# Vulnerabilities published in 2024


- [CVE-2024-26520](https://insights.sbomify.com/CVE-2024-26520/): An issue in Hangzhou Xiongwei Technology Development Co., Ltd. (critical 9.8)
- [CVE-2024-26519](https://insights.sbomify.com/CVE-2024-26519/): An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the (critical 9.0)
- [CVE-2024-26517](https://insights.sbomify.com/CVE-2024-26517/): SQL injection in rems:school task manager (critical 9.1)
- [CVE-2024-2651](https://insights.sbomify.com/CVE-2024-2651/): Inefficient Regular Expression Complexity in GitLab (medium 6.5)
- [CVE-2024-26507](https://insights.sbomify.com/CVE-2024-26507/): An issue in FinalWire AIRDA Extreme, AIDA64 Engineer, AIDA64 Business, AIDA64 Network Audit through 7.00.6742 allows a local attacker to esc (high 7.8)
- [CVE-2024-26504](https://insights.sbomify.com/CVE-2024-26504/): An issue in Wifire Hotspot v.4.5.3 allows a local attacker to execute arbitrary code via a crafted payload to the dst parameter. (high 8.8)
- [CVE-2024-26503](https://insights.sbomify.com/CVE-2024-26503/): File upload in openeclass:openeclass (critical 9.1)
- [CVE-2024-2650](https://insights.sbomify.com/CVE-2024-2650/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-26495](https://insights.sbomify.com/CVE-2024-26495/): Cross-site scripting in friendica:friendica (medium 6.1)
- [CVE-2024-26492](https://insights.sbomify.com/CVE-2024-26492/): Missing authorization in oretnom23:online diagnostic lab management system (medium 6.3)
- [CVE-2024-26491](https://insights.sbomify.com/CVE-2024-26491/): Cross-site scripting in flusity:flusity (medium 6.1)
- [CVE-2024-26490](https://insights.sbomify.com/CVE-2024-26490/): Cross-site scripting in flusity:flusity (medium 5.4)
- [CVE-2024-2649](https://insights.sbomify.com/CVE-2024-2649/): Netentsec NS-ASG Application Security Gateway deleteonlineuser.php sql injection (medium 6.3)
- [CVE-2024-26489](https://insights.sbomify.com/CVE-2024-26489/): Cross-site scripting in flusity:flusity (medium 6.1)
- [CVE-2024-26484](https://insights.sbomify.com/CVE-2024-26484/): Cross-site scripting in getkirby:kirby (medium 6.1)
- [CVE-2024-26483](https://insights.sbomify.com/CVE-2024-26483/): Kirby vulnerable to unrestricted file upload of user avatar images (high 8.8)
- [CVE-2024-26482](https://insights.sbomify.com/CVE-2024-26482/): Cross-site scripting in getkirby:kirby (high 7.1)
- [CVE-2024-26481](https://insights.sbomify.com/CVE-2024-26481/): Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field (medium 4.7)
- [CVE-2024-26480](https://insights.sbomify.com/CVE-2024-26480/): Information disclosure in statping-ng:statping-ng (high 7.5)
- [CVE-2024-2648](https://insights.sbomify.com/CVE-2024-2648/): Netentsec NS-ASG Application Security Gateway naccheck.php xpath injection (medium 4.3)
- [CVE-2024-26479](https://insights.sbomify.com/CVE-2024-26479/): Information disclosure in statping-ng:statping-ng (medium 5.3)
- [CVE-2024-26478](https://insights.sbomify.com/CVE-2024-26478/): Information disclosure in statping-ng:statping-ng (medium 5.3)
- [CVE-2024-26477](https://insights.sbomify.com/CVE-2024-26477/): Information disclosure in statping-ng:statping-ng (high 7.5)
- [CVE-2024-26476](https://insights.sbomify.com/CVE-2024-26476/): Server-side request forgery in open-emr:openemr (low 3.5)
- [CVE-2024-26475](https://insights.sbomify.com/CVE-2024-26475/): Null dereference in radare:radare2 (medium 5.5)
- [CVE-2024-26473](https://insights.sbomify.com/CVE-2024-26473/): Cross-site scripting in msaad1999:klik socialmediawebsite (medium 6.1)
- [CVE-2024-26472](https://insights.sbomify.com/CVE-2024-26472/): Cross-site scripting in msaad1999:klik socialmediawebsite (medium 6.1)
- [CVE-2024-26471](https://insights.sbomify.com/CVE-2024-26471/): Cross-site scripting in msaad1999:klik socialmediawebsite (medium 5.4)
- [CVE-2024-26470](https://insights.sbomify.com/CVE-2024-26470/): FullStackHero's WebAPI Boilerplate host header injection vulnerability (high 8.1)
- [CVE-2024-2647](https://insights.sbomify.com/CVE-2024-2647/): Netentsec NS-ASG Application Security Gateway singlelogin.php sql injection (high 7.3)
- [CVE-2024-26469](https://insights.sbomify.com/CVE-2024-26469/): Server-side request forgery in prestalife:product designer (high 8.1)
- [CVE-2024-26468](https://insights.sbomify.com/CVE-2024-26468/): Cross-site scripting in jstrieb:url pages (medium 6.1)
- [CVE-2024-26467](https://insights.sbomify.com/CVE-2024-26467/): Cross-site scripting in tabatkins:railroad-diagram generator (medium 6.1)
- [CVE-2024-26466](https://insights.sbomify.com/CVE-2024-26466/): Cross-site scripting in web-platform-tests:web-platform-tests (medium 6.1)
- [CVE-2024-26465](https://insights.sbomify.com/CVE-2024-26465/): A DOM based cross-site scripting (XSS) vulnerability in the component /beep/Beep.Instrument.js of stewdio beep.js before commit ef22ad7 allo (medium 6.1)
- [CVE-2024-26462](https://insights.sbomify.com/CVE-2024-26462/): Denial of service in mit:kerberos 5 (medium 5.5)
- [CVE-2024-26461](https://insights.sbomify.com/CVE-2024-26461/): Denial of service in mit:kerberos 5 (high 7.5)
- [CVE-2024-2646](https://insights.sbomify.com/CVE-2024-2646/): Netentsec NS-ASG Application Security Gateway sql injection (medium 6.3)
- [CVE-2024-26458](https://insights.sbomify.com/CVE-2024-26458/): Denial of service in mit:kerberos 5 (medium 5.3)
- [CVE-2024-26455](https://insights.sbomify.com/CVE-2024-26455/): Use after free in treasuredata:fluent bit (high 7.5)
- [CVE-2024-26454](https://insights.sbomify.com/CVE-2024-26454/): A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter in login.php. (medium 5.4)
- [CVE-2024-26450](https://insights.sbomify.com/CVE-2024-26450/): Cross-site scripting in piwigo:piwigo (medium 5.4)
- [CVE-2024-2645](https://insights.sbomify.com/CVE-2024-2645/): Netentsec NS-ASG Application Security Gateway resetpwd.php xpath injection (medium 4.3)
- [CVE-2024-26445](https://insights.sbomify.com/CVE-2024-26445/): Cross-site request forgery in flusity:flusity (medium 6.1)
- [CVE-2024-2644](https://insights.sbomify.com/CVE-2024-2644/): Netentsec NS-ASG Application Security Gateway addfirewall.php sql injection (medium 6.3)
- [CVE-2024-2643](https://insights.sbomify.com/CVE-2024-2643/): My Sticky Bar < 2.6.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-2642](https://insights.sbomify.com/CVE-2024-2642/): Ruijie RG-NBS2009G-P EXCU_SHELL command injection (high 7.3)
- [CVE-2024-2641](https://insights.sbomify.com/CVE-2024-2641/): Ruijie RG-NBS2009G-P Password passwdManage.htm improper authorization (medium 5.3)
- [CVE-2024-2640](https://insights.sbomify.com/CVE-2024-2640/): Watu Quiz < 3.4.1.2 - Author+ Stored XSS (medium 6.8)
- [CVE-2024-2639](https://insights.sbomify.com/CVE-2024-2639/): Bdtask Wholesale Inventory Management System session fixiation (medium 4.3)
- [CVE-2024-2637](https://insights.sbomify.com/CVE-2024-2637/): Insecure Loading of Code in B&R Products (high 7.2)
- [CVE-2024-26369](https://insights.sbomify.com/CVE-2024-26369/): An issue in the HistoryQosPolicy component of FastDDS v2.12.x, v2.11.x, v2.10.x, and v2.6.x leads to a SIGABRT (signal abort) upon receiving DataWriter's data. (high 7.5)
- [CVE-2024-26367](https://insights.sbomify.com/CVE-2024-26367/): Cross Site Scripting vulnerability in Evertz microsystems MViP-II Firmware 8.6.5, XPS-EDGE-* Build 1467, evEDGE-EO-* Build 0029, MMA10G-* Bu (medium 6.1)
- [CVE-2024-26362](https://insights.sbomify.com/CVE-2024-26362/): Cross-site scripting in enpass:password manager (high 8.8)
- [CVE-2024-2636](https://insights.sbomify.com/CVE-2024-2636/): Multiple vulnerabilities on Meta4 HR from Cegid (critical 9.0)
- [CVE-2024-26352](https://insights.sbomify.com/CVE-2024-26352/): Cross-site request forgery in flusity:flusity (high 8.8)
- [CVE-2024-26351](https://insights.sbomify.com/CVE-2024-26351/): Cross-site request forgery in flusity:flusity (medium 6.1)
- [CVE-2024-26350](https://insights.sbomify.com/CVE-2024-26350/): Cross-site request forgery in flusity:flusity (high 8.8)
- [CVE-2024-2635](https://insights.sbomify.com/CVE-2024-2635/): Multiple vulnerabilities on Meta4 HR from Cegid (high 7.3)
- [CVE-2024-26349](https://insights.sbomify.com/CVE-2024-26349/): Cross-site request forgery in flusity:flusity (medium 4.3)
- [CVE-2024-26342](https://insights.sbomify.com/CVE-2024-26342/): Null dereference in asus:4g-ac68u firmware (high 7.5)
- [CVE-2024-2634](https://insights.sbomify.com/CVE-2024-2634/): Multiple vulnerabilities on Meta4 HR from Cegid (medium 6.1)
- [CVE-2024-26339](https://insights.sbomify.com/CVE-2024-26339/): Memory corruption in swftools:swftools (critical 9.1)
- [CVE-2024-26337](https://insights.sbomify.com/CVE-2024-26337/): Memory corruption in swftools:swftools (medium 4.3)
- [CVE-2024-26335](https://insights.sbomify.com/CVE-2024-26335/): Memory corruption in swftools:swftools (medium 5.5)
- [CVE-2024-26334](https://insights.sbomify.com/CVE-2024-26334/): Memory corruption in swftools:swftools (medium 6.2)
- [CVE-2024-26333](https://insights.sbomify.com/CVE-2024-26333/): Use after free in swftools:swftools (medium 5.5)
- [CVE-2024-26331](https://insights.sbomify.com/CVE-2024-26331/): ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. (high 7.5)
- [CVE-2024-26330](https://insights.sbomify.com/CVE-2024-26330/): An issue was discovered in Kape CyberGhostVPN 8.4.3.12823 on Windows. (medium 6.5)
- [CVE-2024-2633](https://insights.sbomify.com/CVE-2024-2633/): Multiple vulnerabilities on Meta4 HR from Cegid (medium 6.1)
- [CVE-2024-26329](https://insights.sbomify.com/CVE-2024-26329/): Chilkat before v9.5.0.98, allows attackers to obtain sensitive information via predictable PRNG in ChilkatRand::randomBytes function. (medium 6.2)
- [CVE-2024-26328](https://insights.sbomify.com/CVE-2024-26328/): Memory corruption in qemu:qemu (medium 6.0)
- [CVE-2024-26327](https://insights.sbomify.com/CVE-2024-26327/): Memory corruption in qemu:qemu (medium 5.3)
- [CVE-2024-2632](https://insights.sbomify.com/CVE-2024-2632/): Information Exposure Vulnerability on Meta4 HR (high 7.5)
- [CVE-2024-26318](https://insights.sbomify.com/CVE-2024-26318/): Cross-site Scripting in Serenity (medium 6.1)
- [CVE-2024-26317](https://insights.sbomify.com/CVE-2024-26317/): In illumos illumos-gate 2024-02-15, an error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinat (medium 6.1)
- [CVE-2024-26314](https://insights.sbomify.com/CVE-2024-26314/): Privilege escalation in jungo:windriver (high 7.8)
- [CVE-2024-26313](https://insights.sbomify.com/CVE-2024-26313/): Cross-site scripting in archerirm:archer (high 7.3)
- [CVE-2024-26312](https://insights.sbomify.com/CVE-2024-26312/): Information disclosure in archerirm:archer (medium 4.3)
- [CVE-2024-26311](https://insights.sbomify.com/CVE-2024-26311/): Cross-site scripting in archerirm:archer (medium 5.7)
- [CVE-2024-26310](https://insights.sbomify.com/CVE-2024-26310/): Missing authorization in archerirm:archer (medium 4.3)
- [CVE-2024-2631](https://insights.sbomify.com/CVE-2024-2631/): Other in Chrome (medium 4.3)
- [CVE-2024-26309](https://insights.sbomify.com/CVE-2024-26309/): Information disclosure in archerirm:archer (medium 5.3)
- [CVE-2024-26308](https://insights.sbomify.com/CVE-2024-26308/): Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file (medium 5.5)
- [CVE-2024-26307](https://insights.sbomify.com/CVE-2024-26307/): Apache Doris: Possible race condition (medium 5.3)
- [CVE-2024-26306](https://insights.sbomify.com/CVE-2024-26306/): Weak cryptography in es:iperf3 (medium 5.9)
- [CVE-2024-26305](https://insights.sbomify.com/CVE-2024-26305/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (critical 9.8)
- [CVE-2024-26304](https://insights.sbomify.com/CVE-2024-26304/): Memory corruption in Aruba Mobility Conductor (formerly Mobility Master); Aruba Mobility Controllers; WLAN Gateways and SD-WAN Gateways managed by Aruba Central (critical 9.8)
- [CVE-2024-26303](https://insights.sbomify.com/CVE-2024-26303/): Denial of service in ArubaOS-S Switch (medium 4.9)
- [CVE-2024-26302](https://insights.sbomify.com/CVE-2024-26302/): Information disclosure in Aruba ClearPass Policy Manager (medium 4.8)
- [CVE-2024-26301](https://insights.sbomify.com/CVE-2024-26301/): Information disclosure in Aruba ClearPass Policy Manager (medium 6.5)
- [CVE-2024-26300](https://insights.sbomify.com/CVE-2024-26300/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 6.6)
- [CVE-2024-2630](https://insights.sbomify.com/CVE-2024-2630/): Information disclosure in Chrome (medium 6.5)
- [CVE-2024-26299](https://insights.sbomify.com/CVE-2024-26299/): Cross-site scripting in Aruba ClearPass Policy Manager (medium 6.6)
- [CVE-2024-26298](https://insights.sbomify.com/CVE-2024-26298/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2024-26297](https://insights.sbomify.com/CVE-2024-26297/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2024-26296](https://insights.sbomify.com/CVE-2024-26296/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2024-26295](https://insights.sbomify.com/CVE-2024-26295/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2024-26294](https://insights.sbomify.com/CVE-2024-26294/): Command injection in Aruba ClearPass Policy Manager (high 7.2)
- [CVE-2024-26293](https://insights.sbomify.com/CVE-2024-26293/): Unauthenticated Path Traversal affecting Avid NEXIS (high 8.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/415/