# Vulnerabilities published in 2024


- [CVE-2024-45782](https://insights.sbomify.com/CVE-2024-45782/): Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382) (high 7.8)
- [CVE-2024-45781](https://insights.sbomify.com/CVE-2024-45781/): Grub2: fs/ufs: oob write in the heap (medium 6.7)
- [CVE-2024-45780](https://insights.sbomify.com/CVE-2024-45780/): Grub2: fs/tar: integer overflow causes heap oob write (medium 6.7)
- [CVE-2024-4578](https://insights.sbomify.com/CVE-2024-4578/): Privilege escalation in Arista Wireless Access Points (high 8.4)
- [CVE-2024-45779](https://insights.sbomify.com/CVE-2024-45779/): Grub2: fs/bfs: integer overflow leads to heap oob read in the bfs parser (medium 6.0)
- [CVE-2024-45778](https://insights.sbomify.com/CVE-2024-45778/): Grub2: fs/bfs: integer overflow in the bfs parser. (medium 4.1)
- [CVE-2024-45777](https://insights.sbomify.com/CVE-2024-45777/): Grub2: grub-core/gettext: integer overflow leads to heap oob write. (medium 6.7)
- [CVE-2024-45776](https://insights.sbomify.com/CVE-2024-45776/): Grub2: grub-core/gettext: integer overflow leads to heap oob write and read. (medium 6.7)
- [CVE-2024-45775](https://insights.sbomify.com/CVE-2024-45775/): Grub2: commands/extcmd: missing check for failed allocation (medium 5.2)
- [CVE-2024-45774](https://insights.sbomify.com/CVE-2024-45774/): Grub2: reader/jpeg: heap oob write during jpeg parsing (medium 6.7)
- [CVE-2024-45773](https://insights.sbomify.com/CVE-2024-45773/): Use after free in Facebook Thrift (high 7.5)
- [CVE-2024-45772](https://insights.sbomify.com/CVE-2024-45772/): Apache Lucene Replicator: Security Vulnerability in Lucene Replicator - Deserialization Issue (medium 5.1)
- [CVE-2024-45771](https://insights.sbomify.com/CVE-2024-45771/): SQL injection in openrapid:rapidcms (critical 9.8)
- [CVE-2024-45770](https://insights.sbomify.com/CVE-2024-45770/): Pcp: pmpost symlink attack allows escalating pcp to root user (medium 4.4)
- [CVE-2024-4577](https://insights.sbomify.com/CVE-2024-4577/): PHP-CGI OS Command Injection (critical 9.8, exploited in the wild)
- [CVE-2024-45769](https://insights.sbomify.com/CVE-2024-45769/): Pcp: pmcd heap corruption through metric pmstore operations (medium 5.5)
- [CVE-2024-45767](https://insights.sbomify.com/CVE-2024-45767/): SQL injection in Dell OpenManage Enterprise (medium 4.3)
- [CVE-2024-45766](https://insights.sbomify.com/CVE-2024-45766/): Code injection in Dell OpenManage Enterprise (high 8.0)
- [CVE-2024-45765](https://insights.sbomify.com/CVE-2024-45765/): Command injection in Enterprise SONiC OS (critical 9.1)
- [CVE-2024-45764](https://insights.sbomify.com/CVE-2024-45764/): Auth bypass in Enterprise SONiC OS (critical 9.0)
- [CVE-2024-45763](https://insights.sbomify.com/CVE-2024-45763/): Command injection in Enterprise SONiC OS (critical 9.1)
- [CVE-2024-45761](https://insights.sbomify.com/CVE-2024-45761/): Code injection in Dell OpenManage Server Administrator (medium 5.4)
- [CVE-2024-45760](https://insights.sbomify.com/CVE-2024-45760/): Missing authorization in Dell OpenManage Server Administrator (medium 4.3)
- [CVE-2024-4576](https://insights.sbomify.com/CVE-2024-4576/): TIBCO EBX File Inclusion Vulnerability (medium 5.3)
- [CVE-2024-45759](https://insights.sbomify.com/CVE-2024-45759/): Privilege escalation in PowerProtect DD (medium 6.8)
- [CVE-2024-45758](https://insights.sbomify.com/CVE-2024-45758/): H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL (critical 9.1)
- [CVE-2024-45757](https://insights.sbomify.com/CVE-2024-45757/): An issue was discovered in Centreon centreon-bam 24.04, 23.10, 23.04, and 22.10. (high 7.2)
- [CVE-2024-45756](https://insights.sbomify.com/CVE-2024-45756/): An issue was discovered in Centreon centreon-open-tickets 24.10.x before 24.10.0, 24.04.x before 24.04.2, 23.10.x before 23.10.1, 23.04.x be (high 7.2)
- [CVE-2024-45755](https://insights.sbomify.com/CVE-2024-45755/): An issue was discovered in Centreon centreon-dsm-server 24.10.x before 24.10.0, 24.04.x before 24.04.3, 23.10.x before 23.10.1, 23.04.x befo (high 7.2)
- [CVE-2024-45754](https://insights.sbomify.com/CVE-2024-45754/): An issue was discovered in the centreon-bi-server component in Centreon BI Server 24.04.x before 24.04.3, 23.10.x before 23.10.8, 23.04.x be (high 7.2)
- [CVE-2024-45753](https://insights.sbomify.com/CVE-2024-45753/): Cross-site scripting in mahara:mahara (medium 6.1)
- [CVE-2024-45752](https://insights.sbomify.com/CVE-2024-45752/): Privilege escalation in pixlone:logiops (high 8.5)
- [CVE-2024-45751](https://insights.sbomify.com/CVE-2024-45751/): tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. (medium 5.9)
- [CVE-2024-45750](https://insights.sbomify.com/CVE-2024-45750/): An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterp (high 7.3)
- [CVE-2024-4575](https://insights.sbomify.com/CVE-2024-4575/): LayerSlider 7.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ls_search_form Shortcode (medium 6.4)
- [CVE-2024-45746](https://insights.sbomify.com/CVE-2024-45746/): An issue was discovered in Trusted Firmware-M through 2.1.0. (critical 9.8)
- [CVE-2024-45745](https://insights.sbomify.com/CVE-2024-45745/): TopQuadrant TopBraid EDG JavaScript console XXE (medium 5.0)
- [CVE-2024-45744](https://insights.sbomify.com/CVE-2024-45744/): TopQuadrant TopBraid EDG password manager stores external credentials insecurely (low 3.0)
- [CVE-2024-45741](https://insights.sbomify.com/CVE-2024-45741/): Persistent Cross-Site Scripting (XSS) via props.conf on Splunk Enterprise (medium 5.4)
- [CVE-2024-45740](https://insights.sbomify.com/CVE-2024-45740/): Persistent Cross-Site Scripting (XSS) through Scheduled Views on Splunk Enterprise (medium 5.4)
- [CVE-2024-4574](https://insights.sbomify.com/CVE-2024-4574/): Cross-site scripting in Graphina – Charts and Graphs For Elementor (medium 6.4)
- [CVE-2024-45739](https://insights.sbomify.com/CVE-2024-45739/): Sensitive information disclosure in AdminManager logging channel (medium 4.9)
- [CVE-2024-45738](https://insights.sbomify.com/CVE-2024-45738/): Sensitive information disclosure in REST_Calls logging channel (medium 4.9)
- [CVE-2024-45737](https://insights.sbomify.com/CVE-2024-45737/): Maintenance mode state change of App Key Value Store (KVStore) through Cross-Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-45736](https://insights.sbomify.com/CVE-2024-45736/): Improperly Formatted ‘INGEST_EVAL’ Parameter Crashes Splunk Daemon (medium 6.5)
- [CVE-2024-45735](https://insights.sbomify.com/CVE-2024-45735/): Improper Access Control for low-privileged user in Splunk Secure Gateway App (medium 4.3)
- [CVE-2024-45734](https://insights.sbomify.com/CVE-2024-45734/): Low Privilege User can View Images on the Host Machine by using the PDF Export feature in Splunk Classic Dashboard (medium 4.3)
- [CVE-2024-45733](https://insights.sbomify.com/CVE-2024-45733/): Remote Code Execution (RCE) due to insecure session storage configuration in Splunk Enterprise on Windows (high 8.8)
- [CVE-2024-45732](https://insights.sbomify.com/CVE-2024-45732/): Low-privileged user could run search as nobody in SplunkDeploymentServerConfig app (high 7.1)
- [CVE-2024-45731](https://insights.sbomify.com/CVE-2024-45731/): Path traversal in Splunk Enterprise (high 8.0)
- [CVE-2024-45723](https://insights.sbomify.com/CVE-2024-45723/): goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator (high 7.1)
- [CVE-2024-45722](https://insights.sbomify.com/CVE-2024-45722/): Ruijie Reyee OS Use of Weak Credentials (high 8.7)
- [CVE-2024-45721](https://insights.sbomify.com/CVE-2024-45721/): Command injection in Wi-Fi STATION SH-52B (high 7.2)
- [CVE-2024-45720](https://insights.sbomify.com/CVE-2024-45720/): Apache Subversion: Command line argument injection on Windows platforms (high 8.2)
- [CVE-2024-45719](https://insights.sbomify.com/CVE-2024-45719/): Apache Answer: Predictable Authorization Token Using UUIDv1 (low 2.6)
- [CVE-2024-45718](https://insights.sbomify.com/CVE-2024-45718/): Sensitive data disclosure vulnerability (medium 4.6)
- [CVE-2024-45717](https://insights.sbomify.com/CVE-2024-45717/): SolarWinds Platform Cross- Site Scripting Vulnerability (high 7.0)
- [CVE-2024-45715](https://insights.sbomify.com/CVE-2024-45715/): SolarWinds Platform Edit Function Cross-Site Scripting Vulnerability (high 7.1)
- [CVE-2024-45714](https://insights.sbomify.com/CVE-2024-45714/): SolarWinds Serv-U Stored XSS Vulnerability (medium 4.8)
- [CVE-2024-45713](https://insights.sbomify.com/CVE-2024-45713/): SolarWinds Kiwi CatTools Sensitive Information Disclosure Vulnerability (medium 5.1)
- [CVE-2024-45712](https://insights.sbomify.com/CVE-2024-45712/): SolarWinds Serv-U Client-Side Cross-Site Scripting Vulnerability (low 2.6)
- [CVE-2024-45711](https://insights.sbomify.com/CVE-2024-45711/): SolarWinds Serv-U FTP Service Directory Traversal Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-45710](https://insights.sbomify.com/CVE-2024-45710/): SolarWinds Platform Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-45709](https://insights.sbomify.com/CVE-2024-45709/): SolarWinds Web Help Desk Local File Read Vulnerability (medium 5.3)
- [CVE-2024-45700](https://insights.sbomify.com/CVE-2024-45700/): DoS vulnerability due to uncontrolled resource exhaustion (medium 6.0)
- [CVE-2024-4570](https://insights.sbomify.com/CVE-2024-4570/): Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-45699](https://insights.sbomify.com/CVE-2024-45699/): Reflected XSS vulnerability in /zabbix.php?action=export.valuemaps (high 7.5)
- [CVE-2024-45698](https://insights.sbomify.com/CVE-2024-45698/): D-Link WiFi router - OS Command Injection (critical 9.8)
- [CVE-2024-45697](https://insights.sbomify.com/CVE-2024-45697/): D-Link WiFi router - Hidden Functionality (critical 9.8)
- [CVE-2024-45696](https://insights.sbomify.com/CVE-2024-45696/): D-Link WiFi router - Hidden Functionality (high 8.8)
- [CVE-2024-45695](https://insights.sbomify.com/CVE-2024-45695/): D-Link WiFi router - Stack-based Buffer Overflow (critical 9.8)
- [CVE-2024-45694](https://insights.sbomify.com/CVE-2024-45694/): D-Link WiFi router - Stack-based Buffer Overflow (critical 9.8)
- [CVE-2024-45693](https://insights.sbomify.com/CVE-2024-45693/): Apache CloudStack: Request origin validation bypass makes account takeover possible (high 8.0)
- [CVE-2024-45692](https://insights.sbomify.com/CVE-2024-45692/): Denial of service in virtualmin:virtualmin (high 7.5)
- [CVE-2024-45691](https://insights.sbomify.com/CVE-2024-45691/): Moodle: lesson activity password bypass through php loose comparison (medium 5.4)
- [CVE-2024-45690](https://insights.sbomify.com/CVE-2024-45690/): Moodle: idor when deleting oauth2 linked accounts (high 7.5)
- [CVE-2024-4569](https://insights.sbomify.com/CVE-2024-4569/): Elementor Addon Elements <= 1.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-45689](https://insights.sbomify.com/CVE-2024-45689/): Moodle: unprotected access to sensitive information via dynamic tables (medium 6.5)
- [CVE-2024-45687](https://insights.sbomify.com/CVE-2024-45687/): HTTP Server incorrectly accepting disallowed characters within header values (low 2.4)
- [CVE-2024-45682](https://insights.sbomify.com/CVE-2024-45682/): Millbeck Communications Proroute H685t-w Command Injection. (high 8.8)
- [CVE-2024-4568](https://insights.sbomify.com/CVE-2024-4568/): Stack overflow in Xpdf 4.05 due to object loop in PDF resources (low 2.9)
- [CVE-2024-45679](https://insights.sbomify.com/CVE-2024-45679/): Memory corruption in Assimp (high 8.4)
- [CVE-2024-45678](https://insights.sbomify.com/CVE-2024-45678/): Weak cryptography in yubico:security key c nfc by yubico firmware (medium 4.2)
- [CVE-2024-45676](https://insights.sbomify.com/CVE-2024-45676/): IBM Cognos Controller file upload (medium 4.3)
- [CVE-2024-45675](https://insights.sbomify.com/CVE-2024-45675/): IBM Informix Dynamic Server Authentication Bypass (high 8.4)
- [CVE-2024-45674](https://insights.sbomify.com/CVE-2024-45674/): IBM Security Verify Bridge information disclosure (low 3.3)
- [CVE-2024-45673](https://insights.sbomify.com/CVE-2024-45673/): IBM Security Verify Bridge information disclosure (medium 5.5)
- [CVE-2024-45672](https://insights.sbomify.com/CVE-2024-45672/): IBM Security Verify Bridge data manipulation (medium 6.0)
- [CVE-2024-45671](https://insights.sbomify.com/CVE-2024-45671/): IBM Security Verify Information Queue information disclosure (medium 5.9)
- [CVE-2024-45670](https://insights.sbomify.com/CVE-2024-45670/): IBM Security SOAR weak password recovery mechanism (medium 5.6)
- [CVE-2024-4567](https://insights.sbomify.com/CVE-2024-4567/): Themify Shortcodes <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via themify_button Shortcode (medium 6.4)
- [CVE-2024-45669](https://insights.sbomify.com/CVE-2024-45669/): IBM Security Verify Information Queue denial of service (medium 6.5)
- [CVE-2024-45663](https://insights.sbomify.com/CVE-2024-45663/): IBM Db2 denial of service (medium 6.5)
- [CVE-2024-45662](https://insights.sbomify.com/CVE-2024-45662/): IBM Safer Payments denial of service (high 7.5)
- [CVE-2024-4566](https://insights.sbomify.com/CVE-2024-4566/): ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification (high 7.1)
- [CVE-2024-45659](https://insights.sbomify.com/CVE-2024-45659/): IBM Security Verify Access information disclosure (medium 5.3)
- [CVE-2024-45658](https://insights.sbomify.com/CVE-2024-45658/): IBM Security Verify Access information disclosure (low 2.7)
- [CVE-2024-45657](https://insights.sbomify.com/CVE-2024-45657/): IBM Security Verify Access incorrect privilege assignment (medium 5.0)
- [CVE-2024-45656](https://insights.sbomify.com/CVE-2024-45656/): IBM Flexible Service Processor hard coded credentials (critical 9.8)
- [CVE-2024-45655](https://insights.sbomify.com/CVE-2024-45655/): IBM Application Gateway incorrect permission assignment (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/264/