# Vulnerabilities published in 2024


- [CVE-2024-53303](https://insights.sbomify.com/CVE-2024-53303/): A remote code execution (RCE) vulnerability in the upload_file function of LRQA Nettitude PoshC2 after commit 123db87 allows authenticated a (high 8.8)
- [CVE-2024-5330](https://insights.sbomify.com/CVE-2024-5330/): Breakdance <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-53299](https://insights.sbomify.com/CVE-2024-53299/): Apache Wicket: An attacker can intentionally trigger a memory leak (medium 6.5)
- [CVE-2024-53298](https://insights.sbomify.com/CVE-2024-53298/): Missing authorization in PowerScale OneFS (critical 9.8)
- [CVE-2024-53296](https://insights.sbomify.com/CVE-2024-53296/): Memory corruption in PowerProtect DD (low 2.7)
- [CVE-2024-53295](https://insights.sbomify.com/CVE-2024-53295/): Privilege escalation in PowerProtect DD (high 7.8)
- [CVE-2024-53292](https://insights.sbomify.com/CVE-2024-53292/): Information disclosure in Dell VxRail HCI (high 7.2)
- [CVE-2024-53291](https://insights.sbomify.com/CVE-2024-53291/): Information disclosure in NativeEdge (high 7.5)
- [CVE-2024-53290](https://insights.sbomify.com/CVE-2024-53290/): Command injection in Wyse Proprietary OS (Modern ThinOS) (high 8.4)
- [CVE-2024-5329](https://insights.sbomify.com/CVE-2024-5329/): SQL injection in Unlimited Elements For Elementor (high 8.8)
- [CVE-2024-53289](https://insights.sbomify.com/CVE-2024-53289/): Race condition in Wyse Proprietary OS (Modern ThinOS) (high 7.8)
- [CVE-2024-53288](https://insights.sbomify.com/CVE-2024-53288/): Cross-site scripting in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-53287](https://insights.sbomify.com/CVE-2024-53287/): Cross-site scripting in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-53286](https://insights.sbomify.com/CVE-2024-53286/): Command injection in Synology Router Manager (SRM) (high 7.2)
- [CVE-2024-53285](https://insights.sbomify.com/CVE-2024-53285/): Cross-site scripting in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-53284](https://insights.sbomify.com/CVE-2024-53284/): Cross-site scripting in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-53283](https://insights.sbomify.com/CVE-2024-53283/): Cross-site scripting in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-53282](https://insights.sbomify.com/CVE-2024-53282/): Cross-site scripting in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-53281](https://insights.sbomify.com/CVE-2024-53281/): Cross-site scripting in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-53280](https://insights.sbomify.com/CVE-2024-53280/): Cross-site scripting in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-5328](https://insights.sbomify.com/CVE-2024-5328/): SSRF Vulnerability in lunary-ai/lunary (high 8.6)
- [CVE-2024-53279](https://insights.sbomify.com/CVE-2024-53279/): Cross-site scripting in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-53278](https://insights.sbomify.com/CVE-2024-53278/): Cross-site scripting in WP Admin UI Customize (medium 4.8)
- [CVE-2024-53277](https://insights.sbomify.com/CVE-2024-53277/): Cross-site Scripting in form messages in silverstripe framework (medium 5.4)
- [CVE-2024-53276](https://insights.sbomify.com/CVE-2024-53276/): GHSL-2024-092: Open CORS policy in home-gallery (medium 6.3)
- [CVE-2024-53275](https://insights.sbomify.com/CVE-2024-53275/): GHSL-2024-091: DNS rebinding attack in home-gallery (medium 5.3)
- [CVE-2024-53274](https://insights.sbomify.com/CVE-2024-53274/): GHSL-2024-111: Reflected XSS in /home in habitica (low 2.0)
- [CVE-2024-53273](https://insights.sbomify.com/CVE-2024-53273/): GHSL-2024-110: Reflected XSS in /register in habitica (medium 5.0)
- [CVE-2024-53272](https://insights.sbomify.com/CVE-2024-53272/): GHSL-2024-109: Reflected XSS in /login in habitica (medium 5.0)
- [CVE-2024-53271](https://insights.sbomify.com/CVE-2024-53271/): HTTP/1.1 multiple issues with envoy.reloadable_features.http1_balsa_delay_reset in envoy (high 7.1)
- [CVE-2024-53270](https://insights.sbomify.com/CVE-2024-53270/): HTTP/1: sending overload crashes when the request is reset beforehand in envoy (high 7.5)
- [CVE-2024-5327](https://insights.sbomify.com/CVE-2024-5327/): Cross-site scripting in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (medium 6.4)
- [CVE-2024-53269](https://insights.sbomify.com/CVE-2024-53269/): Happy Eyeballs: Validate that additional_address are IP addresses instead of crashing when sorting in envoy (medium 4.5)
- [CVE-2024-53268](https://insights.sbomify.com/CVE-2024-53268/): Lack of validation on openExternal allows 1 click remote code execution in joplin (high 7.3)
- [CVE-2024-53267](https://insights.sbomify.com/CVE-2024-53267/): Vulnerability with bundle verification in sigstore-java (medium 5.5)
- [CVE-2024-53266](https://insights.sbomify.com/CVE-2024-53266/): Cross-site Scripting (XSS) via topic titles when CSP disabled in Discourse (medium 4.3)
- [CVE-2024-53264](https://insights.sbomify.com/CVE-2024-53264/): Open Redirect Vulnerability in Loading Page in bunkerweb (medium 5.1)
- [CVE-2024-53263](https://insights.sbomify.com/CVE-2024-53263/): Git LFS permits exfiltration of credentials via crafted HTTP URLs (high 8.5)
- [CVE-2024-53262](https://insights.sbomify.com/CVE-2024-53262/): Unescaped error message included on error page in SvelteKit (low 2.0)
- [CVE-2024-53261](https://insights.sbomify.com/CVE-2024-53261/): Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit (low 2.0)
- [CVE-2024-53260](https://insights.sbomify.com/CVE-2024-53260/): Course Roster vulnerable to CSV Injection in Autolab (medium 6.8)
- [CVE-2024-5326](https://insights.sbomify.com/CVE-2024-5326/): Missing authorization in Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX (high 8.8)
- [CVE-2024-53259](https://insights.sbomify.com/CVE-2024-53259/): quic-go affected by an ICMP Packet Too Large Injection Attack on Linux (medium 6.5)
- [CVE-2024-53258](https://insights.sbomify.com/CVE-2024-53258/): download_all_submissions allows student to download another student's submissions in Autolab (high 7.1)
- [CVE-2024-53257](https://insights.sbomify.com/CVE-2024-53257/): Vitess allows HTML injection in /debug/querylogz & /debug/env (medium 4.9)
- [CVE-2024-53256](https://insights.sbomify.com/CVE-2024-53256/): Rizin has a command injection via RzBinInfo bclass due legacy code (high 7.8)
- [CVE-2024-53255](https://insights.sbomify.com/CVE-2024-53255/): Reflected Cross-site Scripting in /admin?page=media via file Parameter in BoidCMS (medium 5.3)
- [CVE-2024-53253](https://insights.sbomify.com/CVE-2024-53253/): Sentry's improper error handling leaks Application Integration Client Secret (medium 5.3)
- [CVE-2024-5325](https://insights.sbomify.com/CVE-2024-5325/): Form Vibes <= 1.4.10 - Authenticated (Subscriber+) SQL Injection via fv_export_data (high 8.8)
- [CVE-2024-53247](https://insights.sbomify.com/CVE-2024-53247/): Remote Code Execution through Deserialization of Untrusted Data in Splunk Secure Gateway app (high 8.8)
- [CVE-2024-53246](https://insights.sbomify.com/CVE-2024-53246/): Sensitive Information Disclosure through SPL commands (medium 5.3)
- [CVE-2024-53245](https://insights.sbomify.com/CVE-2024-53245/): Information Disclosure due to Username Collision with a Role that has the same Name as the User (low 3.1)
- [CVE-2024-53244](https://insights.sbomify.com/CVE-2024-53244/): Risky command safeguards bypass in “/en-US/app/search/report“ endpoint through “s“ parameter (medium 5.7)
- [CVE-2024-53243](https://insights.sbomify.com/CVE-2024-53243/): Information Disclosure in Mobile Alert Responses in Splunk Secure Gateway (medium 4.3)
- [CVE-2024-53242](https://insights.sbomify.com/CVE-2024-53242/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-53241](https://insights.sbomify.com/CVE-2024-53241/): x86/xen: don't do PV iret hypercall through hypercall page (medium 5.5)
- [CVE-2024-53240](https://insights.sbomify.com/CVE-2024-53240/): xen/netfront: fix crash when removing device (medium 5.7)
- [CVE-2024-5324](https://insights.sbomify.com/CVE-2024-5324/): XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update (high 8.8)
- [CVE-2024-53239](https://insights.sbomify.com/CVE-2024-53239/): ALSA: 6fire: Release resources at card release (high 7.8)
- [CVE-2024-53238](https://insights.sbomify.com/CVE-2024-53238/): Bluetooth: btmtk: adjust the position to init iso data anchor (medium 5.5)
- [CVE-2024-53237](https://insights.sbomify.com/CVE-2024-53237/): Bluetooth: fix use-after-free in device_for_each_child() (high 8.8)
- [CVE-2024-53236](https://insights.sbomify.com/CVE-2024-53236/): xsk: Free skb when TX metadata options are invalid (medium 5.5)
- [CVE-2024-53235](https://insights.sbomify.com/CVE-2024-53235/): erofs: fix file-backed mounts over FUSE (medium 5.5)
- [CVE-2024-53234](https://insights.sbomify.com/CVE-2024-53234/): erofs: handle NONHEAD !delta[1] lclusters gracefully (medium 5.5)
- [CVE-2024-53233](https://insights.sbomify.com/CVE-2024-53233/): unicode: Fix utf8_load() error path (medium 5.5)
- [CVE-2024-53232](https://insights.sbomify.com/CVE-2024-53232/): iommu/s390: Implement blocking domain (high 7.8)
- [CVE-2024-53231](https://insights.sbomify.com/CVE-2024-53231/): cpufreq: CPPC: Fix possible null-ptr-deref for cpufreq_cpu_get_raw() (medium 5.5)
- [CVE-2024-53230](https://insights.sbomify.com/CVE-2024-53230/): cpufreq: CPPC: Fix possible null-ptr-deref for cppc_get_cpu_cost() (medium 5.5)
- [CVE-2024-53229](https://insights.sbomify.com/CVE-2024-53229/): RDMA/rxe: Fix the qp flush warnings in req (medium 5.5)
- [CVE-2024-53228](https://insights.sbomify.com/CVE-2024-53228/): riscv: kvm: Fix out-of-bounds array access (high 7.8)
- [CVE-2024-53227](https://insights.sbomify.com/CVE-2024-53227/): scsi: bfa: Fix use-after-free in bfad_im_module_exit() (high 7.8)
- [CVE-2024-53226](https://insights.sbomify.com/CVE-2024-53226/): RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() (high 7.5)
- [CVE-2024-53225](https://insights.sbomify.com/CVE-2024-53225/): iommu/tegra241-cmdqv: Fix alignment failure at max_n_shift (medium 5.5)
- [CVE-2024-53224](https://insights.sbomify.com/CVE-2024-53224/): RDMA/mlx5: Move events notifier registration to be after device registration (high 8.8)
- [CVE-2024-53223](https://insights.sbomify.com/CVE-2024-53223/): clk: ralink: mtmips: fix clocks probe order in oldest ralink SoCs (medium 5.5)
- [CVE-2024-53222](https://insights.sbomify.com/CVE-2024-53222/): zram: fix NULL pointer in comp_algorithm_show() (medium 5.5)
- [CVE-2024-53221](https://insights.sbomify.com/CVE-2024-53221/): f2fs: fix null-ptr-deref in f2fs_submit_page_bio() (medium 5.5)
- [CVE-2024-53220](https://insights.sbomify.com/CVE-2024-53220/): f2fs: fix to account dirty data in __get_secs_required() (high 7.8)
- [CVE-2024-5322](https://insights.sbomify.com/CVE-2024-5322/): N-central Authentication Bypass via Session Rebinding (critical 9.1)
- [CVE-2024-53219](https://insights.sbomify.com/CVE-2024-53219/): virtiofs: use pages instead of pointer for kernel direct IO (medium 5.5)
- [CVE-2024-53218](https://insights.sbomify.com/CVE-2024-53218/): f2fs: fix race in concurrent f2fs_stop_gc_thread (high 7.8)
- [CVE-2024-53217](https://insights.sbomify.com/CVE-2024-53217/): NFSD: Prevent NULL dereference in nfsd4_process_cb_update() (high 7.5)
- [CVE-2024-53216](https://insights.sbomify.com/CVE-2024-53216/): nfsd: release svc_expkey/svc_export with rcu_work (high 7.8)
- [CVE-2024-53215](https://insights.sbomify.com/CVE-2024-53215/): svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() (medium 5.5)
- [CVE-2024-53214](https://insights.sbomify.com/CVE-2024-53214/): vfio/pci: Properly hide first-in-list PCIe extended capability (high 7.8)
- [CVE-2024-53213](https://insights.sbomify.com/CVE-2024-53213/): net: usb: lan78xx: Fix double free issue with interrupt buffer allocation (high 7.8)
- [CVE-2024-53212](https://insights.sbomify.com/CVE-2024-53212/): netlink: fix false positive warning in extack during dumps (medium 5.5)
- [CVE-2024-53211](https://insights.sbomify.com/CVE-2024-53211/): net/l2tp: fix warning in l2tp_exit_net found by syzbot (medium 5.5)
- [CVE-2024-53210](https://insights.sbomify.com/CVE-2024-53210/): s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (medium 5.5)
- [CVE-2024-5321](https://insights.sbomify.com/CVE-2024-5321/): Incorrect permissions on Windows containers logs (medium 6.1)
- [CVE-2024-53209](https://insights.sbomify.com/CVE-2024-53209/): bnxt_en: Fix receive ring space parameters when XDP is active (critical 9.8)
- [CVE-2024-53208](https://insights.sbomify.com/CVE-2024-53208/): Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (high 7.8)
- [CVE-2024-53207](https://insights.sbomify.com/CVE-2024-53207/): Bluetooth: MGMT: Fix possible deadlocks (high 7.8)
- [CVE-2024-53206](https://insights.sbomify.com/CVE-2024-53206/): tcp: Fix use-after-free of nreq in reqsk_timer_handler(). (critical 9.8)
- [CVE-2024-53205](https://insights.sbomify.com/CVE-2024-53205/): phy: realtek: usb: fix NULL deref in rtk_usb2phy_probe (medium 5.5)
- [CVE-2024-53204](https://insights.sbomify.com/CVE-2024-53204/): phy: realtek: usb: fix NULL deref in rtk_usb3phy_probe (medium 5.5)
- [CVE-2024-53203](https://insights.sbomify.com/CVE-2024-53203/): usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (high 7.8)
- [CVE-2024-53202](https://insights.sbomify.com/CVE-2024-53202/): firmware_loader: Fix possible resource leak in fw_log_firmware_info() (medium 5.5)
- [CVE-2024-53201](https://insights.sbomify.com/CVE-2024-53201/): drm/amd/display: Fix null check for pipe_ctx->plane_state in dcn20_program_pipe (medium 5.5)
- [CVE-2024-53200](https://insights.sbomify.com/CVE-2024-53200/): drm/amd/display: Fix null check for pipe_ctx->plane_state in hwss_setup_dpp (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/207/