# Vulnerabilities published in 2024


- [CVE-2024-13058](https://insights.sbomify.com/CVE-2024-13058/): Authenticated, non-admin users can create storage pools via the sifi API (medium 4.8)
- [CVE-2024-13057](https://insights.sbomify.com/CVE-2024-13057/): Dyn Business Panel <= 1.0.0 - Stored XSS via CSRF (high 7.1)
- [CVE-2024-13056](https://insights.sbomify.com/CVE-2024-13056/): Dyn Business Panel <= 1.0.0 - Reflected XSS (high 7.1)
- [CVE-2024-13055](https://insights.sbomify.com/CVE-2024-13055/): Dyn Business Panel <= 1.0.0 - Reflected XSS (high 7.1)
- [CVE-2024-13054](https://insights.sbomify.com/CVE-2024-13054/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2024-13053](https://insights.sbomify.com/CVE-2024-13053/): Form Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme Title (medium 4.8)
- [CVE-2024-13052](https://insights.sbomify.com/CVE-2024-13052/): Dental Optimizer Patient Generator App <= 1.0 - Reflected XSS (high 7.1)
- [CVE-2024-13051](https://insights.sbomify.com/CVE-2024-13051/): Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-13050](https://insights.sbomify.com/CVE-2024-13050/): Ashlar-Vellum Graphite VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-1305](https://insights.sbomify.com/CVE-2024-1305/): Integer overflow in OpenVPN-GUI (critical 9.8)
- [CVE-2024-13049](https://insights.sbomify.com/CVE-2024-13049/): Ashlar-Vellum Cobalt XE File Parsing Type Confusion Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-13048](https://insights.sbomify.com/CVE-2024-13048/): Ashlar-Vellum Cobalt XE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-13047](https://insights.sbomify.com/CVE-2024-13047/): Ashlar-Vellum Cobalt CO File Parsing Type Confusion Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-13046](https://insights.sbomify.com/CVE-2024-13046/): Ashlar-Vellum Cobalt CO File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-13045](https://insights.sbomify.com/CVE-2024-13045/): Ashlar-Vellum Cobalt AR File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-13044](https://insights.sbomify.com/CVE-2024-13044/): Ashlar-Vellum Cobalt AR File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-13043](https://insights.sbomify.com/CVE-2024-13043/): Panda Security Dome Link Following Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-13042](https://insights.sbomify.com/CVE-2024-13042/): Tsinghua Unigroup Electronic Archives Management System download.html download information disclosure (medium 5.3)
- [CVE-2024-13041](https://insights.sbomify.com/CVE-2024-13041/): Incorrect User Management in GitLab (medium 4.2)
- [CVE-2024-13040](https://insights.sbomify.com/CVE-2024-13040/): Quanta Computer QOCA aim - Authorization Bypass (high 8.8)
- [CVE-2024-1304](https://insights.sbomify.com/CVE-2024-1304/): Multiple Vulnerabilities in Badger Meter's Monitool (medium 6.3)
- [CVE-2024-13039](https://insights.sbomify.com/CVE-2024-13039/): code-projects Simple Chat System add_user.php sql injection (medium 5.3)
- [CVE-2024-13038](https://insights.sbomify.com/CVE-2024-13038/): CodeAstro Simple Loan Management System Login index.php sql injection (medium 6.9)
- [CVE-2024-13037](https://insights.sbomify.com/CVE-2024-13037/): 1000 Projects Attendance Tracking Management System report.php attendance_report sql injection (medium 5.3)
- [CVE-2024-13036](https://insights.sbomify.com/CVE-2024-13036/): code-projects Chat System update_room.php sql injection (medium 5.3)
- [CVE-2024-13035](https://insights.sbomify.com/CVE-2024-13035/): code-projects Chat System update_user.php sql injection (medium 5.3)
- [CVE-2024-13034](https://insights.sbomify.com/CVE-2024-13034/): code-projects Chat System update_user.php cross site scripting (medium 5.3)
- [CVE-2024-13033](https://insights.sbomify.com/CVE-2024-13033/): code-projects Chat System chatroom.php cross site scripting (medium 5.3)
- [CVE-2024-13032](https://insights.sbomify.com/CVE-2024-13032/): Antabot White-Jotter Article Editor editor server-side request forgery (medium 5.1)
- [CVE-2024-13031](https://insights.sbomify.com/CVE-2024-13031/): Antabot White-Jotter Article Content Editor editor cross site scripting (medium 5.1)
- [CVE-2024-13030](https://insights.sbomify.com/CVE-2024-13030/): D-Link DIR-823G Web Management Interface HNAP1 SetVirtualServerSettings access control (medium 6.9)
- [CVE-2024-1303](https://insights.sbomify.com/CVE-2024-1303/): Multiple Vulnerabilities in Badger Meter's Monitool (medium 6.5)
- [CVE-2024-13029](https://insights.sbomify.com/CVE-2024-13029/): Antabot White-Jotter Edit Book book server-side request forgery (medium 5.3)
- [CVE-2024-13028](https://insights.sbomify.com/CVE-2024-13028/): Antabot White-Jotter login observable response discrepancy (medium 6.3)
- [CVE-2024-13026](https://insights.sbomify.com/CVE-2024-13026/): Inadequate Encryption Strength Vulnerability in Roche Algo Edge (medium 6.1)
- [CVE-2024-13025](https://insights.sbomify.com/CVE-2024-13025/): Codezips College Management System faculty.php sql injection (medium 5.3)
- [CVE-2024-13024](https://insights.sbomify.com/CVE-2024-13024/): Codezips Blood Bank Management System campaign.php sql injection (medium 5.3)
- [CVE-2024-13023](https://insights.sbomify.com/CVE-2024-13023/): PHPGurukul Maid Hiring Management System Search Maid Page search-maid.php cross site scripting (medium 5.1)
- [CVE-2024-13022](https://insights.sbomify.com/CVE-2024-13022/): taisan tarzan-cms Article Management UploadController.java UploadResponse unrestricted upload (medium 5.3)
- [CVE-2024-13021](https://insights.sbomify.com/CVE-2024-13021/): SourceCodester Road Accident Map Marker add-mark.php cross site scripting (medium 5.3)
- [CVE-2024-13020](https://insights.sbomify.com/CVE-2024-13020/): code-projects Chat System chatroom.php sql injection (medium 5.3)
- [CVE-2024-1302](https://insights.sbomify.com/CVE-2024-1302/): Multiple Vulnerabilities in Badger Meter's Monitool (high 7.3)
- [CVE-2024-13019](https://insights.sbomify.com/CVE-2024-13019/): code-projects Chat System Chat Room Page update_room.php cross site scripting (medium 5.3)
- [CVE-2024-13018](https://insights.sbomify.com/CVE-2024-13018/): PHPGurukul Maid Hiring Management System profile.php cross site scripting (medium 5.1)
- [CVE-2024-13017](https://insights.sbomify.com/CVE-2024-13017/): PHPGurukul Maid Hiring Management System About Us Page aboutus.php cross site scripting (medium 5.1)
- [CVE-2024-13016](https://insights.sbomify.com/CVE-2024-13016/): PHPGurukul Maid Hiring Management System edit-category.php sql injection (medium 5.3)
- [CVE-2024-13015](https://insights.sbomify.com/CVE-2024-13015/): PHPGurukul Maid Hiring Management System search-booking-request.php cross site scripting (medium 5.1)
- [CVE-2024-13014](https://insights.sbomify.com/CVE-2024-13014/): PHPGurukul Maid Hiring Management System search-maid.php sql injection (medium 5.3)
- [CVE-2024-13013](https://insights.sbomify.com/CVE-2024-13013/): PHPGurukul Maid Hiring Management System Contact Us Page contactus.php cross site scripting (medium 5.1)
- [CVE-2024-13012](https://insights.sbomify.com/CVE-2024-13012/): code-projects Hostel Management System registration.php cross site scripting (medium 5.3)
- [CVE-2024-13011](https://insights.sbomify.com/CVE-2024-13011/): WP Foodbakery <= 4.7 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-13010](https://insights.sbomify.com/CVE-2024-13010/): WP Foodbakery <= 4.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1301](https://insights.sbomify.com/CVE-2024-1301/): Multiple Vulnerabilities in Badger Meter's Monitool (critical 9.8)
- [CVE-2024-13009](https://insights.sbomify.com/CVE-2024-13009/): Eclipse Jetty GZIP buffer release (high 7.2)
- [CVE-2024-13008](https://insights.sbomify.com/CVE-2024-13008/): code-projects Responsive Hotel Site newsletter.php sql injection (medium 5.3)
- [CVE-2024-13007](https://insights.sbomify.com/CVE-2024-13007/): Codezips Event Management System contact.php sql injection (medium 5.3)
- [CVE-2024-13006](https://insights.sbomify.com/CVE-2024-13006/): 1000 Projects Human Resource Management System employeeview.php sql injection (medium 6.9)
- [CVE-2024-13005](https://insights.sbomify.com/CVE-2024-13005/): 1000 Projects Attendance Tracking Management System attendance_action.php sql injection (medium 5.3)
- [CVE-2024-13004](https://insights.sbomify.com/CVE-2024-13004/): PHPGurukul Complaint Management System category.php sql injection (medium 6.9)
- [CVE-2024-13003](https://insights.sbomify.com/CVE-2024-13003/): 1000 Projects Portfolio Management System MCA update_ed.php sql injection (medium 5.3)
- [CVE-2024-13002](https://insights.sbomify.com/CVE-2024-13002/): 1000 Projects Bookstore Management System order_process.php sql injection (medium 6.9)
- [CVE-2024-13001](https://insights.sbomify.com/CVE-2024-13001/): PHPGurukul Small CRM index.php sql injection (medium 5.3)
- [CVE-2024-13000](https://insights.sbomify.com/CVE-2024-13000/): PHPGurukul Small CRM quote-details.php sql injection (medium 5.3)
- [CVE-2024-1300](https://insights.sbomify.com/CVE-2024-1300/): Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support (medium 5.4)
- [CVE-2024-12999](https://insights.sbomify.com/CVE-2024-12999/): PHPGurukul Small CRM edit-user.php sql injection (medium 5.3)
- [CVE-2024-12998](https://insights.sbomify.com/CVE-2024-12998/): code-projects Online Car Rental System GET Parameter index.php cross site scripting (medium 6.9)
- [CVE-2024-12995](https://insights.sbomify.com/CVE-2024-12995/): ruifang-tech Rebuild Project Tasks Section tasks cross site scripting (medium 5.3)
- [CVE-2024-12994](https://insights.sbomify.com/CVE-2024-12994/): running-elephant Datart File Upload import extractModel deserialization (medium 5.3)
- [CVE-2024-12993](https://insights.sbomify.com/CVE-2024-12993/): Location information exposure in Infinix Weather app (medium 4.8)
- [CVE-2024-12992](https://insights.sbomify.com/CVE-2024-12992/): Remote Code Execution leads to Command Injection (high 8.6)
- [CVE-2024-12991](https://insights.sbomify.com/CVE-2024-12991/): Beijing Longda Jushang Technology DBShop商城系统 home-order cross site scripting (medium 5.3)
- [CVE-2024-12990](https://insights.sbomify.com/CVE-2024-12990/): ruifang-tech Rebuild Admin Verification Page admin-verify redirect (medium 5.3)
- [CVE-2024-1299](https://insights.sbomify.com/CVE-2024-1299/): Privilege Chaining in GitLab (medium 6.5)
- [CVE-2024-12989](https://insights.sbomify.com/CVE-2024-12989/): WISI Tangram GT31 HTTP Request server-side request forgery (medium 6.9)
- [CVE-2024-12988](https://insights.sbomify.com/CVE-2024-12988/): Netgear R6900P/R7000P HTTP Header sub_16C4C buffer overflow (medium 6.9)
- [CVE-2024-12987](https://insights.sbomify.com/CVE-2024-12987/): DrayTek Vigor Routers OS Command Injection (medium 6.9, exploited in the wild)
- [CVE-2024-12986](https://insights.sbomify.com/CVE-2024-12986/): DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection (medium 6.9)
- [CVE-2024-12985](https://insights.sbomify.com/CVE-2024-12985/): Overtek OT-E801G passwd os command injection (medium 5.3)
- [CVE-2024-12984](https://insights.sbomify.com/CVE-2024-12984/): Amcrest IP2M-841B Web Interface webCapsConfig information disclosure (medium 6.9)
- [CVE-2024-12983](https://insights.sbomify.com/CVE-2024-12983/): code-projects Hospital Management System Edit Doctor Details Page manage-doctors.php cross site scripting (medium 5.1)
- [CVE-2024-12982](https://insights.sbomify.com/CVE-2024-12982/): PHPGurukul Blood Bank & Donor Management System update-contactinfo.php cross site scripting (medium 5.1)
- [CVE-2024-12981](https://insights.sbomify.com/CVE-2024-12981/): CodeAstro Car Rental System bookingconfirm.php sql injection (medium 5.3)
- [CVE-2024-12980](https://insights.sbomify.com/CVE-2024-12980/): code-projects Job Recruitment _all_edits.php fln_update cross site scripting (medium 6.9)
- [CVE-2024-1298](https://insights.sbomify.com/CVE-2024-1298/): Integer Overflow caused by divide by zero during S3 suspension (medium 6.0)
- [CVE-2024-12979](https://insights.sbomify.com/CVE-2024-12979/): code-projects Job Recruitment _all_edits.php cn_update cross site scripting (medium 6.9)
- [CVE-2024-12978](https://insights.sbomify.com/CVE-2024-12978/): code-projects Job Recruitment _all_edits.php add_req sql injection (medium 6.9)
- [CVE-2024-12977](https://insights.sbomify.com/CVE-2024-12977/): PHPGurukul Complaint Management System state.php sql injection (medium 5.3)
- [CVE-2024-12976](https://insights.sbomify.com/CVE-2024-12976/): CodeZips Hospital Management System staff.php sql injection (medium 6.9)
- [CVE-2024-12975](https://insights.sbomify.com/CVE-2024-12975/): Silicon Labs CPC can leak information in full duplex SPI (low 1.0)
- [CVE-2024-12974](https://insights.sbomify.com/CVE-2024-12974/): XSS in Akinsoft's ProKuaför (medium 4.3)
- [CVE-2024-12973](https://insights.sbomify.com/CVE-2024-12973/): Host Header Injection in Akinsoft's OctoCloud (medium 4.7)
- [CVE-2024-12972](https://insights.sbomify.com/CVE-2024-12972/): XSS in Akinsoft's OctoCloud (medium 4.3)
- [CVE-2024-12971](https://insights.sbomify.com/CVE-2024-12971/): QuickShell Authenticated Command Injection (high 8.6)
- [CVE-2024-12970](https://insights.sbomify.com/CVE-2024-12970/): OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer (low 3.9)
- [CVE-2024-1297](https://insights.sbomify.com/CVE-2024-1297/): Loomio 2.22.0 - Code injection (high 7.2)
- [CVE-2024-12969](https://insights.sbomify.com/CVE-2024-12969/): code-projects Hospital Management System Login index.php sql injection (medium 6.9)
- [CVE-2024-12968](https://insights.sbomify.com/CVE-2024-12968/): code-projects Job Recruitment _all_edits.php edit_jobpost sql injection (medium 6.9)
- [CVE-2024-12967](https://insights.sbomify.com/CVE-2024-12967/): code-projects Job Recruitment _all_edits.php fln_update sql injection (medium 6.9)
- [CVE-2024-12966](https://insights.sbomify.com/CVE-2024-12966/): code-projects Job Recruitment _all_edits.php cn_update sql injection (medium 6.9)
- [CVE-2024-12965](https://insights.sbomify.com/CVE-2024-12965/): 1000 Projects Portfolio Management System MCA update_ex_detail.php sql injection (medium 6.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/481/