# Vulnerabilities published in 2024


- [CVE-2024-24043](https://insights.sbomify.com/CVE-2024-24043/): Directory Traversal vulnerability in Speedy11CZ MCRPX v.1.4.0 and before allows a local attacker to execute arbitrary code via a crafted file. (medium 5.5)
- [CVE-2024-24042](https://insights.sbomify.com/CVE-2024-24042/): Path traversal in flaskcode Devan-Kerman ARRP (high 8.8)
- [CVE-2024-24041](https://insights.sbomify.com/CVE-2024-24041/): Cross-site scripting in remyandrade:travel journal using php and mysql with source code (medium 6.1)
- [CVE-2024-2404](https://insights.sbomify.com/CVE-2024-2404/): Better Comments < 1.5.6 - Subscriber+ Stored XSS (medium 5.4)
- [CVE-2024-24035](https://insights.sbomify.com/CVE-2024-24035/): Cross-site scripting in setorinformatica:s.i.l. (medium 6.1)
- [CVE-2024-24034](https://insights.sbomify.com/CVE-2024-24034/): Open redirect in setorinformatica:s.i.l (medium 6.1)
- [CVE-2024-2403](https://insights.sbomify.com/CVE-2024-2403/): Information disclosure in Remote Desktop Manager (medium 5.9)
- [CVE-2024-24029](https://insights.sbomify.com/CVE-2024-24029/): SQL injection in jfinalcms project:jfinalcms (critical 9.8)
- [CVE-2024-24028](https://insights.sbomify.com/CVE-2024-24028/): Server-side request forgery in likeshop:likeshop (medium 5.9)
- [CVE-2024-24027](https://insights.sbomify.com/CVE-2024-24027/): SQL injection in likeshop:likeshop (high 7.2)
- [CVE-2024-24026](https://insights.sbomify.com/CVE-2024-24026/): File upload in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-24025](https://insights.sbomify.com/CVE-2024-24025/): File upload in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-24024](https://insights.sbomify.com/CVE-2024-24024/): Path traversal in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-24023](https://insights.sbomify.com/CVE-2024-24023/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-24021](https://insights.sbomify.com/CVE-2024-24021/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-2402](https://insights.sbomify.com/CVE-2024-2402/): Better Comments < 1.5.6 - Admin+ Stored XSS (medium 5.4)
- [CVE-2024-24019](https://insights.sbomify.com/CVE-2024-24019/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-24018](https://insights.sbomify.com/CVE-2024-24018/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-24017](https://insights.sbomify.com/CVE-2024-24017/): SQL injection in xxyopen:novel-plus (high 7.5)
- [CVE-2024-24015](https://insights.sbomify.com/CVE-2024-24015/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-24014](https://insights.sbomify.com/CVE-2024-24014/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-24013](https://insights.sbomify.com/CVE-2024-24013/): SQL injection in xxyopen:novel-plus (critical 9.8)
- [CVE-2024-2401](https://insights.sbomify.com/CVE-2024-2401/): Admin Page Spider <= 3.31 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-24004](https://insights.sbomify.com/CVE-2024-24004/): SQL injection in jishenghua:jsherp (critical 9.8)
- [CVE-2024-24003](https://insights.sbomify.com/CVE-2024-24003/): SQL injection in jishenghua:jsherp (critical 9.8)
- [CVE-2024-24002](https://insights.sbomify.com/CVE-2024-24002/): SQL injection in jishenghua:jsherp (critical 9.8)
- [CVE-2024-24001](https://insights.sbomify.com/CVE-2024-24001/): SQL injection in jishenghua:jsherp (critical 9.8)
- [CVE-2024-24000](https://insights.sbomify.com/CVE-2024-24000/): File upload in huaxiaerp:jsherp (critical 9.8)
- [CVE-2024-2400](https://insights.sbomify.com/CVE-2024-2400/): Use after free in Chrome (high 8.8)
- [CVE-2024-23998](https://insights.sbomify.com/CVE-2024-23998/): Cross-site scripting in goanother:another redis desktop manager (medium 5.0)
- [CVE-2024-23997](https://insights.sbomify.com/CVE-2024-23997/): Cross-site scripting in lukasbach:yana (medium 6.1)
- [CVE-2024-23995](https://insights.sbomify.com/CVE-2024-23995/): Cross Site Scripting (XSS) in Beekeeper Studio 4.1.13 and earlier allows remote attackers to execute arbitrary code in the column name of a (medium 6.1)
- [CVE-2024-2399](https://insights.sbomify.com/CVE-2024-2399/): Premium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-23985](https://insights.sbomify.com/CVE-2024-23985/): Denial of service in ezhometech:ezserver (high 7.5)
- [CVE-2024-23984](https://insights.sbomify.com/CVE-2024-23984/): Information disclosure in Intel(R) Processors (medium 6.8)
- [CVE-2024-23983](https://insights.sbomify.com/CVE-2024-23983/): Access rules for PingAccess may be circumvented with URL-encoded characters (medium 5.8)
- [CVE-2024-23982](https://insights.sbomify.com/CVE-2024-23982/): BIG-IP PEM vulnerability (high 7.5)
- [CVE-2024-23981](https://insights.sbomify.com/CVE-2024-23981/): Integer overflow in Intel(R) Ethernet Network Controllers and Adapters (critical 9.3)
- [CVE-2024-23980](https://insights.sbomify.com/CVE-2024-23980/): Memory corruption in UEFI firmware for some Intel(R) Server D50FCP Family products (high 7.5)
- [CVE-2024-2398](https://insights.sbomify.com/CVE-2024-2398/): HTTP/2 push headers memory-leak (high 8.6)
- [CVE-2024-23979](https://insights.sbomify.com/CVE-2024-23979/): BIG-IP SSL Client Certificate LDAP and CRLDP Authentication profiles vulnerability (high 7.5)
- [CVE-2024-23978](https://insights.sbomify.com/CVE-2024-23978/): Memory corruption in HOME SPOT CUBE2 (critical 9.8)
- [CVE-2024-23976](https://insights.sbomify.com/CVE-2024-23976/): BIG-IP Appliance mode iAppsLX vulnerability (medium 6.0)
- [CVE-2024-23975](https://insights.sbomify.com/CVE-2024-23975/): Delta Electronics DIAEnergie SQL injection (high 8.8)
- [CVE-2024-23974](https://insights.sbomify.com/CVE-2024-23974/): Misconfiguration in Intel(R) ISH software installers (medium 5.4)
- [CVE-2024-23973](https://insights.sbomify.com/CVE-2024-23973/): Silicon Labs Gecko OS HTTP GET Request Handling Stack-based Buffer Overflow (high 8.8)
- [CVE-2024-23972](https://insights.sbomify.com/CVE-2024-23972/): Sony XAV-AX5500 USB Configuration Descriptor Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-23971](https://insights.sbomify.com/CVE-2024-23971/): ChargePoint Home Flex OCPP bswitch Command Injection (high 8.8)
- [CVE-2024-23970](https://insights.sbomify.com/CVE-2024-23970/): ChargePoint Home Flex Improper Certificate Validation (medium 6.5)
- [CVE-2024-2397](https://insights.sbomify.com/CVE-2024-2397/): infinite loop in the PPP printer of tcpdump (medium 6.2)
- [CVE-2024-23969](https://insights.sbomify.com/CVE-2024-23969/): ChargePoint Home Flex wlanchnllst Out-Of-Bounds Write (high 8.8)
- [CVE-2024-23968](https://insights.sbomify.com/CVE-2024-23968/): ChargePoint Home Flex SrvrToSmSetAutoChnlListMsg Stack-based Buffer Overflow (high 8.8)
- [CVE-2024-23967](https://insights.sbomify.com/CVE-2024-23967/): Memory corruption in MaxiCharger AC Elite Business C50 (high 8.0)
- [CVE-2024-23963](https://insights.sbomify.com/CVE-2024-23963/): Alpine Halo9 Stack-based Buffer Overflow (high 8.0)
- [CVE-2024-23962](https://insights.sbomify.com/CVE-2024-23962/): Alpine Halo9 Missing Authentication (medium 5.3)
- [CVE-2024-23961](https://insights.sbomify.com/CVE-2024-23961/): Alpine Halo9 UPDM_wemCmdUpdFSpeDecomp Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-23960](https://insights.sbomify.com/CVE-2024-23960/): Alpine Halo9 Improper Verification of Cryptographic Signature Vulnerability (medium 4.6)
- [CVE-2024-23959](https://insights.sbomify.com/CVE-2024-23959/): Memory corruption in MaxiCharger AC Elite Business C50 (high 8.0)
- [CVE-2024-23958](https://insights.sbomify.com/CVE-2024-23958/): Autel MaxiCharger AC Elite Business C50 BLE Hardcoded Credentials Authentication Bypass Vulnerability (medium 6.5)
- [CVE-2024-23957](https://insights.sbomify.com/CVE-2024-23957/): Memory corruption in MaxiCharger AC Elite Business C50 (high 8.8)
- [CVE-2024-23953](https://insights.sbomify.com/CVE-2024-23953/): Apache Hive: Timing Attack Against Signature in LLAP util (medium 6.5)
- [CVE-2024-23952](https://insights.sbomify.com/CVE-2024-23952/): Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104) (medium 6.5)
- [CVE-2024-23951](https://insights.sbomify.com/CVE-2024-23951/): Memory corruption in libigl (high 8.8)
- [CVE-2024-23950](https://insights.sbomify.com/CVE-2024-23950/): Memory corruption in libigl (high 8.8)
- [CVE-2024-2395](https://insights.sbomify.com/CVE-2024-2395/): Bulgarisation for WooCommerce <= 3.0.14 - Cross-Site Request Forgery (high 7.3)
- [CVE-2024-23949](https://insights.sbomify.com/CVE-2024-23949/): Memory corruption in libigl (high 8.8)
- [CVE-2024-23948](https://insights.sbomify.com/CVE-2024-23948/): Memory corruption in libigl (high 8.8)
- [CVE-2024-23947](https://insights.sbomify.com/CVE-2024-23947/): Memory corruption in libigl (high 8.8)
- [CVE-2024-23946](https://insights.sbomify.com/CVE-2024-23946/): Apache OFBiz: Path traversal or file inclusion (medium 5.3)
- [CVE-2024-23945](https://insights.sbomify.com/CVE-2024-23945/): Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails (medium 5.9)
- [CVE-2024-23944](https://insights.sbomify.com/CVE-2024-23944/): Apache ZooKeeper: Information disclosure in persistent watcher handling (medium 5.3)
- [CVE-2024-23943](https://insights.sbomify.com/CVE-2024-23943/): MB connect line: Cloud API access due to a lack of authentication for a critical function (critical 9.1)
- [CVE-2024-23942](https://insights.sbomify.com/CVE-2024-23942/): MB connect line: Configuration File on the client workstation is not encrypted (high 7.1)
- [CVE-2024-23941](https://insights.sbomify.com/CVE-2024-23941/): Cross-site scripting in Group Office (medium 5.4)
- [CVE-2024-23940](https://insights.sbomify.com/CVE-2024-23940/): Privilege escalation in Trend Micro Security (Consumer) uiAirSupport (high 7.8)
- [CVE-2024-2394](https://insights.sbomify.com/CVE-2024-2394/): SourceCodester Employee Management System add-admin.php unrestricted upload (medium 4.7)
- [CVE-2024-23938](https://insights.sbomify.com/CVE-2024-23938/): Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-23937](https://insights.sbomify.com/CVE-2024-23937/): Silicon Labs Gecko OS Debug Interface Format String (medium 4.3)
- [CVE-2024-23935](https://insights.sbomify.com/CVE-2024-23935/): Alpine Halo9 DecodeUTF7 Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.0)
- [CVE-2024-23934](https://insights.sbomify.com/CVE-2024-23934/): Sony XAV-AX5500 WMV/ASF Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-23933](https://insights.sbomify.com/CVE-2024-23933/): Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-23930](https://insights.sbomify.com/CVE-2024-23930/): Pioneer DMH-WT7600NEX Media Service Improper Handling of Exceptional Conditions (medium 4.3)
- [CVE-2024-2393](https://insights.sbomify.com/CVE-2024-2393/): SourceCodester CRUD without Page Reload add_user.php sql injection (medium 6.3)
- [CVE-2024-23929](https://insights.sbomify.com/CVE-2024-23929/): Pioneer DMH-WT7600NEX Telematics Directory Traversal (high 7.3)
- [CVE-2024-23928](https://insights.sbomify.com/CVE-2024-23928/): Pioneer DMH-WT7600NEX Telematics Improper Certificate Validation (medium 6.5)
- [CVE-2024-23924](https://insights.sbomify.com/CVE-2024-23924/): Alpine Halo9 UPDM_wemCmdCreatSHA256Hash Command Injection Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-23923](https://insights.sbomify.com/CVE-2024-23923/): Alpine Halo9 prh_l2_sar_data_ind Use-After-Free Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-23922](https://insights.sbomify.com/CVE-2024-23922/): Sony XAV-AX5500 Insufficient Firmware Update Validation Remote Code Execution Vulnerability (medium 6.8)
- [CVE-2024-23921](https://insights.sbomify.com/CVE-2024-23921/): ChargePoint Home Flex Command Injection (high 8.8)
- [CVE-2024-23920](https://insights.sbomify.com/CVE-2024-23920/): ChargePoint Home Flex Improper Access Control (high 8.8)
- [CVE-2024-2392](https://insights.sbomify.com/CVE-2024-2392/): Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-23919](https://insights.sbomify.com/CVE-2024-23919/): Memory corruption in Intel(R) Graphics software (medium 4.8)
- [CVE-2024-23918](https://insights.sbomify.com/CVE-2024-23918/): Privilege escalation in Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX (high 8.8)
- [CVE-2024-23917](https://insights.sbomify.com/CVE-2024-23917/): Auth bypass in TeamCity (critical 9.8)
- [CVE-2024-23916](https://insights.sbomify.com/CVE-2024-23916/): NULL Pointer Dereference in libfluid_msg library (medium 5.3)
- [CVE-2024-23915](https://insights.sbomify.com/CVE-2024-23915/): NULL Pointer Dereference in libfluid_msg library (medium 5.3)
- [CVE-2024-23914](https://insights.sbomify.com/CVE-2024-23914/): Denial of service in Merge DICOM Toolkit C/C++ (medium 5.7)
- [CVE-2024-23913](https://insights.sbomify.com/CVE-2024-23913/): Memory corruption in Merge DICOM Toolkit C/C++ (medium 4.0)
- [CVE-2024-23912](https://insights.sbomify.com/CVE-2024-23912/): Memory corruption in Merge DICOM Toolkit C/C++ (medium 4.0)
- [CVE-2024-23911](https://insights.sbomify.com/CVE-2024-23911/): Memory corruption in Cente IPv6 (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/432/