# Vulnerabilities published in 2024


- [CVE-2024-2447](https://insights.sbomify.com/CVE-2024-2447/): Mattermost fails to authenticate the source of certain types of post actions (medium 6.5)
- [CVE-2024-24469](https://insights.sbomify.com/CVE-2024-24469/): Cross-site request forgery in flusity:flusity (high 8.8)
- [CVE-2024-24468](https://insights.sbomify.com/CVE-2024-24468/): Cross-site request forgery in flusity:flusity (high 8.8)
- [CVE-2024-2446](https://insights.sbomify.com/CVE-2024-2446/): Denial of service in Mattermost (medium 4.3)
- [CVE-2024-24459](https://insights.sbomify.com/CVE-2024-24459/): Memory corruption in HPE Athonet Core (medium 5.9)
- [CVE-2024-24458](https://insights.sbomify.com/CVE-2024-24458/): Memory corruption in HPE Athonet Core (medium 5.9)
- [CVE-2024-24457](https://insights.sbomify.com/CVE-2024-24457/): Memory corruption in HPE Athonet Core (medium 5.9)
- [CVE-2024-24456](https://insights.sbomify.com/CVE-2024-24456/): Memory corruption in HPE Athonet Core (medium 5.9)
- [CVE-2024-24455](https://insights.sbomify.com/CVE-2024-24455/): Memory corruption in HPE Athonet Core (medium 5.9)
- [CVE-2024-24454](https://insights.sbomify.com/CVE-2024-24454/): Memory corruption in HPE Athonet Core (medium 5.9)
- [CVE-2024-24453](https://insights.sbomify.com/CVE-2024-24453/): Memory corruption in HPE Athonet Core (medium 5.9)
- [CVE-2024-24452](https://insights.sbomify.com/CVE-2024-24452/): Memory corruption in HPE Athonet Core (medium 5.9)
- [CVE-2024-24451](https://insights.sbomify.com/CVE-2024-24451/): A stack overflow in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attacker (high 7.5)
- [CVE-2024-24450](https://insights.sbomify.com/CVE-2024-24450/): Stack-based memcpy buffer overflow in the ngap_handle_pdu_session_resource_setup_response routine in OpenAirInterface CN5G AMF <= 2.0.0 allo (medium 5.3)
- [CVE-2024-2445](https://insights.sbomify.com/CVE-2024-2445/): Reflected XSS in Mattermost Jira plugin (medium 6.1)
- [CVE-2024-24449](https://insights.sbomify.com/CVE-2024-24449/): An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a D (medium 6.5)
- [CVE-2024-24447](https://insights.sbomify.com/CVE-2024-24447/): A buffer overflow in the ngap_amf_handle_pdu_session_resource_setup_response function of oai-cn5g-amf up to v2.0.0 allows attackers to cause (medium 5.3)
- [CVE-2024-24446](https://insights.sbomify.com/CVE-2024-24446/): An uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service (DoS) via a cra (medium 6.5)
- [CVE-2024-24445](https://insights.sbomify.com/CVE-2024-24445/): OpenAirInterface CN5G AMF (oai-cn5g-amf) <= 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which al (medium 6.5)
- [CVE-2024-24444](https://insights.sbomify.com/CVE-2024-24444/): Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers to cause (high 7.5)
- [CVE-2024-24443](https://insights.sbomify.com/CVE-2024-24443/): An uninitialized pointer dereference in the ngap_handle_pdu_session_resource_setup_response routine of OpenAirInterface CN5G AMF (oai-cn5g-a (medium 6.5)
- [CVE-2024-24442](https://insights.sbomify.com/CVE-2024-24442/): A NULL pointer dereference in the ngap_app::handle_receive routine of OpenAirInterface CN5G AMF (oai-cn5g-amf) up to v2.0.0 allows attackers (high 7.5)
- [CVE-2024-2444](https://insights.sbomify.com/CVE-2024-2444/): Inline Related Posts < 3.5.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-24432](https://insights.sbomify.com/CVE-2024-24432/): Denial of service in open5gs:open5gs (medium 5.3)
- [CVE-2024-24431](https://insights.sbomify.com/CVE-2024-24431/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2024-24430](https://insights.sbomify.com/CVE-2024-24430/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2024-2443](https://insights.sbomify.com/CVE-2024-2443/): Command injection in GitHub Enterprise Server (critical 9.1)
- [CVE-2024-24429](https://insights.sbomify.com/CVE-2024-24429/): Denial of service in open5gs:open5gs (high 8.6)
- [CVE-2024-24428](https://insights.sbomify.com/CVE-2024-24428/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2024-24427](https://insights.sbomify.com/CVE-2024-24427/): Denial of service in open5gs:open5gs (high 7.5)
- [CVE-2024-24426](https://insights.sbomify.com/CVE-2024-24426/): Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attacke (high 7.5)
- [CVE-2024-24425](https://insights.sbomify.com/CVE-2024-24425/): Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amf/amf_as.cpp. (medium 6.5)
- [CVE-2024-24424](https://insights.sbomify.com/CVE-2024-24424/): A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2 (high 7.5)
- [CVE-2024-24423](https://insights.sbomify.com/CVE-2024-24423/): Memory corruption in linuxfoundation:magma (high 7.5)
- [CVE-2024-24422](https://insights.sbomify.com/CVE-2024-24422/): Memory corruption in linuxfoundation:magma (high 7.5)
- [CVE-2024-24421](https://insights.sbomify.com/CVE-2024-24421/): Memory corruption in linuxfoundation:magma (critical 9.8)
- [CVE-2024-24420](https://insights.sbomify.com/CVE-2024-24420/): Denial of service in linuxfoundation:magma (high 7.5)
- [CVE-2024-2442](https://insights.sbomify.com/CVE-2024-2442/): Path Traversal vulnerability in Franklin Fueling System EVO 550/5000 (high 7.5)
- [CVE-2024-24419](https://insights.sbomify.com/CVE-2024-24419/): Memory corruption in linuxfoundation:magma (high 7.5)
- [CVE-2024-24418](https://insights.sbomify.com/CVE-2024-24418/): Memory corruption in linuxfoundation:magma (high 7.5)
- [CVE-2024-24417](https://insights.sbomify.com/CVE-2024-24417/): Memory corruption in linuxfoundation:magma (high 7.5)
- [CVE-2024-24416](https://insights.sbomify.com/CVE-2024-24416/): Memory corruption in linuxfoundation:magma (high 7.5)
- [CVE-2024-2441](https://insights.sbomify.com/CVE-2024-2441/): VikBooking < 1.6.8 - Insecure Direct Object References (high 8.1)
- [CVE-2024-24409](https://insights.sbomify.com/CVE-2024-24409/): Privilege Escalation (high 8.8)
- [CVE-2024-24407](https://insights.sbomify.com/CVE-2024-24407/): SQL injection in mayurik:best courier management system (medium 5.3)
- [CVE-2024-24402](https://insights.sbomify.com/CVE-2024-24402/): Privilege escalation in nagios:nagios xi (critical 9.8)
- [CVE-2024-24401](https://insights.sbomify.com/CVE-2024-24401/): SQL injection in nagios:nagios xi (critical 9.8)
- [CVE-2024-2440](https://insights.sbomify.com/CVE-2024-2440/): Race Condition was identified in GitHub Enterprise Server that allowed maintaining admin permissions (medium 5.5)
- [CVE-2024-24399](https://insights.sbomify.com/CVE-2024-24399/): File upload in lepton-cms:leptoncms (high 7.2)
- [CVE-2024-24398](https://insights.sbomify.com/CVE-2024-24398/): Stimulsoft Dashboard.JS directory traversal vulnerability (critical 9.8)
- [CVE-2024-24397](https://insights.sbomify.com/CVE-2024-24397/): Stimulsoft Dashboard.JS Cross Site Scripting vulnerability (medium 5.4)
- [CVE-2024-24396](https://insights.sbomify.com/CVE-2024-24396/): Stimulsoft Dashboard.JS Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2024-24393](https://insights.sbomify.com/CVE-2024-24393/): File upload in oaooa:pichome (critical 9.8)
- [CVE-2024-2439](https://insights.sbomify.com/CVE-2024-2439/): Salon booking system <= 9.6.5 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-24389](https://insights.sbomify.com/CVE-2024-24389/): Cross-site scripting in xunruicms:xunruicms (medium 6.1)
- [CVE-2024-24388](https://insights.sbomify.com/CVE-2024-24388/): Cross-site scripting in xunruicms:xunruicms (medium 6.1)
- [CVE-2024-24386](https://insights.sbomify.com/CVE-2024-24386/): Code injection in vitalpbx:vitalpbx (high 7.2)
- [CVE-2024-24377](https://insights.sbomify.com/CVE-2024-24377/): Command injection in idocv:idocview (high 8.1)
- [CVE-2024-24375](https://insights.sbomify.com/CVE-2024-24375/): SQL injection in jfinalcms project:jfinalcms (high 7.5)
- [CVE-2024-2436](https://insights.sbomify.com/CVE-2024-2436/): Lightweight Accordion <= 1.5.16 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-24350](https://insights.sbomify.com/CVE-2024-24350/): File upload in softwarepublico:e-sic livre (high 8.8)
- [CVE-2024-2435](https://insights.sbomify.com/CVE-2024-2435/): Stored XSS in Timeline View (medium 4.3)
- [CVE-2024-2434](https://insights.sbomify.com/CVE-2024-2434/): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (high 8.5)
- [CVE-2024-24337](https://insights.sbomify.com/CVE-2024-24337/): Code injection in koha:koha (high 8.8)
- [CVE-2024-24336](https://insights.sbomify.com/CVE-2024-24336/): A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Li (high 8.1)
- [CVE-2024-24335](https://insights.sbomify.com/CVE-2024-24335/): Memory corruption in rt-thread:rt-thread (high 8.4)
- [CVE-2024-24334](https://insights.sbomify.com/CVE-2024-24334/): Memory corruption in rt-thread:rt-thread (high 8.4)
- [CVE-2024-24333](https://insights.sbomify.com/CVE-2024-24333/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-24332](https://insights.sbomify.com/CVE-2024-24332/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-24331](https://insights.sbomify.com/CVE-2024-24331/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-24330](https://insights.sbomify.com/CVE-2024-24330/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-2433](https://insights.sbomify.com/CVE-2024-2433/): PAN-OS: Improper Privilege Management Vulnerability in Panorama Software Leads to Availability Loss (medium 4.3)
- [CVE-2024-24329](https://insights.sbomify.com/CVE-2024-24329/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-24328](https://insights.sbomify.com/CVE-2024-24328/): Command injection in totolink:a3300r firmware (high 8.8)
- [CVE-2024-24327](https://insights.sbomify.com/CVE-2024-24327/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-24326](https://insights.sbomify.com/CVE-2024-24326/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-24325](https://insights.sbomify.com/CVE-2024-24325/): Command injection in totolink:a3300r firmware (critical 9.8)
- [CVE-2024-24324](https://insights.sbomify.com/CVE-2024-24324/): Hardcoded credentials in totolink:a8000ru firmware (critical 9.8)
- [CVE-2024-24323](https://insights.sbomify.com/CVE-2024-24323/): SQL injection in linlinjava:litemall (high 7.2)
- [CVE-2024-24321](https://insights.sbomify.com/CVE-2024-24321/): Command injection in dlink:dir-816 firmware (critical 9.8)
- [CVE-2024-24320](https://insights.sbomify.com/CVE-2024-24320/): Path traversal in mgt-commerce:cloudpanel (high 8.8)
- [CVE-2024-2432](https://insights.sbomify.com/CVE-2024-2432/): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (medium 4.5)
- [CVE-2024-24313](https://insights.sbomify.com/CVE-2024-24313/): An issue in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Models/FormModel.php and (high 7.5)
- [CVE-2024-24312](https://insights.sbomify.com/CVE-2024-24312/): SQL injection vulnerability in Vaales Technologies V_QRS v.2024-01-17 allows a remote attacker to obtain sensitive information via the Model (high 7.5)
- [CVE-2024-24311](https://insights.sbomify.com/CVE-2024-24311/): Path traversal in lineagrafica:multilingual and multistore sitemap pro (high 7.5)
- [CVE-2024-24310](https://insights.sbomify.com/CVE-2024-24310/): SQL injection in ethercreation:generate barcode on invoice \/ delivery slip (high 8.8)
- [CVE-2024-2431](https://insights.sbomify.com/CVE-2024-2431/): GlobalProtect App: Local User Can Disable GlobalProtect (medium 5.5)
- [CVE-2024-24309](https://insights.sbomify.com/CVE-2024-24309/): Missing authorization in ecomiz:survey tma (high 7.5)
- [CVE-2024-24308](https://insights.sbomify.com/CVE-2024-24308/): SQL injection in boostmyshop:boostmyshop (critical 9.8)
- [CVE-2024-24307](https://insights.sbomify.com/CVE-2024-24307/): Path traversal in prestalife:product designer (high 7.5)
- [CVE-2024-24304](https://insights.sbomify.com/CVE-2024-24304/): Missing authorization in sinch:mailjet (high 7.5)
- [CVE-2024-24303](https://insights.sbomify.com/CVE-2024-24303/): SQL injection in hipresta:gift wrapping pro (critical 9.8)
- [CVE-2024-24302](https://insights.sbomify.com/CVE-2024-24302/): Deserialization in prestalife:product designer (critical 9.8)
- [CVE-2024-24301](https://insights.sbomify.com/CVE-2024-24301/): Command injection in 4ipnet:eap-767 firmware (high 8.8)
- [CVE-2024-24300](https://insights.sbomify.com/CVE-2024-24300/): Hardcoded credentials in 4ipnet:eap-767 firmware (critical 9.8)
- [CVE-2024-2430](https://insights.sbomify.com/CVE-2024-2430/): Website Content in Page or Post < 2024.04.09 - Contributor+ Stored Cross-Site Scripting (medium 6.5)
- [CVE-2024-24294](https://insights.sbomify.com/CVE-2024-24294/): Blackprint @blackprint/engine Prototype Pollution issue (critical 9.8)
- [CVE-2024-24293](https://insights.sbomify.com/CVE-2024-24293/): MiguelCastillo @bit/loader Prototype Pollution issue (high 8.8)
- [CVE-2024-24292](https://insights.sbomify.com/CVE-2024-24292/): Code injection in aliconnect:software development kit (critical 9.8)
- [CVE-2024-24291](https://insights.sbomify.com/CVE-2024-24291/): Open redirect in yzmcms:yzmcms (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/430/