# Vulnerabilities published in 2024


- [CVE-2024-53006](https://insights.sbomify.com/CVE-2024-53006/): Substance3D - Modeler | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-53005](https://insights.sbomify.com/CVE-2024-53005/): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-53004](https://insights.sbomify.com/CVE-2024-53004/): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-53003](https://insights.sbomify.com/CVE-2024-53003/): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-53002](https://insights.sbomify.com/CVE-2024-53002/): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-53001](https://insights.sbomify.com/CVE-2024-53001/): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-53000](https://insights.sbomify.com/CVE-2024-53000/): Substance3D - Modeler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-5300](https://insights.sbomify.com/CVE-2024-5300/): Security feature bypass in Ubuntu 16.04 LTS (medium 5.6)
- [CVE-2024-52999](https://insights.sbomify.com/CVE-2024-52999/): Substance3D - Modeler | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-52998](https://insights.sbomify.com/CVE-2024-52998/): Substance3D - Stager | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-52997](https://insights.sbomify.com/CVE-2024-52997/): Photoshop Desktop | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-52996](https://insights.sbomify.com/CVE-2024-52996/): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-52995](https://insights.sbomify.com/CVE-2024-52995/): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-52994](https://insights.sbomify.com/CVE-2024-52994/): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-52993](https://insights.sbomify.com/CVE-2024-52993/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52992](https://insights.sbomify.com/CVE-2024-52992/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52991](https://insights.sbomify.com/CVE-2024-52991/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52990](https://insights.sbomify.com/CVE-2024-52990/): Animate | Buffer Underwrite ('Buffer Underflow') (CWE-124) (high 7.8)
- [CVE-2024-5299](https://insights.sbomify.com/CVE-2024-5299/): D-Link D-View execMonitorScript Exposed Dangerous Method Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-52989](https://insights.sbomify.com/CVE-2024-52989/): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-52988](https://insights.sbomify.com/CVE-2024-52988/): Animate | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-52987](https://insights.sbomify.com/CVE-2024-52987/): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-52986](https://insights.sbomify.com/CVE-2024-52986/): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-52985](https://insights.sbomify.com/CVE-2024-52985/): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-52984](https://insights.sbomify.com/CVE-2024-52984/): Animate | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-52983](https://insights.sbomify.com/CVE-2024-52983/): Animate | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2024-52982](https://insights.sbomify.com/CVE-2024-52982/): Animate | Improper Input Validation (CWE-20) (high 7.8)
- [CVE-2024-52981](https://insights.sbomify.com/CVE-2024-52981/): Elasticsearch Vulnerable to Stack Overflow due to a Large Recursion (medium 4.9)
- [CVE-2024-52980](https://insights.sbomify.com/CVE-2024-52980/): Elasticsearch Uncontrolled Resource Consumption vulnerability (medium 6.5)
- [CVE-2024-5298](https://insights.sbomify.com/CVE-2024-5298/): D-Link D-View queryDeviceCustomMonitorResult Exposed Dangerous Method Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-52979](https://insights.sbomify.com/CVE-2024-52979/): Elasticsearch Uncontrolled Resource Consumption vulnerability (medium 6.5)
- [CVE-2024-52976](https://insights.sbomify.com/CVE-2024-52976/): Elastic Agent Inclusion of Functionality from Untrusted Control Sphere (medium 4.4)
- [CVE-2024-52975](https://insights.sbomify.com/CVE-2024-52975/): Fleet Server sensitive information exposure via logs (critical 9.0)
- [CVE-2024-52974](https://insights.sbomify.com/CVE-2024-52974/): Denial of service in Kibana (medium 6.5)
- [CVE-2024-52973](https://insights.sbomify.com/CVE-2024-52973/): Kibana allocation of resources without limits or throttling leads to crash (medium 6.5)
- [CVE-2024-52972](https://insights.sbomify.com/CVE-2024-52972/): Kibana allocation of resources without limits or throttling leads to crash (medium 6.5)
- [CVE-2024-5297](https://insights.sbomify.com/CVE-2024-5297/): D-Link D-View executeWmicCmd Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-52969](https://insights.sbomify.com/CVE-2024-52969/): SQL injection in FortiSIEM (low 3.7)
- [CVE-2024-52968](https://insights.sbomify.com/CVE-2024-52968/): Auth bypass in FortiClientMac (medium 5.8)
- [CVE-2024-52967](https://insights.sbomify.com/CVE-2024-52967/): Cross-site scripting in FortiPortal (low 3.3)
- [CVE-2024-52966](https://insights.sbomify.com/CVE-2024-52966/): Information disclosure in FortiAnalyzer (low 2.2)
- [CVE-2024-52965](https://insights.sbomify.com/CVE-2024-52965/): Auth bypass in FortiOS (medium 6.8)
- [CVE-2024-52964](https://insights.sbomify.com/CVE-2024-52964/): Path traversal in FortiManager (medium 5.2)
- [CVE-2024-52963](https://insights.sbomify.com/CVE-2024-52963/): Memory corruption in FortiOS (low 3.5)
- [CVE-2024-52962](https://insights.sbomify.com/CVE-2024-52962/): Other in FortiAnalyzer (medium 5.0)
- [CVE-2024-52961](https://insights.sbomify.com/CVE-2024-52961/): Command injection in FortiSandbox (high 8.6)
- [CVE-2024-52960](https://insights.sbomify.com/CVE-2024-52960/): Security feature bypass in FortiSandbox (medium 4.2)
- [CVE-2024-5296](https://insights.sbomify.com/CVE-2024-5296/): D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2024-52959](https://insights.sbomify.com/CVE-2024-52959/): iota C.ai Conversational Platform - Improper Control of Generation of Code ('Code Injection') (critical 9.3)
- [CVE-2024-52958](https://insights.sbomify.com/CVE-2024-52958/): iota C.ai Conversational Platform - Improper Verification of Cryptographic Signature (critical 9.3)
- [CVE-2024-52951](https://insights.sbomify.com/CVE-2024-52951/): Stored Cross-Site Scripting in the Access Request History in Omada Identity before version 15 update 1 allows an authenticated attacker to e (high 8.0)
- [CVE-2024-5295](https://insights.sbomify.com/CVE-2024-5295/): D-Link G416 flupl self Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-52949](https://insights.sbomify.com/CVE-2024-52949/): Memory corruption in iptraf-ng:iptraf-ng (high 7.5)
- [CVE-2024-52947](https://insights.sbomify.com/CVE-2024-52947/): A cross-site scripting (XSS) vulnerability in LemonLDAP::NG before 2.20.1 allows remote attackers to inject arbitrary web script or HTML via (medium 6.1)
- [CVE-2024-52946](https://insights.sbomify.com/CVE-2024-52946/): An issue was discovered in LemonLDAP::NG before 2.20.1. (high 8.8)
- [CVE-2024-52945](https://insights.sbomify.com/CVE-2024-52945/): Code injection in veritas:netbackup (high 7.8)
- [CVE-2024-52944](https://insights.sbomify.com/CVE-2024-52944/): Cross-site scripting in veritas:enterprise vault (medium 5.4)
- [CVE-2024-52943](https://insights.sbomify.com/CVE-2024-52943/): Cross-site scripting in veritas:enterprise vault (medium 5.4)
- [CVE-2024-52942](https://insights.sbomify.com/CVE-2024-52942/): Cross-site scripting in veritas:enterprise vault (medium 5.4)
- [CVE-2024-52941](https://insights.sbomify.com/CVE-2024-52941/): An issue was discovered in Veritas Enterprise Vault before 15.1 UPD882911, ZDI-CAN-24695. (medium 5.4)
- [CVE-2024-52940](https://insights.sbomify.com/CVE-2024-52940/): AnyDesk through 8.1.0 on Windows, when Allow Direct Connections is enabled, inadvertently exposes a public IP address within network traffic. (high 7.5)
- [CVE-2024-5294](https://insights.sbomify.com/CVE-2024-5294/): D-Link DIR-3040 prog.cgi websSecurityHandler Memory Leak Denial-of-Service Vulnerability (medium 4.3)
- [CVE-2024-52939](https://insights.sbomify.com/CVE-2024-52939/): GPU DDK - RGXFWIF_HWPERF_CTL_BLK.uiNumCounters OOB write (high 7.8)
- [CVE-2024-52938](https://insights.sbomify.com/CVE-2024-52938/): GPU DDK - rgxfw_pm_add_freelist_for_reconstruction OOB write (high 7.8)
- [CVE-2024-52937](https://insights.sbomify.com/CVE-2024-52937/): GPU DDK - rgxfw_kernel_CMD_DISABLE_ZSSTORE OOB write via ui32WriteOffsetOfDisableZSStore (medium 6.7)
- [CVE-2024-52936](https://insights.sbomify.com/CVE-2024-52936/): GPU DDK - rgxfw_hwperf_config OOB read & write (medium 4.4)
- [CVE-2024-52935](https://insights.sbomify.com/CVE-2024-52935/): GPU DDK - psContext->eDM gives OOB write (medium 4.1)
- [CVE-2024-5293](https://insights.sbomify.com/CVE-2024-5293/): D-Link DIR-2640 HTTP Referer Stack-Based Buffer Overflow Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-52928](https://insights.sbomify.com/CVE-2024-52928/): Security feature bypass in thebrowser:arc (critical 9.6)
- [CVE-2024-52926](https://insights.sbomify.com/CVE-2024-52926/): Privilege escalation in Privilege Manager (medium 6.5)
- [CVE-2024-52925](https://insights.sbomify.com/CVE-2024-52925/): Code injection in MetaDefender Kiosk (medium 6.8)
- [CVE-2024-52924](https://insights.sbomify.com/CVE-2024-52924/): Memory corruption in samsung:exynos 1080 firmware (high 7.5)
- [CVE-2024-52923](https://insights.sbomify.com/CVE-2024-52923/): Memory corruption in samsung:exynos 1080 firmware (high 7.5)
- [CVE-2024-52922](https://insights.sbomify.com/CVE-2024-52922/): Denial of service in bitcoin:bitcoin core (medium 6.5)
- [CVE-2024-52921](https://insights.sbomify.com/CVE-2024-52921/): Missing authorization in bitcoin:bitcoin core (medium 5.3)
- [CVE-2024-52920](https://insights.sbomify.com/CVE-2024-52920/): Denial of service in bitcoin:bitcoin core (high 7.5)
- [CVE-2024-5292](https://insights.sbomify.com/CVE-2024-5292/): D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (high 7.3)
- [CVE-2024-52919](https://insights.sbomify.com/CVE-2024-52919/): Integer overflow in bitcoin:bitcoin core (medium 6.5)
- [CVE-2024-52918](https://insights.sbomify.com/CVE-2024-52918/): Bitcoin-Qt in Bitcoin Core before 0.20.0 allows remote attackers to cause a denial of service (memory consumption and application crash) via (medium 6.5)
- [CVE-2024-52917](https://insights.sbomify.com/CVE-2024-52917/): Denial of service in bitcoin:bitcoin core (medium 6.5)
- [CVE-2024-52916](https://insights.sbomify.com/CVE-2024-52916/): Denial of service in bitcoin:bitcoin core (high 7.5)
- [CVE-2024-52915](https://insights.sbomify.com/CVE-2024-52915/): Denial of service in bitcoin:bitcoin core (high 7.5)
- [CVE-2024-52914](https://insights.sbomify.com/CVE-2024-52914/): Denial of service in bitcoin:bitcoin core (high 7.5)
- [CVE-2024-52913](https://insights.sbomify.com/CVE-2024-52913/): Denial of service in bitcoin:bitcoin core (medium 5.3)
- [CVE-2024-52912](https://insights.sbomify.com/CVE-2024-52912/): Integer overflow in bitcoin:bitcoin core (high 7.5)
- [CVE-2024-52911](https://insights.sbomify.com/CVE-2024-52911/): Bitcoin Core through 28.x has a security issue, the details of which are not disclosed. (high 7.5)
- [CVE-2024-5291](https://insights.sbomify.com/CVE-2024-5291/): D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-52906](https://insights.sbomify.com/CVE-2024-52906/): IBM AIX denial of service (medium 5.5)
- [CVE-2024-52905](https://insights.sbomify.com/CVE-2024-52905/): IBM Sterling B2B Integrator information disclosure (low 2.7)
- [CVE-2024-52903](https://insights.sbomify.com/CVE-2024-52903/): IBM Db2 denial of service (medium 5.3)
- [CVE-2024-52902](https://insights.sbomify.com/CVE-2024-52902/): IBM Cognos Controller information disclosure (high 8.8)
- [CVE-2024-52901](https://insights.sbomify.com/CVE-2024-52901/): IBM InfoSphere Information Server denial of service (medium 6.5)
- [CVE-2024-52900](https://insights.sbomify.com/CVE-2024-52900/): IBM Cognos Analytics cross-site scripting (medium 6.4)
- [CVE-2024-5290](https://insights.sbomify.com/CVE-2024-5290/): Privilege escalation in wpa supplicant (high 8.8)
- [CVE-2024-52899](https://insights.sbomify.com/CVE-2024-52899/): IBM Data Virtualization Manager code execution (high 8.5)
- [CVE-2024-52898](https://insights.sbomify.com/CVE-2024-52898/): IBM MQ information disclosure (medium 6.2)
- [CVE-2024-52897](https://insights.sbomify.com/CVE-2024-52897/): IBM MQ information disclosure (medium 6.2)
- [CVE-2024-52896](https://insights.sbomify.com/CVE-2024-52896/): IBM MQ information disclosure (medium 6.2)
- [CVE-2024-52895](https://insights.sbomify.com/CVE-2024-52895/): IBM i denial of service (medium 6.5)
- [CVE-2024-52894](https://insights.sbomify.com/CVE-2024-52894/): IBM Db2 for Linux, UNIX and Windows denial of service (medium 4.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/210/