# Vulnerabilities published in 2024


- [CVE-2024-22938](https://insights.sbomify.com/CVE-2024-22938/): Privilege escalation in bosscms:bosscms (high 7.8)
- [CVE-2024-22936](https://insights.sbomify.com/CVE-2024-22936/): Cross-site scripting in manuelaldape:parents \& student portal (medium 6.1)
- [CVE-2024-2293](https://insights.sbomify.com/CVE-2024-2293/): Site Reviews <= 6.11.4 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name (medium 6.4)
- [CVE-2024-22927](https://insights.sbomify.com/CVE-2024-22927/): Cross-site scripting in eyoucms:eyoucms (medium 6.1)
- [CVE-2024-22923](https://insights.sbomify.com/CVE-2024-22923/): SQL injection in advradius:adv radius (critical 9.8)
- [CVE-2024-22922](https://insights.sbomify.com/CVE-2024-22922/): Privilege escalation in projectworlds:visitor management system (critical 9.8)
- [CVE-2024-22920](https://insights.sbomify.com/CVE-2024-22920/): Use after free in swftools:swftools (high 7.8)
- [CVE-2024-2292](https://insights.sbomify.com/CVE-2024-2292/): Access Control Vulnerabilities lead to Violation of Privacy and Modification of Personal Data (high 7.1)
- [CVE-2024-22919](https://insights.sbomify.com/CVE-2024-22919/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2024-22917](https://insights.sbomify.com/CVE-2024-22917/): SQL injection in lopalopa:dynamic lab management system (high 8.6)
- [CVE-2024-22916](https://insights.sbomify.com/CVE-2024-22916/): Memory corruption in dlink:go-rt-ac750 firmware (critical 9.8)
- [CVE-2024-22915](https://insights.sbomify.com/CVE-2024-22915/): Use after free in swftools:swftools (high 7.8)
- [CVE-2024-22914](https://insights.sbomify.com/CVE-2024-22914/): Use after free in swftools:swftools (medium 5.5)
- [CVE-2024-22913](https://insights.sbomify.com/CVE-2024-22913/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2024-22912](https://insights.sbomify.com/CVE-2024-22912/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2024-22911](https://insights.sbomify.com/CVE-2024-22911/): Memory corruption in swftools:swftools (high 7.8)
- [CVE-2024-22910](https://insights.sbomify.com/CVE-2024-22910/): Cross-site scripting in crushftp:crushftp (medium 6.1)
- [CVE-2024-2291](https://insights.sbomify.com/CVE-2024-2291/): MOVEit Transfer Logging Bypass Vulnerability (medium 4.3)
- [CVE-2024-22905](https://insights.sbomify.com/CVE-2024-22905/): Memory corruption in arm:mbed os (high 7.0)
- [CVE-2024-22903](https://insights.sbomify.com/CVE-2024-22903/): Command injection in vinchin:vinchin backup and recovery (high 8.8)
- [CVE-2024-22902](https://insights.sbomify.com/CVE-2024-22902/): Hardcoded credentials in vinchin:vinchin backup and recovery (critical 9.8)
- [CVE-2024-22901](https://insights.sbomify.com/CVE-2024-22901/): Hardcoded credentials in vinchin:vinchin backup and recovery (critical 9.8)
- [CVE-2024-22900](https://insights.sbomify.com/CVE-2024-22900/): Command injection in vinchin:vinchin backup and recovery (high 8.8)
- [CVE-2024-2290](https://insights.sbomify.com/CVE-2024-2290/): Advanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Admin+) PHP Object Injection (high 7.2)
- [CVE-2024-22899](https://insights.sbomify.com/CVE-2024-22899/): Code injection in vinchin:vinchin backup and recovery (high 8.8)
- [CVE-2024-22895](https://insights.sbomify.com/CVE-2024-22895/): File upload in dedecms:dedecms (high 8.8)
- [CVE-2024-22894](https://insights.sbomify.com/CVE-2024-22894/): Weak cryptography in alpha-innotec:heat pumps firmware (medium 6.8)
- [CVE-2024-22893](https://insights.sbomify.com/CVE-2024-22893/): Information disclosure in openslides:openslides (high 7.5)
- [CVE-2024-22892](https://insights.sbomify.com/CVE-2024-22892/): Weak cryptography in openslides:openslides (high 7.5)
- [CVE-2024-22891](https://insights.sbomify.com/CVE-2024-22891/): Nteract Remote Code Execution vulnerability (critical 9.8)
- [CVE-2024-2289](https://insights.sbomify.com/CVE-2024-2289/): PowerPack Lite for Beaver Builder <= 1.3.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via element link (medium 6.4)
- [CVE-2024-22889](https://insights.sbomify.com/CVE-2024-22889/): Phone information disclosure vulnerability (medium 5.5)
- [CVE-2024-22880](https://insights.sbomify.com/CVE-2024-22880/): Cross-site scripting in zadarma:zadarma (medium 4.7)
- [CVE-2024-2288](https://insights.sbomify.com/CVE-2024-2288/): CSRF File Upload Vulnerability in parisneo/lollms-webui (high 8.3)
- [CVE-2024-22877](https://insights.sbomify.com/CVE-2024-22877/): Cross-site scripting in strangebee:thehive (medium 5.4)
- [CVE-2024-22876](https://insights.sbomify.com/CVE-2024-22876/): Cross-site scripting in strangebee:thehive (medium 5.4)
- [CVE-2024-22873](https://insights.sbomify.com/CVE-2024-22873/): Server-side request forgery in tencent:blueking configuration management database (high 8.1)
- [CVE-2024-22871](https://insights.sbomify.com/CVE-2024-22871/): Reading specially crafted serializable objects from an untrusted source may cause an infinite loop and denial of service (high 7.5)
- [CVE-2024-2287](https://insights.sbomify.com/CVE-2024-2287/): Knight Lab Timeline <= 3.9.3.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-22862](https://insights.sbomify.com/CVE-2024-22862/): Integer overflow in ffmpeg:ffmpeg (critical 9.8)
- [CVE-2024-22861](https://insights.sbomify.com/CVE-2024-22861/): Integer overflow in ffmpeg:ffmpeg (high 7.5)
- [CVE-2024-22860](https://insights.sbomify.com/CVE-2024-22860/): Integer overflow in ffmpeg:ffmpeg (critical 9.8)
- [CVE-2024-2286](https://insights.sbomify.com/CVE-2024-2286/): Sky Addons for Elementor <= 2.4.0 - Authenticated(Contributor+) Stored Cross-site scripting via Wrapper Link URL (medium 6.4)
- [CVE-2024-22859](https://insights.sbomify.com/CVE-2024-22859/): Cross-site request forgery in laravel:livewire (high 8.8)
- [CVE-2024-22857](https://insights.sbomify.com/CVE-2024-22857/): Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog_rule_new().The size of record_name is MAXLEN_PATH(1024) + 1 but file_path may have (critical 9.8)
- [CVE-2024-22856](https://insights.sbomify.com/CVE-2024-22856/): A SQL injection vulnerability via the Save Favorite Search function in Axefinance Axe Credit Portal >= v.3.0 allows authenticated attackers (medium 5.4)
- [CVE-2024-22855](https://insights.sbomify.com/CVE-2024-22855/): Cross-site scripting in itssglobal:imlog (medium 5.4)
- [CVE-2024-22854](https://insights.sbomify.com/CVE-2024-22854/): Cross-site scripting in darktrace:threat visualizer (medium 4.6)
- [CVE-2024-22853](https://insights.sbomify.com/CVE-2024-22853/): Hardcoded credentials in dlink:go-rt-ac750 firmware (critical 9.8)
- [CVE-2024-22852](https://insights.sbomify.com/CVE-2024-22852/): Memory corruption in dlink:go-rt-ac750 firmware (critical 9.8)
- [CVE-2024-22851](https://insights.sbomify.com/CVE-2024-22851/): Path traversal in liveconfig:liveconfig (high 7.5)
- [CVE-2024-2285](https://insights.sbomify.com/CVE-2024-2285/): boyiddha Automated-Mess-Management-System member_edit.php cross site scripting (low 3.5)
- [CVE-2024-2284](https://insights.sbomify.com/CVE-2024-2284/): boyiddha Automated-Mess-Management-System Chat Book chat.php cross site scripting (low 3.5)
- [CVE-2024-22836](https://insights.sbomify.com/CVE-2024-22836/): Command injection in akaunting:akaunting (critical 9.8)
- [CVE-2024-22830](https://insights.sbomify.com/CVE-2024-22830/): Anti-Cheat Expert's Windows kernel module "ACE-BASE.sys" version 1.0.2202.6217 does not perform proper access control when handling system resources. (medium 5.3)
- [CVE-2024-2283](https://insights.sbomify.com/CVE-2024-2283/): boyiddha Automated-Mess-Management-System view.php sql injection (medium 6.3)
- [CVE-2024-22824](https://insights.sbomify.com/CVE-2024-22824/): File upload in auntvt:timo (critical 9.8)
- [CVE-2024-2282](https://insights.sbomify.com/CVE-2024-2282/): boyiddha Automated-Mess-Management-System Login Page index.php sql injection (high 7.3)
- [CVE-2024-22819](https://insights.sbomify.com/CVE-2024-22819/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-22818](https://insights.sbomify.com/CVE-2024-22818/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-22817](https://insights.sbomify.com/CVE-2024-22817/): Cross-site request forgery in flycms project:flycms (high 8.8)
- [CVE-2024-22815](https://insights.sbomify.com/CVE-2024-22815/): Denial of service in tormach:pathpilot controller (medium 5.3)
- [CVE-2024-22813](https://insights.sbomify.com/CVE-2024-22813/): Hardcoded credentials in tormach:pathpilot controller (medium 4.4)
- [CVE-2024-22811](https://insights.sbomify.com/CVE-2024-22811/): Denial of service in tormach:pathpilot controller (high 8.2)
- [CVE-2024-2281](https://insights.sbomify.com/CVE-2024-2281/): boyiddha Automated-Mess-Management-System Setting index.php access control (medium 6.3)
- [CVE-2024-22809](https://insights.sbomify.com/CVE-2024-22809/): Missing authorization in tormach:pathpilot controller (medium 6.5)
- [CVE-2024-22808](https://insights.sbomify.com/CVE-2024-22808/): Denial of service in tormach:pathpilot controller (high 7.5)
- [CVE-2024-22807](https://insights.sbomify.com/CVE-2024-22807/): Missing authorization in tormach:pathpilot controller (medium 6.5)
- [CVE-2024-2280](https://insights.sbomify.com/CVE-2024-2280/): Better Elementor Addons <= 1.4.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links (medium 6.4)
- [CVE-2024-22795](https://insights.sbomify.com/CVE-2024-22795/): Privilege escalation in forescout:secureconnector (high 7.0)
- [CVE-2024-2279](https://insights.sbomify.com/CVE-2024-2279/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2024-22780](https://insights.sbomify.com/CVE-2024-22780/): CA17 TeamsACS Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2024-2278](https://insights.sbomify.com/CVE-2024-2278/): WooCommerce Product Filter < 1.4.4 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-22779](https://insights.sbomify.com/CVE-2024-22779/): Path traversal in kihron:serverrpexposer (high 8.8)
- [CVE-2024-22778](https://insights.sbomify.com/CVE-2024-22778/): Denial of service in hackmd:codimd (high 7.5)
- [CVE-2024-22776](https://insights.sbomify.com/CVE-2024-22776/): Cross-site scripting in wallosapp:wallos (medium 4.7)
- [CVE-2024-22774](https://insights.sbomify.com/CVE-2024-22774/): An issue in Panoramic Corporation Digital Imaging Software v.9.1.2.7600 allows a local attacker to escalate privileges via the ccsservice.exe component. (high 7.8)
- [CVE-2024-22773](https://insights.sbomify.com/CVE-2024-22773/): Auth bypass in intelbras:action rf 1200 firmware (high 8.1)
- [CVE-2024-22772](https://insights.sbomify.com/CVE-2024-22772/): Hitron Systems DVR LGUVR-8H Improper Input Validation Vulnerability (high 7.4)
- [CVE-2024-22771](https://insights.sbomify.com/CVE-2024-22771/): Hitron Systems DVR LGUVR-4H Improper Input Validation Vulnerability (high 7.4)
- [CVE-2024-22770](https://insights.sbomify.com/CVE-2024-22770/): Hitron Systems DVR HVR-16781 Improper Input Validation Vulnerability (high 7.4)
- [CVE-2024-2277](https://insights.sbomify.com/CVE-2024-2277/): Cross-site request forgery in G-Prescription Gynaecology & OBS Consultation Software (medium 4.3)
- [CVE-2024-22769](https://insights.sbomify.com/CVE-2024-22769/): Hitron Systems DVR HVR-8781 Improper Input Validation Vulnerability (high 7.4)
- [CVE-2024-22768](https://insights.sbomify.com/CVE-2024-22768/): Hitron Systems DVR HVR-4781 Improper Input Validation Vulnerability (high 7.4)
- [CVE-2024-2276](https://insights.sbomify.com/CVE-2024-2276/): Bdtask G-Prescription Gynaecology & OBS Consultation Software Edit Venue Page cross site scripting (low 2.4)
- [CVE-2024-22752](https://insights.sbomify.com/CVE-2024-22752/): Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable (high 8.1)
- [CVE-2024-22751](https://insights.sbomify.com/CVE-2024-22751/): Memory corruption in dlink:dir-882 a1 firmware (critical 9.8)
- [CVE-2024-2275](https://insights.sbomify.com/CVE-2024-2275/): Bdtask G-Prescription Gynaecology & OBS Consultation Software OBS Patient/Gynee Prescription cross site scripting (low 2.4)
- [CVE-2024-22749](https://insights.sbomify.com/CVE-2024-22749/): Memory corruption in gpac:gpac (high 7.8)
- [CVE-2024-2274](https://insights.sbomify.com/CVE-2024-2274/): Bdtask G-Prescription Gynaecology & OBS Consultation Software Prescription Dashboard Index cross site scripting (low 2.4)
- [CVE-2024-22734](https://insights.sbomify.com/CVE-2024-22734/): Hardcoded credentials in amcsgroup:trux waste management (medium 6.2)
- [CVE-2024-22733](https://insights.sbomify.com/CVE-2024-22733/): Null dereference in tp-link:mr200 firmware (low 3.5)
- [CVE-2024-2273](https://insights.sbomify.com/CVE-2024-2273/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-22729](https://insights.sbomify.com/CVE-2024-22729/): Command injection in netis-systems:mw5360 firmware (critical 9.8)
- [CVE-2024-22727](https://insights.sbomify.com/CVE-2024-22727/): Other in teltonika:trb140 firmware (high 8.3)
- [CVE-2024-22725](https://insights.sbomify.com/CVE-2024-22725/): Cross-site scripting in orthanc-server:orthanc (medium 6.1)
- [CVE-2024-22724](https://insights.sbomify.com/CVE-2024-22724/): File upload in oscommerce:oscommerce (medium 6.6)
- [CVE-2024-22723](https://insights.sbomify.com/CVE-2024-22723/): Webtrees Path Traversal vulnerability (medium 4.9)
- [CVE-2024-22722](https://insights.sbomify.com/CVE-2024-22722/): Code injection in formtools:form tools (high 7.2)
- [CVE-2024-22721](https://insights.sbomify.com/CVE-2024-22721/): Cross-site request forgery in formtools:form tools (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/441/