# Vulnerabilities published in 2024


- [CVE-2024-28118](https://insights.sbomify.com/CVE-2024-28118/): Grav vulnerable to Server Side Template Injection (SSTI) (high 8.8)
- [CVE-2024-28117](https://insights.sbomify.com/CVE-2024-28117/): Grav vulnerable to Server Side Template Injection (SSTI) (high 8.8)
- [CVE-2024-28116](https://insights.sbomify.com/CVE-2024-28116/): Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass (high 8.8)
- [CVE-2024-28115](https://insights.sbomify.com/CVE-2024-28115/): Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabled (high 8.8)
- [CVE-2024-28114](https://insights.sbomify.com/CVE-2024-28114/): Remote Code Execution using Server Side Template Injection in Peering Manager (high 8.1)
- [CVE-2024-28113](https://insights.sbomify.com/CVE-2024-28113/): Open redirection using the return_url parameter in Peering Manager (low 3.5)
- [CVE-2024-28112](https://insights.sbomify.com/CVE-2024-28112/): Cross site scripting on router page in Peering Manager (medium 6.1)
- [CVE-2024-28111](https://insights.sbomify.com/CVE-2024-28111/): CSV Injection in exported history CSV files (medium 6.5)
- [CVE-2024-28110](https://insights.sbomify.com/CVE-2024-28110/): Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials (high 7.5)
- [CVE-2024-2811](https://insights.sbomify.com/CVE-2024-2811/): Tenda AC15 WifiWpsStart formWifiWpsStart stack-based overflow (high 8.8)
- [CVE-2024-28109](https://insights.sbomify.com/CVE-2024-28109/): Potential XSLT injection vulnerability when using policy files (high 8.1)
- [CVE-2024-28108](https://insights.sbomify.com/CVE-2024-28108/): phpMyFAQ Stored HTML Injection at contentLink (medium 4.7)
- [CVE-2024-28107](https://insights.sbomify.com/CVE-2024-28107/): phpMyFAQ SQL injections at insertentry & saveentry (high 8.8)
- [CVE-2024-28106](https://insights.sbomify.com/CVE-2024-28106/): phpMyFAQ Stored XSS at FAQ News Content (medium 4.3)
- [CVE-2024-28105](https://insights.sbomify.com/CVE-2024-28105/): phpMyFAQ's File Upload Bypass at Category Image Leads to RCE (high 7.2)
- [CVE-2024-28103](https://insights.sbomify.com/CVE-2024-28103/): Action Pack is missing security headers on non-HTML responses (medium 5.4)
- [CVE-2024-28102](https://insights.sbomify.com/CVE-2024-28102/): JWCrypto vulnerable to JWT bomb Attack in `deserialize` function (medium 6.8)
- [CVE-2024-28101](https://insights.sbomify.com/CVE-2024-28101/): Apollo Router's Compressed Payloads do not respect HTTP Payload Limits (high 7.5)
- [CVE-2024-28100](https://insights.sbomify.com/CVE-2024-28100/): Stored Cross-site Scripting leading to arbitrary actions taken on behalf of users in elabftw (high 8.9)
- [CVE-2024-2810](https://insights.sbomify.com/CVE-2024-2810/): Tenda AC15 WifiWpsOOB formWifiWpsOOB stack-based overflow (high 8.8)
- [CVE-2024-28099](https://insights.sbomify.com/CVE-2024-28099/): Other in VT STUDIO (high 7.8)
- [CVE-2024-28098](https://insights.sbomify.com/CVE-2024-28098/): Apache Pulsar: Improper Authorization For Topic-Level Policy Management (medium 6.4)
- [CVE-2024-28097](https://insights.sbomify.com/CVE-2024-28097/): Stored Cross-site Scripting in Calendar functionality in Schoolbox (high 7.3)
- [CVE-2024-28096](https://insights.sbomify.com/CVE-2024-28096/): Stored Cross-site Scripting in Class functionality in Schoolbox (high 7.3)
- [CVE-2024-28095](https://insights.sbomify.com/CVE-2024-28095/): Stored Cross-site Scripting in News functionality in Schoolbox (high 7.3)
- [CVE-2024-28094](https://insights.sbomify.com/CVE-2024-28094/): Blind SQL Injection in Chat functionality in Schoolbox (high 8.8)
- [CVE-2024-28093](https://insights.sbomify.com/CVE-2024-28093/): The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level account. (high 8.8)
- [CVE-2024-28092](https://insights.sbomify.com/CVE-2024-28092/): UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks vi (high 7.2)
- [CVE-2024-28091](https://insights.sbomify.com/CVE-2024-28091/): Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stor (medium 6.1)
- [CVE-2024-28090](https://insights.sbomify.com/CVE-2024-28090/): Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stor (medium 5.4)
- [CVE-2024-2809](https://insights.sbomify.com/CVE-2024-2809/): Tenda AC15 SetFirewallCfg formSetFirewallCfg stack-based overflow (high 8.8)
- [CVE-2024-28089](https://insights.sbomify.com/CVE-2024-28089/): Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel (medium 5.2)
- [CVE-2024-28088](https://insights.sbomify.com/CVE-2024-28088/): LangChain directory traversal vulnerability (high 8.1)
- [CVE-2024-28087](https://insights.sbomify.com/CVE-2024-28087/): Bonitasoft Runtime Community edition's contains an insecure direct object references vulnerability (medium 6.5)
- [CVE-2024-28085](https://insights.sbomify.com/CVE-2024-28085/): Other in debian:debian linux (low 3.3)
- [CVE-2024-28084](https://insights.sbomify.com/CVE-2024-28084/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2024-2808](https://insights.sbomify.com/CVE-2024-2808/): Tenda AC15 QuickIndex formQuickIndex stack-based overflow (high 8.8)
- [CVE-2024-28077](https://insights.sbomify.com/CVE-2024-28077/): Denial of service in gl-inet:a1300 firmware (high 7.5)
- [CVE-2024-28076](https://insights.sbomify.com/CVE-2024-28076/): SolarWinds Platform Arbitrary Open Redirection Vulnerability (high 7.0)
- [CVE-2024-28075](https://insights.sbomify.com/CVE-2024-28075/): SolarWinds ARM Deserialization of Untrusted Data Remote Code Execution (critical 9.0)
- [CVE-2024-28074](https://insights.sbomify.com/CVE-2024-28074/): SolarWinds Access Rights Manager (ARM) Internal Deserialization Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2024-28073](https://insights.sbomify.com/CVE-2024-28073/): SolarWinds Serv-U Directory Traversal Remote Code Execution Vulnerability (high 8.4)
- [CVE-2024-28072](https://insights.sbomify.com/CVE-2024-28072/): Arbitrary File Overwrite Vulnerability (medium 5.7)
- [CVE-2024-28070](https://insights.sbomify.com/CVE-2024-28070/): Cross-site scripting in mitel:micontact center business (medium 6.8)
- [CVE-2024-2807](https://insights.sbomify.com/CVE-2024-2807/): Tenda AC15 expandDlnaFile formExpandDlnaFile stack-based overflow (high 8.8)
- [CVE-2024-28069](https://insights.sbomify.com/CVE-2024-28069/): Misconfiguration in mitel:micontact center business (high 7.5)
- [CVE-2024-28068](https://insights.sbomify.com/CVE-2024-28068/): Null dereference in samsung:exynos 1080 firmware (medium 5.3)
- [CVE-2024-28067](https://insights.sbomify.com/CVE-2024-28067/): Security feature bypass in samsung:exynos modem 5300 firmware (medium 5.3)
- [CVE-2024-28066](https://insights.sbomify.com/CVE-2024-28066/): Hardcoded credentials in mitel:6905 firmware (high 8.8)
- [CVE-2024-28065](https://insights.sbomify.com/CVE-2024-28065/): In Unify CP IP Phone firmware 1.10.4.3, files are not encrypted and contain sensitive information such as the root password hash. (medium 5.9)
- [CVE-2024-28064](https://insights.sbomify.com/CVE-2024-28064/): Kiteworks Totemomail 7.x and 8.x before 8.3.0 allows /responsiveUI/EnvelopeOpenServlet messageId directory traversal for unauthenticated fil (critical 9.8)
- [CVE-2024-28063](https://insights.sbomify.com/CVE-2024-28063/): Cross-site scripting in totemo:totemomail (medium 6.1)
- [CVE-2024-28061](https://insights.sbomify.com/CVE-2024-28061/): An issue was discovered in Apiris Kafeo 6.4.4. (medium 6.3)
- [CVE-2024-28060](https://insights.sbomify.com/CVE-2024-28060/): An issue was discovered in Apiris Kafeo 6.4.4. (high 7.3)
- [CVE-2024-2806](https://insights.sbomify.com/CVE-2024-2806/): Tenda AC15 addWifiMacFilter stack-based overflow (high 8.8)
- [CVE-2024-28058](https://insights.sbomify.com/CVE-2024-28058/): In RSA NetWitness (NW) Platform before 12.5.1, even when an administrator revokes the access of a specific user with an active session, an i (high 7.5)
- [CVE-2024-28056](https://insights.sbomify.com/CVE-2024-28056/): AWS Amplify CLI has incorrect trust policy management (critical 9.8)
- [CVE-2024-28054](https://insights.sbomify.com/CVE-2024-28054/): Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some ma (high 7.4)
- [CVE-2024-28053](https://insights.sbomify.com/CVE-2024-28053/): Resource Exhaustion via the Invitation Feature (low 3.1)
- [CVE-2024-28052](https://insights.sbomify.com/CVE-2024-28052/): Other in WBR-6012 (medium 5.3)
- [CVE-2024-28051](https://insights.sbomify.com/CVE-2024-28051/): Memory corruption in Intel(R) VPL software (low 1.0)
- [CVE-2024-28050](https://insights.sbomify.com/CVE-2024-28050/): Missing authorization in Intel(R) Arc(TM) & Iris(R) Xe Graphics software (medium 5.1)
- [CVE-2024-2805](https://insights.sbomify.com/CVE-2024-2805/): Tenda AC15 SetSpeedWan formSetSpeedWan stack-based overflow (high 8.8)
- [CVE-2024-28049](https://insights.sbomify.com/CVE-2024-28049/): Denial of service in Intel(R) PROSet/Wireless Software and Intel(R) Killer(TM) Wi-Fi wireless products (medium 6.8)
- [CVE-2024-28048](https://insights.sbomify.com/CVE-2024-28048/): Command injection in ffBull (critical 9.8)
- [CVE-2024-28047](https://insights.sbomify.com/CVE-2024-28047/): Information disclosure in Intel(R) Processors (medium 6.8)
- [CVE-2024-28046](https://insights.sbomify.com/CVE-2024-28046/): Privilege escalation in Intel(R) GPA software (medium 5.4)
- [CVE-2024-28045](https://insights.sbomify.com/CVE-2024-28045/): Delta Electronics DIAEnergie Cross-site scripting (medium 4.6)
- [CVE-2024-28044](https://insights.sbomify.com/CVE-2024-28044/): Liteos-A has an integer overflow vulnerability (low 3.3)
- [CVE-2024-28042](https://insights.sbomify.com/CVE-2024-28042/): SUBNET PowerSYSTEM Center Reliance on Insufficiently Trustworthy Component (high 8.6)
- [CVE-2024-28041](https://insights.sbomify.com/CVE-2024-28041/): Command injection in HGW BL1500HM (high 8.8)
- [CVE-2024-28040](https://insights.sbomify.com/CVE-2024-28040/): Delta Electronics DIAEnergie SQL injection (high 8.8)
- [CVE-2024-2804](https://insights.sbomify.com/CVE-2024-2804/): Network Summary <= 2.0.11 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-28039](https://insights.sbomify.com/CVE-2024-28039/): XML external entity in FitNesse (medium 5.8)
- [CVE-2024-28038](https://insights.sbomify.com/CVE-2024-28038/): Memory corruption in Multiple MFPs (multifunction printers) (critical 9.0)
- [CVE-2024-28036](https://insights.sbomify.com/CVE-2024-28036/): Denial of service in Intel(R) Arc™ GPU (medium 5.7)
- [CVE-2024-28034](https://insights.sbomify.com/CVE-2024-28034/): Cross-site scripting in Mini Thread (medium 5.4)
- [CVE-2024-28033](https://insights.sbomify.com/CVE-2024-28033/): Command injection in WebProxy (high 7.3)
- [CVE-2024-28030](https://insights.sbomify.com/CVE-2024-28030/): Null dereference in Intel(R) VPL software (low 1.0)
- [CVE-2024-2803](https://insights.sbomify.com/CVE-2024-2803/): ElementsKit Elementor addons <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (medium 6.4)
- [CVE-2024-28029](https://insights.sbomify.com/CVE-2024-28029/): Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie (high 8.8)
- [CVE-2024-28028](https://insights.sbomify.com/CVE-2024-28028/): Other in Intel(R) Neural Compressor software (high 7.7)
- [CVE-2024-28027](https://insights.sbomify.com/CVE-2024-28027/): Command injection in MC LR Router (high 7.2)
- [CVE-2024-28026](https://insights.sbomify.com/CVE-2024-28026/): Command injection in MC LR Router (high 7.2)
- [CVE-2024-28025](https://insights.sbomify.com/CVE-2024-28025/): Command injection in MC LR Router (high 7.2)
- [CVE-2024-28024](https://insights.sbomify.com/CVE-2024-28024/): Information disclosure in FOXMAN-UN (medium 4.1)
- [CVE-2024-28023](https://insights.sbomify.com/CVE-2024-28023/): Information disclosure in FOXMAN-UN (medium 5.7)
- [CVE-2024-28022](https://insights.sbomify.com/CVE-2024-28022/): Auth bypass in FOXMAN-UN (medium 6.5)
- [CVE-2024-28021](https://insights.sbomify.com/CVE-2024-28021/): Security feature bypass in FOXMAN-UN (high 7.4)
- [CVE-2024-28020](https://insights.sbomify.com/CVE-2024-28020/): Auth bypass in FOXMAN-UN (high 8.0)
- [CVE-2024-28016](https://insights.sbomify.com/CVE-2024-28016/): Missing authorization in CR2500P (medium 6.0)
- [CVE-2024-28015](https://insights.sbomify.com/CVE-2024-28015/): Command injection in CR2500P (critical 9.8)
- [CVE-2024-28014](https://insights.sbomify.com/CVE-2024-28014/): Memory corruption in CR2500P (critical 9.8)
- [CVE-2024-28013](https://insights.sbomify.com/CVE-2024-28013/): Weak cryptography in CR2500P (medium 5.3)
- [CVE-2024-28012](https://insights.sbomify.com/CVE-2024-28012/): Auth bypass in CR2500P (critical 9.8)
- [CVE-2024-28011](https://insights.sbomify.com/CVE-2024-28011/): Command injection in CR2500P (critical 9.8)
- [CVE-2024-28010](https://insights.sbomify.com/CVE-2024-28010/): Hardcoded credentials in CR2500P (critical 9.8)
- [CVE-2024-2801](https://insights.sbomify.com/CVE-2024-2801/): Shopkeeper Extender <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-28009](https://insights.sbomify.com/CVE-2024-28009/): Auth bypass in CR2500P (critical 9.8)
- [CVE-2024-28008](https://insights.sbomify.com/CVE-2024-28008/): Command injection in CR2500P (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/401/