# Vulnerabilities published in 2024


- [CVE-2024-47049](https://insights.sbomify.com/CVE-2024-47049/): czim/file-handling vulnerable to SSRF and directory traversal (high 8.2)
- [CVE-2024-47048](https://insights.sbomify.com/CVE-2024-47048/): Cross-site scripting in rocket.chat:rocket.chat (medium 5.4)
- [CVE-2024-47047](https://insights.sbomify.com/CVE-2024-47047/): powermail TYPO3 extension has Insecure Direct Object Reference (high 7.5)
- [CVE-2024-47046](https://insights.sbomify.com/CVE-2024-47046/): Memory corruption in Simcenter Femap V2306 (high 7.3)
- [CVE-2024-47045](https://insights.sbomify.com/CVE-2024-47045/): Privilege escalation in The installer of e-Tax software(common program) (high 7.8)
- [CVE-2024-47044](https://insights.sbomify.com/CVE-2024-47044/): Missing authorization in Hikari Denwa router PR-400MI (medium 5.3)
- [CVE-2024-47043](https://insights.sbomify.com/CVE-2024-47043/): Ruijie Reyee OS Insecure Storage of Sensitive Information (high 8.7)
- [CVE-2024-47041](https://insights.sbomify.com/CVE-2024-47041/): Memory corruption in Android (high 7.4)
- [CVE-2024-47040](https://insights.sbomify.com/CVE-2024-47040/): Use After Free in the android.hardware.radio.sap.ISap/slot2 service (critical 10.0)
- [CVE-2024-4704](https://insights.sbomify.com/CVE-2024-4704/): Contact Form 7 < 5.9.5 - Unauthenticated Open Redirect (medium 6.1)
- [CVE-2024-47039](https://insights.sbomify.com/CVE-2024-47039/): OOB Read in the android.hardware.boot.IBootControl/default service (critical 10.0)
- [CVE-2024-47038](https://insights.sbomify.com/CVE-2024-47038/): Memory corruption in Android (critical 10.0)
- [CVE-2024-47035](https://insights.sbomify.com/CVE-2024-47035/): Memory corruption in Android (high 7.4)
- [CVE-2024-47034](https://insights.sbomify.com/CVE-2024-47034/): Memory corruption in Android (medium 5.1)
- [CVE-2024-47033](https://insights.sbomify.com/CVE-2024-47033/): Use after free in Android (high 7.4)
- [CVE-2024-47032](https://insights.sbomify.com/CVE-2024-47032/): Memory corruption in Android (high 7.8)
- [CVE-2024-47031](https://insights.sbomify.com/CVE-2024-47031/): Privilege escalation in Android (high 7.4)
- [CVE-2024-47030](https://insights.sbomify.com/CVE-2024-47030/): Information disclosure in Android (medium 5.1)
- [CVE-2024-4703](https://insights.sbomify.com/CVE-2024-4703/): Cross-site scripting in One Page Express Companion (medium 6.4)
- [CVE-2024-47029](https://insights.sbomify.com/CVE-2024-47029/): Memory corruption in Android (medium 5.1)
- [CVE-2024-47028](https://insights.sbomify.com/CVE-2024-47028/): Integer overflow in Android (medium 5.1)
- [CVE-2024-47027](https://insights.sbomify.com/CVE-2024-47027/): Memory corruption in Android (high 7.4)
- [CVE-2024-47026](https://insights.sbomify.com/CVE-2024-47026/): Memory corruption in Android (medium 5.1)
- [CVE-2024-47025](https://insights.sbomify.com/CVE-2024-47025/): Information disclosure in Android (medium 5.1)
- [CVE-2024-47024](https://insights.sbomify.com/CVE-2024-47024/): Integer overflow in Android (high 7.4)
- [CVE-2024-47023](https://insights.sbomify.com/CVE-2024-47023/): Business logic in Android (high 7.4)
- [CVE-2024-47022](https://insights.sbomify.com/CVE-2024-47022/): Information disclosure in Android (medium 5.1)
- [CVE-2024-47021](https://insights.sbomify.com/CVE-2024-47021/): Memory corruption in Android (medium 5.1)
- [CVE-2024-47020](https://insights.sbomify.com/CVE-2024-47020/): Information disclosure in Android (medium 5.1)
- [CVE-2024-4702](https://insights.sbomify.com/CVE-2024-4702/): Mega Elements <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (medium 6.4)
- [CVE-2024-47019](https://insights.sbomify.com/CVE-2024-47019/): Memory corruption in Android (medium 5.5)
- [CVE-2024-47018](https://insights.sbomify.com/CVE-2024-47018/): Memory corruption in Android (medium 5.5)
- [CVE-2024-47017](https://insights.sbomify.com/CVE-2024-47017/): Use after free in Android (high 7.8)
- [CVE-2024-47016](https://insights.sbomify.com/CVE-2024-47016/): Misconfiguration in Android (high 7.8)
- [CVE-2024-47015](https://insights.sbomify.com/CVE-2024-47015/): Memory corruption in Android (medium 5.5)
- [CVE-2024-47014](https://insights.sbomify.com/CVE-2024-47014/): Privilege escalation in Android (high 8.8)
- [CVE-2024-47013](https://insights.sbomify.com/CVE-2024-47013/): Memory corruption in Android (high 7.8)
- [CVE-2024-47012](https://insights.sbomify.com/CVE-2024-47012/): Memory corruption in Android (high 7.8)
- [CVE-2024-47011](https://insights.sbomify.com/CVE-2024-47011/): Path traversal in Avalanche (high 7.5)
- [CVE-2024-47010](https://insights.sbomify.com/CVE-2024-47010/): Auth bypass in Avalanche (high 7.3)
- [CVE-2024-4701](https://insights.sbomify.com/CVE-2024-4701/): Path Traversal vulnerability via File Uploads in Genie (critical 9.9)
- [CVE-2024-47009](https://insights.sbomify.com/CVE-2024-47009/): Auth bypass in Avalanche (high 7.3)
- [CVE-2024-47008](https://insights.sbomify.com/CVE-2024-47008/): Server-side request forgery in Avalanche (high 7.5)
- [CVE-2024-47007](https://insights.sbomify.com/CVE-2024-47007/): Null dereference in Avalanche (high 7.5)
- [CVE-2024-47006](https://insights.sbomify.com/CVE-2024-47006/): Privilege escalation in Intel(R) RealSense D400 Series (medium 5.4)
- [CVE-2024-47005](https://insights.sbomify.com/CVE-2024-47005/): Missing authorization in Sharp Digital Full-color MFPs and Monochrome MFPs (high 8.1)
- [CVE-2024-47003](https://insights.sbomify.com/CVE-2024-47003/): DoS via non-string message using permalink embed (low 3.1)
- [CVE-2024-47002](https://insights.sbomify.com/CVE-2024-47002/): Cross-site scripting in Observium (high 8.7)
- [CVE-2024-47001](https://insights.sbomify.com/CVE-2024-47001/): Command injection in AHD04T-A (high 8.8)
- [CVE-2024-47000](https://insights.sbomify.com/CVE-2024-47000/): Service Users Deactivation not Working in Zitadel (high 8.1)
- [CVE-2024-4700](https://insights.sbomify.com/CVE-2024-4700/): WP Table Builder – WordPress Table Plugin <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-46999](https://insights.sbomify.com/CVE-2024-46999/): User Grant Deactivation not Working in Zitadel (high 7.3)
- [CVE-2024-46998](https://insights.sbomify.com/CVE-2024-46998/): baserCMS has a Cross-site Scripting (XSS) Vulnerability in Edit Email Form Settings Feature (high 7.1)
- [CVE-2024-46997](https://insights.sbomify.com/CVE-2024-46997/): DataEase's H2 datasource has a remote command execution risk (critical 9.8)
- [CVE-2024-46996](https://insights.sbomify.com/CVE-2024-46996/): baserCMS has a Cross-site Scripting (XSS) Vulnerability in Blog posts Feature (medium 6.3)
- [CVE-2024-46995](https://insights.sbomify.com/CVE-2024-46995/): baserCMS has Cross-site Scripting Vulnerability in HTTP 400 Bad Request (medium 6.1)
- [CVE-2024-46994](https://insights.sbomify.com/CVE-2024-46994/): baserCMS has Cross-site Scripting Vulnerability in Blog posts and Contents list Feature (medium 5.4)
- [CVE-2024-46993](https://insights.sbomify.com/CVE-2024-46993/): Electron Vulnerable to Heap Buffer Overflow in NativeImage::CreateFromPath (medium 4.4)
- [CVE-2024-46992](https://insights.sbomify.com/CVE-2024-46992/): Electron ASAR Integrity bypass by just modifying the content (high 7.8)
- [CVE-2024-46990](https://insights.sbomify.com/CVE-2024-46990/): SSRF Loopback IP filter bypass in directus (medium 5.0)
- [CVE-2024-4699](https://insights.sbomify.com/CVE-2024-4699/): D-Link DAR-8000-10 importhtml.php deserialization (medium 5.3)
- [CVE-2024-46989](https://insights.sbomify.com/CVE-2024-46989/): Multiple caveats on resources of the same type can result in no permission when permission is expected (low 3.7)
- [CVE-2024-46988](https://insights.sbomify.com/CVE-2024-46988/): Tuleap does not properly check permissions for email notifications in trackers (medium 4.8)
- [CVE-2024-46987](https://insights.sbomify.com/CVE-2024-46987/): Arbitrary path traversal in Camaleon CMS (high 7.7)
- [CVE-2024-46986](https://insights.sbomify.com/CVE-2024-46986/): Arbitrary file write leading to RCE in Camaleon CMS (critical 10.0)
- [CVE-2024-46985](https://insights.sbomify.com/CVE-2024-46985/): DataEase has an XXE vulnerability (high 7.5)
- [CVE-2024-46984](https://insights.sbomify.com/CVE-2024-46984/): Gematik Referenzvalidator has an XXE vulnerability that can lead to a Server Side Request Forgery attack (high 8.6)
- [CVE-2024-46983](https://insights.sbomify.com/CVE-2024-46983/): Remote Command Execution(RCE) Vulnerbility in sofa-hessian (critical 9.8)
- [CVE-2024-46982](https://insights.sbomify.com/CVE-2024-46982/): Cache Poisoning in next.js (high 7.5)
- [CVE-2024-46981](https://insights.sbomify.com/CVE-2024-46981/): Redis' Lua library commands may lead to remote code execution (high 7.0)
- [CVE-2024-46980](https://insights.sbomify.com/CVE-2024-46980/): Tuleap vulnerable to XSS in the HTML mail content of the cross reference field (medium 4.8)
- [CVE-2024-4698](https://insights.sbomify.com/CVE-2024-4698/): Testimonial Carousel For Elementor <= 10.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-46979](https://insights.sbomify.com/CVE-2024-46979/): Data leak of notification filters of users in XWiki Platform (medium 5.3)
- [CVE-2024-46978](https://insights.sbomify.com/CVE-2024-46978/): Missing checks for notification filter preferences editions in XWiki Platform (medium 6.5)
- [CVE-2024-46977](https://insights.sbomify.com/CVE-2024-46977/): OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`) (medium 5.3)
- [CVE-2024-46976](https://insights.sbomify.com/CVE-2024-46976/): Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend (medium 6.5)
- [CVE-2024-46975](https://insights.sbomify.com/CVE-2024-46975/): GPU DDK - rgxfw_write_robustness_buffer allows arbitrary catreg set mapping (high 7.9)
- [CVE-2024-46974](https://insights.sbomify.com/CVE-2024-46974/): GPU DDK - Arbitrary write of read-only dmabuf (high 7.8)
- [CVE-2024-46973](https://insights.sbomify.com/CVE-2024-46973/): Exploitable kernel use-after-free on psServerMMUContext due to reference count mismanagement (high 7.8)
- [CVE-2024-46972](https://insights.sbomify.com/CVE-2024-46972/): GPU DDK - Security: Reference count overflow in pvr_sync_rollback_export_fence (high 7.8)
- [CVE-2024-46971](https://insights.sbomify.com/CVE-2024-46971/): GPU DDK - UAF of memory in PMRUnlockSysPhysAddressesLocalMem for on-demand PMRs on PCI (LMA) systems (high 7.8)
- [CVE-2024-46970](https://insights.sbomify.com/CVE-2024-46970/): Cross-site scripting in IntelliJ IDEA (low 3.3)
- [CVE-2024-4697](https://insights.sbomify.com/CVE-2024-4697/): Cross-site scripting in Cowidgets – Elementor Addons (medium 6.4)
- [CVE-2024-46966](https://insights.sbomify.com/CVE-2024-46966/): The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbit (high 8.1)
- [CVE-2024-46965](https://insights.sbomify.com/CVE-2024-46965/): The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execut (medium 5.4)
- [CVE-2024-46964](https://insights.sbomify.com/CVE-2024-46964/): The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaSc (high 8.1)
- [CVE-2024-46963](https://insights.sbomify.com/CVE-2024-46963/): The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attac (high 8.1)
- [CVE-2024-46962](https://insights.sbomify.com/CVE-2024-46962/): The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary (critical 9.1)
- [CVE-2024-46961](https://insights.sbomify.com/CVE-2024-46961/): The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to ex (high 8.1)
- [CVE-2024-46960](https://insights.sbomify.com/CVE-2024-46960/): The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execut (high 8.8)
- [CVE-2024-4696](https://insights.sbomify.com/CVE-2024-4696/): Command injection in Service Bridge (high 7.5)
- [CVE-2024-46959](https://insights.sbomify.com/CVE-2024-46959/): runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. (medium 6.5)
- [CVE-2024-46958](https://insights.sbomify.com/CVE-2024-46958/): Misconfiguration in nextcloud:desktop (critical 9.1)
- [CVE-2024-46957](https://insights.sbomify.com/CVE-2024-46957/): Mellium allows Authentication Bypass by Spoofing (critical 9.8)
- [CVE-2024-46956](https://insights.sbomify.com/CVE-2024-46956/): Memory corruption in artifex:ghostscript (high 7.8)
- [CVE-2024-46955](https://insights.sbomify.com/CVE-2024-46955/): Memory corruption in artifex:ghostscript (medium 5.5)
- [CVE-2024-46954](https://insights.sbomify.com/CVE-2024-46954/): Path traversal in artifex:ghostscript (high 8.4)
- [CVE-2024-46953](https://insights.sbomify.com/CVE-2024-46953/): Integer overflow in artifex:ghostscript (high 7.8)
- [CVE-2024-46952](https://insights.sbomify.com/CVE-2024-46952/): Memory corruption in artifex:ghostscript (high 8.4)
- [CVE-2024-46951](https://insights.sbomify.com/CVE-2024-46951/): Memory corruption in artifex:ghostscript (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/256/