# Vulnerabilities published in 2024


- [CVE-2024-4950](https://insights.sbomify.com/CVE-2024-4950/): Other in Chrome (medium 5.3)
- [CVE-2024-4949](https://insights.sbomify.com/CVE-2024-4949/): Use after free in Chrome (critical 9.6)
- [CVE-2024-4948](https://insights.sbomify.com/CVE-2024-4948/): Use after free in Chrome (high 8.8)
- [CVE-2024-4947](https://insights.sbomify.com/CVE-2024-4947/): Google Chromium V8 Type Confusion (critical 9.6, exploited in the wild)
- [CVE-2024-4946](https://insights.sbomify.com/CVE-2024-4946/): SourceCodester Online Art Gallery Management System adminHome.php unrestricted upload (medium 5.3)
- [CVE-2024-4945](https://insights.sbomify.com/CVE-2024-4945/): SourceCodester Best Courier Management System view_parcel.php unrestricted upload (medium 5.3)
- [CVE-2024-4944](https://insights.sbomify.com/CVE-2024-4944/): Mobile VPN with SSL Local Privilege Escalation Vulnerability (high 8.6)
- [CVE-2024-4943](https://insights.sbomify.com/CVE-2024-4943/): Blocksy <= 2.0.46 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-49422](https://insights.sbomify.com/CVE-2024-49422/): Security feature bypass in Samsung Mobile Devices (medium 5.2)
- [CVE-2024-49421](https://insights.sbomify.com/CVE-2024-49421/): Path traversal in Quick Share Agent (medium 4.3)
- [CVE-2024-49420](https://insights.sbomify.com/CVE-2024-49420/): Other in GamingHub (high 7.5)
- [CVE-2024-4942](https://insights.sbomify.com/CVE-2024-4942/): Custom Dash <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-49419](https://insights.sbomify.com/CVE-2024-49419/): Security feature bypass in GamingHub (medium 4.3)
- [CVE-2024-49418](https://insights.sbomify.com/CVE-2024-49418/): Security feature bypass in GamingHub (medium 6.5)
- [CVE-2024-49417](https://insights.sbomify.com/CVE-2024-49417/): Privilege escalation in Smart Touch Call (low 2.0)
- [CVE-2024-49416](https://insights.sbomify.com/CVE-2024-49416/): Information disclosure in SmartThings (medium 4.0)
- [CVE-2024-49415](https://insights.sbomify.com/CVE-2024-49415/): Memory corruption in Samsung Mobile Devices (high 8.1)
- [CVE-2024-49414](https://insights.sbomify.com/CVE-2024-49414/): Auth bypass in Samsung Mobile Devices (low 2.4)
- [CVE-2024-49413](https://insights.sbomify.com/CVE-2024-49413/): Security feature bypass in Samsung Mobile Devices (high 7.1)
- [CVE-2024-49412](https://insights.sbomify.com/CVE-2024-49412/): Other in Samsung Mobile Devices (medium 5.5)
- [CVE-2024-49411](https://insights.sbomify.com/CVE-2024-49411/): Path traversal in Samsung Mobile Devices (medium 4.3)
- [CVE-2024-49410](https://insights.sbomify.com/CVE-2024-49410/): Memory corruption in Samsung Mobile Devices (medium 5.9)
- [CVE-2024-4941](https://insights.sbomify.com/CVE-2024-4941/): Local File Inclusion in JSON component in gradio-app/gradio (high 7.5)
- [CVE-2024-49409](https://insights.sbomify.com/CVE-2024-49409/): Memory corruption in Samsung Mobile Devices (medium 6.4)
- [CVE-2024-49408](https://insights.sbomify.com/CVE-2024-49408/): Memory corruption in Samsung Mobile Devices (medium 6.4)
- [CVE-2024-49407](https://insights.sbomify.com/CVE-2024-49407/): Missing authorization in Samsung Flow (medium 4.6)
- [CVE-2024-49406](https://insights.sbomify.com/CVE-2024-49406/): Security feature bypass in Blockchain Keystore (medium 6.7)
- [CVE-2024-49405](https://insights.sbomify.com/CVE-2024-49405/): Auth bypass in Samsung Pass (medium 5.3)
- [CVE-2024-49404](https://insights.sbomify.com/CVE-2024-49404/): Missing authorization in Samsung Video Player (medium 5.5)
- [CVE-2024-49403](https://insights.sbomify.com/CVE-2024-49403/): Missing authorization in Samsung Voice Recorder (medium 4.6)
- [CVE-2024-49402](https://insights.sbomify.com/CVE-2024-49402/): Information disclosure in Samsung Mobile Devices (medium 4.6)
- [CVE-2024-49401](https://insights.sbomify.com/CVE-2024-49401/): Privilege escalation in Samsung Mobile Devices (medium 5.1)
- [CVE-2024-49400](https://insights.sbomify.com/CVE-2024-49400/): Security feature bypass in Tacquito (critical 9.8)
- [CVE-2024-4940](https://insights.sbomify.com/CVE-2024-4940/): Open Redirect in gradio-app/gradio (medium 5.4)
- [CVE-2024-49399](https://insights.sbomify.com/CVE-2024-49399/): Missing Authentication for Critical Function in Elvaco M-Bus Metering Gateway CMe3100 (high 8.7)
- [CVE-2024-49398](https://insights.sbomify.com/CVE-2024-49398/): Unrestricted Upload of File with Dangerous Type in Elvaco M-Bus Metering Gateway CMe3100 (high 8.8)
- [CVE-2024-49397](https://insights.sbomify.com/CVE-2024-49397/): Cross-site Scripting in Elvaco M-Bus Metering Gateway CMe3100 (critical 9.2)
- [CVE-2024-49396](https://insights.sbomify.com/CVE-2024-49396/): Insufficiently Protected Credentials in Elvaco M-Bus Metering Gateway CMe3100 (high 8.7)
- [CVE-2024-49395](https://insights.sbomify.com/CVE-2024-49395/): Mutt: neomutt: bcc email header field is indirectly leaked by cryptographic info block (medium 5.3)
- [CVE-2024-49394](https://insights.sbomify.com/CVE-2024-49394/): Mutt: neomutt: in-reply-to email header field it not protected by cryptograpic signing (medium 5.3)
- [CVE-2024-49393](https://insights.sbomify.com/CVE-2024-49393/): Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing (medium 6.5)
- [CVE-2024-49392](https://insights.sbomify.com/CVE-2024-49392/): Cross-site scripting in Acronis Cyber Files (medium 5.7)
- [CVE-2024-49391](https://insights.sbomify.com/CVE-2024-49391/): Privilege escalation in Acronis Cyber Files (medium 6.7)
- [CVE-2024-49390](https://insights.sbomify.com/CVE-2024-49390/): Privilege escalation in Acronis Cyber Files (high 7.3)
- [CVE-2024-4939](https://insights.sbomify.com/CVE-2024-4939/): Weaver Xtreme Theme Support <= 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via div Shortcode (medium 6.4)
- [CVE-2024-49389](https://insights.sbomify.com/CVE-2024-49389/): Privilege escalation in Acronis Cyber Files (high 7.8)
- [CVE-2024-49388](https://insights.sbomify.com/CVE-2024-49388/): Missing authorization in Acronis Cyber Protect 16 (low 3.1)
- [CVE-2024-49387](https://insights.sbomify.com/CVE-2024-49387/): Information disclosure in Acronis Cyber Protect 16 (medium 5.4)
- [CVE-2024-49386](https://insights.sbomify.com/CVE-2024-49386/): Information disclosure in Acronis Cyber Files (medium 5.7)
- [CVE-2024-49385](https://insights.sbomify.com/CVE-2024-49385/): Misconfiguration in Acronis True Image (medium 5.5)
- [CVE-2024-49384](https://insights.sbomify.com/CVE-2024-49384/): Misconfiguration in Acronis Cyber Protect 16 (low 3.5)
- [CVE-2024-49383](https://insights.sbomify.com/CVE-2024-49383/): Misconfiguration in Acronis Cyber Protect 16 (low 3.5)
- [CVE-2024-49382](https://insights.sbomify.com/CVE-2024-49382/): Misconfiguration in Acronis Cyber Protect 16 (low 3.5)
- [CVE-2024-49381](https://insights.sbomify.com/CVE-2024-49381/): Plenti arbitrary file deletion vulnerability (high 7.7)
- [CVE-2024-49380](https://insights.sbomify.com/CVE-2024-49380/): Plenti arbitrary file write vulnerability (high 8.9)
- [CVE-2024-49379](https://insights.sbomify.com/CVE-2024-49379/): Remote Code Execution (RCE) via Cross-Site Scripting (XSS) in Umbrel (medium 5.3)
- [CVE-2024-49378](https://insights.sbomify.com/CVE-2024-49378/): smartUp Cross-site Scripting vulnerability (medium 5.8)
- [CVE-2024-49377](https://insights.sbomify.com/CVE-2024-49377/): Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrint (medium 5.5)
- [CVE-2024-49376](https://insights.sbomify.com/CVE-2024-49376/): Autolab Has Misconfigured Reset Password Permissions (high 7.1)
- [CVE-2024-49375](https://insights.sbomify.com/CVE-2024-49375/): Remote Code Execution via Remote Model Loading in Rasa (critical 9.1)
- [CVE-2024-49373](https://insights.sbomify.com/CVE-2024-49373/): Centurion ERP user can view projects from organizations they're not apart of (medium 4.1)
- [CVE-2024-49370](https://insights.sbomify.com/CVE-2024-49370/): Change-Password via Portal-Profile sets PimcoreBackendUser password without hashing (high 8.7)
- [CVE-2024-49369](https://insights.sbomify.com/CVE-2024-49369/): Icinga 2 has a TLS Certificate Validation Bypass for JSON-RPC and HTTP API Connections (critical 9.8)
- [CVE-2024-49368](https://insights.sbomify.com/CVE-2024-49368/): Unchecked logrotate settings lead to arbitrary command execution (high 8.9)
- [CVE-2024-49367](https://insights.sbomify.com/CVE-2024-49367/): Nginx UI's log path can be controlled (medium 5.5)
- [CVE-2024-49366](https://insights.sbomify.com/CVE-2024-49366/): Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written (high 7.7)
- [CVE-2024-49365](https://insights.sbomify.com/CVE-2024-49365/): tiny-secp256k1 allows for verify() bypass when running in bundled environment (high 8.1)
- [CVE-2024-49364](https://insights.sbomify.com/CVE-2024-49364/): tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment (high 8.1)
- [CVE-2024-49363](https://insights.sbomify.com/CVE-2024-49363/): Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey (high 7.4)
- [CVE-2024-49362](https://insights.sbomify.com/CVE-2024-49362/): Remote Code Execution on click of <a> Link in markdown preview (high 7.7)
- [CVE-2024-49361](https://insights.sbomify.com/CVE-2024-49361/): Potential Vulnerability in ACON Library: Improper Input Validation Leading to Malicious Code Execution (high 8.1)
- [CVE-2024-49360](https://insights.sbomify.com/CVE-2024-49360/): Path traversal in Sandboxie (critical 9.2)
- [CVE-2024-4936](https://insights.sbomify.com/CVE-2024-4936/): Canto <= 3.0.8 - Unauthenticated Remote File Inclusion (critical 9.8)
- [CVE-2024-49359](https://insights.sbomify.com/CVE-2024-49359/): ZimaOS vulnerable to Directory Listing via Parameter Manipulation (high 7.5)
- [CVE-2024-49358](https://insights.sbomify.com/CVE-2024-49358/): ZimaOS vulnerable to Username Enumeration via API Responses (medium 5.3)
- [CVE-2024-49357](https://insights.sbomify.com/CVE-2024-49357/): ZimaOS (Installed Applications and System Information) has Unauthorized Sensitive Data Leak (high 7.5)
- [CVE-2024-49355](https://insights.sbomify.com/CVE-2024-49355/): IBM OpenPages log manipulation (medium 5.3)
- [CVE-2024-49354](https://insights.sbomify.com/CVE-2024-49354/): IBM Concert information disclosure (medium 5.3)
- [CVE-2024-49353](https://insights.sbomify.com/CVE-2024-49353/): IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data denial of service (high 7.5)
- [CVE-2024-49352](https://insights.sbomify.com/CVE-2024-49352/): IBM Cognos Anaytics XML external entity injection (high 7.1)
- [CVE-2024-49351](https://insights.sbomify.com/CVE-2024-49351/): IBM Workload Scheduler information disclosure (medium 5.5)
- [CVE-2024-49350](https://insights.sbomify.com/CVE-2024-49350/): IBM Db2 denial of service (medium 6.5)
- [CVE-2024-49349](https://insights.sbomify.com/CVE-2024-49349/): IBM Financial Transaction Manager cross-site scripting (medium 6.1)
- [CVE-2024-49348](https://insights.sbomify.com/CVE-2024-49348/): IBM Cloud Pak for Business Automation incorrect privilege assignment (medium 4.3)
- [CVE-2024-49344](https://insights.sbomify.com/CVE-2024-49344/): IBM OpenPages session fixation (medium 4.3)
- [CVE-2024-49343](https://insights.sbomify.com/CVE-2024-49343/): IBM Informix Dynamic Server HTML injection (medium 5.4)
- [CVE-2024-49342](https://insights.sbomify.com/CVE-2024-49342/): IBM Informix Dynamic Server information disclosure (high 7.5)
- [CVE-2024-49340](https://insights.sbomify.com/CVE-2024-49340/): IBM Watson Studio Local cross-site request forgery (medium 4.3)
- [CVE-2024-4934](https://insights.sbomify.com/CVE-2024-4934/): Quiz And Survey Master < 9.0.2 - Contributor+ Stored XSS (medium 5.5)
- [CVE-2024-49339](https://insights.sbomify.com/CVE-2024-49339/): IBM Financial Transaction Manager cross-site scripting (medium 6.4)
- [CVE-2024-49338](https://insights.sbomify.com/CVE-2024-49338/): IBM App Connect Enterprise information disclosure (medium 4.4)
- [CVE-2024-49337](https://insights.sbomify.com/CVE-2024-49337/): IBM OpenPages HTML injection (medium 5.4)
- [CVE-2024-49336](https://insights.sbomify.com/CVE-2024-49336/): IBM Security Guardium server-side request forgery (medium 6.5)
- [CVE-2024-49335](https://insights.sbomify.com/CVE-2024-49335/): WordPress GoogleDrive folder list plugin <= 2.2.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49334](https://insights.sbomify.com/CVE-2024-49334/): WordPress jLayer Parallax Slider plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49333](https://insights.sbomify.com/CVE-2024-49333/): WordPress Hero Menu plugin <= 1.16.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-49332](https://insights.sbomify.com/CVE-2024-49332/): WordPress Giveaway Boost plugin <= 2.1.4 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-49331](https://insights.sbomify.com/CVE-2024-49331/): WordPress Property Lot Management System plugin <= 4.2.38 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-49330](https://insights.sbomify.com/CVE-2024-49330/): WordPress Nice Backgrounds plugin <= 1.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-4933](https://insights.sbomify.com/CVE-2024-4933/): SourceCodester Simple Online Bidding System sql injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/238/