# Vulnerabilities published in 2024


- [CVE-2024-21586](https://insights.sbomify.com/CVE-2024-21586/): Junos OS: SRX Series and NFX Series: Specific valid traffic leads to a PFE crash (high 7.5)
- [CVE-2024-21585](https://insights.sbomify.com/CVE-2024-21585/): Junos OS and Junos OS Evolved: BGP session flaps on NSR-enabled devices can cause rpd crash (medium 5.9)
- [CVE-2024-21584](https://insights.sbomify.com/CVE-2024-21584/): Cross-site scripting in Pleasanter (medium 6.1)
- [CVE-2024-21583](https://insights.sbomify.com/CVE-2024-21583/): github.com/gitpod-io/gitpod vulnerable to Cookie Tossing (medium 4.1)
- [CVE-2024-21577](https://insights.sbomify.com/CVE-2024-21577/): Code injection in ComfyUI-Ace-Nodes (critical 10.0)
- [CVE-2024-21576](https://insights.sbomify.com/CVE-2024-21576/): Code injection in ComfyUI-Bmad-Nodes (critical 10.0)
- [CVE-2024-21575](https://insights.sbomify.com/CVE-2024-21575/): Path traversal in ComfyUI-Impact-Pack (critical 9.2)
- [CVE-2024-21574](https://insights.sbomify.com/CVE-2024-21574/): Code injection in ComfyUI-Manager (critical 10.0)
- [CVE-2024-21571](https://insights.sbomify.com/CVE-2024-21571/): Code injection in Code Agent (high 8.1)
- [CVE-2024-2156](https://insights.sbomify.com/CVE-2024-2156/): SourceCodester Best POS Management System admin_class.php sql injection (medium 6.3)
- [CVE-2024-21552](https://insights.sbomify.com/CVE-2024-21552/): Code injection in SuperAGI (critical 9.8)
- [CVE-2024-21550](https://insights.sbomify.com/CVE-2024-21550/): Cross-site scripting in SteVe (medium 6.1)
- [CVE-2024-2155](https://insights.sbomify.com/CVE-2024-2155/): SourceCodester Best POS Management System index.php file inclusion (medium 4.3)
- [CVE-2024-21549](https://insights.sbomify.com/CVE-2024-21549/): Browsershot Improper Input Validation vulnerability (high 7.7)
- [CVE-2024-21548](https://insights.sbomify.com/CVE-2024-21548/): Code injection in bun (high 7.7)
- [CVE-2024-21547](https://insights.sbomify.com/CVE-2024-21547/): Spatie Browsershot Directory Traversal vulnerability (high 8.7)
- [CVE-2024-21546](https://insights.sbomify.com/CVE-2024-21546/): UniSharp Laravel Filemanager Code Injection vulnerability (critical 9.3)
- [CVE-2024-21545](https://insights.sbomify.com/CVE-2024-21545/): Path traversal in libpve-common-perl (Promox Mail Gateway 8) (high 8.2)
- [CVE-2024-21544](https://insights.sbomify.com/CVE-2024-21544/): Browsershot Local File Inclusion (high 7.7)
- [CVE-2024-21543](https://insights.sbomify.com/CVE-2024-21543/): djoser Authentication Bypass (medium 5.7)
- [CVE-2024-21542](https://insights.sbomify.com/CVE-2024-21542/): luigi Arbitrary File Write via Archive Extraction (Zip Slip) (high 7.7)
- [CVE-2024-21541](https://insights.sbomify.com/CVE-2024-21541/): dom-iterator code execution vulnerability (medium 6.9)
- [CVE-2024-2154](https://insights.sbomify.com/CVE-2024-2154/): SourceCodester Online Mobile Management Store view_product.php sql injection (medium 6.3)
- [CVE-2024-21539](https://insights.sbomify.com/CVE-2024-21539/): Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit (high 8.7)
- [CVE-2024-21538](https://insights.sbomify.com/CVE-2024-21538/): Regular Expression Denial of Service (ReDoS) in cross-spawn (high 8.7)
- [CVE-2024-21537](https://insights.sbomify.com/CVE-2024-21537/): lilconfig Code Injection vulnerability (critical 9.3)
- [CVE-2024-21536](https://insights.sbomify.com/CVE-2024-21536/): Denial of service in http-proxy-middleware (high 8.7)
- [CVE-2024-21535](https://insights.sbomify.com/CVE-2024-21535/): Cross site scripting in markdown-to-jsx (medium 6.1)
- [CVE-2024-21534](https://insights.sbomify.com/CVE-2024-21534/): JSONPath Plus Remote Code Execution (RCE) Vulnerability (critical 9.8)
- [CVE-2024-21533](https://insights.sbomify.com/CVE-2024-21533/): ggit is vulnerable to Arbitrary Argument Injection via the clone() API (medium 6.5)
- [CVE-2024-21532](https://insights.sbomify.com/CVE-2024-21532/): ggit is vulnerable to Command Injection via the fetchTags(branch) API (high 7.3)
- [CVE-2024-21531](https://insights.sbomify.com/CVE-2024-21531/): git-shallow-clone Argument Injection vulnerability (medium 5.3)
- [CVE-2024-21530](https://insights.sbomify.com/CVE-2024-21530/): Sequential calls of encryption API (`encrypt`, `wrap`, and `dump`) result in nonce reuse (medium 4.5)
- [CVE-2024-2153](https://insights.sbomify.com/CVE-2024-2153/): SourceCodester Online Mobile Management Store view_order.php sql injection (medium 6.3)
- [CVE-2024-21529](https://insights.sbomify.com/CVE-2024-21529/): dset Prototype Pollution vulnerability (high 8.8)
- [CVE-2024-21528](https://insights.sbomify.com/CVE-2024-21528/): node-gettext vulnerable to Prototype Pollution (medium 5.9)
- [CVE-2024-21527](https://insights.sbomify.com/CVE-2024-21527/): Server-side request forgery in github.com/gotenberg/gotenberg/v8/pkg/gotenberg (high 8.8)
- [CVE-2024-21526](https://insights.sbomify.com/CVE-2024-21526/): speaker vulnerable to Denial of Service (high 7.5)
- [CVE-2024-21525](https://insights.sbomify.com/CVE-2024-21525/): node-twain vulnerable to Improper Check or Handling of Exceptional Conditions (high 8.3)
- [CVE-2024-21524](https://insights.sbomify.com/CVE-2024-21524/): node-stringbuilder vulnerable to Out-of-bounds Read (high 8.2)
- [CVE-2024-21523](https://insights.sbomify.com/CVE-2024-21523/): images vulnerable to Denial of Service (high 7.5)
- [CVE-2024-21522](https://insights.sbomify.com/CVE-2024-21522/): audify vulnerable to Improper Validation of Array Index (high 7.5)
- [CVE-2024-21521](https://insights.sbomify.com/CVE-2024-21521/): @discordjs/opus vulnerable to Denial of Service (high 7.5)
- [CVE-2024-21520](https://insights.sbomify.com/CVE-2024-21520/): Cross-site Scripting in djangorestframework (medium 5.3)
- [CVE-2024-2152](https://insights.sbomify.com/CVE-2024-2152/): SourceCodester Online Mobile Management Store manage_product.php sql injection (medium 4.7)
- [CVE-2024-21519](https://insights.sbomify.com/CVE-2024-21519/): Arbitrary File Creation in opencart (medium 6.6)
- [CVE-2024-21518](https://insights.sbomify.com/CVE-2024-21518/): Zip slip in opencart (high 7.2)
- [CVE-2024-21517](https://insights.sbomify.com/CVE-2024-21517/): Cross site scripting in opencart (low 2.1)
- [CVE-2024-21516](https://insights.sbomify.com/CVE-2024-21516/): Cross site scripting in opencart (low 2.1)
- [CVE-2024-21515](https://insights.sbomify.com/CVE-2024-21515/): Cross site scripting in opencart (low 2.1)
- [CVE-2024-21514](https://insights.sbomify.com/CVE-2024-21514/): SQL injection in opencart (high 7.4)
- [CVE-2024-21513](https://insights.sbomify.com/CVE-2024-21513/): langchain-experimental vulnerable to Arbitrary Code Execution (high 8.5)
- [CVE-2024-21512](https://insights.sbomify.com/CVE-2024-21512/): mysql2 vulnerable to Prototype Pollution (high 8.2)
- [CVE-2024-21511](https://insights.sbomify.com/CVE-2024-21511/): MySQL2 for Node Arbitrary Code Injection (critical 9.8)
- [CVE-2024-21510](https://insights.sbomify.com/CVE-2024-21510/): Sinatra vulnerable to Reliance on Untrusted Inputs in a Security Decision (medium 5.4)
- [CVE-2024-2151](https://insights.sbomify.com/CVE-2024-2151/): SourceCodester Online Mobile Management Store Product Price logic error (medium 4.3)
- [CVE-2024-21509](https://insights.sbomify.com/CVE-2024-21509/): mysql2 vulnerable to Prototype Poisoning (medium 6.5)
- [CVE-2024-21508](https://insights.sbomify.com/CVE-2024-21508/): mysql2 Remote Code Execution (RCE) via the readCodeFor function (critical 9.8)
- [CVE-2024-21507](https://insights.sbomify.com/CVE-2024-21507/): mysql2 cache poisoning vulnerability (medium 6.5)
- [CVE-2024-21505](https://insights.sbomify.com/CVE-2024-21505/): web3-utils Prototype Pollution vulnerability (high 7.5)
- [CVE-2024-21504](https://insights.sbomify.com/CVE-2024-21504/): Cross-site Scripting in livewire/livewire (medium 6.1)
- [CVE-2024-21503](https://insights.sbomify.com/CVE-2024-21503/): Black vulnerable to Regular Expression Denial of Service (ReDoS) (medium 5.3)
- [CVE-2024-21502](https://insights.sbomify.com/CVE-2024-21502/): Uninitialized Variable in fastecdsa (high 7.5)
- [CVE-2024-21501](https://insights.sbomify.com/CVE-2024-21501/): sanitize-html Information Exposure vulnerability (medium 5.3)
- [CVE-2024-21500](https://insights.sbomify.com/CVE-2024-21500/): Improper Restriction of Excessive Authentication Attempts in github.com/greenpau/caddy-security (medium 4.8)
- [CVE-2024-2150](https://insights.sbomify.com/CVE-2024-2150/): SourceCodester Insurance Management System file inclusion (medium 5.3)
- [CVE-2024-21499](https://insights.sbomify.com/CVE-2024-21499/): Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security (medium 4.3)
- [CVE-2024-21498](https://insights.sbomify.com/CVE-2024-21498/): Server-Side Request Forgery in github.com/greenpau/caddy-security (medium 5.3)
- [CVE-2024-21497](https://insights.sbomify.com/CVE-2024-21497/): Open Redirect in github.com/greenpau/caddy-security (medium 5.4)
- [CVE-2024-21496](https://insights.sbomify.com/CVE-2024-21496/): Cross-site Scripting in github.com/greenpau/caddy-security (medium 6.1)
- [CVE-2024-21495](https://insights.sbomify.com/CVE-2024-21495/): Use of Insufficiently Random Values in github.com/greenpau/caddy-security (medium 6.5)
- [CVE-2024-21494](https://insights.sbomify.com/CVE-2024-21494/): Authentication Bypass by Spoofing in github.com/greenpau/caddy-security (medium 5.4)
- [CVE-2024-21493](https://insights.sbomify.com/CVE-2024-21493/): Improper Validation of Array Index in github.com/greenpau/caddy-security (medium 5.3)
- [CVE-2024-21492](https://insights.sbomify.com/CVE-2024-21492/): Insufficient Session Expiration in github.com/greenpau/caddy-security (medium 4.8)
- [CVE-2024-21491](https://insights.sbomify.com/CVE-2024-21491/): svix vulnerable to Authentication Bypass (medium 5.9)
- [CVE-2024-21490](https://insights.sbomify.com/CVE-2024-21490/): angular vulnerable to super-linear runtime due to backtracking (high 7.5)
- [CVE-2024-2149](https://insights.sbomify.com/CVE-2024-2149/): CodeAstro Membership Management System settings.php sql injection (medium 4.7)
- [CVE-2024-21489](https://insights.sbomify.com/CVE-2024-21489/): uPlot Prototype Pollution vulnerability (high 8.8)
- [CVE-2024-21488](https://insights.sbomify.com/CVE-2024-21488/): network Arbitrary Command Injection vulnerability (high 7.3)
- [CVE-2024-21485](https://insights.sbomify.com/CVE-2024-21485/): Dash apps vulnerable to Cross-site Scripting (medium 6.5)
- [CVE-2024-21484](https://insights.sbomify.com/CVE-2024-21484/): Marvin Attack of RSA and RSAOAEP decryption in jsrsasign (high 7.5)
- [CVE-2024-21483](https://insights.sbomify.com/CVE-2024-21483/): Information disclosure in SENTRON 7KM PAC3120 AC/DC (medium 5.1)
- [CVE-2024-21482](https://insights.sbomify.com/CVE-2024-21482/): Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux Boot Loader (medium 6.8)
- [CVE-2024-21481](https://insights.sbomify.com/CVE-2024-21481/): Improper Restriction of Operations within the Bounds of a Memory Buffer in Hypervisor (high 8.4)
- [CVE-2024-21480](https://insights.sbomify.com/CVE-2024-21480/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio (high 7.3)
- [CVE-2024-2148](https://insights.sbomify.com/CVE-2024-2148/): SourceCodester Online Mobile Management Store Users.php unrestricted upload (medium 6.3)
- [CVE-2024-21479](https://insights.sbomify.com/CVE-2024-21479/): Buffer Over-read in Audio (high 7.5)
- [CVE-2024-21478](https://insights.sbomify.com/CVE-2024-21478/): NULL Pointer Dereference in Graphics (medium 6.2)
- [CVE-2024-21477](https://insights.sbomify.com/CVE-2024-21477/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2024-21476](https://insights.sbomify.com/CVE-2024-21476/): Improper Input Validation in Secure Processor (high 7.8)
- [CVE-2024-21475](https://insights.sbomify.com/CVE-2024-21475/): Use of Out-of-range Pointer Offset in Video (high 7.8)
- [CVE-2024-21474](https://insights.sbomify.com/CVE-2024-21474/): Stack-based Buffer Overflow in PMIC (high 8.4)
- [CVE-2024-21473](https://insights.sbomify.com/CVE-2024-21473/): Improper Input Validation in WIN SON (critical 9.8)
- [CVE-2024-21472](https://insights.sbomify.com/CVE-2024-21472/): Use After Free in Kernel (high 8.4)
- [CVE-2024-21471](https://insights.sbomify.com/CVE-2024-21471/): Use After Free in Graphics Linux (high 8.4)
- [CVE-2024-21470](https://insights.sbomify.com/CVE-2024-21470/): Integer Overflow to Buffer Overflow in Graphics Windows (high 8.4)
- [CVE-2024-2147](https://insights.sbomify.com/CVE-2024-2147/): SourceCodester Online Mobile Management Store login.php sql injection (high 7.3)
- [CVE-2024-21469](https://insights.sbomify.com/CVE-2024-21469/): Permissions, Privileges, and Access Control issues in TZ Secure OS (high 7.3)
- [CVE-2024-21468](https://insights.sbomify.com/CVE-2024-21468/): Use After Free in Kernel (high 8.4)
- [CVE-2024-21467](https://insights.sbomify.com/CVE-2024-21467/): Buffer Over-read in WLAN Host Communication (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/451/