# Vulnerabilities published in 2024


- [CVE-2024-56449](https://insights.sbomify.com/CVE-2024-56449/): Privilege escalation in EMUI (medium 6.6)
- [CVE-2024-56448](https://insights.sbomify.com/CVE-2024-56448/): Missing authorization in EMUI (medium 6.7)
- [CVE-2024-56447](https://insights.sbomify.com/CVE-2024-56447/): Missing authorization in EMUI (high 7.8)
- [CVE-2024-56446](https://insights.sbomify.com/CVE-2024-56446/): Other in HarmonyOS (medium 4.0)
- [CVE-2024-56445](https://insights.sbomify.com/CVE-2024-56445/): Auth bypass in HarmonyOS (medium 4.3)
- [CVE-2024-56444](https://insights.sbomify.com/CVE-2024-56444/): Information disclosure in HarmonyOS (high 7.5)
- [CVE-2024-56443](https://insights.sbomify.com/CVE-2024-56443/): Information disclosure in HarmonyOS (medium 6.2)
- [CVE-2024-56442](https://insights.sbomify.com/CVE-2024-56442/): Other in EMUI (medium 5.5)
- [CVE-2024-56441](https://insights.sbomify.com/CVE-2024-56441/): Race condition in EMUI (medium 4.1)
- [CVE-2024-56440](https://insights.sbomify.com/CVE-2024-56440/): Missing authorization in EMUI (medium 6.2)
- [CVE-2024-5644](https://insights.sbomify.com/CVE-2024-5644/): WordPress Plugin Tournamatch < 4.6.1 - Admin+ Stored XSS via Ladders (medium 5.4)
- [CVE-2024-56439](https://insights.sbomify.com/CVE-2024-56439/): Information disclosure in HarmonyOS (high 7.5)
- [CVE-2024-56438](https://insights.sbomify.com/CVE-2024-56438/): Memory corruption in EMUI (medium 6.0)
- [CVE-2024-56437](https://insights.sbomify.com/CVE-2024-56437/): Other in HarmonyOS (medium 5.7)
- [CVE-2024-56436](https://insights.sbomify.com/CVE-2024-56436/): Information disclosure in HarmonyOS (medium 5.5)
- [CVE-2024-56435](https://insights.sbomify.com/CVE-2024-56435/): Information disclosure in HarmonyOS (medium 6.2)
- [CVE-2024-56434](https://insights.sbomify.com/CVE-2024-56434/): Use after free in EMUI (medium 4.4)
- [CVE-2024-56433](https://insights.sbomify.com/CVE-2024-56433/): Misconfiguration in shadow-utils (low 3.6)
- [CVE-2024-56431](https://insights.sbomify.com/CVE-2024-56431/): Other in xiph:theora (critical 9.8)
- [CVE-2024-56430](https://insights.sbomify.com/CVE-2024-56430/): Null dereference in OpenFHE (low 2.9)
- [CVE-2024-56429](https://insights.sbomify.com/CVE-2024-56429/): Hardcoded credentials in iLabClient (high 7.7)
- [CVE-2024-56428](https://insights.sbomify.com/CVE-2024-56428/): Information disclosure in itech-gmbh:ilabclient (medium 5.5)
- [CVE-2024-56427](https://insights.sbomify.com/CVE-2024-56427/): Memory corruption in samsung:exynos 1080 firmware (medium 6.5)
- [CVE-2024-56426](https://insights.sbomify.com/CVE-2024-56426/): Memory corruption in samsung:exynos 1080 firmware (high 7.5)
- [CVE-2024-5642](https://insights.sbomify.com/CVE-2024-5642/): Buffer overread when using an empty list with SSLContext.set_npn_protocols() (medium 6.5)
- [CVE-2024-56414](https://insights.sbomify.com/CVE-2024-56414/): Weak cryptography in Acronis Cyber Protect 16 (medium 5.5)
- [CVE-2024-56413](https://insights.sbomify.com/CVE-2024-56413/): Auth bypass in Acronis Cyber Protect 16 (medium 6.1)
- [CVE-2024-56412](https://insights.sbomify.com/CVE-2024-56412/): PhpSpreadsheet vulnerable to bypass of the XSS sanitizer using the javascript protocol and special characters (medium 4.8)
- [CVE-2024-56411](https://insights.sbomify.com/CVE-2024-56411/): PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability of the hyperlink base in the HTML page header (medium 4.8)
- [CVE-2024-56410](https://insights.sbomify.com/CVE-2024-56410/): PhpSpreadsheet has Cross-Site Scripting (XSS) vulnerability in custom properties (medium 4.8)
- [CVE-2024-5641](https://insights.sbomify.com/CVE-2024-5641/): One Click Order Re-Order <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-56409](https://insights.sbomify.com/CVE-2024-56409/): PhpSpreadsheet vulnerable to unauthorized reflected XSS in Currency.php file (high 8.3)
- [CVE-2024-56408](https://insights.sbomify.com/CVE-2024-56408/): PhpSpreadsheet allows unauthorized reflected XSS in `Convert-Online.php` file (high 8.3)
- [CVE-2024-56406](https://insights.sbomify.com/CVE-2024-56406/): Perl is vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (high 8.4)
- [CVE-2024-56404](https://insights.sbomify.com/CVE-2024-56404/): Privilege escalation in Identity Manager (critical 9.9)
- [CVE-2024-5640](https://insights.sbomify.com/CVE-2024-5640/): Cross-site scripting in Prime Slider – Addons for Elementor (medium 6.4)
- [CVE-2024-5639](https://insights.sbomify.com/CVE-2024-5639/): User Profile Picture <= 2.6.1 - Authenticated (Author+) Insecure Direct Object Reference to Profile Picture Update (medium 4.3)
- [CVE-2024-5638](https://insights.sbomify.com/CVE-2024-5638/): Formula <= 0.5.1 - Reflected Cross-Site Scripting via ti_customizer_notify_dismiss_recommended_plugins (medium 6.1)
- [CVE-2024-56378](https://insights.sbomify.com/CVE-2024-56378/): Memory corruption in freedesktop:poppler (medium 4.3)
- [CVE-2024-56377](https://insights.sbomify.com/CVE-2024-56377/): Cross-site scripting in REDCap (medium 5.4)
- [CVE-2024-56376](https://insights.sbomify.com/CVE-2024-56376/): Cross-site scripting in REDCap (medium 5.4)
- [CVE-2024-56375](https://insights.sbomify.com/CVE-2024-56375/): Integer overflow in fort-validator (high 7.5)
- [CVE-2024-56374](https://insights.sbomify.com/CVE-2024-56374/): Django has a potential denial-of-service vulnerability in IPv6 validation (medium 5.8)
- [CVE-2024-56373](https://insights.sbomify.com/CVE-2024-56373/): Apache Airflow: SSTI to Code Execution in Airflow through Shared DB Information (high 8.4)
- [CVE-2024-56372](https://insights.sbomify.com/CVE-2024-56372/): net: tun: fix tun_napi_alloc_frags() (medium 5.5)
- [CVE-2024-56370](https://insights.sbomify.com/CVE-2024-56370/): Net::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functions (medium 6.5)
- [CVE-2024-5637](https://insights.sbomify.com/CVE-2024-5637/): Market Exporter <= 2.0.19 - Missing Authorization to Arbitrary File Deletion (high 7.5)
- [CVE-2024-56369](https://insights.sbomify.com/CVE-2024-56369/): drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() (medium 5.5)
- [CVE-2024-56368](https://insights.sbomify.com/CVE-2024-56368/): ring-buffer: Fix overflow in __rb_map_vma (high 7.1)
- [CVE-2024-56366](https://insights.sbomify.com/CVE-2024-56366/): PhpSpreadsheet vulnerable to unauthorized reflected XSS in the Accounting.php file (high 8.3)
- [CVE-2024-56365](https://insights.sbomify.com/CVE-2024-56365/): PhpSpreadsheet vulnerable to unauthorized reflected XSS in the constructor of the Downloader class (high 8.3)
- [CVE-2024-56364](https://insights.sbomify.com/CVE-2024-56364/): Cross-site Scripting vulnerability in SimpleXLSXEx::readThemeColors, SimpleXLSXEx::getColorValue and SimpleXLSX::toHTMLEx (medium 5.4)
- [CVE-2024-56363](https://insights.sbomify.com/CVE-2024-56363/): APTRS has SSTI vulnerability (high 7.8)
- [CVE-2024-56362](https://insights.sbomify.com/CVE-2024-56362/): Navidrome Stores JWT Secret in Plaintext in navidrome.db (high 7.1)
- [CVE-2024-56361](https://insights.sbomify.com/CVE-2024-56361/): Stored Cross-Site Scripting (XSS) in lgsl v7.0 (medium 5.3)
- [CVE-2024-5636](https://insights.sbomify.com/CVE-2024-5636/): itsourcecode Bakery Online Ordering System index.php sql injection (medium 5.3)
- [CVE-2024-56359](https://insights.sbomify.com/CVE-2024-56359/): Cross-site Scripting vulnerability through HyperLink cells in grist-core (high 8.1)
- [CVE-2024-56358](https://insights.sbomify.com/CVE-2024-56358/): Cross-site Scripting vulnerability through svg attachment previews in grist-core (high 8.1)
- [CVE-2024-56357](https://insights.sbomify.com/CVE-2024-56357/): Cross-site Scripting vulnerability through custom widget URLs and form redirect URLs in grist-core (high 8.1)
- [CVE-2024-56356](https://insights.sbomify.com/CVE-2024-56356/): XML external entity in TeamCity (medium 5.9)
- [CVE-2024-56355](https://insights.sbomify.com/CVE-2024-56355/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-56354](https://insights.sbomify.com/CVE-2024-56354/): Information disclosure in TeamCity (medium 5.5)
- [CVE-2024-56353](https://insights.sbomify.com/CVE-2024-56353/): Information disclosure in TeamCity (medium 5.5)
- [CVE-2024-56352](https://insights.sbomify.com/CVE-2024-56352/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-56351](https://insights.sbomify.com/CVE-2024-56351/): Auth bypass in TeamCity (medium 6.3)
- [CVE-2024-56350](https://insights.sbomify.com/CVE-2024-56350/): Missing authorization in TeamCity (medium 4.3)
- [CVE-2024-5635](https://insights.sbomify.com/CVE-2024-5635/): itsourcecode Bakery Online Ordering System index.php sql injection (medium 5.3)
- [CVE-2024-56349](https://insights.sbomify.com/CVE-2024-56349/): Missing authorization in TeamCity (medium 5.3)
- [CVE-2024-56348](https://insights.sbomify.com/CVE-2024-56348/): Missing authorization in TeamCity (medium 4.3)
- [CVE-2024-56347](https://insights.sbomify.com/CVE-2024-56347/): IBM AIX command execution (critical 9.6)
- [CVE-2024-56346](https://insights.sbomify.com/CVE-2024-56346/): IBM AIX command execution (critical 10.0)
- [CVE-2024-56344](https://insights.sbomify.com/CVE-2024-56344/): IBM Cognos Analytics 12.0.4 and 12.1.3 versions are affected by security vulnerabilities (medium 5.9)
- [CVE-2024-56343](https://insights.sbomify.com/CVE-2024-56343/): IBM Verify Identity Access Digital Credentials denial of service (medium 4.3)
- [CVE-2024-56342](https://insights.sbomify.com/CVE-2024-56342/): IBM Verify Identity Access Digital Credentials information disclosure (medium 4.3)
- [CVE-2024-56341](https://insights.sbomify.com/CVE-2024-56341/): IBM Content Navigator cross-site scripting (medium 5.4)
- [CVE-2024-56340](https://insights.sbomify.com/CVE-2024-56340/): IBM Cognos Analytics path traversal (medium 6.5)
- [CVE-2024-5634](https://insights.sbomify.com/CVE-2024-5634/): Weak cryptography in LBH30FE200W (high 8.6)
- [CVE-2024-56339](https://insights.sbomify.com/CVE-2024-56339/): IBM WebSphere Application Server information disclosure (low 3.7)
- [CVE-2024-56338](https://insights.sbomify.com/CVE-2024-56338/): IBM Sterling B2B Integrator cross-site scripting (medium 4.8)
- [CVE-2024-56337](https://insights.sbomify.com/CVE-2024-56337/): Apache Tomcat: RCE due to TOCTOU issue in JSP compilation - CVE-2024-50379 mitigation was incomplete (critical 9.8)
- [CVE-2024-56336](https://insights.sbomify.com/CVE-2024-56336/): Security feature bypass in SINAMICS S200 (critical 9.5)
- [CVE-2024-56335](https://insights.sbomify.com/CVE-2024-56335/): Privilege escalation allows organization groups to be updated/deleted if their UUID is known in vaultwarden (high 7.6)
- [CVE-2024-56334](https://insights.sbomify.com/CVE-2024-56334/): Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformation (high 7.8)
- [CVE-2024-56333](https://insights.sbomify.com/CVE-2024-56333/): Remote code execution in onyxia-api (critical 9.4)
- [CVE-2024-56332](https://insights.sbomify.com/CVE-2024-56332/): Next.js Vulnerable to Denial of Service (DoS) with Server Actions (medium 5.3)
- [CVE-2024-56331](https://insights.sbomify.com/CVE-2024-56331/): Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitor (medium 6.8)
- [CVE-2024-56330](https://insights.sbomify.com/CVE-2024-56330/): Session VNC may be accessed by other sessions on the same host in stardust (critical 9.3)
- [CVE-2024-5633](https://insights.sbomify.com/CVE-2024-5633/): Auth bypass in LBH30FE200W (high 7.5)
- [CVE-2024-56329](https://insights.sbomify.com/CVE-2024-56329/): Account Takeover Vulnerability in Social Account Linking in joelbutcher/socialstream (high 8.9)
- [CVE-2024-56328](https://insights.sbomify.com/CVE-2024-56328/): HTMLi(XSS without CSP) via Onebox urls in Discourse (medium 6.5)
- [CVE-2024-56327](https://insights.sbomify.com/CVE-2024-56327/): Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage (high 7.7)
- [CVE-2024-56326](https://insights.sbomify.com/CVE-2024-56326/): Jinja has a sandbox breakout through indirect reference to format method (medium 5.4)
- [CVE-2024-56325](https://insights.sbomify.com/CVE-2024-56325/): Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not required (critical 9.8)
- [CVE-2024-56324](https://insights.sbomify.com/CVE-2024-56324/): GoCD vulnerable to XXE injection via abuse of pipeline XML "snippet" editing by group admins (low 2.1)
- [CVE-2024-56323](https://insights.sbomify.com/CVE-2024-56323/): OpenFGA Authorization Bypass (medium 5.8)
- [CVE-2024-56322](https://insights.sbomify.com/CVE-2024-56322/): GoCD vulnerable to XXE injection via abuse of unused XML configuration repository functionality (low 2.1)
- [CVE-2024-56321](https://insights.sbomify.com/CVE-2024-56321/): GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access (low 3.8)
- [CVE-2024-56320](https://insights.sbomify.com/CVE-2024-56320/): GoCD vulnerable to admin privilege escalation by a malicious internal/existing authenticated user (critical 9.4)
- [CVE-2024-5632](https://insights.sbomify.com/CVE-2024-5632/): Hardcoded credentials in NVR3608PGE2W (medium 5.3)
- [CVE-2024-56319](https://insights.sbomify.com/CVE-2024-56319/): Denial of service in Matter (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/188/