# Vulnerabilities published in 2024


- [CVE-2024-0267](https://insights.sbomify.com/CVE-2024-0267/): Kashipara Hospital Management System Parameter login.php sql injection (high 7.3)
- [CVE-2024-0266](https://insights.sbomify.com/CVE-2024-0266/): Project Worlds Online Lawyer Management System User Registration cross site scripting (medium 4.3)
- [CVE-2024-0265](https://insights.sbomify.com/CVE-2024-0265/): SourceCodester Clinic Queuing System GET Parameter index.php file inclusion (medium 6.3)
- [CVE-2024-0264](https://insights.sbomify.com/CVE-2024-0264/): SourceCodester Clinic Queuing System LoginRegistration.php authorization (high 7.3)
- [CVE-2024-0263](https://insights.sbomify.com/CVE-2024-0263/): ACME Ultra Mini HTTPd HTTP GET Request denial of service (medium 5.3)
- [CVE-2024-0262](https://insights.sbomify.com/CVE-2024-0262/): Online Job Portal Create News Page News.php cross site scripting (low 2.4)
- [CVE-2024-0261](https://insights.sbomify.com/CVE-2024-0261/): Sentex FTPDMIN RNFR Command denial of service (medium 5.3)
- [CVE-2024-0260](https://insights.sbomify.com/CVE-2024-0260/): SourceCodester Engineers Online Portal Password Change change_password_teacher.php session expiration (medium 4.3)
- [CVE-2024-0259](https://insights.sbomify.com/CVE-2024-0259/): Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04 (high 7.3)
- [CVE-2024-0258](https://insights.sbomify.com/CVE-2024-0258/): Memory corruption in iOS and iPadOS (high 8.2)
- [CVE-2024-0257](https://insights.sbomify.com/CVE-2024-0257/): RoboDK Heap-based Buffer Overflow (low 3.3)
- [CVE-2024-0256](https://insights.sbomify.com/CVE-2024-0256/): Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings (medium 6.4)
- [CVE-2024-0255](https://insights.sbomify.com/CVE-2024-0255/): WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color (medium 6.4)
- [CVE-2024-0254](https://insights.sbomify.com/CVE-2024-0254/): (Simply) Guest Author Name <= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0253](https://insights.sbomify.com/CVE-2024-0253/): SQL Injection (high 8.3)
- [CVE-2024-0252](https://insights.sbomify.com/CVE-2024-0252/): Remote code execution (high 8.8)
- [CVE-2024-0251](https://insights.sbomify.com/CVE-2024-0251/): Advanced Woo Search <= 2.96 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-0250](https://insights.sbomify.com/CVE-2024-0250/): Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect (medium 6.1)
- [CVE-2024-0249](https://insights.sbomify.com/CVE-2024-0249/): Advanced Schedule Posts <= 2.1.8 - Reflected XSS (high 7.1)
- [CVE-2024-0248](https://insights.sbomify.com/CVE-2024-0248/): EazyDocs < 2.4.0 - Subscriber+ Arbitrary Posts Deletion and Document Management (medium 4.3)
- [CVE-2024-0247](https://insights.sbomify.com/CVE-2024-0247/): CodeAstro Online Food Ordering System Admin Panel sql injection (high 7.3)
- [CVE-2024-0246](https://insights.sbomify.com/CVE-2024-0246/): IceWarp Utility Download cross site scripting (medium 4.3)
- [CVE-2024-0245](https://insights.sbomify.com/CVE-2024-0245/): Task Hijacking in hamza417/inure (medium 5.5)
- [CVE-2024-0244](https://insights.sbomify.com/CVE-2024-0244/): Memory corruption in C1333iF (critical 9.8)
- [CVE-2024-0243](https://insights.sbomify.com/CVE-2024-0243/): Server-side Request Forgery In Recursive URL Loader (low 3.7)
- [CVE-2024-0242](https://insights.sbomify.com/CVE-2024-0242/): Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 Hub (high 7.3)
- [CVE-2024-0241](https://insights.sbomify.com/CVE-2024-0241/): encoded_id-rails Denial of Service Vulnerability (high 7.5)
- [CVE-2024-0240](https://insights.sbomify.com/CVE-2024-0240/): Silicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clients (medium 6.5)
- [CVE-2024-0239](https://insights.sbomify.com/CVE-2024-0239/): Contact Form 7 Connector < 1.2.3 - Reflected XSS (medium 6.1)
- [CVE-2024-0238](https://insights.sbomify.com/CVE-2024-0238/): EventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata Update (medium 6.1)
- [CVE-2024-0237](https://insights.sbomify.com/CVE-2024-0237/): EventON (Free < 2.2.9, Premium <= 4.5.8) - Unauthenticated Virtual Event Settings Update (medium 5.3)
- [CVE-2024-0236](https://insights.sbomify.com/CVE-2024-0236/): EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password Disclosure (medium 5.3)
- [CVE-2024-0235](https://insights.sbomify.com/CVE-2024-0235/): EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure (medium 5.3)
- [CVE-2024-0233](https://insights.sbomify.com/CVE-2024-0233/): EventON (Free < 2.2.8, Premium < 4.5.5) - Reflected XSS (medium 6.1)
- [CVE-2024-0232](https://insights.sbomify.com/CVE-2024-0232/): Sqlite: use-after-free bug in jsonparseaddnodearray (medium 4.7)
- [CVE-2024-0231](https://insights.sbomify.com/CVE-2024-0231/): Improper Control of Resource Identifiers ('Resource Injection') in GitLab (low 2.7)
- [CVE-2024-0230](https://insights.sbomify.com/CVE-2024-0230/): Information disclosure in Magic Keyboard Firmware (low 2.4)
- [CVE-2024-0229](https://insights.sbomify.com/CVE-2024-0229/): Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access (high 7.8)
- [CVE-2024-0226](https://insights.sbomify.com/CVE-2024-0226/): Stored Cross-Site Scripting in Synopsys Seeker (medium 4.8)
- [CVE-2024-0225](https://insights.sbomify.com/CVE-2024-0225/): Use after free in Chrome (high 8.8)
- [CVE-2024-0224](https://insights.sbomify.com/CVE-2024-0224/): Use after free in Chrome (high 8.8)
- [CVE-2024-0223](https://insights.sbomify.com/CVE-2024-0223/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-0222](https://insights.sbomify.com/CVE-2024-0222/): Use after free in Chrome (high 8.8)
- [CVE-2024-0221](https://insights.sbomify.com/CVE-2024-0221/): Photo Gallery by 10Web - Mobile-Friendly Image Gallery <= 1.8.19 - Directory Traversal to Arbitrary File Rename (critical 9.1)
- [CVE-2024-0220](https://insights.sbomify.com/CVE-2024-0220/): B&R products use insufficient communication encryption (high 8.3)
- [CVE-2024-0219](https://insights.sbomify.com/CVE-2024-0219/): Privilege Elevation via Telerik JustDecompile Installer (high 7.8)
- [CVE-2024-0218](https://insights.sbomify.com/CVE-2024-0218/): DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1 (high 8.2)
- [CVE-2024-0217](https://insights.sbomify.com/CVE-2024-0217/): Packagekitd: use-after-free in idle function callback (low 3.3)
- [CVE-2024-0216](https://insights.sbomify.com/CVE-2024-0216/): Google Doc Embedder <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery (medium 6.4)
- [CVE-2024-0213](https://insights.sbomify.com/CVE-2024-0213/): Memory corruption in Trellix Agent (TA) (high 8.2)
- [CVE-2024-0212](https://insights.sbomify.com/CVE-2024-0212/): Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users) (high 8.1)
- [CVE-2024-0211](https://insights.sbomify.com/CVE-2024-0211/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (high 7.8)
- [CVE-2024-0210](https://insights.sbomify.com/CVE-2024-0210/): Uncontrolled Recursion in Wireshark (high 7.8)
- [CVE-2024-0209](https://insights.sbomify.com/CVE-2024-0209/): NULL Pointer Dereference in Wireshark (high 7.8)
- [CVE-2024-0208](https://insights.sbomify.com/CVE-2024-0208/): Improper Handling of Missing Values in Wireshark (high 7.8)
- [CVE-2024-0207](https://insights.sbomify.com/CVE-2024-0207/): Out-of-bounds Read in Wireshark (high 7.8)
- [CVE-2024-0206](https://insights.sbomify.com/CVE-2024-0206/): Privilege escalation in Anti-Malware Engine (high 7.1)
- [CVE-2024-0204](https://insights.sbomify.com/CVE-2024-0204/): Authentication Bypass in GoAnywhere MFT (critical 9.8)
- [CVE-2024-0203](https://insights.sbomify.com/CVE-2024-0203/): Cross-site request forgery in Digits: WordPress Mobile Number Signup and Login (high 8.8)
- [CVE-2024-0202](https://insights.sbomify.com/CVE-2024-0202/): Cryptlib: rsa key exchange ciphersuites in tls vulnerable to marvin attack (medium 5.9)
- [CVE-2024-0201](https://insights.sbomify.com/CVE-2024-0201/): Product Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (medium 5.4)
- [CVE-2024-0200](https://insights.sbomify.com/CVE-2024-0200/): Unsafe Reflection in Github Enterprise Server leading to Command Injection (high 7.2)
- [CVE-2024-0199](https://insights.sbomify.com/CVE-2024-0199/): Incorrect Authorization in GitLab (high 7.7)
- [CVE-2024-0197](https://insights.sbomify.com/CVE-2024-0197/): Privilege Escalation in Thales SafeNet Sentinel HASP LDK (high 7.8)
- [CVE-2024-0196](https://insights.sbomify.com/CVE-2024-0196/): Magic-Api code injection (medium 6.3)
- [CVE-2024-0195](https://insights.sbomify.com/CVE-2024-0195/): spider-flow FunctionController.java FunctionService.saveFunction code injection (medium 6.3)
- [CVE-2024-0194](https://insights.sbomify.com/CVE-2024-0194/): CodeAstro Internet Banking System Profile Picture pages_account.php unrestricted upload (medium 6.3)
- [CVE-2024-0193](https://insights.sbomify.com/CVE-2024-0193/): Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation (high 7.8)
- [CVE-2024-0192](https://insights.sbomify.com/CVE-2024-0192/): RRJ Nueva Ecija Engineer Online Portal Add Downloadable downloadable.php unrestricted upload (medium 6.3)
- [CVE-2024-0191](https://insights.sbomify.com/CVE-2024-0191/): RRJ Nueva Ecija Engineer Online Portal file information disclosure (medium 5.3)
- [CVE-2024-0190](https://insights.sbomify.com/CVE-2024-0190/): RRJ Nueva Ecija Engineer Online Portal Quiz add_quiz.php cross site scripting (low 3.5)
- [CVE-2024-0189](https://insights.sbomify.com/CVE-2024-0189/): RRJ Nueva Ecija Engineer Online Portal Create Message teacher_message.php cross site scripting (low 3.5)
- [CVE-2024-0188](https://insights.sbomify.com/CVE-2024-0188/): RRJ Nueva Ecija Engineer Online Portal change_password_teacher.php weak password (low 3.1)
- [CVE-2024-0187](https://insights.sbomify.com/CVE-2024-0187/): Community by PeepSo < 6.3.1.2 - Reflected XSS (medium 6.1)
- [CVE-2024-0186](https://insights.sbomify.com/CVE-2024-0186/): HuiRan Host Reseller System HTTP POST Request password recovery (low 3.7)
- [CVE-2024-0185](https://insights.sbomify.com/CVE-2024-0185/): RRJ Nueva Ecija Engineer Online Portal Avatar dasboard_teacher.php unrestricted upload (medium 4.7)
- [CVE-2024-0184](https://insights.sbomify.com/CVE-2024-0184/): RRJ Nueva Ecija Engineer Online Portal Add Enginer edit_teacher.php cross site scripting (low 2.4)
- [CVE-2024-0183](https://insights.sbomify.com/CVE-2024-0183/): RRJ Nueva Ecija Engineer Online Portal NIA Office students.php cross site scripting (low 2.4)
- [CVE-2024-0182](https://insights.sbomify.com/CVE-2024-0182/): SourceCodester Engineers Online Portal Admin Login sql injection (high 7.3)
- [CVE-2024-0181](https://insights.sbomify.com/CVE-2024-0181/): RRJ Nueva Ecija Engineer Online Portal Admin Panel admin_user.php cross site scripting (low 2.4)
- [CVE-2024-0179](https://insights.sbomify.com/CVE-2024-0179/): Memory corruption in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (high 8.2)
- [CVE-2024-0173](https://insights.sbomify.com/CVE-2024-0173/): Information disclosure in PowerEdge Platform (low 3.8)
- [CVE-2024-0172](https://insights.sbomify.com/CVE-2024-0172/): Privilege escalation in PowerEdge Platform (high 7.9)
- [CVE-2024-0171](https://insights.sbomify.com/CVE-2024-0171/): Race condition in PowerEdge Platform (medium 5.3)
- [CVE-2024-0170](https://insights.sbomify.com/CVE-2024-0170/): Command injection in Unity (high 7.8)
- [CVE-2024-0169](https://insights.sbomify.com/CVE-2024-0169/): Cross-site scripting in Unity (medium 5.7)
- [CVE-2024-0168](https://insights.sbomify.com/CVE-2024-0168/): Command injection in Unity (high 7.8)
- [CVE-2024-0167](https://insights.sbomify.com/CVE-2024-0167/): Command injection in Unity (high 7.8)
- [CVE-2024-0166](https://insights.sbomify.com/CVE-2024-0166/): Command injection in Unity (high 7.8)
- [CVE-2024-0165](https://insights.sbomify.com/CVE-2024-0165/): Command injection in Unity (high 7.8)
- [CVE-2024-0164](https://insights.sbomify.com/CVE-2024-0164/): Command injection in Unity (high 7.8)
- [CVE-2024-0163](https://insights.sbomify.com/CVE-2024-0163/): Race condition in PowerEdge BIOS Intel 16G (medium 5.3)
- [CVE-2024-0162](https://insights.sbomify.com/CVE-2024-0162/): Memory corruption in PowerEdge BIOS Intel 16G (medium 5.3)
- [CVE-2024-0161](https://insights.sbomify.com/CVE-2024-0161/): Memory corruption in PowerEdge Platform (high 7.2)
- [CVE-2024-0160](https://insights.sbomify.com/CVE-2024-0160/): Security feature bypass in CPG BIOS (medium 6.8)
- [CVE-2024-0159](https://insights.sbomify.com/CVE-2024-0159/): Missing authorization in Alienware Command Center (AWCC) (medium 6.7)
- [CVE-2024-0158](https://insights.sbomify.com/CVE-2024-0158/): Other in CPG BIOS (medium 5.1)
- [CVE-2024-0157](https://insights.sbomify.com/CVE-2024-0157/): Auth bypass in Dell Storage Resource Manager (medium 5.9)
- [CVE-2024-0156](https://insights.sbomify.com/CVE-2024-0156/): Memory corruption in Dell Digital Delivery (D3) (high 7.0)
- [CVE-2024-0155](https://insights.sbomify.com/CVE-2024-0155/): Use after free in Dell Digital Delivery (D3) (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/519/