# Vulnerabilities published in 2024


- [CVE-2024-54169](https://insights.sbomify.com/CVE-2024-54169/): IBM EntireX path traversal (medium 6.5)
- [CVE-2024-54160](https://insights.sbomify.com/CVE-2024-54160/): Cross-site scripting in OpenSearch (medium 6.4)
- [CVE-2024-5416](https://insights.sbomify.com/CVE-2024-5416/): Cross-site scripting in Elementor Website Builder – more than just a page builder (medium 5.4)
- [CVE-2024-54159](https://insights.sbomify.com/CVE-2024-54159/): stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack. (medium 4.1)
- [CVE-2024-54158](https://insights.sbomify.com/CVE-2024-54158/): Other in YouTrack (low 3.5)
- [CVE-2024-54157](https://insights.sbomify.com/CVE-2024-54157/): Denial of service in YouTrack (medium 4.3)
- [CVE-2024-54156](https://insights.sbomify.com/CVE-2024-54156/): Code injection in YouTrack (medium 4.2)
- [CVE-2024-54155](https://insights.sbomify.com/CVE-2024-54155/): Missing authorization in YouTrack (low 3.7)
- [CVE-2024-54154](https://insights.sbomify.com/CVE-2024-54154/): Path traversal in YouTrack (high 8.0)
- [CVE-2024-54153](https://insights.sbomify.com/CVE-2024-54153/): Missing authorization in YouTrack (low 3.1)
- [CVE-2024-54152](https://insights.sbomify.com/CVE-2024-54152/): Angular Expressions - Remote Code Execution when using locals (critical 9.3)
- [CVE-2024-54151](https://insights.sbomify.com/CVE-2024-54151/): Directus allows unauthenticated access to WebSocket events and operations (high 7.5)
- [CVE-2024-54150](https://insights.sbomify.com/CVE-2024-54150/): Algorithm Confusion Vulnerability in cjwt (high 8.7)
- [CVE-2024-5415](https://insights.sbomify.com/CVE-2024-5415/): Cross-Site Scripting (XSS) vulnerability on PhpMyBackupPro (high 7.1)
- [CVE-2024-54149](https://insights.sbomify.com/CVE-2024-54149/): Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion (high 8.5)
- [CVE-2024-54148](https://insights.sbomify.com/CVE-2024-54148/): Gogs has a Path Traversal in file editing UI (high 8.7)
- [CVE-2024-54147](https://insights.sbomify.com/CVE-2024-54147/): Altair GraphQL Client's desktop app does not validate HTTPS certificates (medium 6.8)
- [CVE-2024-54146](https://insights.sbomify.com/CVE-2024-54146/): Cacti has a SQL Injection vulnerability when view host template (high 7.6)
- [CVE-2024-54145](https://insights.sbomify.com/CVE-2024-54145/): Cacti has a SQL Injection vulnerability when request automation devices (medium 6.3)
- [CVE-2024-54143](https://insights.sbomify.com/CVE-2024-54143/): openwrt/asu allows build artifact poisoning via truncated SHA-256 hash and command injection (critical 9.3)
- [CVE-2024-54142](https://insights.sbomify.com/CVE-2024-54142/): Cross-site Scripting via Discourse-ai SharedAiConversation onebox in Discourse (critical 9.1)
- [CVE-2024-54141](https://insights.sbomify.com/CVE-2024-54141/): phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available (high 8.6)
- [CVE-2024-54140](https://insights.sbomify.com/CVE-2024-54140/): sigstore-java has a vulnerability with bundle verification (low 2.1)
- [CVE-2024-5414](https://insights.sbomify.com/CVE-2024-5414/): Cross-Site Scripting (XSS) vulnerability on PhpMyBackupPro (high 7.1)
- [CVE-2024-54139](https://insights.sbomify.com/CVE-2024-54139/): Combodo iTop vulnerable to XSS leading to CSRF breach on _table_id parameter (high 7.9)
- [CVE-2024-54138](https://insights.sbomify.com/CVE-2024-54138/): XSS Vulnerability in NuGetGallery's Markdown Autolinks Processing (medium 6.9)
- [CVE-2024-54137](https://insights.sbomify.com/CVE-2024-54137/): liboqs has a correctness error in HQC decapsulation (high 7.4)
- [CVE-2024-54136](https://insights.sbomify.com/CVE-2024-54136/): Untrusted Deserialization in ClipBucket-v5 Version 5.5.1 Revision 199 and Below (critical 9.8)
- [CVE-2024-54135](https://insights.sbomify.com/CVE-2024-54135/): Untrusted Deserialization in ClipBucket-v5 Version 2.0 to 5.5.1 Revision 199 (critical 9.8)
- [CVE-2024-54134](https://insights.sbomify.com/CVE-2024-54134/): @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material (high 8.3)
- [CVE-2024-54133](https://insights.sbomify.com/CVE-2024-54133/): Possible Content Security Policy bypass in Action Dispatch (low 2.3)
- [CVE-2024-54132](https://insights.sbomify.com/CVE-2024-54132/): GitHub CLI allows downloading malicious GitHub Actions workflow artifact to result in path traversal vulnerability (medium 6.3)
- [CVE-2024-54131](https://insights.sbomify.com/CVE-2024-54131/): Kolide Agent Privilege Escalation (Windows, Versions >= 1.5.3, < 1.12.3) (high 7.3)
- [CVE-2024-54130](https://insights.sbomify.com/CVE-2024-54130/): Segmentation Fault in `forwardBundle` Function of ION-DTN BPv7 When Destination EID is `dtn:none` (public) (critical 9.2)
- [CVE-2024-5413](https://insights.sbomify.com/CVE-2024-5413/): Cross-Site Scripting (XSS) vulnerability on PhpMyBackupPro (high 7.1)
- [CVE-2024-54129](https://insights.sbomify.com/CVE-2024-54129/): Improper Initialization of `imc` Scheme Leading to `SIGABRT` in ION-DTN BPv7 (critical 9.2)
- [CVE-2024-54128](https://insights.sbomify.com/CVE-2024-54128/): Directus has an HTML Injection in Comment (medium 5.7)
- [CVE-2024-54127](https://insights.sbomify.com/CVE-2024-54127/): Exposure of Wi-Fi Credentials in Plaintext in TP-Link Archer C50 (medium 4.3)
- [CVE-2024-54126](https://insights.sbomify.com/CVE-2024-54126/): Insufficient Integrity Verification Vulnerability in TP-Link Archer C50 (high 8.5)
- [CVE-2024-54125](https://insights.sbomify.com/CVE-2024-54125/): Open redirect in "Shonen Jump+" App for Android (low 3.3)
- [CVE-2024-54124](https://insights.sbomify.com/CVE-2024-54124/): In Click Studios Passwordstate before build 9920, there is a potential permission escalation on the edit folder screen. (high 8.8)
- [CVE-2024-54123](https://insights.sbomify.com/CVE-2024-54123/): Cross-site scripting in backdropcms:backdrop cms (medium 6.1)
- [CVE-2024-54122](https://insights.sbomify.com/CVE-2024-54122/): Race condition in HarmonyOS (medium 6.2)
- [CVE-2024-54121](https://insights.sbomify.com/CVE-2024-54121/): Other in HarmonyOS (medium 6.2)
- [CVE-2024-54120](https://insights.sbomify.com/CVE-2024-54120/): Race condition in HarmonyOS (medium 4.1)
- [CVE-2024-5412](https://insights.sbomify.com/CVE-2024-5412/): Memory corruption in VMG8825-T50K firmware (high 7.5)
- [CVE-2024-54119](https://insights.sbomify.com/CVE-2024-54119/): Information disclosure in HarmonyOS (medium 6.2)
- [CVE-2024-54117](https://insights.sbomify.com/CVE-2024-54117/): Information disclosure in HarmonyOS (medium 6.2)
- [CVE-2024-54116](https://insights.sbomify.com/CVE-2024-54116/): Memory corruption in HarmonyOS (medium 4.3)
- [CVE-2024-54115](https://insights.sbomify.com/CVE-2024-54115/): Memory corruption in HarmonyOS (medium 4.3)
- [CVE-2024-54114](https://insights.sbomify.com/CVE-2024-54114/): Memory corruption in HarmonyOS (medium 4.4)
- [CVE-2024-54113](https://insights.sbomify.com/CVE-2024-54113/): Denial of service in HarmonyOS (medium 6.5)
- [CVE-2024-54112](https://insights.sbomify.com/CVE-2024-54112/): Information disclosure in HarmonyOS (medium 5.5)
- [CVE-2024-54111](https://insights.sbomify.com/CVE-2024-54111/): Other in HarmonyOS (medium 5.7)
- [CVE-2024-54110](https://insights.sbomify.com/CVE-2024-54110/): Information disclosure in HarmonyOS (medium 6.2)
- [CVE-2024-5411](https://insights.sbomify.com/CVE-2024-5411/): Command Injection (high 8.7)
- [CVE-2024-54109](https://insights.sbomify.com/CVE-2024-54109/): Memory corruption in HarmonyOS (medium 6.5)
- [CVE-2024-54108](https://insights.sbomify.com/CVE-2024-54108/): Memory corruption in HarmonyOS (medium 6.5)
- [CVE-2024-54107](https://insights.sbomify.com/CVE-2024-54107/): Memory corruption in HarmonyOS (high 7.1)
- [CVE-2024-54106](https://insights.sbomify.com/CVE-2024-54106/): Null dereference in HarmonyOS (high 7.1)
- [CVE-2024-54105](https://insights.sbomify.com/CVE-2024-54105/): Memory corruption in HarmonyOS (medium 5.1)
- [CVE-2024-54104](https://insights.sbomify.com/CVE-2024-54104/): Information disclosure in HarmonyOS (medium 6.2)
- [CVE-2024-54103](https://insights.sbomify.com/CVE-2024-54103/): Missing authorization in HarmonyOS (medium 6.1)
- [CVE-2024-54102](https://insights.sbomify.com/CVE-2024-54102/): Race condition in HarmonyOS (medium 6.1)
- [CVE-2024-54101](https://insights.sbomify.com/CVE-2024-54101/): Denial of service in EMUI (medium 6.2)
- [CVE-2024-54100](https://insights.sbomify.com/CVE-2024-54100/): Missing authorization in EMUI (medium 6.2)
- [CVE-2024-5410](https://insights.sbomify.com/CVE-2024-5410/): Stored Cross-Site Scripting (high 8.3)
- [CVE-2024-54099](https://insights.sbomify.com/CVE-2024-54099/): Other in EMUI (medium 6.7)
- [CVE-2024-54098](https://insights.sbomify.com/CVE-2024-54098/): Business logic in EMUI (high 8.5)
- [CVE-2024-54097](https://insights.sbomify.com/CVE-2024-54097/): Other in EMUI (high 7.3)
- [CVE-2024-54096](https://insights.sbomify.com/CVE-2024-54096/): Missing authorization in EMUI (medium 5.3)
- [CVE-2024-54095](https://insights.sbomify.com/CVE-2024-54095/): Integer overflow in Solid Edge SE2024 (high 7.3)
- [CVE-2024-54094](https://insights.sbomify.com/CVE-2024-54094/): Memory corruption in Solid Edge SE2024 (high 7.3)
- [CVE-2024-54093](https://insights.sbomify.com/CVE-2024-54093/): Memory corruption in Solid Edge SE2024 (high 7.3)
- [CVE-2024-54092](https://insights.sbomify.com/CVE-2024-54092/): Auth bypass in Industrial Edge Device Kit - arm64 V1.17 (critical 9.3)
- [CVE-2024-54091](https://insights.sbomify.com/CVE-2024-54091/): Memory corruption in Solid Edge SE2024 (high 7.3)
- [CVE-2024-54090](https://insights.sbomify.com/CVE-2024-54090/): Memory corruption in APOGEE PXC Series (BACnet) (medium 6.0)
- [CVE-2024-5409](https://insights.sbomify.com/CVE-2024-5409/): Cross-site Scripting vulnerability in RhinOS from SaltOS (high 7.1)
- [CVE-2024-54089](https://insights.sbomify.com/CVE-2024-54089/): Weak cryptography in APOGEE PXC Series (BACnet) (high 8.7)
- [CVE-2024-54085](https://insights.sbomify.com/CVE-2024-54085/): AMI MegaRAC SPx Authentication Bypass by Spoofing (critical 10.0, exploited in the wild)
- [CVE-2024-54084](https://insights.sbomify.com/CVE-2024-54084/): SMM Arbitrary Write via TOCTOU Vulnerability (high 7.5)
- [CVE-2024-54083](https://insights.sbomify.com/CVE-2024-54083/): DoS via lack of type validation in Calls (medium 6.5)
- [CVE-2024-54082](https://insights.sbomify.com/CVE-2024-54082/): Command injection in Wi-Fi STATION SH-54C (high 7.2)
- [CVE-2024-5408](https://insights.sbomify.com/CVE-2024-5408/): Cross-site Scripting vulnerability in RhinOS from SaltOS (high 7.1)
- [CVE-2024-5407](https://insights.sbomify.com/CVE-2024-5407/): Code Injection vulnerability in RhinOS from SaltOS (critical 10.0)
- [CVE-2024-5406](https://insights.sbomify.com/CVE-2024-5406/): Multiple vulnerabilities in WinNMP from Wtriple (medium 6.3)
- [CVE-2024-54051](https://insights.sbomify.com/CVE-2024-54051/): Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (medium 6.1)
- [CVE-2024-54050](https://insights.sbomify.com/CVE-2024-54050/): Adobe Connect | URL Redirection to Untrusted Site ('Open Redirect') (CWE-601) (medium 6.1)
- [CVE-2024-5405](https://insights.sbomify.com/CVE-2024-5405/): Multiple vulnerabilities in WinNMP from Wtriple (medium 6.3)
- [CVE-2024-54049](https://insights.sbomify.com/CVE-2024-54049/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-54048](https://insights.sbomify.com/CVE-2024-54048/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-54047](https://insights.sbomify.com/CVE-2024-54047/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-54046](https://insights.sbomify.com/CVE-2024-54046/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-54045](https://insights.sbomify.com/CVE-2024-54045/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-54044](https://insights.sbomify.com/CVE-2024-54044/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-54043](https://insights.sbomify.com/CVE-2024-54043/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-54042](https://insights.sbomify.com/CVE-2024-54042/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-54041](https://insights.sbomify.com/CVE-2024-54041/): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-54040](https://insights.sbomify.com/CVE-2024-54040/): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-5404](https://insights.sbomify.com/CVE-2024-5404/): ifm: moneo prone to weak password recovery mechanism (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/201/