# Vulnerabilities published in 2024


- [CVE-2024-49615](https://insights.sbomify.com/CVE-2024-49615/): WordPress SafetyForms plugin <= 1.0.0 - CSRF to SQL Injection vulnerability (high 8.2)
- [CVE-2024-49614](https://insights.sbomify.com/CVE-2024-49614/): WordPress SermonAudio Widgets plugin <= 1.9.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49613](https://insights.sbomify.com/CVE-2024-49613/): WordPress Simple Code Insert Shortcode plugin <= 1.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49612](https://insights.sbomify.com/CVE-2024-49612/): WordPress SW Contact Form plugin <= 1.0 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49611](https://insights.sbomify.com/CVE-2024-49611/): WordPress Product Website Showcase plugin <= 1.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49610](https://insights.sbomify.com/CVE-2024-49610/): WordPress photokit plugin <= 1.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-4961](https://insights.sbomify.com/CVE-2024-4961/): D-Link DAR-7000-40 onlineuser.php unrestricted upload (medium 5.3)
- [CVE-2024-49609](https://insights.sbomify.com/CVE-2024-49609/): WordPress Author Discussion plugin <= 0.2.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49608](https://insights.sbomify.com/CVE-2024-49608/): WordPress GERRYWORKS Post by Mail plugin <= 1.0 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-49607](https://insights.sbomify.com/CVE-2024-49607/): WordPress WP Dropbox Dropins plugin <= 1.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49606](https://insights.sbomify.com/CVE-2024-49606/): WordPress Google Map Locations plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49605](https://insights.sbomify.com/CVE-2024-49605/): WordPress Community Lite Video Chat plugin <= 2.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-49604](https://insights.sbomify.com/CVE-2024-49604/): WordPress Simple User Registration plugin <= 6.7 - Broken Authentication vulnerability (critical 9.8)
- [CVE-2024-49603](https://insights.sbomify.com/CVE-2024-49603/): Information disclosure in PowerScale OneFS (medium 4.3)
- [CVE-2024-49602](https://insights.sbomify.com/CVE-2024-49602/): Denial of service in PowerScale OneFS (medium 6.5)
- [CVE-2024-49601](https://insights.sbomify.com/CVE-2024-49601/): Command injection in Unity (high 7.3)
- [CVE-2024-49600](https://insights.sbomify.com/CVE-2024-49600/): Privilege escalation in Dell Power Manager (DPM) (high 7.8)
- [CVE-2024-4960](https://insights.sbomify.com/CVE-2024-4960/): D-Link DAR-7000-40 licenseauthorization.php unrestricted upload (medium 5.3)
- [CVE-2024-49597](https://insights.sbomify.com/CVE-2024-49597/): Auth bypass in Wyse Management Suite (high 7.6)
- [CVE-2024-49596](https://insights.sbomify.com/CVE-2024-49596/): Missing authorization in Wyse Management Suite (medium 5.9)
- [CVE-2024-49595](https://insights.sbomify.com/CVE-2024-49595/): Auth bypass in Wyse Management Suite (high 7.6)
- [CVE-2024-49593](https://insights.sbomify.com/CVE-2024-49593/): In Advanced Custom Fields (ACF) before 6.3.9 and Secure Custom Fields before 6.3.6.3 (plugins for WordPress), using the Field Group editor t (medium 5.3)
- [CVE-2024-49592](https://insights.sbomify.com/CVE-2024-49592/): Trial installer for McAfee Total Protection (legacy trial installer software) 16.0.53 allows local privilege escalation because of an Uncont (medium 6.7)
- [CVE-2024-4959](https://insights.sbomify.com/CVE-2024-4959/): Frontend Checklist <= 2.3.2 - Admin+ Stored XSS via Items (medium 4.8)
- [CVE-2024-49589](https://insights.sbomify.com/CVE-2024-49589/): Foundry artifacts denial of service (medium 6.5)
- [CVE-2024-49588](https://insights.sbomify.com/CVE-2024-49588/): Multiple authenticated SQL injections in oracle-sidecar (medium 6.8)
- [CVE-2024-49587](https://insights.sbomify.com/CVE-2024-49587/): Glutton V1 endpoints missing authentication (critical 9.1)
- [CVE-2024-49581](https://insights.sbomify.com/CVE-2024-49581/): Access control issue impacting RV backed objects (medium 6.5)
- [CVE-2024-49580](https://insights.sbomify.com/CVE-2024-49580/): JetBrains Ktor information disclosure (medium 5.3)
- [CVE-2024-4958](https://insights.sbomify.com/CVE-2024-4958/): Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (high 7.1)
- [CVE-2024-49579](https://insights.sbomify.com/CVE-2024-49579/): Code injection in YouTrack (high 8.1)
- [CVE-2024-49576](https://insights.sbomify.com/CVE-2024-49576/): Use after free in Foxit Reader (high 8.8)
- [CVE-2024-49574](https://insights.sbomify.com/CVE-2024-49574/): SQL Injection (high 8.3)
- [CVE-2024-49573](https://insights.sbomify.com/CVE-2024-49573/): sched/fair: Fix NEXT_BUDDY (high 7.0)
- [CVE-2024-49572](https://insights.sbomify.com/CVE-2024-49572/): Auth bypass in DIRIS Digiware M-70 (high 7.2)
- [CVE-2024-49571](https://insights.sbomify.com/CVE-2024-49571/): net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg (critical 9.1)
- [CVE-2024-49570](https://insights.sbomify.com/CVE-2024-49570/): drm/xe/tracing: Fix a potential TP_printk UAF (high 7.8)
- [CVE-2024-4957](https://insights.sbomify.com/CVE-2024-4957/): Frontend Checklist <= 2.3.2 - Admin+ Stored XSS (medium 4.3)
- [CVE-2024-49569](https://insights.sbomify.com/CVE-2024-49569/): nvme-rdma: unquiesce admin_q before destroy it (high 7.5)
- [CVE-2024-49568](https://insights.sbomify.com/CVE-2024-49568/): net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg (critical 9.8)
- [CVE-2024-49565](https://insights.sbomify.com/CVE-2024-49565/): Command injection in Unity (high 7.8)
- [CVE-2024-49564](https://insights.sbomify.com/CVE-2024-49564/): Command injection in Unity (high 7.8)
- [CVE-2024-49563](https://insights.sbomify.com/CVE-2024-49563/): Command injection in Unity (high 7.8)
- [CVE-2024-49561](https://insights.sbomify.com/CVE-2024-49561/): Privilege escalation in SmartFabric OS10 Software (high 7.8)
- [CVE-2024-49560](https://insights.sbomify.com/CVE-2024-49560/): Command injection in SmartFabric OS10 Software (high 7.8)
- [CVE-2024-4956](https://insights.sbomify.com/CVE-2024-4956/): Nexus Repository 3 - Path Traversal (high 7.5)
- [CVE-2024-49559](https://insights.sbomify.com/CVE-2024-49559/): Hardcoded credentials in SmartFabric OS10 Software (high 8.8)
- [CVE-2024-49558](https://insights.sbomify.com/CVE-2024-49558/): Privilege escalation in SmartFabric OS10 Software (high 7.8)
- [CVE-2024-49557](https://insights.sbomify.com/CVE-2024-49557/): Command injection in SmartFabric OS10 Software (high 7.8)
- [CVE-2024-49554](https://insights.sbomify.com/CVE-2024-49554/): Media Encoder | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-49553](https://insights.sbomify.com/CVE-2024-49553/): Media Encoder | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49552](https://insights.sbomify.com/CVE-2024-49552/): Media Encoder | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-49551](https://insights.sbomify.com/CVE-2024-49551/): Media Encoder | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49550](https://insights.sbomify.com/CVE-2024-49550/): Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 6.1)
- [CVE-2024-49549](https://insights.sbomify.com/CVE-2024-49549/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49548](https://insights.sbomify.com/CVE-2024-49548/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49547](https://insights.sbomify.com/CVE-2024-49547/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49546](https://insights.sbomify.com/CVE-2024-49546/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49545](https://insights.sbomify.com/CVE-2024-49545/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-49544](https://insights.sbomify.com/CVE-2024-49544/): InDesign Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49543](https://insights.sbomify.com/CVE-2024-49543/): InDesign Desktop | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2024-49541](https://insights.sbomify.com/CVE-2024-49541/): Illustrator | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49538](https://insights.sbomify.com/CVE-2024-49538/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49537](https://insights.sbomify.com/CVE-2024-49537/): After Effects | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2024-49536](https://insights.sbomify.com/CVE-2024-49536/): Audition | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49535](https://insights.sbomify.com/CVE-2024-49535/): Acrobat Reader | Improper Restriction of XML External Entity Reference ('XXE') (CWE-611) (medium 6.3)
- [CVE-2024-49534](https://insights.sbomify.com/CVE-2024-49534/): Acrobat Reader | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49533](https://insights.sbomify.com/CVE-2024-49533/): Acrobat Reader | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49532](https://insights.sbomify.com/CVE-2024-49532/): Acrobat Reader | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49531](https://insights.sbomify.com/CVE-2024-49531/): Acrobat Reader | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-49530](https://insights.sbomify.com/CVE-2024-49530/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-49529](https://insights.sbomify.com/CVE-2024-49529/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49528](https://insights.sbomify.com/CVE-2024-49528/): Animate | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49527](https://insights.sbomify.com/CVE-2024-49527/): Animate | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49526](https://insights.sbomify.com/CVE-2024-49526/): Animate | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-49525](https://insights.sbomify.com/CVE-2024-49525/): Substance3D - Painter | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-49524](https://insights.sbomify.com/CVE-2024-49524/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-49523](https://insights.sbomify.com/CVE-2024-49523/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-49522](https://insights.sbomify.com/CVE-2024-49522/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49521](https://insights.sbomify.com/CVE-2024-49521/): Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918) (high 7.7)
- [CVE-2024-49520](https://insights.sbomify.com/CVE-2024-49520/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49519](https://insights.sbomify.com/CVE-2024-49519/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49518](https://insights.sbomify.com/CVE-2024-49518/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49517](https://insights.sbomify.com/CVE-2024-49517/): Substance3D - Painter | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-49516](https://insights.sbomify.com/CVE-2024-49516/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49515](https://insights.sbomify.com/CVE-2024-49515/): Substance3D - Painter | Untrusted Search Path (CWE-426) (high 7.8)
- [CVE-2024-49514](https://insights.sbomify.com/CVE-2024-49514/): Photoshop Desktop | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-49513](https://insights.sbomify.com/CVE-2024-49513/): Not a product | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-49512](https://insights.sbomify.com/CVE-2024-49512/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49511](https://insights.sbomify.com/CVE-2024-49511/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49510](https://insights.sbomify.com/CVE-2024-49510/): InDesign Desktop | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-49509](https://insights.sbomify.com/CVE-2024-49509/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-49508](https://insights.sbomify.com/CVE-2024-49508/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-49507](https://insights.sbomify.com/CVE-2024-49507/): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-49506](https://insights.sbomify.com/CVE-2024-49506/): Fixed temporary file path in aeon-checks allows fixing of disk encryption key (high 7.3)
- [CVE-2024-49505](https://insights.sbomify.com/CVE-2024-49505/): XSS vulnerability found in OpenSuse MirrorCache (medium 5.3)
- [CVE-2024-49504](https://insights.sbomify.com/CVE-2024-49504/): grub2 allows bypassing TPM-bound disk encryption on SL(E)M encrypted Images (high 7.0)
- [CVE-2024-49503](https://insights.sbomify.com/CVE-2024-49503/): Reflected XSS in Setup Wizard, Organization Credentials in spacewalk-web (medium 4.6)
- [CVE-2024-49502](https://insights.sbomify.com/CVE-2024-49502/): Reflected XSS in Setup Wizard, HTTP Proxy credentials pane in spacewalk-web (medium 4.6)
- [CVE-2024-49501](https://insights.sbomify.com/CVE-2024-49501/): Missing authorization in SYSMAC-SE2[][][] (medium 5.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/237/