# Vulnerabilities published in 2024


- [CVE-2024-2429](https://insights.sbomify.com/CVE-2024-2429/): Salon booking system <= 9.6.5 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-2428](https://insights.sbomify.com/CVE-2024-2428/): The Ultimate Video Player For WordPress < 2.2.3 - Contributor+ Stored XSS (medium 4.7)
- [CVE-2024-24279](https://insights.sbomify.com/CVE-2024-24279/): Auth bypass in secdiskapp:secdiskapp (high 8.8)
- [CVE-2024-24278](https://insights.sbomify.com/CVE-2024-24278/): Code injection in teamwire:teamwire (high 7.5)
- [CVE-2024-24276](https://insights.sbomify.com/CVE-2024-24276/): Cross-site scripting in teamwire:teamwire (critical 9.6)
- [CVE-2024-24275](https://insights.sbomify.com/CVE-2024-24275/): Cross-site scripting in teamwire:teamwire (critical 9.6)
- [CVE-2024-24272](https://insights.sbomify.com/CVE-2024-24272/): Information disclosure in itopvpn:dualsafe password manager (high 7.1)
- [CVE-2024-2427](https://insights.sbomify.com/CVE-2024-2427/): Rockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527 (high 7.5)
- [CVE-2024-24267](https://insights.sbomify.com/CVE-2024-24267/): Denial of service in gpac:gpac (high 7.5)
- [CVE-2024-24266](https://insights.sbomify.com/CVE-2024-24266/): Use after free in gpac:gpac (high 7.5)
- [CVE-2024-24265](https://insights.sbomify.com/CVE-2024-24265/): Denial of service in gpac:gpac (high 7.5)
- [CVE-2024-24263](https://insights.sbomify.com/CVE-2024-24263/): Use after free in chendotjs:lotos webserver (high 7.5)
- [CVE-2024-24262](https://insights.sbomify.com/CVE-2024-24262/): Use after free in ireader:media-server (high 7.5)
- [CVE-2024-24260](https://insights.sbomify.com/CVE-2024-24260/): Use after free in ireader:media-server (high 7.5)
- [CVE-2024-2426](https://insights.sbomify.com/CVE-2024-2426/): Rockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527 (high 7.5)
- [CVE-2024-24259](https://insights.sbomify.com/CVE-2024-24259/): Denial of service in artifex:mupdf (high 7.5)
- [CVE-2024-24258](https://insights.sbomify.com/CVE-2024-24258/): Denial of service in artifex:mupdf (high 7.5)
- [CVE-2024-24257](https://insights.sbomify.com/CVE-2024-24257/): An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information v (high 7.5)
- [CVE-2024-24256](https://insights.sbomify.com/CVE-2024-24256/): SQL injection in yonyou:yonyou (medium 5.9)
- [CVE-2024-24255](https://insights.sbomify.com/CVE-2024-24255/): Race condition in dronecode:px4 drone autopilot (medium 4.2)
- [CVE-2024-24254](https://insights.sbomify.com/CVE-2024-24254/): Race condition in dronecode:px4 drone autopilot (medium 4.2)
- [CVE-2024-2425](https://insights.sbomify.com/CVE-2024-2425/): Rockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527 (high 7.5)
- [CVE-2024-24246](https://insights.sbomify.com/CVE-2024-24246/): Memory corruption in fedoraproject:fedora (medium 5.5)
- [CVE-2024-24245](https://insights.sbomify.com/CVE-2024-24245/): Privilege escalation in clamxav:clamxav (high 7.8)
- [CVE-2024-2424](https://insights.sbomify.com/CVE-2024-2424/): Rockwell Automation Input/Output Device Vulnerable to Major Nonrecoverable Fault (high 7.5)
- [CVE-2024-24230](https://insights.sbomify.com/CVE-2024-24230/): Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. (high 7.5)
- [CVE-2024-2423](https://insights.sbomify.com/CVE-2024-2423/): UsersWP <= 1.2.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-2422](https://insights.sbomify.com/CVE-2024-2422/): LenelS2 NetBox Improper Neutralization of Argumented Delimiters (critical 9.3)
- [CVE-2024-24216](https://insights.sbomify.com/CVE-2024-24216/): Command injection in easycorp:zentao (critical 9.8)
- [CVE-2024-24215](https://insights.sbomify.com/CVE-2024-24215/): Information disclosure in cellinx:nvt web server (medium 5.3)
- [CVE-2024-24213](https://insights.sbomify.com/CVE-2024-24213/): SQL injection in supabase:postgres (critical 9.8)
- [CVE-2024-2421](https://insights.sbomify.com/CVE-2024-2421/): LenelS2 NetBox Improper Neutralization of Special Elements (critical 9.3)
- [CVE-2024-24202](https://insights.sbomify.com/CVE-2024-24202/): File upload in easycorp:zentao (critical 9.8)
- [CVE-2024-2420](https://insights.sbomify.com/CVE-2024-2420/): LenelS2 NetBox Hardcoded Credentials (high 8.8)
- [CVE-2024-24199](https://insights.sbomify.com/CVE-2024-24199/): Memory corruption in pymumu:smartdns (high 7.5)
- [CVE-2024-24198](https://insights.sbomify.com/CVE-2024-24198/): Memory corruption in pymumu:smartdns (high 7.5)
- [CVE-2024-24195](https://insights.sbomify.com/CVE-2024-24195/): Memory corruption in robertdavidgraham:robdns (high 7.5)
- [CVE-2024-24194](https://insights.sbomify.com/CVE-2024-24194/): robdns commit d76d2e6 was discovered to contain a NULL pointer dereference via the item->tokens component at /src/conf-parse.c. (high 7.5)
- [CVE-2024-24192](https://insights.sbomify.com/CVE-2024-24192/): Memory corruption in robertdavidgraham:robdns (low 2.7)
- [CVE-2024-2419](https://insights.sbomify.com/CVE-2024-2419/): Keycloak: path traversal in the redirect validation (high 7.1)
- [CVE-2024-24189](https://insights.sbomify.com/CVE-2024-24189/): Use after free in jsish:jsish (critical 9.8)
- [CVE-2024-24188](https://insights.sbomify.com/CVE-2024-24188/): Memory corruption in jsish:jsish (critical 9.8)
- [CVE-2024-24186](https://insights.sbomify.com/CVE-2024-24186/): Memory corruption in jsish:jsish (critical 9.8)
- [CVE-2024-2418](https://insights.sbomify.com/CVE-2024-2418/): SourceCodester Best POS Management System view_order.php sql injection (medium 6.3)
- [CVE-2024-2417](https://insights.sbomify.com/CVE-2024-2417/): Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (high 8.8)
- [CVE-2024-24161](https://insights.sbomify.com/CVE-2024-24161/): Path traversal in mrcms:mrcms (high 7.5)
- [CVE-2024-24160](https://insights.sbomify.com/CVE-2024-24160/): Cross-site scripting in mrcms:mrcms (medium 6.1)
- [CVE-2024-2416](https://insights.sbomify.com/CVE-2024-2416/): Cross-Site Request Forgery vulnerability in Movistar 4G router (medium 6.5)
- [CVE-2024-24157](https://insights.sbomify.com/CVE-2024-24157/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2024-24156](https://insights.sbomify.com/CVE-2024-24156/): Cross-site scripting in sir:gnuboard (medium 6.1)
- [CVE-2024-24155](https://insights.sbomify.com/CVE-2024-24155/): Denial of service in axiosys:bento4 (medium 6.5)
- [CVE-2024-24150](https://insights.sbomify.com/CVE-2024-24150/): Denial of service in libming:libming (medium 6.5)
- [CVE-2024-2415](https://insights.sbomify.com/CVE-2024-2415/): Command injection vulnerability in Movistar 4G router (high 7.8)
- [CVE-2024-24149](https://insights.sbomify.com/CVE-2024-24149/): Denial of service in libming:libming (medium 6.5)
- [CVE-2024-24148](https://insights.sbomify.com/CVE-2024-24148/): Denial of service in libming:libming (high 7.5)
- [CVE-2024-24147](https://insights.sbomify.com/CVE-2024-24147/): Denial of service in libming:libming (medium 6.5)
- [CVE-2024-24146](https://insights.sbomify.com/CVE-2024-24146/): Denial of service in libming:libming (medium 6.5)
- [CVE-2024-24142](https://insights.sbomify.com/CVE-2024-24142/): SQL injection in rems:school task manager (critical 9.8)
- [CVE-2024-24141](https://insights.sbomify.com/CVE-2024-24141/): SQL injection in remyandrade:school task manager (critical 9.8)
- [CVE-2024-24140](https://insights.sbomify.com/CVE-2024-24140/): SQL injection in remyandrade:daily habit tracker (high 7.2)
- [CVE-2024-2414](https://insights.sbomify.com/CVE-2024-2414/): Unprotected Primary Channel vulnerability in Movistar 4G router (high 8.8)
- [CVE-2024-24139](https://insights.sbomify.com/CVE-2024-24139/): SQL injection in remyandrade:login system with email verification (high 7.2)
- [CVE-2024-24136](https://insights.sbomify.com/CVE-2024-24136/): Cross-site scripting in remyandrade:math game (medium 6.1)
- [CVE-2024-24135](https://insights.sbomify.com/CVE-2024-24135/): Cross-site scripting in remyandrade:product inventory with export to excel (medium 6.1)
- [CVE-2024-24134](https://insights.sbomify.com/CVE-2024-24134/): Cross-site scripting in remyandrade:online food menu (medium 4.8)
- [CVE-2024-24133](https://insights.sbomify.com/CVE-2024-24133/): SQL injection in atmail:atmail (critical 9.8)
- [CVE-2024-24131](https://insights.sbomify.com/CVE-2024-24131/): Cross-site scripting in superwebmailer:superwebmailer (medium 6.1)
- [CVE-2024-24130](https://insights.sbomify.com/CVE-2024-24130/): Cross-site scripting in mail2world:mail2world webmail (medium 6.1)
- [CVE-2024-2413](https://insights.sbomify.com/CVE-2024-2413/): Intumit SmartRobot - Use of Hard-coded Cryptographic Key (critical 9.8)
- [CVE-2024-24122](https://insights.sbomify.com/CVE-2024-24122/): Path traversal in wondershare:edraw (critical 9.8)
- [CVE-2024-2412](https://insights.sbomify.com/CVE-2024-2412/): Heimavista Rpage and Epage - Broken Access Control (medium 5.3)
- [CVE-2024-24117](https://insights.sbomify.com/CVE-2024-24117/): Privilege escalation in ruijie:rg-nbs2009g-p firmware (critical 9.8)
- [CVE-2024-24116](https://insights.sbomify.com/CVE-2024-24116/): Privilege escalation in ruijie:rg-nbs2009g-p firmware (critical 9.8)
- [CVE-2024-24115](https://insights.sbomify.com/CVE-2024-24115/): Cross-site scripting in cotonti:cotonti siena (medium 5.4)
- [CVE-2024-24113](https://insights.sbomify.com/CVE-2024-24113/): XXL-JOB vulnerable to Server-Side Request Forgery (high 8.8)
- [CVE-2024-24112](https://insights.sbomify.com/CVE-2024-24112/): SQL injection in exrick:xmall (critical 9.8)
- [CVE-2024-24110](https://insights.sbomify.com/CVE-2024-24110/): SQL injection in crmeb:crmeb java (medium 6.5)
- [CVE-2024-2411](https://insights.sbomify.com/CVE-2024-2411/): MasterStudy LMS <= 3.3.0 - Unauthenticated Local File Inclusion via modal (critical 9.8)
- [CVE-2024-24105](https://insights.sbomify.com/CVE-2024-24105/): SQL injection in carmelo:computer science time table system (high 7.8)
- [CVE-2024-24101](https://insights.sbomify.com/CVE-2024-24101/): SQL injection in code-projects:scholars tracking system (medium 5.1)
- [CVE-2024-24100](https://insights.sbomify.com/CVE-2024-24100/): SQL injection in carmelo:computer book store (high 8.3)
- [CVE-2024-2410](https://insights.sbomify.com/CVE-2024-2410/): Use after free in C++ protobuf (high 7.6)
- [CVE-2024-24099](https://insights.sbomify.com/CVE-2024-24099/): SQL injection in code-projects:scholars tracking system (medium 5.4)
- [CVE-2024-24098](https://insights.sbomify.com/CVE-2024-24098/): SQL injection in fabian:scholars tracking system (critical 9.8)
- [CVE-2024-24097](https://insights.sbomify.com/CVE-2024-24097/): Cross-site scripting in code-projects:scholars tracking system (medium 5.4)
- [CVE-2024-24096](https://insights.sbomify.com/CVE-2024-24096/): SQL injection in carmelo:computer book store (high 7.8)
- [CVE-2024-24095](https://insights.sbomify.com/CVE-2024-24095/): SQL injection in code-projects:simple stock system (critical 9.8)
- [CVE-2024-24093](https://insights.sbomify.com/CVE-2024-24093/): SQL injection in code-projects:scholars tracking system (critical 9.8)
- [CVE-2024-24092](https://insights.sbomify.com/CVE-2024-24092/): SQL injection in code-projects:scholars tracking system (high 7.8)
- [CVE-2024-24091](https://insights.sbomify.com/CVE-2024-24091/): Command injection in yealink:yealink meeting server (critical 9.8)
- [CVE-2024-2409](https://insights.sbomify.com/CVE-2024-2409/): MasterStudy LMS <= 3.3.1 - Unauthenticated Privilege Escalation via stm_lms_register AJAX Action (critical 9.8)
- [CVE-2024-2408](https://insights.sbomify.com/CVE-2024-2408/): PHP is vulnerable to the Marvin Attack (medium 5.9)
- [CVE-2024-24062](https://insights.sbomify.com/CVE-2024-24062/): Cross-site scripting in aitangbao:springboot-manager (medium 5.4)
- [CVE-2024-24061](https://insights.sbomify.com/CVE-2024-24061/): Cross-site scripting in aitangbao:springboot-manager (medium 5.4)
- [CVE-2024-24060](https://insights.sbomify.com/CVE-2024-24060/): Cross-site scripting in aitangbao:springboot-manager (medium 5.4)
- [CVE-2024-2406](https://insights.sbomify.com/CVE-2024-2406/): Gacjie Server Upload.php index unrestricted upload (medium 5.4)
- [CVE-2024-24059](https://insights.sbomify.com/CVE-2024-24059/): File upload in aitangbao:springboot-manager (medium 6.1)
- [CVE-2024-24051](https://insights.sbomify.com/CVE-2024-24051/): Other in monoprice:select mini 3d printer v2 firmware (medium 5.5)
- [CVE-2024-24050](https://insights.sbomify.com/CVE-2024-24050/): Cross-site scripting in remyandrade:workout journal app (medium 4.7)
- [CVE-2024-2405](https://insights.sbomify.com/CVE-2024-2405/): Float menu < 6.0.1 - Menu Deletion via CSRF (medium 4.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/431/