# Vulnerabilities published in 2024


- [CVE-2024-27813](https://insights.sbomify.com/CVE-2024-27813/): Privilege escalation in macOS (medium 5.3)
- [CVE-2024-27812](https://insights.sbomify.com/CVE-2024-27812/): Denial of service in visionOS (high 7.5)
- [CVE-2024-27811](https://insights.sbomify.com/CVE-2024-27811/): Privilege escalation in iOS and iPadOS (critical 9.1)
- [CVE-2024-27810](https://insights.sbomify.com/CVE-2024-27810/): Path traversal in iOS and iPadOS (critical 9.8)
- [CVE-2024-2781](https://insights.sbomify.com/CVE-2024-2781/): Cross-site scripting in Elementor Website Builder Pro (medium 6.4)
- [CVE-2024-27809](https://insights.sbomify.com/CVE-2024-27809/): Information disclosure in macOS (medium 5.5)
- [CVE-2024-27808](https://insights.sbomify.com/CVE-2024-27808/): Memory corruption in Safari (high 7.5)
- [CVE-2024-27807](https://insights.sbomify.com/CVE-2024-27807/): Security feature bypass in iOS and iPadOS (medium 4.3)
- [CVE-2024-27806](https://insights.sbomify.com/CVE-2024-27806/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-27805](https://insights.sbomify.com/CVE-2024-27805/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-27804](https://insights.sbomify.com/CVE-2024-27804/): Denial of service in iOS and iPadOS (high 8.1)
- [CVE-2024-27803](https://insights.sbomify.com/CVE-2024-27803/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2024-27802](https://insights.sbomify.com/CVE-2024-27802/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2024-27801](https://insights.sbomify.com/CVE-2024-27801/): Privilege escalation in iOS and iPadOS (high 8.4)
- [CVE-2024-27800](https://insights.sbomify.com/CVE-2024-27800/): Denial of service in iOS and iPadOS (high 7.1)
- [CVE-2024-2780](https://insights.sbomify.com/CVE-2024-2780/): Campcodes Online Marriage Registration System admin-profile.php cross site scripting (low 3.5)
- [CVE-2024-27799](https://insights.sbomify.com/CVE-2024-27799/): Missing authorization in iOS and iPadOS (low 3.3)
- [CVE-2024-27798](https://insights.sbomify.com/CVE-2024-27798/): Privilege escalation in macOS (high 7.8)
- [CVE-2024-27796](https://insights.sbomify.com/CVE-2024-27796/): Privilege escalation in iOS and iPadOS (high 8.1)
- [CVE-2024-27795](https://insights.sbomify.com/CVE-2024-27795/): Security feature bypass in macOS (high 7.5)
- [CVE-2024-27794](https://insights.sbomify.com/CVE-2024-27794/): Cross-site scripting in FileMaker Server (medium 4.3)
- [CVE-2024-27793](https://insights.sbomify.com/CVE-2024-27793/): Code injection in iTunes for Windows (medium 6.3)
- [CVE-2024-27792](https://insights.sbomify.com/CVE-2024-27792/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-27791](https://insights.sbomify.com/CVE-2024-27791/): Memory corruption in iOS and iPadOS (medium 5.8)
- [CVE-2024-27790](https://insights.sbomify.com/CVE-2024-27790/): Missing authorization in FileMaker Server (high 7.5)
- [CVE-2024-2779](https://insights.sbomify.com/CVE-2024-2779/): Campcodes Online Marriage Registration System application-bwdates-reports-details.php cross site scripting (low 3.5)
- [CVE-2024-27789](https://insights.sbomify.com/CVE-2024-27789/): Business logic in iOS and iPadOS (medium 5.3)
- [CVE-2024-27785](https://insights.sbomify.com/CVE-2024-27785/): Code injection in FortiAIOps (medium 5.1)
- [CVE-2024-27784](https://insights.sbomify.com/CVE-2024-27784/): Information disclosure in FortiAIOps (high 8.3)
- [CVE-2024-27783](https://insights.sbomify.com/CVE-2024-27783/): Cross-site request forgery in FortiAIOps (high 7.2)
- [CVE-2024-27782](https://insights.sbomify.com/CVE-2024-27782/): Auth bypass in FortiAIOps (high 7.7)
- [CVE-2024-27781](https://insights.sbomify.com/CVE-2024-27781/): Cross-site scripting in FortiSandbox (medium 6.9)
- [CVE-2024-27780](https://insights.sbomify.com/CVE-2024-27780/): Cross-site scripting in FortiSIEM (low 2.2)
- [CVE-2024-2778](https://insights.sbomify.com/CVE-2024-2778/): Campcodes Online Marriage Registration System search.php cross site scripting (low 3.5)
- [CVE-2024-27779](https://insights.sbomify.com/CVE-2024-27779/): Auth bypass in FortiIsolator (medium 6.3)
- [CVE-2024-27778](https://insights.sbomify.com/CVE-2024-27778/): Command injection in FortiSandbox (high 8.3)
- [CVE-2024-27776](https://insights.sbomify.com/CVE-2024-27776/): MileSight DeviceHub - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (critical 9.8)
- [CVE-2024-27775](https://insights.sbomify.com/CVE-2024-27775/): SysAid - CWE-918: Server-Side Request Forgery (SSRF) (high 7.2)
- [CVE-2024-27774](https://insights.sbomify.com/CVE-2024-27774/): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded Password (high 7.5)
- [CVE-2024-27773](https://insights.sbomify.com/CVE-2024-27773/): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Source (high 8.8)
- [CVE-2024-27772](https://insights.sbomify.com/CVE-2024-27772/): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-78: 'OS Command Injection' (high 8.8)
- [CVE-2024-27771](https://insights.sbomify.com/CVE-2024-27771/): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-22: 'Path Traversal' (high 8.8)
- [CVE-2024-27770](https://insights.sbomify.com/CVE-2024-27770/): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-23: Relative Path Traversal (high 8.8)
- [CVE-2024-2777](https://insights.sbomify.com/CVE-2024-2777/): Campcodes/PHPGurukul Online Marriage Registration System application-bwdates-reports-details.php sql injection (medium 5.3)
- [CVE-2024-27769](https://insights.sbomify.com/CVE-2024-27769/): Information disclosure in Unistream Unilogic (high 8.8)
- [CVE-2024-27768](https://insights.sbomify.com/CVE-2024-27768/): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-22: 'Path Traversal' (critical 9.8)
- [CVE-2024-27767](https://insights.sbomify.com/CVE-2024-27767/): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-287: Improper Authentication (critical 10.0)
- [CVE-2024-27766](https://insights.sbomify.com/CVE-2024-27766/): Code injection in mariadb:mariadb (medium 5.7)
- [CVE-2024-27765](https://insights.sbomify.com/CVE-2024-27765/): Path traversal in jeewms:jeewms (medium 5.3)
- [CVE-2024-27764](https://insights.sbomify.com/CVE-2024-27764/): Privilege escalation in jeewms:jeewms (critical 9.8)
- [CVE-2024-27763](https://insights.sbomify.com/CVE-2024-27763/): XPixelGroup BasicSR Command Injection (medium 5.3)
- [CVE-2024-2776](https://insights.sbomify.com/CVE-2024-2776/): Campcodes Online Marriage Registration System search.php sql injection (medium 6.3)
- [CVE-2024-27758](https://insights.sbomify.com/CVE-2024-27758/): RPyC's missing security check results in code execution when using numpy.array on the server-side. (high 8.4)
- [CVE-2024-27757](https://insights.sbomify.com/CVE-2024-27757/): Cross-site scripting in flusity:flusity (medium 6.1)
- [CVE-2024-27756](https://insights.sbomify.com/CVE-2024-27756/): Code injection in glpi-project:glpi (high 8.8)
- [CVE-2024-27752](https://insights.sbomify.com/CVE-2024-27752/): Cross-site scripting in cszcms:csz cms (medium 5.4)
- [CVE-2024-2775](https://insights.sbomify.com/CVE-2024-2775/): Campcodes Online Marriage Registration System user-profile.php cross site scripting (low 3.5)
- [CVE-2024-27747](https://insights.sbomify.com/CVE-2024-27747/): File upload in mayurik:petrol pump management (critical 9.8)
- [CVE-2024-27746](https://insights.sbomify.com/CVE-2024-27746/): SQL injection in mayurik:petrol pump management (critical 9.8)
- [CVE-2024-27744](https://insights.sbomify.com/CVE-2024-27744/): Cross-site scripting in mayurik:petrol pump management (medium 6.1)
- [CVE-2024-27743](https://insights.sbomify.com/CVE-2024-27743/): Cross-site scripting in mayurik:petrol pump management (medium 6.1)
- [CVE-2024-2774](https://insights.sbomify.com/CVE-2024-2774/): Campcodes Online Marriage Registration System search.php sql injection (medium 6.3)
- [CVE-2024-27734](https://insights.sbomify.com/CVE-2024-27734/): Cross-site scripting in cszcms:csz cms (medium 6.1)
- [CVE-2024-27733](https://insights.sbomify.com/CVE-2024-27733/): File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the use (high 7.7)
- [CVE-2024-27731](https://insights.sbomify.com/CVE-2024-27731/): Cross-site scripting in friendica:friendica (medium 6.1)
- [CVE-2024-27730](https://insights.sbomify.com/CVE-2024-27730/): Missing authorization in friendica:friendica (critical 9.8)
- [CVE-2024-2773](https://insights.sbomify.com/CVE-2024-2773/): Campcodes Online Marriage Registration System search.php cross site scripting (low 3.5)
- [CVE-2024-27729](https://insights.sbomify.com/CVE-2024-27729/): Cross-site scripting in friendica:friendica (high 7.4)
- [CVE-2024-27728](https://insights.sbomify.com/CVE-2024-27728/): Cross-site scripting in friendica:friendica (medium 6.1)
- [CVE-2024-2772](https://insights.sbomify.com/CVE-2024-2772/): Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 6.4)
- [CVE-2024-27719](https://insights.sbomify.com/CVE-2024-27719/): Cross-site scripting in rems:faq management system (medium 6.1)
- [CVE-2024-27718](https://insights.sbomify.com/CVE-2024-27718/): SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information (high 7.8)
- [CVE-2024-27717](https://insights.sbomify.com/CVE-2024-27717/): Cross-site request forgery in eskooly:eskooly (medium 6.5)
- [CVE-2024-27716](https://insights.sbomify.com/CVE-2024-27716/): Cross Site Scripting vulnerability in Eskooly Web Product v.3.0 and before allows a remote attacker to execute arbitrary code via the messag (medium 5.4)
- [CVE-2024-27715](https://insights.sbomify.com/CVE-2024-27715/): Privilege escalation in eskooly:eskooly (high 8.2)
- [CVE-2024-27713](https://insights.sbomify.com/CVE-2024-27713/): Privilege escalation in eskooly:eskooly (high 8.8)
- [CVE-2024-27712](https://insights.sbomify.com/CVE-2024-27712/): Privilege escalation in eskooly:eskooly (critical 9.8)
- [CVE-2024-27711](https://insights.sbomify.com/CVE-2024-27711/): Privilege escalation in eskooly:eskooly (high 8.8)
- [CVE-2024-27710](https://insights.sbomify.com/CVE-2024-27710/): Privilege escalation in eskooly:eskooly (critical 9.8)
- [CVE-2024-2771](https://insights.sbomify.com/CVE-2024-2771/): Missing authorization in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (critical 9.8)
- [CVE-2024-27709](https://insights.sbomify.com/CVE-2024-27709/): SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of th (critical 9.8)
- [CVE-2024-27708](https://insights.sbomify.com/CVE-2024-27708/): Cross-site scripting in airc:mynet (critical 9.6)
- [CVE-2024-27707](https://insights.sbomify.com/CVE-2024-27707/): Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload of crafted SVG file. (medium 4.3)
- [CVE-2024-27706](https://insights.sbomify.com/CVE-2024-27706/): Cross Site Scripting vulnerability in Huly Platform v.0.6.202 allows attackers to execute arbitrary code via upload of crafted SVG file to issues. (medium 6.1)
- [CVE-2024-27705](https://insights.sbomify.com/CVE-2024-27705/): Cross-site scripting in leantime:leantime (high 7.6)
- [CVE-2024-27703](https://insights.sbomify.com/CVE-2024-27703/): Cross-site scripting in leantime:leantime (medium 5.4)
- [CVE-2024-2770](https://insights.sbomify.com/CVE-2024-2770/): Campcodes Complete Online Beauty Parlor Management System contact-us.php sql injection (medium 6.3)
- [CVE-2024-27694](https://insights.sbomify.com/CVE-2024-27694/): Cross-site request forgery in flycms project:flycms (high 7.4)
- [CVE-2024-2769](https://insights.sbomify.com/CVE-2024-2769/): Campcodes Complete Online Beauty Parlor Management System admin-profile.php sql injection (medium 5.3)
- [CVE-2024-27689](https://insights.sbomify.com/CVE-2024-27689/): Cross-site request forgery in codelyfe:stupid simple cms (high 8.8)
- [CVE-2024-27686](https://insights.sbomify.com/CVE-2024-27686/): Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted (high 7.5)
- [CVE-2024-27685](https://insights.sbomify.com/CVE-2024-27685/): SQL injection in phpgurukul:student record system (high 7.1)
- [CVE-2024-27684](https://insights.sbomify.com/CVE-2024-27684/): Cross-site scripting in dlink:go-rt-ac750 firmware (medium 6.1)
- [CVE-2024-27683](https://insights.sbomify.com/CVE-2024-27683/): Memory corruption in dlink:go-rt-ac750 firmware (critical 9.8)
- [CVE-2024-27680](https://insights.sbomify.com/CVE-2024-27680/): Cross-site scripting in flusity:flusity (medium 6.1)
- [CVE-2024-2768](https://insights.sbomify.com/CVE-2024-2768/): Campcodes Complete Online Beauty Parlor Management System edit-services.php sql injection (medium 6.3)
- [CVE-2024-27674](https://insights.sbomify.com/CVE-2024-27674/): Privilege escalation in macro-expert:macro expert (high 7.8)
- [CVE-2024-2767](https://insights.sbomify.com/CVE-2024-2767/): Campcodes Complete Online Beauty Parlor Management System forgot-password.php sql injection (medium 6.3)
- [CVE-2024-27668](https://insights.sbomify.com/CVE-2024-27668/): Cross-site scripting in flusity:flusity (medium 6.1)
- [CVE-2024-27665](https://insights.sbomify.com/CVE-2024-27665/): Unifiedtransform v2.X is vulnerable to Stored Cross-Site Scripting (XSS) via file upload feature in Syllabus module. (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/404/