# Vulnerabilities published in 2024


- [CVE-2024-27662](https://insights.sbomify.com/CVE-2024-27662/): Null dereference in dlink:dir-823g firmware (medium 6.5)
- [CVE-2024-27661](https://insights.sbomify.com/CVE-2024-27661/): Null dereference in dlink:dir-823g firmware (medium 6.5)
- [CVE-2024-27660](https://insights.sbomify.com/CVE-2024-27660/): Null dereference in dlink:dir-823g firmware (medium 6.5)
- [CVE-2024-2766](https://insights.sbomify.com/CVE-2024-2766/): Campcodes Complete Online Beauty Parlor Management System index.php sql injection (medium 6.3)
- [CVE-2024-27659](https://insights.sbomify.com/CVE-2024-27659/): Null dereference in dlink:dir-823g firmware (medium 6.5)
- [CVE-2024-27658](https://insights.sbomify.com/CVE-2024-27658/): Null dereference in dlink:dir-823g firmware (medium 6.5)
- [CVE-2024-27657](https://insights.sbomify.com/CVE-2024-27657/): Memory corruption in dlink:dir-823g firmware (high 8.8)
- [CVE-2024-27656](https://insights.sbomify.com/CVE-2024-27656/): Memory corruption in dlink:dir-823g firmware (high 8.8)
- [CVE-2024-27655](https://insights.sbomify.com/CVE-2024-27655/): Memory corruption in dlink:dir-823g firmware (high 8.8)
- [CVE-2024-2765](https://insights.sbomify.com/CVE-2024-2765/): Ultimate Member <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-2764](https://insights.sbomify.com/CVE-2024-2764/): Tenda AC10U SetPptpServerCfg formSetPPTPServer stack-based overflow (high 8.8)
- [CVE-2024-27632](https://insights.sbomify.com/CVE-2024-27632/): Privilege escalation in gnu:savane (high 8.8)
- [CVE-2024-27631](https://insights.sbomify.com/CVE-2024-27631/): Cross-site request forgery in gnu:savane (medium 6.0)
- [CVE-2024-27630](https://insights.sbomify.com/CVE-2024-27630/): Missing authorization in gnu:savane (high 7.5)
- [CVE-2024-2763](https://insights.sbomify.com/CVE-2024-2763/): Tenda AC10U setcfm formSetCfm stack-based overflow (high 8.8)
- [CVE-2024-27629](https://insights.sbomify.com/CVE-2024-27629/): An issue in dc2niix before v.1.0.20240202 allows a local attacker to execute arbitrary code via the generated file name is not properly esca (high 7.8)
- [CVE-2024-27628](https://insights.sbomify.com/CVE-2024-27628/): Memory corruption in offis:dcmtk (high 8.1)
- [CVE-2024-27627](https://insights.sbomify.com/CVE-2024-27627/): A reflected cross-site scripting (XSS) vulnerability exists in SuperCali version 1.1.0, allowing remote attackers to execute arbitrary JavaS (medium 6.1)
- [CVE-2024-27626](https://insights.sbomify.com/CVE-2024-27626/): Cross-site scripting in dotclear:dotclear (medium 6.1)
- [CVE-2024-27625](https://insights.sbomify.com/CVE-2024-27625/): Cross-site scripting in cmsmadesimple:cms made simple (medium 4.8)
- [CVE-2024-27623](https://insights.sbomify.com/CVE-2024-27623/): Code injection in cmsmadesimple:cms made simple (medium 5.9)
- [CVE-2024-27622](https://insights.sbomify.com/CVE-2024-27622/): Code injection in cmsmadesimple:cms made simple (high 7.2)
- [CVE-2024-27620](https://insights.sbomify.com/CVE-2024-27620/): An issue in Ladder v.0.0.1 thru v.0.0.21 allows a remote attacker to obtain sensitive information via a crafted request to the API. (high 7.5)
- [CVE-2024-2762](https://insights.sbomify.com/CVE-2024-2762/): FooGallery < 2.4.15 - Author+ Stored XSS (medium 6.3)
- [CVE-2024-27619](https://insights.sbomify.com/CVE-2024-27619/): Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow. (high 7.3)
- [CVE-2024-27613](https://insights.sbomify.com/CVE-2024-27613/): Other in numbas:editor (high 7.3)
- [CVE-2024-27612](https://insights.sbomify.com/CVE-2024-27612/): Other in numbas:editor (medium 6.2)
- [CVE-2024-2761](https://insights.sbomify.com/CVE-2024-2761/): Genesis Blocks < 3.1.3 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2024-27609](https://insights.sbomify.com/CVE-2024-27609/): Bonita cross-site scripting vulnerability (medium 6.5)
- [CVE-2024-27605](https://insights.sbomify.com/CVE-2024-27605/): Missing authorization in alldata:alldata (high 7.5)
- [CVE-2024-27604](https://insights.sbomify.com/CVE-2024-27604/): Deserialization in alldata:alldata (critical 9.8)
- [CVE-2024-27602](https://insights.sbomify.com/CVE-2024-27602/): Missing authorization in alldata:alldata (critical 9.1)
- [CVE-2024-2760](https://insights.sbomify.com/CVE-2024-2760/): Bkav Home v7816, build 2403161130 - Kernel Memory Leak (medium 5.5)
- [CVE-2024-27593](https://insights.sbomify.com/CVE-2024-27593/): A stored cross-site scripting (XSS) vulnerability in the Filter function of Eramba Version 3.22.3 Community Edition allows authenticated att (medium 5.4)
- [CVE-2024-27592](https://insights.sbomify.com/CVE-2024-27592/): Open redirect in corezoid:corezoid (medium 4.3)
- [CVE-2024-2759](https://insights.sbomify.com/CVE-2024-2759/): Improper access control in Apaczka plugin for PrestaShop (high 7.5)
- [CVE-2024-2758](https://insights.sbomify.com/CVE-2024-2758/): CVE-2024-2758 (medium 6.3)
- [CVE-2024-27575](https://insights.sbomify.com/CVE-2024-27575/): INOTEC Sicherheitstechnik WebServer CPS220/64 3.3.19 allows a remote attacker to read arbitrary files via absolute path traversal, such as w (high 7.5)
- [CVE-2024-27574](https://insights.sbomify.com/CVE-2024-27574/): SQL Injection vulnerability in Trainme Academy version Ichin v.1.3.2 allows a remote attacker to obtain sensitive information via the inform (critical 9.1)
- [CVE-2024-27572](https://insights.sbomify.com/CVE-2024-27572/): Memory corruption in libtor:lbt-t300-t390 firmware (high 7.5)
- [CVE-2024-27571](https://insights.sbomify.com/CVE-2024-27571/): Memory corruption in libtor:lbt-t300-t390 firmware (high 7.5)
- [CVE-2024-27570](https://insights.sbomify.com/CVE-2024-27570/): Memory corruption in libtor:lbt-t300-t390 firmware (high 7.5)
- [CVE-2024-2757](https://insights.sbomify.com/CVE-2024-2757/): PHP mb_encode_mimeheader runs endlessly for some inputs (high 7.5)
- [CVE-2024-27569](https://insights.sbomify.com/CVE-2024-27569/): Memory corruption in libtor:lbt-t300-t390 firmware (medium 6.5)
- [CVE-2024-27568](https://insights.sbomify.com/CVE-2024-27568/): Memory corruption in libtor:lbt-t300-t390 firmware (medium 6.5)
- [CVE-2024-27567](https://insights.sbomify.com/CVE-2024-27567/): Memory corruption in libtor:lbt-t300-t390 firmware (medium 6.5)
- [CVE-2024-27565](https://insights.sbomify.com/CVE-2024-27565/): Server-side request forgery in dirk1983:chatgpt-wechat-personal (critical 9.8)
- [CVE-2024-27564](https://insights.sbomify.com/CVE-2024-27564/): Server-side request forgery in mm1.ltd source code (medium 5.8)
- [CVE-2024-27563](https://insights.sbomify.com/CVE-2024-27563/): Server-side request forgery in wondercms:wondercms (medium 6.5)
- [CVE-2024-27561](https://insights.sbomify.com/CVE-2024-27561/): Server-side request forgery in wondercms:wondercms (critical 9.1)
- [CVE-2024-2756](https://insights.sbomify.com/CVE-2024-2756/): __Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix (medium 6.5)
- [CVE-2024-27559](https://insights.sbomify.com/CVE-2024-27559/): Cross-site request forgery in codelyfe:stupid simple cms (medium 6.3)
- [CVE-2024-27558](https://insights.sbomify.com/CVE-2024-27558/): Cross-site scripting in codelyfe:stupid simple cms (medium 6.1)
- [CVE-2024-2754](https://insights.sbomify.com/CVE-2024-2754/): SourceCodester Complete E-Commerce Site users_photo.php unrestricted upload (medium 4.7)
- [CVE-2024-27532](https://insights.sbomify.com/CVE-2024-27532/): Null dereference in bytecodealliance:webassembly micro runtime (high 7.5)
- [CVE-2024-27530](https://insights.sbomify.com/CVE-2024-27530/): pywasm3 contains a Use-After-Free in ForEachModule (high 8.4)
- [CVE-2024-2753](https://insights.sbomify.com/CVE-2024-2753/): Concrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screen (low 2.0)
- [CVE-2024-27529](https://insights.sbomify.com/CVE-2024-27529/): wasm3 uncontrolled memory allocation vulnerability (high 8.4)
- [CVE-2024-27528](https://insights.sbomify.com/CVE-2024-27528/): pywasm3 has an Invalid Memory Read, Leading to DoS and Potential Code Execution (high 8.4)
- [CVE-2024-27527](https://insights.sbomify.com/CVE-2024-27527/): Denial of service in wasm3 project:wasm3 (high 7.5)
- [CVE-2024-27525](https://insights.sbomify.com/CVE-2024-27525/): Cross-site scripting in chamilo:chamilo lms (medium 4.6)
- [CVE-2024-27524](https://insights.sbomify.com/CVE-2024-27524/): Cross-site scripting in chamilo:chamilo lms (high 7.1)
- [CVE-2024-27521](https://insights.sbomify.com/CVE-2024-27521/): Command injection in totolink:a3300r firmware (high 8.0)
- [CVE-2024-2752](https://insights.sbomify.com/CVE-2024-2752/): Cross-site scripting in Where Did You Hear About Us Checkout Field for WooCommerce (medium 5.5)
- [CVE-2024-27518](https://insights.sbomify.com/CVE-2024-27518/): An issue in SUPERAntiSyware Professional X 10.0.1262 and 10.0.1264 allows unprivileged attackers to escalate privileges via a restore of a c (high 7.8)
- [CVE-2024-27517](https://insights.sbomify.com/CVE-2024-27517/): Cross-site scripting in webasyst:webasyst (medium 5.4)
- [CVE-2024-27516](https://insights.sbomify.com/CVE-2024-27516/): livehelperchat Server-Side Template Injection (critical 9.8)
- [CVE-2024-27515](https://insights.sbomify.com/CVE-2024-27515/): SQL injection in mindstellar:osclass (high 7.2)
- [CVE-2024-2751](https://insights.sbomify.com/CVE-2024-2751/): Exclusive Addons for Elementor <= 2.6.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via InfoBox (medium 6.4)
- [CVE-2024-27508](https://insights.sbomify.com/CVE-2024-27508/): Denial of service in atheme:atheme (high 7.5)
- [CVE-2024-27507](https://insights.sbomify.com/CVE-2024-27507/): Denial of service in fedoraproject:fedora (high 7.5)
- [CVE-2024-2750](https://insights.sbomify.com/CVE-2024-2750/): Exclusive Addons for Elementor <= 2.6.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (medium 6.4)
- [CVE-2024-27499](https://insights.sbomify.com/CVE-2024-27499/): Bagist Cross-site Scripting vulnerability (medium 6.5)
- [CVE-2024-27497](https://insights.sbomify.com/CVE-2024-27497/): Auth bypass in linksys:e2000 firmware (high 8.8)
- [CVE-2024-2749](https://insights.sbomify.com/CVE-2024-2749/): VikBooking < 1.6.8 - Broken Access Control (medium 5.9)
- [CVE-2024-27489](https://insights.sbomify.com/CVE-2024-27489/): An issue in the DelFile() function of WMCMS v4.4 allows attackers to delete arbitrary files via a crafted POST request. (high 7.5)
- [CVE-2024-27488](https://insights.sbomify.com/CVE-2024-27488/): Incorrect Access Control vulnerability in ZLMediaKit versions 1.0 through 8.0, allows remote attackers to escalate privileges and obtain sensitive information. (critical 9.8)
- [CVE-2024-27480](https://insights.sbomify.com/CVE-2024-27480/): File upload in vvveb:vvvebjs (critical 9.8)
- [CVE-2024-2748](https://insights.sbomify.com/CVE-2024-2748/): CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a user (medium 4.3)
- [CVE-2024-27477](https://insights.sbomify.com/CVE-2024-27477/): Cross-site scripting in leantime:leantime (medium 6.1)
- [CVE-2024-27476](https://insights.sbomify.com/CVE-2024-27476/): Cross-site scripting in leantime:leantime (medium 4.7)
- [CVE-2024-27474](https://insights.sbomify.com/CVE-2024-27474/): Cross-site request forgery in leantime:leantime (high 8.8)
- [CVE-2024-2747](https://insights.sbomify.com/CVE-2024-2747/): Privilege escalation in Easergy Studio (high 7.8)
- [CVE-2024-27461](https://insights.sbomify.com/CVE-2024-27461/): Misconfiguration in Intel(R) MAS (GUI) (medium 4.3)
- [CVE-2024-27460](https://insights.sbomify.com/CVE-2024-27460/): Privilege escalation in Plantronics Hub (medium 6.7)
- [CVE-2024-2746](https://insights.sbomify.com/CVE-2024-2746/): Incomplete fix for CVE-2024-1929 (high 8.8)
- [CVE-2024-27459](https://insights.sbomify.com/CVE-2024-27459/): Memory corruption in OpenVPN GUI (high 7.2)
- [CVE-2024-27458](https://insights.sbomify.com/CVE-2024-27458/): HP Hotkey Support – Escalation of Privilege (high 8.8)
- [CVE-2024-27457](https://insights.sbomify.com/CVE-2024-27457/): Information disclosure in Intel(R) TDX Module firmware (low 1.8)
- [CVE-2024-27456](https://insights.sbomify.com/CVE-2024-27456/): Rack CORS Middleware has Insecure File Permissions (critical 9.1)
- [CVE-2024-27455](https://insights.sbomify.com/CVE-2024-27455/): In the Bentley ALIM Web application, certain configuration settings can cause exposure of a user's ALIM session token when the user attempts to download files. (critical 9.1)
- [CVE-2024-27454](https://insights.sbomify.com/CVE-2024-27454/): orjson does not limit recursion for deeply nested JSON documents (high 7.5)
- [CVE-2024-27453](https://insights.sbomify.com/CVE-2024-27453/): Privilege escalation in extremenetworks:extremexos (high 8.6)
- [CVE-2024-2745](https://insights.sbomify.com/CVE-2024-2745/): Rapid7 InsightVM Sensitive Information Exposure via URL (low 3.3)
- [CVE-2024-27448](https://insights.sbomify.com/CVE-2024-27448/): MailDev Remote Code Execution (critical 9.1)
- [CVE-2024-27447](https://insights.sbomify.com/CVE-2024-27447/): pretix mishandles file validation (critical 9.8)
- [CVE-2024-27444](https://insights.sbomify.com/CVE-2024-27444/): LangChain Experimental vulnerable to arbitrary code execution (critical 9.8)
- [CVE-2024-27443](https://insights.sbomify.com/CVE-2024-27443/): Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2024-27442](https://insights.sbomify.com/CVE-2024-27442/): Privilege escalation in zimbra:collaboration (high 7.8)
- [CVE-2024-27440](https://insights.sbomify.com/CVE-2024-27440/): Security feature bypass in Toyoko Inn official App for Android (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/405/