# Vulnerabilities published in 2024


- [CVE-2024-47491](https://insights.sbomify.com/CVE-2024-47491/): Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP path attribute leads to an RPD crash (high 8.2)
- [CVE-2024-47490](https://insights.sbomify.com/CVE-2024-47490/): Junos OS Evolved: ACX 7000 Series: Receipt of specific transit MPLS packets causes resources to be exhausted (high 7.7)
- [CVE-2024-4749](https://insights.sbomify.com/CVE-2024-4749/): WP eMember < 10.3.9 - Reflected XSS (high 8.3)
- [CVE-2024-47489](https://insights.sbomify.com/CVE-2024-47489/): Junos OS Evolved: ACX Series: Receipt of specific transit protocol packets is incorrectly processed by the RE (medium 6.9)
- [CVE-2024-47487](https://insights.sbomify.com/CVE-2024-47487/): SQL injection in HikCentral Professional (high 7.2)
- [CVE-2024-47486](https://insights.sbomify.com/CVE-2024-47486/): Cross-site scripting in HikCentral Master Lite (low 2.1)
- [CVE-2024-47485](https://insights.sbomify.com/CVE-2024-47485/): Code injection in HikCentral Master Lite (medium 5.5)
- [CVE-2024-47484](https://insights.sbomify.com/CVE-2024-47484/): SQL injection in Avamar (high 8.2)
- [CVE-2024-47483](https://insights.sbomify.com/CVE-2024-47483/): SQL injection in Data Lakehouse (low 2.9)
- [CVE-2024-47481](https://insights.sbomify.com/CVE-2024-47481/): Missing authorization in Dell Data Lakehouse (medium 6.5)
- [CVE-2024-47480](https://insights.sbomify.com/CVE-2024-47480/): Privilege escalation in Inventory Collector Client (high 7.8)
- [CVE-2024-4748](https://insights.sbomify.com/CVE-2024-4748/): RCE in Cruddiy (high 8.8)
- [CVE-2024-47477](https://insights.sbomify.com/CVE-2024-47477/): Security feature bypass in PowerFlex Manager (medium 6.5)
- [CVE-2024-47476](https://insights.sbomify.com/CVE-2024-47476/): Security feature bypass in NetWorker Management Console (high 7.8)
- [CVE-2024-47475](https://insights.sbomify.com/CVE-2024-47475/): Misconfiguration in PowerScale OneFS (medium 5.0)
- [CVE-2024-4747](https://insights.sbomify.com/CVE-2024-4747/): WordPress Propovoice CRM plugin <= 1.7.6.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47464](https://insights.sbomify.com/CVE-2024-47464/): Authenticated Path Traversal Vulnerability Leads to a Remote Unauthorized Access to Files (medium 6.8)
- [CVE-2024-47463](https://insights.sbomify.com/CVE-2024-47463/): Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE) (high 7.2)
- [CVE-2024-47462](https://insights.sbomify.com/CVE-2024-47462/): Arbitrary File Creation Vulnerability in Instant AOS-8 and AOS-10 leads to Authenticated Remote Command Execution (RCE) (high 7.2)
- [CVE-2024-47461](https://insights.sbomify.com/CVE-2024-47461/): Authenticated Arbitrary Remote Command Execution (RCE) in Instant AOS-8 and AOS-10 (high 7.2)
- [CVE-2024-47460](https://insights.sbomify.com/CVE-2024-47460/): Unauthenticated Command Injection Vulnerability in the CLI Service Accessed by the PAPI Protocol (critical 9.0)
- [CVE-2024-4746](https://insights.sbomify.com/CVE-2024-4746/): WordPress Netgsm plugin <= 2.9.32 - Broken Access Control + CSRF vulnerability (medium 4.3)
- [CVE-2024-47459](https://insights.sbomify.com/CVE-2024-47459/): Substance3D - Sampler | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-47458](https://insights.sbomify.com/CVE-2024-47458/): Bridge | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-47457](https://insights.sbomify.com/CVE-2024-47457/): Illustrator | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-47456](https://insights.sbomify.com/CVE-2024-47456/): Illustrator | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47455](https://insights.sbomify.com/CVE-2024-47455/): Illustrator | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47454](https://insights.sbomify.com/CVE-2024-47454/): Illustrator | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47453](https://insights.sbomify.com/CVE-2024-47453/): Illustrator | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47452](https://insights.sbomify.com/CVE-2024-47452/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47451](https://insights.sbomify.com/CVE-2024-47451/): Illustrator | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47450](https://insights.sbomify.com/CVE-2024-47450/): Illustrator | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-4745](https://insights.sbomify.com/CVE-2024-4745/): WordPress Giveaways and Contests by RafflePress plugin <= 1.12.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-47449](https://insights.sbomify.com/CVE-2024-47449/): Audition | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47446](https://insights.sbomify.com/CVE-2024-47446/): After Effects | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47445](https://insights.sbomify.com/CVE-2024-47445/): After Effects | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47444](https://insights.sbomify.com/CVE-2024-47444/): After Effects | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47443](https://insights.sbomify.com/CVE-2024-47443/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47442](https://insights.sbomify.com/CVE-2024-47442/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47441](https://insights.sbomify.com/CVE-2024-47441/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47440](https://insights.sbomify.com/CVE-2024-47440/): Substance3D - Painter | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-4744](https://insights.sbomify.com/CVE-2024-4744/): WordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-47439](https://insights.sbomify.com/CVE-2024-47439/): Substance3D - Painter | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-47438](https://insights.sbomify.com/CVE-2024-47438/): Substance3D - Painter | Write-what-where Condition (CWE-123) (medium 5.5)
- [CVE-2024-47437](https://insights.sbomify.com/CVE-2024-47437/): Substance3D - Painter | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47436](https://insights.sbomify.com/CVE-2024-47436/): Substance3D - Painter | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47435](https://insights.sbomify.com/CVE-2024-47435/): Substance3D - Painter | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47434](https://insights.sbomify.com/CVE-2024-47434/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47433](https://insights.sbomify.com/CVE-2024-47433/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47432](https://insights.sbomify.com/CVE-2024-47432/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47431](https://insights.sbomify.com/CVE-2024-47431/): Substance3D - Painter | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-47430](https://insights.sbomify.com/CVE-2024-47430/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-4743](https://insights.sbomify.com/CVE-2024-4743/): LifterLMS – WordPress LMS Plugin for eLearning <= 7.6.2 - Authenticated (Contributor+) SQL Injection via Shortcode (high 8.8)
- [CVE-2024-47429](https://insights.sbomify.com/CVE-2024-47429/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47428](https://insights.sbomify.com/CVE-2024-47428/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47427](https://insights.sbomify.com/CVE-2024-47427/): Substance3D - Painter | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-47426](https://insights.sbomify.com/CVE-2024-47426/): Substance3D - Painter | Double Free (CWE-415) (high 7.8)
- [CVE-2024-47425](https://insights.sbomify.com/CVE-2024-47425/): Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-47424](https://insights.sbomify.com/CVE-2024-47424/): Adobe Framemaker | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2024-47423](https://insights.sbomify.com/CVE-2024-47423/): Adobe Framemaker | Unrestricted Upload of File with Dangerous Type (CWE-434) (high 7.8)
- [CVE-2024-47422](https://insights.sbomify.com/CVE-2024-47422/): Adobe Framemaker | Untrusted Search Path (CWE-426) (high 7.8)
- [CVE-2024-47421](https://insights.sbomify.com/CVE-2024-47421/): Adobe Framemaker | Out-of-bounds Read (CWE-125) (high 7.8)
- [CVE-2024-47420](https://insights.sbomify.com/CVE-2024-47420/): Animate | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-4742](https://insights.sbomify.com/CVE-2024-4742/): SQL injection in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress (medium 6.5)
- [CVE-2024-47419](https://insights.sbomify.com/CVE-2024-47419/): Animate | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-47418](https://insights.sbomify.com/CVE-2024-47418/): Animate | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-47417](https://insights.sbomify.com/CVE-2024-47417/): Animate | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-47416](https://insights.sbomify.com/CVE-2024-47416/): Animate | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2024-47415](https://insights.sbomify.com/CVE-2024-47415/): Animate | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-47414](https://insights.sbomify.com/CVE-2024-47414/): Animate | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-47413](https://insights.sbomify.com/CVE-2024-47413/): Animate | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-47412](https://insights.sbomify.com/CVE-2024-47412/): Animate | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-47411](https://insights.sbomify.com/CVE-2024-47411/): Animate | Access of Uninitialized Pointer (CWE-824) (high 7.8)
- [CVE-2024-47410](https://insights.sbomify.com/CVE-2024-47410/): Animate | Stack-based Buffer Overflow (CWE-121) (high 7.8)
- [CVE-2024-4741](https://insights.sbomify.com/CVE-2024-4741/): Use After Free with SSL_free_buffers (high 7.5)
- [CVE-2024-47408](https://insights.sbomify.com/CVE-2024-47408/): net/smc: check smcd_v2_ext_offset when receiving proposal msg (critical 9.8)
- [CVE-2024-47407](https://insights.sbomify.com/CVE-2024-47407/): mySCADA myPRO OS Command Injection (critical 10.0)
- [CVE-2024-47406](https://insights.sbomify.com/CVE-2024-47406/): Auth bypass in Sharp Digital Full-color MFPs and Monochrome MFPs (critical 9.1)
- [CVE-2024-47404](https://insights.sbomify.com/CVE-2024-47404/): Liteos_a has a double free vulnerability (high 8.4)
- [CVE-2024-47402](https://insights.sbomify.com/CVE-2024-47402/): Liteos_a has an Out-of-bounds Read vulnerability (low 3.3)
- [CVE-2024-47401](https://insights.sbomify.com/CVE-2024-47401/): DoS via Amplified GraphQL Response in Playbooks (medium 4.3)
- [CVE-2024-4740](https://insights.sbomify.com/CVE-2024-4740/): MXsecurity Use of Hard-coded Credentials (medium 5.3)
- [CVE-2024-47398](https://insights.sbomify.com/CVE-2024-47398/): Liteos_a has an out-of-bounds write vulnerability (high 8.8)
- [CVE-2024-47397](https://insights.sbomify.com/CVE-2024-47397/): Auth bypass in AE1021 (high 7.5)
- [CVE-2024-47396](https://insights.sbomify.com/CVE-2024-47396/): WordPress Move Addons for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47395](https://insights.sbomify.com/CVE-2024-47395/): Cross-site scripting in Robokassa payment gateway for Woocommerce (high 7.1)
- [CVE-2024-47394](https://insights.sbomify.com/CVE-2024-47394/): WordPress WP JobSearch plugin <= 2.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47393](https://insights.sbomify.com/CVE-2024-47393/): WordPress Quill Forms plugin <= 3.7.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47392](https://insights.sbomify.com/CVE-2024-47392/): WordPress Element Pack Elementor Addons plugin <= 5.7.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47391](https://insights.sbomify.com/CVE-2024-47391/): WordPress Bold Page Builder plugin < 5.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47390](https://insights.sbomify.com/CVE-2024-47390/): WordPress Jeg Elementor Kit plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4739](https://insights.sbomify.com/CVE-2024-4739/): MXsecurity License Generation Function Disclosure (medium 5.3)
- [CVE-2024-47389](https://insights.sbomify.com/CVE-2024-47389/): WordPress NEX-Forms plugin <= 8.7.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47388](https://insights.sbomify.com/CVE-2024-47388/): WordPress SliceWP Affiliates plugin <= 1.1.18 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47387](https://insights.sbomify.com/CVE-2024-47387/): WordPress Search Atlas SEO plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47386](https://insights.sbomify.com/CVE-2024-47386/): WordPress WP Extended plugin <= 3.0.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47385](https://insights.sbomify.com/CVE-2024-47385/): WordPress Essential Blocks plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-47384](https://insights.sbomify.com/CVE-2024-47384/): WordPress WP Compress plugin <= 6.20.13 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-47383](https://insights.sbomify.com/CVE-2024-47383/): WordPress The Pack Elementor addons plugin 2.0.8.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-47382](https://insights.sbomify.com/CVE-2024-47382/): WordPress Page-list plugin <= 5.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/252/