# Vulnerabilities published in 2024


- [CVE-2024-25270](https://insights.sbomify.com/CVE-2024-25270/): Missing authorization in mirapolis:lms (medium 4.3)
- [CVE-2024-2527](https://insights.sbomify.com/CVE-2024-2527/): MAGESH-K21 Online-College-Event-Hall-Reservation-System rooms.php sql injection (medium 6.3)
- [CVE-2024-25269](https://insights.sbomify.com/CVE-2024-25269/): Denial of service in struktur:libheif (high 7.5)
- [CVE-2024-25262](https://insights.sbomify.com/CVE-2024-25262/): texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump. (high 8.1)
- [CVE-2024-25260](https://insights.sbomify.com/CVE-2024-25260/): Null dereference in elfutils project:elfutils (medium 4.0)
- [CVE-2024-2526](https://insights.sbomify.com/CVE-2024-2526/): MAGESH-K21 Online-College-Event-Hall-Reservation-System rooms.php cross site scripting (low 3.5)
- [CVE-2024-25255](https://insights.sbomify.com/CVE-2024-25255/): Sublime Text 4 was discovered to contain a command injection vulnerability via the New Build System module. (critical 9.8)
- [CVE-2024-25254](https://insights.sbomify.com/CVE-2024-25254/): Memory corruption in mcafee:superscan (critical 9.8)
- [CVE-2024-25253](https://insights.sbomify.com/CVE-2024-25253/): Driver Booster v10.6 was discovered to contain a buffer overflow via the Host parameter under the Customize proxy module. (high 7.5)
- [CVE-2024-25251](https://insights.sbomify.com/CVE-2024-25251/): Missing authorization in carmelo:agro-school management system (high 8.8)
- [CVE-2024-25250](https://insights.sbomify.com/CVE-2024-25250/): SQL injection in carmelo:agro-school management system (critical 9.8)
- [CVE-2024-2525](https://insights.sbomify.com/CVE-2024-2525/): MAGESH-K21 Online-College-Event-Hall-Reservation-System receipt.php cross site scripting (low 3.5)
- [CVE-2024-25249](https://insights.sbomify.com/CVE-2024-25249/): Code injection in he3app:he3 app (critical 9.8)
- [CVE-2024-25248](https://insights.sbomify.com/CVE-2024-25248/): SQL injection in niushop:b2b2c multi-business (critical 9.8)
- [CVE-2024-25247](https://insights.sbomify.com/CVE-2024-25247/): SQL injection in niushop:b2b2c multi-business (critical 9.8)
- [CVE-2024-2524](https://insights.sbomify.com/CVE-2024-2524/): MAGESH-K21 Online-College-Event-Hall-Reservation-System receipt.php sql injection (medium 6.3)
- [CVE-2024-25239](https://insights.sbomify.com/CVE-2024-25239/): SQL injection in walterjnr1:employee management system (critical 9.8)
- [CVE-2024-2523](https://insights.sbomify.com/CVE-2024-2523/): MAGESH-K21 Online-College-Event-Hall-Reservation-System booktime.php cross site scripting (low 3.5)
- [CVE-2024-25228](https://insights.sbomify.com/CVE-2024-25228/): Command injection in vinchin:vinchin backup and recovery (high 8.8)
- [CVE-2024-25227](https://insights.sbomify.com/CVE-2024-25227/): SQL injection in abocms:abo.cms (medium 6.5)
- [CVE-2024-25226](https://insights.sbomify.com/CVE-2024-25226/): Cross-site scripting in code-projects:simple admin panel (medium 6.1)
- [CVE-2024-25225](https://insights.sbomify.com/CVE-2024-25225/): Cross-site scripting in code-projects:simple admin panel (medium 6.1)
- [CVE-2024-25224](https://insights.sbomify.com/CVE-2024-25224/): Cross-site scripting in code-projects:simple admin panel (medium 5.4)
- [CVE-2024-25223](https://insights.sbomify.com/CVE-2024-25223/): SQL injection in code-projects:simple admin panel (critical 9.8)
- [CVE-2024-25222](https://insights.sbomify.com/CVE-2024-25222/): SQL injection in code-projects:task manager (critical 9.8)
- [CVE-2024-25221](https://insights.sbomify.com/CVE-2024-25221/): Cross-site scripting in code-projects:task manager (medium 6.1)
- [CVE-2024-25220](https://insights.sbomify.com/CVE-2024-25220/): SQL injection in code-projects:task manager (critical 9.8)
- [CVE-2024-2522](https://insights.sbomify.com/CVE-2024-2522/): MAGESH-K21 Online-College-Event-Hall-Reservation-System booktime.php sql injection (medium 6.3)
- [CVE-2024-25219](https://insights.sbomify.com/CVE-2024-25219/): Cross-site scripting in code-projects:task manager (medium 6.1)
- [CVE-2024-25218](https://insights.sbomify.com/CVE-2024-25218/): Cross-site scripting in code-projects:task manager (medium 4.6)
- [CVE-2024-25217](https://insights.sbomify.com/CVE-2024-25217/): SQL injection in oretnom23:online medicine ordering system (high 8.8)
- [CVE-2024-25216](https://insights.sbomify.com/CVE-2024-25216/): SQL injection in sherlock:employee management system (critical 9.8)
- [CVE-2024-25215](https://insights.sbomify.com/CVE-2024-25215/): SQL injection in sherlock:employee management system (critical 9.8)
- [CVE-2024-25214](https://insights.sbomify.com/CVE-2024-25214/): SQL injection in sherlock:employee management system (critical 9.8)
- [CVE-2024-25213](https://insights.sbomify.com/CVE-2024-25213/): SQL injection in sherlock:employee management system (high 7.2)
- [CVE-2024-25212](https://insights.sbomify.com/CVE-2024-25212/): SQL injection in sherlock:employee management system (high 7.2)
- [CVE-2024-25211](https://insights.sbomify.com/CVE-2024-25211/): SQL injection in rems:simple expense tracker app (critical 9.8)
- [CVE-2024-25210](https://insights.sbomify.com/CVE-2024-25210/): SQL injection in rems:simple expense tracker app (critical 9.8)
- [CVE-2024-2521](https://insights.sbomify.com/CVE-2024-2521/): MAGESH-K21 Online-College-Event-Hall-Reservation-System bookdate.php cross site scripting (low 3.5)
- [CVE-2024-25209](https://insights.sbomify.com/CVE-2024-25209/): SQL injection in rems:barangay population monitoring system (critical 9.8)
- [CVE-2024-25208](https://insights.sbomify.com/CVE-2024-25208/): Cross-site scripting in barangay management system project:barangay management system (medium 5.4)
- [CVE-2024-25207](https://insights.sbomify.com/CVE-2024-25207/): Cross-site scripting in barangay management system project:barangay management system (medium 5.4)
- [CVE-2024-25202](https://insights.sbomify.com/CVE-2024-25202/): Cross-site scripting in phpgurukul:user registration \& login and user management system (medium 6.1)
- [CVE-2024-25201](https://insights.sbomify.com/CVE-2024-25201/): Memory corruption in espruino:espruino (high 7.5)
- [CVE-2024-25200](https://insights.sbomify.com/CVE-2024-25200/): Memory corruption in espruino:espruino (high 7.5)
- [CVE-2024-2520](https://insights.sbomify.com/CVE-2024-2520/): MAGESH-K21 Online-College-Event-Hall-Reservation-System bookdate.php sql injection (medium 6.3)
- [CVE-2024-25199](https://insights.sbomify.com/CVE-2024-25199/): Use after free in opennav:nav2 (high 8.1)
- [CVE-2024-25198](https://insights.sbomify.com/CVE-2024-25198/): Use after free in opennav:nav2 (critical 9.1)
- [CVE-2024-25197](https://insights.sbomify.com/CVE-2024-25197/): Null dereference in opennav:nav2 (medium 6.5)
- [CVE-2024-25196](https://insights.sbomify.com/CVE-2024-25196/): Memory corruption in opennav:nav2 (low 3.3)
- [CVE-2024-25191](https://insights.sbomify.com/CVE-2024-25191/): Weak cryptography in zihanggao:php-jwt (critical 9.8)
- [CVE-2024-25190](https://insights.sbomify.com/CVE-2024-25190/): Weak cryptography in glitchedpolygons:l8w8jwt (critical 9.8)
- [CVE-2024-2519](https://insights.sbomify.com/CVE-2024-2519/): MAGESH-K21 Online-College-Event-Hall-Reservation-System navbar.php cross site scripting (low 3.5)
- [CVE-2024-25189](https://insights.sbomify.com/CVE-2024-25189/): Weak cryptography in debian:debian linux (critical 9.8)
- [CVE-2024-25187](https://insights.sbomify.com/CVE-2024-25187/): Server-side request forgery in xiaocheng-keji:71cms (high 8.6)
- [CVE-2024-25183](https://insights.sbomify.com/CVE-2024-25183/): Path traversal in vvveb:vvvebjs (high 7.5)
- [CVE-2024-25182](https://insights.sbomify.com/CVE-2024-25182/): File upload in vvveb:vvvebjs (critical 9.8)
- [CVE-2024-25181](https://insights.sbomify.com/CVE-2024-25181/): Server-side request forgery in vvveb:vvvebjs (critical 9.1)
- [CVE-2024-25180](https://insights.sbomify.com/CVE-2024-25180/): Code injection in pdfmake project:pdfmake (critical 9.8)
- [CVE-2024-2518](https://insights.sbomify.com/CVE-2024-2518/): MAGESH-K21 Online-College-Event-Hall-Reservation-System book_history.php cross site scripting (low 3.5)
- [CVE-2024-25178](https://insights.sbomify.com/CVE-2024-25178/): Memory corruption in luajit:luajit (critical 9.1)
- [CVE-2024-25177](https://insights.sbomify.com/CVE-2024-25177/): Null dereference in luajit:luajit (high 7.5)
- [CVE-2024-25176](https://insights.sbomify.com/CVE-2024-25176/): Memory corruption in luajit:luajit (critical 9.8)
- [CVE-2024-25175](https://insights.sbomify.com/CVE-2024-25175/): Cross-site scripting in kickdler:kickdler (medium 6.1)
- [CVE-2024-25170](https://insights.sbomify.com/CVE-2024-25170/): Mezzanine allows attackers to bypass access controls via manipulating the Host header (critical 9.1)
- [CVE-2024-2517](https://insights.sbomify.com/CVE-2024-2517/): MAGESH-K21 Online-College-Event-Hall-Reservation-System book_history.php sql injection (medium 6.3)
- [CVE-2024-25169](https://insights.sbomify.com/CVE-2024-25169/): Mezzanine allows attackers to bypass access control mechanisms (critical 9.8)
- [CVE-2024-25168](https://insights.sbomify.com/CVE-2024-25168/): SQL injection in dingflow:snow (medium 6.3)
- [CVE-2024-25167](https://insights.sbomify.com/CVE-2024-25167/): Cross-site scripting in markerhub:eblog (medium 6.1)
- [CVE-2024-25166](https://insights.sbomify.com/CVE-2024-25166/): Cross-site scripting in xiaocheng-keji:71cms (medium 6.1)
- [CVE-2024-25165](https://insights.sbomify.com/CVE-2024-25165/): Memory corruption in swftools:swftools (high 8.8)
- [CVE-2024-25164](https://insights.sbomify.com/CVE-2024-25164/): Path traversal in idurarapp:idurar (high 7.5)
- [CVE-2024-2516](https://insights.sbomify.com/CVE-2024-2516/): MAGESH-K21 Online-College-Event-Hall-Reservation-System home.php sql injection (medium 6.3)
- [CVE-2024-25157](https://insights.sbomify.com/CVE-2024-25157/): Authentication bypass in GoAnywhere MFT prior to 7.6.0 (medium 6.5)
- [CVE-2024-25156](https://insights.sbomify.com/CVE-2024-25156/): Path traversal in GoAnywhere MFT 7.4.1 and Earlier (medium 6.5)
- [CVE-2024-25155](https://insights.sbomify.com/CVE-2024-25155/): Reflected Cross-Site Scripting (XSS) in FileCatalyst Direct 3.8.8 and earlier (high 7.2)
- [CVE-2024-25154](https://insights.sbomify.com/CVE-2024-25154/): Path Traversal in FileCatalyst Direct 3.8.8 and Earlier (medium 5.3)
- [CVE-2024-25153](https://insights.sbomify.com/CVE-2024-25153/): Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114 (critical 9.8)
- [CVE-2024-25152](https://insights.sbomify.com/CVE-2024-25152/): Liferay Portal Message Board widget and Liferay DXP vulnerable to stored Cross-site Scripting (critical 9.0)
- [CVE-2024-25151](https://insights.sbomify.com/CVE-2024-25151/): Liferay Portal Calendar module and Liferay DXP vulnerable to Cross-site Scripting, content spoofing (medium 5.4)
- [CVE-2024-25150](https://insights.sbomify.com/CVE-2024-25150/): Liferay Portal and Liferay DXP Information Disclosure Vulnerability in the Control Panel (medium 4.3)
- [CVE-2024-2515](https://insights.sbomify.com/CVE-2024-2515/): MAGESH-K21 Online-College-Event-Hall-Reservation-System home.php cross site scripting (low 3.5)
- [CVE-2024-25149](https://insights.sbomify.com/CVE-2024-25149/): Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options (medium 5.4)
- [CVE-2024-25148](https://insights.sbomify.com/CVE-2024-25148/): Liferay Portal vulnerable to user impersonation (medium 5.4)
- [CVE-2024-25147](https://insights.sbomify.com/CVE-2024-25147/): Liferay Portal and Liferay DXP vulnerable to Cross-site Scripting (critical 9.6)
- [CVE-2024-25146](https://insights.sbomify.com/CVE-2024-25146/): Liferay Portal allows attackers to discover the existence of sites (medium 5.3)
- [CVE-2024-25145](https://insights.sbomify.com/CVE-2024-25145/): Liferay Portal stored cross-site scripting (XSS) vulnerability (critical 9.6)
- [CVE-2024-25144](https://insights.sbomify.com/CVE-2024-25144/): Liferay Portal denial-of-service vulnerability (medium 4.1)
- [CVE-2024-25143](https://insights.sbomify.com/CVE-2024-25143/): Liferay Portal denial of service (memory consumption) (medium 6.5)
- [CVE-2024-25142](https://insights.sbomify.com/CVE-2024-25142/): Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache (medium 5.5)
- [CVE-2024-25141](https://insights.sbomify.com/CVE-2024-25141/): Improper Certificate Validation in apache airflow mongo hook (critical 9.1)
- [CVE-2024-25140](https://insights.sbomify.com/CVE-2024-25140/): Misconfiguration in rustdesk:rustdesk (critical 9.8)
- [CVE-2024-2514](https://insights.sbomify.com/CVE-2024-2514/): MAGESH-K21 Online-College-Event-Hall-Reservation-System login.php sql injection (high 7.3)
- [CVE-2024-25139](https://insights.sbomify.com/CVE-2024-25139/): Integer overflow in tp-link:omada er605 firmware (critical 10.0)
- [CVE-2024-25138](https://insights.sbomify.com/CVE-2024-25138/): AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password (medium 6.5)
- [CVE-2024-25137](https://insights.sbomify.com/CVE-2024-25137/): AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow (medium 4.3)
- [CVE-2024-25136](https://insights.sbomify.com/CVE-2024-25136/): AutomationDirect C-MORE EA9 HMI Path Traversal (high 7.5)
- [CVE-2024-25133](https://insights.sbomify.com/CVE-2024-25133/): Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalation (high 8.8)
- [CVE-2024-25132](https://insights.sbomify.com/CVE-2024-25132/): Openshift-dedicated: hive: hibernation controller denial of service (medium 4.3)
- [CVE-2024-25131](https://insights.sbomify.com/CVE-2024-25131/): Openshift-dedicated: must-gather-operator: yaml template injection leads to privilege escalation (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/424/