 SetSysTimeCfg fromSetSysTime stack-based overflow (high 8.8)
- [CVE-2024-28547](https://insights.sbomify.com/CVE-2024-28547/): Memory corruption in tenda:ac18 firmware (medium 6.5)
- [CVE-2024-28545](https://insights.sbomify.com/CVE-2024-28545/): Command injection in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-2854](https://insights.sbomify.com/CVE-2024-2854/): Tenda AC18 setsambacfg formSetSambaConf os command injection (medium 6.3)
- [CVE-2024-28537](https://insights.sbomify.com/CVE-2024-28537/): Memory corruption in tenda:ac18 firmware (critical 9.8)
- [CVE-2024-28535](https://insights.sbomify.com/CVE-2024-28535/): Memory corruption in tenda:ac18 firmware (high 8.0)
- [CVE-2024-2853](https://insights.sbomify.com/CVE-2024-2853/): Tenda AC10U setsambacfg formSetSambaConf os command injection (medium 6.3)
- [CVE-2024-28521](https://insights.sbomify.com/CVE-2024-28521/): SQL injection in netentsec:application security gateway firmware (high 7.8)
- [CVE-2024-28520](https://insights.sbomify.com/CVE-2024-28520/): File Upload vulnerability in Byzoro Networks Smart multi-service security gateway intelligent management platform version S210, allows an at (medium 6.5)
- [CVE-2024-2852](https://insights.sbomify.com/CVE-2024-2852/): Tenda AC15 saveParentControlInfo stack-based overflow (high 8.8)
- [CVE-2024-28519](https://insights.sbomify.com/CVE-2024-28519/): A kernel handle leak issue in ProcObsrvesx.sys 4.0.0.49 in MicroWorld Technologies Inc eScan Antivirus could allow privilege escalation for low-privileged users. (high 7.8)
- [CVE-2024-28515](https://insights.sbomify.com/CVE-2024-28515/): Buffer Overflow vulnerability in CSAPP_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of cs (critical 9.8)
- [CVE-2024-2851](https://insights.sbomify.com/CVE-2024-2851/): Tenda AC15 setsambacfg formSetSambaConf os command injection (medium 6.3)
- [CVE-2024-2850](https://insights.sbomify.com/CVE-2024-2850/): Tenda AC15 saveParentControlInfo stack-based overflow (high 8.8)
- [CVE-2024-2849](https://insights.sbomify.com/CVE-2024-2849/): SourceCodester Simple File Manager unrestricted upload (medium 6.3)
- [CVE-2024-2848](https://insights.sbomify.com/CVE-2024-2848/): Responsive <= 5.0.2 - Missing Authorization to HTML Injection (high 7.5)
- [CVE-2024-2847](https://insights.sbomify.com/CVE-2024-2847/): WordPress File Upload <= 4.24.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-2846](https://insights.sbomify.com/CVE-2024-2846/): Visual Footer Credit Remover <= 1.2 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-28458](https://insights.sbomify.com/CVE-2024-28458/): Null dereference in swftools:swftools (high 7.5)
- [CVE-2024-28456](https://insights.sbomify.com/CVE-2024-28456/): Cross-site scripting in campcodes:online marriage registration system (critical 9.0)
- [CVE-2024-2845](https://insights.sbomify.com/CVE-2024-2845/): Cross-site scripting in BetterDocs – Knowledge Base Docs & FAQ Solution for Elementor & Block Editor (medium 6.4)
- [CVE-2024-28447](https://insights.sbomify.com/CVE-2024-28447/): Memory corruption in szlbt:lbt-t300-mini1 firmware (medium 6.5)
- [CVE-2024-28446](https://insights.sbomify.com/CVE-2024-28446/): Memory corruption in szlbt:lbt-t300-mini1 firmware (medium 5.7)
- [CVE-2024-28442](https://insights.sbomify.com/CVE-2024-28442/): Path traversal in yealink:vp59 firmware (high 7.5)
- [CVE-2024-28441](https://insights.sbomify.com/CVE-2024-28441/): File upload in magicflue:magicflue (critical 9.8)
- [CVE-2024-2844](https://insights.sbomify.com/CVE-2024-2844/): Easy Appointments <= 3.11.18 - Insufficient Authorization (medium 4.3)
- [CVE-2024-28436](https://insights.sbomify.com/CVE-2024-28436/): Cross Site Scripting vulnerability in D-Link DAP products DAP-2230, DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2590, DAP-2690, DAP-2695, DA (medium 6.1)
- [CVE-2024-28435](https://insights.sbomify.com/CVE-2024-28435/): Server-side request forgery in twenty:twenty (medium 5.4)
- [CVE-2024-28434](https://insights.sbomify.com/CVE-2024-28434/): Cross-site scripting in twenty:twenty (high 7.6)
- [CVE-2024-28432](https://insights.sbomify.com/CVE-2024-28432/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2024-28431](https://insights.sbomify.com/CVE-2024-28431/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2024-28430](https://insights.sbomify.com/CVE-2024-28430/): Cross-site request forgery in dedecms:dedecms (medium 6.1)
- [CVE-2024-2843](https://insights.sbomify.com/CVE-2024-2843/): WooCommerce Customers Manager < 30.1 - User Deletion via CSRF (medium 6.5)
- [CVE-2024-28429](https://insights.sbomify.com/CVE-2024-28429/): Cross-site request forgery in dedecms:dedecms (medium 5.5)
- [CVE-2024-28425](https://insights.sbomify.com/CVE-2024-28425/): File upload in linkedin:greykite (high 7.5)
- [CVE-2024-28424](https://insights.sbomify.com/CVE-2024-28424/): Deserialization in zenml:zenml (high 8.8)
- [CVE-2024-28423](https://insights.sbomify.com/CVE-2024-28423/): File upload in feluelle:airflow-diagrams (critical 9.8)
- [CVE-2024-28421](https://insights.sbomify.com/CVE-2024-28421/): SQL injection in cobub:razor (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/398/