# Vulnerabilities published in 2024


- [CVE-2024-4695](https://insights.sbomify.com/CVE-2024-4695/): Move Addons for Elementor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (medium 6.4)
- [CVE-2024-46948](https://insights.sbomify.com/CVE-2024-46948/): Missing authorization in northern.tech:mender (medium 5.3)
- [CVE-2024-46947](https://insights.sbomify.com/CVE-2024-46947/): Northern.tech Mender before 3.6.6 and 3.7.x before 3.7.7 allows SSRF. (medium 6.5)
- [CVE-2024-46946](https://insights.sbomify.com/CVE-2024-46946/): LangChain Experimental Eval Injection vulnerability (critical 9.8)
- [CVE-2024-46943](https://insights.sbomify.com/CVE-2024-46943/): OpenDaylight Authentication, Authorization and Accounting (AAA) peer impersonation vulnerability (critical 9.1)
- [CVE-2024-46942](https://insights.sbomify.com/CVE-2024-46942/): OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) allows follower controller to set up flow entries (critical 9.1)
- [CVE-2024-46941](https://insights.sbomify.com/CVE-2024-46941/): SystemUI component protection settings vulnerability (medium 4.8)
- [CVE-2024-46939](https://insights.sbomify.com/CVE-2024-46939/): Game Extension Engine Path Traversal Vulnerability (low 2.4)
- [CVE-2024-46938](https://insights.sbomify.com/CVE-2024-46938/): Information disclosure in sitecore:experience commerce (high 7.5)
- [CVE-2024-46937](https://insights.sbomify.com/CVE-2024-46937/): Missing authorization in mfasoft:secure authentication server (critical 9.1)
- [CVE-2024-46936](https://insights.sbomify.com/CVE-2024-46936/): Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message forgery / impersonation issue. (high 7.5)
- [CVE-2024-46935](https://insights.sbomify.com/CVE-2024-46935/): Denial of service in rocket chat message parser (high 7.5)
- [CVE-2024-46934](https://insights.sbomify.com/CVE-2024-46934/): Cross-site scripting in rocket.chat:rocket.chat (medium 6.1)
- [CVE-2024-46933](https://insights.sbomify.com/CVE-2024-46933/): An issue was discovered in Atos Eviden BullSequana XH2140 BMC before C4EM-125: OMF_C4E 101.05.0014. (high 7.7)
- [CVE-2024-4693](https://insights.sbomify.com/CVE-2024-4693/): Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash (medium 5.5)
- [CVE-2024-46923](https://insights.sbomify.com/CVE-2024-46923/): Null dereference in samsung:exynos 1480 firmware (high 7.5)
- [CVE-2024-46922](https://insights.sbomify.com/CVE-2024-46922/): Null dereference in samsung:exynos 1480 firmware (high 7.5)
- [CVE-2024-46921](https://insights.sbomify.com/CVE-2024-46921/): Denial of service in samsung:exynos 1080 firmware (medium 6.5)
- [CVE-2024-46920](https://insights.sbomify.com/CVE-2024-46920/): Memory corruption in samsung:exynos 1080 firmware (medium 6.5)
- [CVE-2024-4692](https://insights.sbomify.com/CVE-2024-4692/): Multiple missing permission checks (low 1.8)
- [CVE-2024-46919](https://insights.sbomify.com/CVE-2024-46919/): Memory corruption in samsung:exynos 1080 firmware (medium 5.3)
- [CVE-2024-46918](https://insights.sbomify.com/CVE-2024-46918/): Missing authorization in misp-project:misp (critical 9.8)
- [CVE-2024-46917](https://insights.sbomify.com/CVE-2024-46917/): Security feature bypass in dieboldnixdorf:vynamic security suite (high 8.1)
- [CVE-2024-46916](https://insights.sbomify.com/CVE-2024-46916/): Race condition in dieboldnixdorf:vynamic security suite (high 8.1)
- [CVE-2024-46911](https://insights.sbomify.com/CVE-2024-46911/): Apache Roller: Weakness in CSRF protection allows privilege escalation (medium 4.7)
- [CVE-2024-46910](https://insights.sbomify.com/CVE-2024-46910/): Apache Atlas: An authenticated user can perform XSS and potentially impersonate another user (high 7.1)
- [CVE-2024-46909](https://insights.sbomify.com/CVE-2024-46909/): WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-46908](https://insights.sbomify.com/CVE-2024-46908/): WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability (high 8.8)
- [CVE-2024-46907](https://insights.sbomify.com/CVE-2024-46907/): WhatsUp Gold GetFilterCriteria SQL Injection Privilege Escalation Vulnerability (high 8.8)
- [CVE-2024-46906](https://insights.sbomify.com/CVE-2024-46906/): WhatsUp Gold GetSqlWhereClause SQL Injection Privilege Escalation Vulnerability (high 8.8)
- [CVE-2024-46905](https://insights.sbomify.com/CVE-2024-46905/): WhatsUp Gold GetOrderByClause SQL Injection Privilege Escalation Vulnerability (high 8.8)
- [CVE-2024-46903](https://insights.sbomify.com/CVE-2024-46903/): Information disclosure in Trend Micro Deep Discovery Inspector (medium 6.5)
- [CVE-2024-46902](https://insights.sbomify.com/CVE-2024-46902/): Information disclosure in Trend Micro Deep Discovery Inspector (medium 4.9)
- [CVE-2024-46901](https://insights.sbomify.com/CVE-2024-46901/): Apache Subversion: mod_dav_svn denial-of-service via control characters in paths (low 3.1)
- [CVE-2024-4690](https://insights.sbomify.com/CVE-2024-4690/): Insecure usage for DocumentBuilderFactory and TransformerFactory in OpenText Application Automation Tools (medium 5.1)
- [CVE-2024-46899](https://insights.sbomify.com/CVE-2024-46899/): Information disclosure in Hitachi Ops Center Analyzer viewpoint OVF (high 7.1)
- [CVE-2024-46898](https://insights.sbomify.com/CVE-2024-46898/): Path traversal in SHIRASAGI (high 8.6)
- [CVE-2024-46897](https://insights.sbomify.com/CVE-2024-46897/): Missing authorization in Exment (low 3.8)
- [CVE-2024-46896](https://insights.sbomify.com/CVE-2024-46896/): drm/amdgpu: don't access invalid sched (medium 5.5)
- [CVE-2024-46895](https://insights.sbomify.com/CVE-2024-46895/): Privilege escalation in Intel(R) Arc™ &amp; Iris(R) Xe graphics software (medium 5.4)
- [CVE-2024-46894](https://insights.sbomify.com/CVE-2024-46894/): Missing authorization in SINEC INS (medium 5.3)
- [CVE-2024-46892](https://insights.sbomify.com/CVE-2024-46892/): Auth bypass in SINEC INS (medium 6.9)
- [CVE-2024-46891](https://insights.sbomify.com/CVE-2024-46891/): Denial of service in SINEC INS (medium 6.9)
- [CVE-2024-46890](https://insights.sbomify.com/CVE-2024-46890/): Command injection in SINEC INS (critical 9.4)
- [CVE-2024-4689](https://insights.sbomify.com/CVE-2024-4689/): WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-46889](https://insights.sbomify.com/CVE-2024-46889/): Hardcoded credentials in SINEC INS (medium 6.9)
- [CVE-2024-46888](https://insights.sbomify.com/CVE-2024-46888/): Path traversal in SINEC INS (critical 9.4)
- [CVE-2024-46887](https://insights.sbomify.com/CVE-2024-46887/): Auth bypass in SIMATIC Drive Controller CPU 1504D TF (medium 6.9)
- [CVE-2024-46886](https://insights.sbomify.com/CVE-2024-46886/): Open redirect in SIMATIC Drive Controller CPU 1504D TF (medium 5.1)
- [CVE-2024-46881](https://insights.sbomify.com/CVE-2024-46881/): Misconfiguration in Enterprise (high 7.1)
- [CVE-2024-4688](https://insights.sbomify.com/CVE-2024-4688/): Campcodes Complete Web-Based School Management System conversation_history_admin.php cross site scripting (medium 5.3)
- [CVE-2024-46879](https://insights.sbomify.com/CVE-2024-46879/): Cross-site scripting in tiki:tiki (medium 5.4)
- [CVE-2024-46878](https://insights.sbomify.com/CVE-2024-46878/): Cross-site scripting in tiki:tiki (medium 5.4)
- [CVE-2024-46874](https://insights.sbomify.com/CVE-2024-46874/): Ruijie Reyee OS Improper Handling of Insufficient Permissions or Privileges (critical 9.2)
- [CVE-2024-46873](https://insights.sbomify.com/CVE-2024-46873/): Misconfiguration in PocketWifi 809SH (critical 9.8)
- [CVE-2024-46872](https://insights.sbomify.com/CVE-2024-46872/): Client-Side Path Traversal Leading to CSRF in Playbooks (medium 4.6)
- [CVE-2024-46871](https://insights.sbomify.com/CVE-2024-46871/): drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX (high 7.8)
- [CVE-2024-46870](https://insights.sbomify.com/CVE-2024-46870/): drm/amd/display: Disable DMCUB timeout for DCN35 (medium 4.7)
- [CVE-2024-4687](https://insights.sbomify.com/CVE-2024-4687/): Campcodes Complete Web-Based School Management System create_events.php cross site scripting (medium 5.3)
- [CVE-2024-46869](https://insights.sbomify.com/CVE-2024-46869/): Bluetooth: btintel_pcie: Allocate memory for driver private data (high 7.8)
- [CVE-2024-46868](https://insights.sbomify.com/CVE-2024-46868/): firmware: qcom: uefisecapp: Fix deadlock in qcuefi_acquire() (medium 5.5)
- [CVE-2024-46867](https://insights.sbomify.com/CVE-2024-46867/): drm/xe/client: fix deadlock in show_meminfo() (medium 5.5)
- [CVE-2024-46866](https://insights.sbomify.com/CVE-2024-46866/): drm/xe/client: add missing bo locking in show_meminfo() (high 7.8)
- [CVE-2024-46865](https://insights.sbomify.com/CVE-2024-46865/): fou: fix initialization of grc (critical 9.8)
- [CVE-2024-46864](https://insights.sbomify.com/CVE-2024-46864/): x86/hyperv: fix kexec crash due to VP assist page corruption (medium 5.5)
- [CVE-2024-46863](https://insights.sbomify.com/CVE-2024-46863/): ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item (high 7.3)
- [CVE-2024-46862](https://insights.sbomify.com/CVE-2024-46862/): ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item (high 8.0)
- [CVE-2024-46861](https://insights.sbomify.com/CVE-2024-46861/): usbnet: ipheth: do not stop RX on failing RX callback (medium 5.5)
- [CVE-2024-46860](https://insights.sbomify.com/CVE-2024-46860/): wifi: mt76: mt7921: fix NULL pointer access in mt7921_ipv6_addr_change (medium 5.5)
- [CVE-2024-4686](https://insights.sbomify.com/CVE-2024-4686/): Campcodes Complete Web-Based School Management System emarks_range_grade_update_form.php cross site scripting (medium 5.3)
- [CVE-2024-46859](https://insights.sbomify.com/CVE-2024-46859/): platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses (high 7.8)
- [CVE-2024-46858](https://insights.sbomify.com/CVE-2024-46858/): mptcp: pm: Fix uaf in __timer_delete_sync (high 8.1)
- [CVE-2024-46857](https://insights.sbomify.com/CVE-2024-46857/): net/mlx5: Fix bridge mode operations when there are no VFs (medium 5.5)
- [CVE-2024-46856](https://insights.sbomify.com/CVE-2024-46856/): net: phy: dp83822: Fix NULL pointer dereference on DP83825 devices (medium 5.5)
- [CVE-2024-46855](https://insights.sbomify.com/CVE-2024-46855/): netfilter: nft_socket: fix sk refcount leaks (high 7.5)
- [CVE-2024-46854](https://insights.sbomify.com/CVE-2024-46854/): net: dpaa: Pad packets to ETH_ZLEN (high 7.1)
- [CVE-2024-46853](https://insights.sbomify.com/CVE-2024-46853/): spi: nxp-fspi: fix the KASAN report out-of-bounds bug (high 7.8)
- [CVE-2024-46852](https://insights.sbomify.com/CVE-2024-46852/): dma-buf: heaps: Fix off-by-one in CMA heap fault handler (high 7.8)
- [CVE-2024-46851](https://insights.sbomify.com/CVE-2024-46851/): drm/amd/display: Avoid race between dcn10_set_drr() and dc_state_destruct() (medium 4.7)
- [CVE-2024-46850](https://insights.sbomify.com/CVE-2024-46850/): drm/amd/display: Avoid race between dcn35_set_drr() and dc_state_destruct() (high 7.8)
- [CVE-2024-4685](https://insights.sbomify.com/CVE-2024-4685/): Campcodes Complete Web-Based School Management System exam_timetable.php cross site scripting (medium 5.3)
- [CVE-2024-46849](https://insights.sbomify.com/CVE-2024-46849/): ASoC: meson: axg-card: fix 'use-after-free' (high 7.8)
- [CVE-2024-46848](https://insights.sbomify.com/CVE-2024-46848/): perf/x86/intel: Limit the period on Haswell (medium 5.5)
- [CVE-2024-46847](https://insights.sbomify.com/CVE-2024-46847/): mm: vmalloc: ensure vmap_block is initialised before adding to queue (high 7.8)
- [CVE-2024-46846](https://insights.sbomify.com/CVE-2024-46846/): spi: rockchip: Resolve unbalanced runtime PM / system PM handling (medium 5.5)
- [CVE-2024-46845](https://insights.sbomify.com/CVE-2024-46845/): tracing/timerlat: Only clear timer if a kthread exists (high 7.8)
- [CVE-2024-46844](https://insights.sbomify.com/CVE-2024-46844/): um: line: always fill *error_out in setup_one_line() (high 7.1)
- [CVE-2024-46843](https://insights.sbomify.com/CVE-2024-46843/): scsi: ufs: core: Remove SCSI host only if added (medium 5.5)
- [CVE-2024-46842](https://insights.sbomify.com/CVE-2024-46842/): scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (high 7.8)
- [CVE-2024-46841](https://insights.sbomify.com/CVE-2024-46841/): btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() (medium 5.5)
- [CVE-2024-46840](https://insights.sbomify.com/CVE-2024-46840/): btrfs: clean up our handling of refs == 0 in snapshot delete (medium 5.5)
- [CVE-2024-4684](https://insights.sbomify.com/CVE-2024-4684/): Campcodes Complete Web-Based School Management System exam_timetable_grade_wise.php cross site scripting (medium 5.3)
- [CVE-2024-46838](https://insights.sbomify.com/CVE-2024-46838/): userfaultfd: don't BUG_ON() if khugepaged yanks our page table (medium 5.5)
- [CVE-2024-46837](https://insights.sbomify.com/CVE-2024-46837/): drm/panthor: Restrict high priorities on group_create (medium 5.5)
- [CVE-2024-46836](https://insights.sbomify.com/CVE-2024-46836/): usb: gadget: aspeed_udc: validate endpoint index for ast udc (high 7.8)
- [CVE-2024-46835](https://insights.sbomify.com/CVE-2024-46835/): drm/amdgpu: Fix smatch static checker warning (medium 5.5)
- [CVE-2024-46834](https://insights.sbomify.com/CVE-2024-46834/): ethtool: fail closed if we can't get max channel used in indirection tables (high 7.8)
- [CVE-2024-46833](https://insights.sbomify.com/CVE-2024-46833/): net: hns3: void array out of bound when loop tnl_num (high 7.8)
- [CVE-2024-46832](https://insights.sbomify.com/CVE-2024-46832/): MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed (medium 5.5)
- [CVE-2024-46831](https://insights.sbomify.com/CVE-2024-46831/): net: microchip: vcap: Fix use-after-free error in kunit test (high 8.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/257/