# Vulnerabilities published in 2024


- [CVE-2024-52893](https://insights.sbomify.com/CVE-2024-52893/): IBM Concert Software information disclosure (medium 5.3)
- [CVE-2024-52892](https://insights.sbomify.com/CVE-2024-52892/): IBM Jazz for Service Management Cross-Site Scripting (medium 6.1)
- [CVE-2024-52891](https://insights.sbomify.com/CVE-2024-52891/): IBM Concert Software log manipulation (medium 5.4)
- [CVE-2024-52890](https://insights.sbomify.com/CVE-2024-52890/): IBM Engineering Lifecycle Optimization - Publishing cross-site scripting (medium 6.1)
- [CVE-2024-5289](https://insights.sbomify.com/CVE-2024-5289/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-52888](https://insights.sbomify.com/CVE-2024-52888/): Stored-XSS (medium 5.4)
- [CVE-2024-52887](https://insights.sbomify.com/CVE-2024-52887/): Self-XSS (low 3.5)
- [CVE-2024-52885](https://insights.sbomify.com/CVE-2024-52885/): Path Traversal (medium 5.0)
- [CVE-2024-52884](https://insights.sbomify.com/CVE-2024-52884/): Weak cryptography in audiocodes:mediant session border controller (high 7.5)
- [CVE-2024-52883](https://insights.sbomify.com/CVE-2024-52883/): Path traversal in audiocodes:one voice operations center (high 7.5)
- [CVE-2024-52882](https://insights.sbomify.com/CVE-2024-52882/): Cross-site scripting in audiocodes:one voice operations center (medium 6.1)
- [CVE-2024-52881](https://insights.sbomify.com/CVE-2024-52881/): Hardcoded credentials in audiocodes:one voice operations center (high 7.5)
- [CVE-2024-52880](https://insights.sbomify.com/CVE-2024-52880/): Memory corruption in insyde:kernel (high 7.9)
- [CVE-2024-5288](https://insights.sbomify.com/CVE-2024-5288/): Safe-error attack on TLS 1.3 Protocol (medium 5.1)
- [CVE-2024-52879](https://insights.sbomify.com/CVE-2024-52879/): Memory corruption in insyde:insydeh2o (high 7.5)
- [CVE-2024-52878](https://insights.sbomify.com/CVE-2024-52878/): Memory corruption in insyde:insydeh2o (high 7.5)
- [CVE-2024-52877](https://insights.sbomify.com/CVE-2024-52877/): Memory corruption in insyde:insydeh2o (high 7.5)
- [CVE-2024-52876](https://insights.sbomify.com/CVE-2024-52876/): Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote (high 7.5)
- [CVE-2024-52875](https://insights.sbomify.com/CVE-2024-52875/): Cross-site scripting in Kerio Control (high 8.8)
- [CVE-2024-52874](https://insights.sbomify.com/CVE-2024-52874/): SQL injection in infoblox:netmri (high 8.8)
- [CVE-2024-52872](https://insights.sbomify.com/CVE-2024-52872/): Missing authorization in flagsmith:flagsmith (high 7.5)
- [CVE-2024-52871](https://insights.sbomify.com/CVE-2024-52871/): Security feature bypass in flagsmith:flagsmith (high 7.5)
- [CVE-2024-52870](https://insights.sbomify.com/CVE-2024-52870/): Teradata Vantage Editor 1.0.1 is mostly intended for SQL database access and docs.teradata.com access, but provides unintended functionality (high 7.1)
- [CVE-2024-5287](https://insights.sbomify.com/CVE-2024-5287/): WP Affiliate Platform < 6.5.1 - Profile Update via CSRF (high 7.1)
- [CVE-2024-52869](https://insights.sbomify.com/CVE-2024-52869/): Certain Teradata account-handling code through 2024-11-04, used with SUSE Enterprise Linux Server, mismanages groups. (medium 6.0)
- [CVE-2024-52867](https://insights.sbomify.com/CVE-2024-52867/): guix-daemon in GNU Guix before 5ab3c4c allows privilege escalation because build outputs are accessible by local users before file metadata (high 8.1)
- [CVE-2024-52865](https://insights.sbomify.com/CVE-2024-52865/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52864](https://insights.sbomify.com/CVE-2024-52864/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52862](https://insights.sbomify.com/CVE-2024-52862/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52861](https://insights.sbomify.com/CVE-2024-52861/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52860](https://insights.sbomify.com/CVE-2024-52860/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-5286](https://insights.sbomify.com/CVE-2024-5286/): WP Affiliate Platform < 6.5.1 - Reflected XSS via Banner Editing (medium 4.8)
- [CVE-2024-52859](https://insights.sbomify.com/CVE-2024-52859/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52858](https://insights.sbomify.com/CVE-2024-52858/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52857](https://insights.sbomify.com/CVE-2024-52857/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52855](https://insights.sbomify.com/CVE-2024-52855/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52854](https://insights.sbomify.com/CVE-2024-52854/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52853](https://insights.sbomify.com/CVE-2024-52853/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52852](https://insights.sbomify.com/CVE-2024-52852/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52851](https://insights.sbomify.com/CVE-2024-52851/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52850](https://insights.sbomify.com/CVE-2024-52850/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-5285](https://insights.sbomify.com/CVE-2024-5285/): WP Affiliate Platform < 6.5.2 - Affiliate Deletion via CSRF (medium 5.5)
- [CVE-2024-52849](https://insights.sbomify.com/CVE-2024-52849/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52848](https://insights.sbomify.com/CVE-2024-52848/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52847](https://insights.sbomify.com/CVE-2024-52847/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52846](https://insights.sbomify.com/CVE-2024-52846/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52845](https://insights.sbomify.com/CVE-2024-52845/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52844](https://insights.sbomify.com/CVE-2024-52844/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52843](https://insights.sbomify.com/CVE-2024-52843/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52842](https://insights.sbomify.com/CVE-2024-52842/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52841](https://insights.sbomify.com/CVE-2024-52841/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52840](https://insights.sbomify.com/CVE-2024-52840/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-5284](https://insights.sbomify.com/CVE-2024-5284/): WP Affiliate Platform < 6.5.1 - Stored XSS via CSRF (medium 6.8)
- [CVE-2024-52839](https://insights.sbomify.com/CVE-2024-52839/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52838](https://insights.sbomify.com/CVE-2024-52838/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52837](https://insights.sbomify.com/CVE-2024-52837/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52836](https://insights.sbomify.com/CVE-2024-52836/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52835](https://insights.sbomify.com/CVE-2024-52835/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52834](https://insights.sbomify.com/CVE-2024-52834/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52833](https://insights.sbomify.com/CVE-2024-52833/): Substance3D - Modeler | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-52832](https://insights.sbomify.com/CVE-2024-52832/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52831](https://insights.sbomify.com/CVE-2024-52831/): Adobe Experience Manager | Improper Input Validation (CWE-20) (low 3.5)
- [CVE-2024-52830](https://insights.sbomify.com/CVE-2024-52830/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-5283](https://insights.sbomify.com/CVE-2024-5283/): WP Affiliate Platform < 6.5.1 - Reflected XSS via Lead Editing (medium 6.1)
- [CVE-2024-52829](https://insights.sbomify.com/CVE-2024-52829/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52828](https://insights.sbomify.com/CVE-2024-52828/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52827](https://insights.sbomify.com/CVE-2024-52827/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52826](https://insights.sbomify.com/CVE-2024-52826/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52825](https://insights.sbomify.com/CVE-2024-52825/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52824](https://insights.sbomify.com/CVE-2024-52824/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52823](https://insights.sbomify.com/CVE-2024-52823/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52822](https://insights.sbomify.com/CVE-2024-52822/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-5282](https://insights.sbomify.com/CVE-2024-5282/): WP Affiliate Platform < 6.5.1 - Reflected XSS via Registration Form (medium 6.1)
- [CVE-2024-52818](https://insights.sbomify.com/CVE-2024-52818/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52817](https://insights.sbomify.com/CVE-2024-52817/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52816](https://insights.sbomify.com/CVE-2024-52816/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-52815](https://insights.sbomify.com/CVE-2024-52815/): Synapse allows a a malformed invite to break the invitee's `/sync` (high 8.7)
- [CVE-2024-52814](https://insights.sbomify.com/CVE-2024-52814/): Helm Lacks Granularity in Workflow Role (low 2.8)
- [CVE-2024-52813](https://insights.sbomify.com/CVE-2024-52813/): matrix-sdk-crypto missing facility to signal rotation of a verified cryptographic identity (medium 4.3)
- [CVE-2024-52812](https://insights.sbomify.com/CVE-2024-52812/): LF Edge eKuiper has Stored XSS in Rules Functionality (medium 5.4)
- [CVE-2024-52811](https://insights.sbomify.com/CVE-2024-52811/): Acks not validated before logged to qlog leads to buffer overflow in ngtcp2 (high 8.2)
- [CVE-2024-52810](https://insights.sbomify.com/CVE-2024-52810/): Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4 (medium 6.9)
- [CVE-2024-5281](https://insights.sbomify.com/CVE-2024-5281/): WP Affiliate Platform < 6.5.1 - Reflected XSS via Affiliate Editing (medium 6.1)
- [CVE-2024-52809](https://insights.sbomify.com/CVE-2024-52809/): Cross-site Scripting vulnerability with prototype pollution in vue-i18n (medium 5.3)
- [CVE-2024-52807](https://insights.sbomify.com/CVE-2024-52807/): XXE vulnerability in XSLT parsing in `org.hl7.fhir.publisher` (high 8.6)
- [CVE-2024-52806](https://insights.sbomify.com/CVE-2024-52806/): SimpleSAMLphp SAML2 has an XXE in parsing SAML messages (high 8.3)
- [CVE-2024-52805](https://insights.sbomify.com/CVE-2024-52805/): Synapse allows unsupported content types to lead to memory exhaustion (high 8.2)
- [CVE-2024-52804](https://insights.sbomify.com/CVE-2024-52804/): Tornado has HTTP cookie parsing DoS vulnerability (high 7.5)
- [CVE-2024-52803](https://insights.sbomify.com/CVE-2024-52803/): LLama Factory Remote OS Command Injection Vulnerability (high 7.5)
- [CVE-2024-52802](https://insights.sbomify.com/CVE-2024-52802/): RIOT-OS missing dhcpv6_opt_t minimum header length check (high 7.5)
- [CVE-2024-52801](https://insights.sbomify.com/CVE-2024-52801/): Brute force takeover of OpenID Connect session cookies in sftpgo (medium 5.3)
- [CVE-2024-52800](https://insights.sbomify.com/CVE-2024-52800/): Potential XXE (XML External Entity Injection) vulnerability in veraPDF CLI (low 2.3)
- [CVE-2024-5280](https://insights.sbomify.com/CVE-2024-5280/): WP Affiliate Platform < 6.5.1 - POST Reflected XSS (medium 4.7)
- [CVE-2024-52799](https://insights.sbomify.com/CVE-2024-52799/): Argo Workflows Chart: Excessive Privileges in Workflow Role (high 8.3)
- [CVE-2024-52798](https://insights.sbomify.com/CVE-2024-52798/): path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x (high 7.7)
- [CVE-2024-52797](https://insights.sbomify.com/CVE-2024-52797/): Searching Opencast may cause a denial of service (medium 6.5)
- [CVE-2024-52796](https://insights.sbomify.com/CVE-2024-52796/): Password Pusher's rate limiter can be bypassed by forging proxy headers (medium 5.3)
- [CVE-2024-52794](https://insights.sbomify.com/CVE-2024-52794/): Magnific lightbox susceptible to Cross-site Scripting in Discourse (medium 6.8)
- [CVE-2024-52793](https://insights.sbomify.com/CVE-2024-52793/): XSS vulnerability in serveDir API of @std/http/file-server on POSIX systems (medium 5.1)
- [CVE-2024-52792](https://insights.sbomify.com/CVE-2024-52792/): Arbitrary config values override in lam (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/211/