# Vulnerabilities published in 2024


- [CVE-2024-54039](https://insights.sbomify.com/CVE-2024-54039/): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-54038](https://insights.sbomify.com/CVE-2024-54038/): Adobe Connect | Improper Access Control (CWE-284) (medium 4.3)
- [CVE-2024-54037](https://insights.sbomify.com/CVE-2024-54037/): Adobe Connect | Cross-site Scripting (DOM-based XSS) (CWE-79) (high 8.1)
- [CVE-2024-54036](https://insights.sbomify.com/CVE-2024-54036/): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2024-54034](https://insights.sbomify.com/CVE-2024-54034/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (critical 9.3)
- [CVE-2024-54032](https://insights.sbomify.com/CVE-2024-54032/): Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79) (critical 9.3)
- [CVE-2024-54031](https://insights.sbomify.com/CVE-2024-54031/): netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext (medium 5.5)
- [CVE-2024-54030](https://insights.sbomify.com/CVE-2024-54030/): Communication_dsoftbus has an UAF vulnerability (medium 4.4)
- [CVE-2024-5403](https://insights.sbomify.com/CVE-2024-5403/): ASKEY 5G NR Small Cell - Command Injection (high 7.2)
- [CVE-2024-54028](https://insights.sbomify.com/CVE-2024-54028/): Integer overflow in catdoc (high 8.4)
- [CVE-2024-54027](https://insights.sbomify.com/CVE-2024-54027/): Hardcoded credentials in FortiSandbox (high 7.8)
- [CVE-2024-54026](https://insights.sbomify.com/CVE-2024-54026/): SQL injection in FortiSandbox (medium 4.1)
- [CVE-2024-54025](https://insights.sbomify.com/CVE-2024-54025/): Command injection in FortiIsolator (medium 6.5)
- [CVE-2024-54024](https://insights.sbomify.com/CVE-2024-54024/): Command injection in FortiIsolator (high 7.0)
- [CVE-2024-54021](https://insights.sbomify.com/CVE-2024-54021/): Security feature bypass in FortiOS (medium 6.4)
- [CVE-2024-54020](https://insights.sbomify.com/CVE-2024-54020/): Missing authorization in FortiManager (low 2.1)
- [CVE-2024-5402](https://insights.sbomify.com/CVE-2024-5402/): Mint Workbench I Unquoted Service Path Enumeration (medium 6.2)
- [CVE-2024-54019](https://insights.sbomify.com/CVE-2024-54019/): Security feature bypass in FortiClientWindows (medium 4.4)
- [CVE-2024-54018](https://insights.sbomify.com/CVE-2024-54018/): Command injection in FortiSandbox (medium 6.5)
- [CVE-2024-54017](https://insights.sbomify.com/CVE-2024-54017/): Other in SIPROTEC 5 6MD84 (CP300) (medium 6.9)
- [CVE-2024-54016](https://insights.sbomify.com/CVE-2024-54016/): compression bomb attack in Apache Seata Server (medium 4.3)
- [CVE-2024-54015](https://insights.sbomify.com/CVE-2024-54015/): Other in SIPROTEC 5 6MD84 (CP300) (high 8.7)
- [CVE-2024-54014](https://insights.sbomify.com/CVE-2024-54014/): Open redirect in 'Skylark' App for Android (low 3.6)
- [CVE-2024-54013](https://insights.sbomify.com/CVE-2024-54013/): Authentication Bypass (high 8.7)
- [CVE-2024-54012](https://insights.sbomify.com/CVE-2024-54012/): Command Injection (high 8.5)
- [CVE-2024-54011](https://insights.sbomify.com/CVE-2024-54011/): Missing Error/Exception Handling (medium 5.3)
- [CVE-2024-54010](https://insights.sbomify.com/CVE-2024-54010/): Unauthenticated Traffic Handling Flaw Allows Packet Leakage on HPE Aruba Networking CX 10000 series switches (low 3.4)
- [CVE-2024-5401](https://insights.sbomify.com/CVE-2024-5401/): Privilege escalation in DiskStation Manager (DSM) (medium 4.3)
- [CVE-2024-54009](https://insights.sbomify.com/CVE-2024-54009/): Auth bypass in HPE Alletra Storage MP B10000 (medium 4.0)
- [CVE-2024-54008](https://insights.sbomify.com/CVE-2024-54008/): Authenticated Remote Code Execution (RCE) in HPE Aruba Networking AirWave Management Platform (high 7.2)
- [CVE-2024-54007](https://insights.sbomify.com/CVE-2024-54007/): Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge (high 7.2)
- [CVE-2024-54006](https://insights.sbomify.com/CVE-2024-54006/): Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge (high 7.2)
- [CVE-2024-54005](https://insights.sbomify.com/CVE-2024-54005/): XML external entity in COMOS V10.3 (medium 5.9)
- [CVE-2024-54004](https://insights.sbomify.com/CVE-2024-54004/): Jenkins Filesystem List Parameter Plugin has Path Traversal vulnerability (medium 4.3)
- [CVE-2024-54003](https://insights.sbomify.com/CVE-2024-54003/): Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability (high 8.0)
- [CVE-2024-54002](https://insights.sbomify.com/CVE-2024-54002/): Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint (medium 5.3)
- [CVE-2024-54001](https://insights.sbomify.com/CVE-2024-54001/): Kanboard allows a persistent HTML injection site scripting in settings page date format (medium 5.5)
- [CVE-2024-54000](https://insights.sbomify.com/CVE-2024-54000/): Mobile Security Framework (MobSF) bypass of SSRF fix (high 7.5)
- [CVE-2024-5400](https://insights.sbomify.com/CVE-2024-5400/): Openfind Mail2000 - OS Command Injection (high 8.8)
- [CVE-2024-53999](https://insights.sbomify.com/CVE-2024-53999/): Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality (high 8.1)
- [CVE-2024-53995](https://insights.sbomify.com/CVE-2024-53995/): GHSL-2024-288: SickChill open redirect in login (low 1.9)
- [CVE-2024-53994](https://insights.sbomify.com/CVE-2024-53994/): Potential bypass of chat permissions in Discourse (medium 4.3)
- [CVE-2024-53992](https://insights.sbomify.com/CVE-2024-53992/): unzip-bot Allows Remote Code Execution (RCE) via archive extraction, password prompt, or video upload (high 8.8)
- [CVE-2024-53991](https://insights.sbomify.com/CVE-2024-53991/): Potential Backup file leaked via Nginx in Discourse (high 7.5)
- [CVE-2024-53990](https://insights.sbomify.com/CVE-2024-53990/): AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s (critical 9.2)
- [CVE-2024-5399](https://insights.sbomify.com/CVE-2024-5399/): Openfind Mail2000 - OS Command Injection (high 7.2)
- [CVE-2024-53989](https://insights.sbomify.com/CVE-2024-53989/): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (low 2.3)
- [CVE-2024-53988](https://insights.sbomify.com/CVE-2024-53988/): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (low 2.3)
- [CVE-2024-53987](https://insights.sbomify.com/CVE-2024-53987/): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (low 2.3)
- [CVE-2024-53986](https://insights.sbomify.com/CVE-2024-53986/): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (low 2.3)
- [CVE-2024-53985](https://insights.sbomify.com/CVE-2024-53985/): Possible XSS vulnerability with certain configurations of rails-html-sanitizer 1.6.0 (low 2.3)
- [CVE-2024-53984](https://insights.sbomify.com/CVE-2024-53984/): Nanopb does not release memory on error return when using PB_DECODE_DELIMITED (medium 4.3)
- [CVE-2024-53983](https://insights.sbomify.com/CVE-2024-53983/): Server-side request forgery in Backstage Scaffolder plugin (medium 5.4)
- [CVE-2024-53982](https://insights.sbomify.com/CVE-2024-53982/): Arbitrary file download in Zoo-Project Echo Example (high 8.7)
- [CVE-2024-53981](https://insights.sbomify.com/CVE-2024-53981/): python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundary (high 7.5)
- [CVE-2024-53980](https://insights.sbomify.com/CVE-2024-53980/): Spoofed length byte traps CC2538 in endless loop (medium 6.9)
- [CVE-2024-53979](https://insights.sbomify.com/CVE-2024-53979/): Information disclosure in zhmc-ansible-modules (high 8.3)
- [CVE-2024-53977](https://insights.sbomify.com/CVE-2024-53977/): Privilege escalation in ModelSim (medium 5.4)
- [CVE-2024-53976](https://insights.sbomify.com/CVE-2024-53976/): Other in Firefox for iOS (medium 5.4)
- [CVE-2024-53975](https://insights.sbomify.com/CVE-2024-53975/): Security feature bypass in Firefox for iOS (medium 5.4)
- [CVE-2024-53974](https://insights.sbomify.com/CVE-2024-53974/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-53970](https://insights.sbomify.com/CVE-2024-53970/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-5397](https://insights.sbomify.com/CVE-2024-5397/): itsourcecode Online Student Enrollment System instructorSubjects.php sql injection (medium 5.3)
- [CVE-2024-53969](https://insights.sbomify.com/CVE-2024-53969/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-53968](https://insights.sbomify.com/CVE-2024-53968/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-53967](https://insights.sbomify.com/CVE-2024-53967/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-53966](https://insights.sbomify.com/CVE-2024-53966/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-53965](https://insights.sbomify.com/CVE-2024-53965/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-53964](https://insights.sbomify.com/CVE-2024-53964/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-53963](https://insights.sbomify.com/CVE-2024-53963/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-53962](https://insights.sbomify.com/CVE-2024-53962/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-53961](https://insights.sbomify.com/CVE-2024-53961/): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (high 8.1)
- [CVE-2024-53960](https://insights.sbomify.com/CVE-2024-53960/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-5396](https://insights.sbomify.com/CVE-2024-5396/): itsourcecode Online Student Enrollment System newfaculty.php sql injection (medium 5.3)
- [CVE-2024-53959](https://insights.sbomify.com/CVE-2024-53959/): Adobe Framemaker | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2024-53958](https://insights.sbomify.com/CVE-2024-53958/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-53957](https://insights.sbomify.com/CVE-2024-53957/): Substance3D - Painter | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-53956](https://insights.sbomify.com/CVE-2024-53956/): Premiere Pro | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-53955](https://insights.sbomify.com/CVE-2024-53955/): Bridge | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-53954](https://insights.sbomify.com/CVE-2024-53954/): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-53953](https://insights.sbomify.com/CVE-2024-53953/): Animate | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-53952](https://insights.sbomify.com/CVE-2024-53952/): InDesign Desktop | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-53951](https://insights.sbomify.com/CVE-2024-53951/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-5395](https://insights.sbomify.com/CVE-2024-5395/): itsourcecode Online Student Enrollment System listofinstructor.php sql injection (medium 5.3)
- [CVE-2024-53949](https://insights.sbomify.com/CVE-2024-53949/): Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled (high 7.6)
- [CVE-2024-53948](https://insights.sbomify.com/CVE-2024-53948/): Apache Superset: Error verbosity exposes metadata in analytics databases (medium 5.3)
- [CVE-2024-53947](https://insights.sbomify.com/CVE-2024-53947/): Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions (low 2.3)
- [CVE-2024-53946](https://insights.sbomify.com/CVE-2024-53946/): The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. (high 8.8)
- [CVE-2024-53945](https://insights.sbomify.com/CVE-2024-53945/): The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. (high 8.8)
- [CVE-2024-53944](https://insights.sbomify.com/CVE-2024-53944/): An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 and LT21B devices through M762 (critical 9.8)
- [CVE-2024-53943](https://insights.sbomify.com/CVE-2024-53943/): An issue was discovered in NRadio N8-180 NROS-1.9.2.n3.c5 devices. (medium 6.1)
- [CVE-2024-53942](https://insights.sbomify.com/CVE-2024-53942/): An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. (medium 4.8)
- [CVE-2024-53941](https://insights.sbomify.com/CVE-2024-53941/): An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. (high 8.8)
- [CVE-2024-53940](https://insights.sbomify.com/CVE-2024-53940/): An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. (high 8.8)
- [CVE-2024-5394](https://insights.sbomify.com/CVE-2024-5394/): itsourcecode Online Student Enrollment System newDept.php sql injection (medium 5.3)
- [CVE-2024-53939](https://insights.sbomify.com/CVE-2024-53939/): An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. (high 8.8)
- [CVE-2024-53938](https://insights.sbomify.com/CVE-2024-53938/): An issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. (high 8.8)
- [CVE-2024-53937](https://insights.sbomify.com/CVE-2024-53937/): An issue was discovered on Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. (high 8.8)
- [CVE-2024-53936](https://insights.sbomify.com/CVE-2024-53936/): The com.asianmobile.callcolor (aka Color Phone Call Screen App) application through 24 for Android enables any application (with no permissi (medium 6.3)
- [CVE-2024-53935](https://insights.sbomify.com/CVE-2024-53935/): The com.callos14.callscreen.colorphone (aka iCall OS17 - Color Phone Flash) application through 4.3 for Android enables any application (wit (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/202/