# Vulnerabilities published in 2024


- [CVE-2024-45654](https://insights.sbomify.com/CVE-2024-45654/): IBM Security ReaQta improper input validation (medium 4.3)
- [CVE-2024-45653](https://insights.sbomify.com/CVE-2024-45653/): IBM Sterling Connect:Direct Web Services information disclosure (medium 4.3)
- [CVE-2024-45652](https://insights.sbomify.com/CVE-2024-45652/): IBM Maximo Asset Management directory traversal (medium 6.5)
- [CVE-2024-45651](https://insights.sbomify.com/CVE-2024-45651/): IBM Sterling Connect:Direct Web Services session fixation (medium 6.3)
- [CVE-2024-45650](https://insights.sbomify.com/CVE-2024-45650/): IBM Security Verify Directory denial of service (high 7.5)
- [CVE-2024-4565](https://insights.sbomify.com/CVE-2024-4565/): Advanced Custom Fields < 6.3 - Contributor+ Custom Field Access (high 7.5)
- [CVE-2024-45647](https://insights.sbomify.com/CVE-2024-45647/): IBM Security Verify Access unverified password change (medium 5.6)
- [CVE-2024-45644](https://insights.sbomify.com/CVE-2024-45644/): IBM Security ReaQta file upload (medium 4.7)
- [CVE-2024-45643](https://insights.sbomify.com/CVE-2024-45643/): IBM QRadar EDR information disclosure (medium 5.9)
- [CVE-2024-45642](https://insights.sbomify.com/CVE-2024-45642/): IBM Security ReaQta information disclosure (medium 5.3)
- [CVE-2024-45641](https://insights.sbomify.com/CVE-2024-45641/): IBM Security ReaQta improper certificate validation (medium 6.5)
- [CVE-2024-45640](https://insights.sbomify.com/CVE-2024-45640/): IBM Security QRadar EDR information disclosure (medium 5.3)
- [CVE-2024-4564](https://insights.sbomify.com/CVE-2024-4564/): Cross-site scripting in CoDesigner – All in One Elementor WooCommerce Builder (medium 6.4)
- [CVE-2024-45638](https://insights.sbomify.com/CVE-2024-45638/): IBM QRadar EDR information disclosure (medium 4.1)
- [CVE-2024-45636](https://insights.sbomify.com/CVE-2024-45636/): Information disclosure in Security QRadar EDR (medium 4.1)
- [CVE-2024-4563](https://insights.sbomify.com/CVE-2024-4563/): The Progress MOVEit Automation Configuration Export Function Uses a Cryptographic Method with Insufficient Bit Length (medium 6.1)
- [CVE-2024-45627](https://insights.sbomify.com/CVE-2024-45627/): Apache Linkis Metadata Query Service JDBC: JDBC Datasource Module with Mysql has file read vulnerability (medium 5.9)
- [CVE-2024-45626](https://insights.sbomify.com/CVE-2024-45626/): Apache James: denial of service through JMAP HTML to text conversion (medium 6.5)
- [CVE-2024-45625](https://insights.sbomify.com/CVE-2024-45625/): Cross-site scripting in Forminator (medium 6.1)
- [CVE-2024-45624](https://insights.sbomify.com/CVE-2024-45624/): Information disclosure in Pgpool-II (high 7.5)
- [CVE-2024-45623](https://insights.sbomify.com/CVE-2024-45623/): D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP (critical 9.8)
- [CVE-2024-45622](https://insights.sbomify.com/CVE-2024-45622/): ASIS (aka Aplikasi Sistem Sekolah using CodeIgniter 3) 3.0.0 through 3.2.0 allows index.php username SQL injection for Authentication Bypass. (critical 9.8)
- [CVE-2024-45621](https://insights.sbomify.com/CVE-2024-45621/): Cross-site scripting in rocket.chat:rocket.chat (medium 5.4)
- [CVE-2024-45620](https://insights.sbomify.com/CVE-2024-45620/): Libopensc: incorrect handling of the length of buffers or files in pkcs15init (low 3.9)
- [CVE-2024-4562](https://insights.sbomify.com/CVE-2024-4562/): WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via HttpMonitorSettings (medium 5.4)
- [CVE-2024-45619](https://insights.sbomify.com/CVE-2024-45619/): Libopensc: incorrect handling length of buffers or files in libopensc (medium 4.3)
- [CVE-2024-45618](https://insights.sbomify.com/CVE-2024-45618/): Libopensc: uninitialized values after incorrect or missing checking return values of functions in pkcs15init (low 3.9)
- [CVE-2024-45617](https://insights.sbomify.com/CVE-2024-45617/): Libopensc: uninitialized values after incorrect or missing checking return values of functions in libopensc (low 3.9)
- [CVE-2024-45616](https://insights.sbomify.com/CVE-2024-45616/): Libopensc: uninitialized values after incorrect check or usage of apdu response values in libopensc (low 3.9)
- [CVE-2024-45615](https://insights.sbomify.com/CVE-2024-45615/): Libopensc: pkcs15init: usage of uninitialized values in libopensc and pkcs15init (low 3.9)
- [CVE-2024-45614](https://insights.sbomify.com/CVE-2024-45614/): Header normalization allows for client to clobber proxy set headers in Puma (medium 5.4)
- [CVE-2024-45613](https://insights.sbomify.com/CVE-2024-45613/): CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package (medium 5.1)
- [CVE-2024-45612](https://insights.sbomify.com/CVE-2024-45612/): Insert tag injection via canonical URL in Contao (medium 5.3)
- [CVE-2024-45611](https://insights.sbomify.com/CVE-2024-45611/): GLPI has a stored XSS at src/RSSFeed.php (medium 5.7)
- [CVE-2024-45610](https://insights.sbomify.com/CVE-2024-45610/): GLPI has a reflected XSS in ajax/cable.php (medium 6.5)
- [CVE-2024-4561](https://insights.sbomify.com/CVE-2024-4561/): WhatsUp Gold Server-Side Request Forgery Information Disclosure Vulnerability via FaviconController (medium 4.2)
- [CVE-2024-45609](https://insights.sbomify.com/CVE-2024-45609/): GLPI has a Reflected XSS in /front/stat.graph.php (medium 6.5)
- [CVE-2024-45608](https://insights.sbomify.com/CVE-2024-45608/): GLPI has an Authenticated SQL Injection (medium 6.5)
- [CVE-2024-45607](https://insights.sbomify.com/CVE-2024-45607/): whatsapp-api-js fails to validate message's signature (medium 5.8)
- [CVE-2024-45606](https://insights.sbomify.com/CVE-2024-45606/): Improper authorization on muting of alert rules in sentry (high 7.1)
- [CVE-2024-45605](https://insights.sbomify.com/CVE-2024-45605/): Improper authorization on deletion of user issue alert notifications in sentry (medium 6.5)
- [CVE-2024-45604](https://insights.sbomify.com/CVE-2024-45604/): Directory traversal in the file selector widget in contao/core-bundle (medium 4.3)
- [CVE-2024-45601](https://insights.sbomify.com/CVE-2024-45601/): Local file Inclusion via static file serving functionality in Mesop (high 7.5)
- [CVE-2024-45600](https://insights.sbomify.com/CVE-2024-45600/): Fields GLPI plugin has an Authenticated SQL Injection (high 7.7)
- [CVE-2024-4560](https://insights.sbomify.com/CVE-2024-4560/): File upload in Kognetiks Chatbot for WordPress (critical 9.8)
- [CVE-2024-45599](https://insights.sbomify.com/CVE-2024-45599/): TCC Bypass in Cursor's macOS Application (low 3.8)
- [CVE-2024-45598](https://insights.sbomify.com/CVE-2024-45598/): Cacti has a Local File Inclusion (LFI) Vulnerability via Poller Standard Error Log Path (medium 6.0)
- [CVE-2024-45597](https://insights.sbomify.com/CVE-2024-45597/): Pluto's http.request allows CR and LF in header values (medium 5.3)
- [CVE-2024-45596](https://insights.sbomify.com/CVE-2024-45596/): Directus's session is cached for OpenID and OAuth2 if `redirect` is not used (high 7.4)
- [CVE-2024-45595](https://insights.sbomify.com/CVE-2024-45595/): D-Tale allows Remote Code Execution through the Query input on Chart Builder (medium 6.1)
- [CVE-2024-45594](https://insights.sbomify.com/CVE-2024-45594/): Decidim allows cross-site scripting (XSS) in the online or hybrid meeting embeds (high 7.7)
- [CVE-2024-45593](https://insights.sbomify.com/CVE-2024-45593/): Nix affected by unsafe NAR unpacking (critical 9.1)
- [CVE-2024-45592](https://insights.sbomify.com/CVE-2024-45592/): auditor-bundle vulnerable to Cross-site Scripting because name of entity does not get escaped (high 8.2)
- [CVE-2024-45591](https://insights.sbomify.com/CVE-2024-45591/): XWiki Platform document history including authors of any page exposed to unauthorized actors (medium 5.3)
- [CVE-2024-45590](https://insights.sbomify.com/CVE-2024-45590/): body-parser vulnerable to denial of service when url encoding is enabled (high 7.5)
- [CVE-2024-4559](https://insights.sbomify.com/CVE-2024-4559/): Memory corruption in Chrome (high 7.5)
- [CVE-2024-45589](https://insights.sbomify.com/CVE-2024-45589/): Denial of service in identityautomation:rapididentity (medium 6.5)
- [CVE-2024-45588](https://insights.sbomify.com/CVE-2024-45588/): Information Disclosure Vulnerability (critical 9.1)
- [CVE-2024-45587](https://insights.sbomify.com/CVE-2024-45587/): Unauthorized Modification Vulnerability (critical 9.1)
- [CVE-2024-45586](https://insights.sbomify.com/CVE-2024-45586/): Account Take Over Vulnerability (critical 9.2)
- [CVE-2024-45584](https://insights.sbomify.com/CVE-2024-45584/): Untrusted Pointer Dereference in Automotive Android OS (high 7.8)
- [CVE-2024-45583](https://insights.sbomify.com/CVE-2024-45583/): Use After Free in Secure Processor (medium 6.6)
- [CVE-2024-45582](https://insights.sbomify.com/CVE-2024-45582/): Improper Validation of Array Index in Camera Driver (high 7.8)
- [CVE-2024-45581](https://insights.sbomify.com/CVE-2024-45581/): Out-of-bounds Write in Audio (medium 6.6)
- [CVE-2024-45580](https://insights.sbomify.com/CVE-2024-45580/): Use After Free in DSP Service (high 7.8)
- [CVE-2024-4558](https://insights.sbomify.com/CVE-2024-4558/): Use after free in Chrome (high 7.5)
- [CVE-2024-45579](https://insights.sbomify.com/CVE-2024-45579/): Improper Input Validation in Camera Driver (high 7.8)
- [CVE-2024-45578](https://insights.sbomify.com/CVE-2024-45578/): Improper Validation of Array Index in Camera Driver (high 7.8)
- [CVE-2024-45577](https://insights.sbomify.com/CVE-2024-45577/): Improper Input Validation in Camera Driver (high 7.8)
- [CVE-2024-45576](https://insights.sbomify.com/CVE-2024-45576/): Improper Validation of Array Index in Camera Driver (high 7.8)
- [CVE-2024-45575](https://insights.sbomify.com/CVE-2024-45575/): Integer Overflow or Wraparound in Camera Driver (high 7.8)
- [CVE-2024-45574](https://insights.sbomify.com/CVE-2024-45574/): Improper Validation of Array Index in Camera Driver (high 7.8)
- [CVE-2024-45573](https://insights.sbomify.com/CVE-2024-45573/): Use of Out-of-range Pointer Offset in Display (high 7.8)
- [CVE-2024-45571](https://insights.sbomify.com/CVE-2024-45571/): Use After Free in WLAN Host Communication (high 7.8)
- [CVE-2024-45570](https://insights.sbomify.com/CVE-2024-45570/): Use of Out-of-range Pointer Offset in Camera Driver (medium 6.6)
- [CVE-2024-4557](https://insights.sbomify.com/CVE-2024-4557/): Uncontrolled Resource Consumption in GitLab (medium 6.5)
- [CVE-2024-45569](https://insights.sbomify.com/CVE-2024-45569/): Improper Validation of Array Index in WLAN Host Communication (critical 9.8)
- [CVE-2024-45568](https://insights.sbomify.com/CVE-2024-45568/): Buffer Over-read in Camera Driver (medium 6.7)
- [CVE-2024-45567](https://insights.sbomify.com/CVE-2024-45567/): Use After Free in Camera Driver (high 7.8)
- [CVE-2024-45566](https://insights.sbomify.com/CVE-2024-45566/): Use After Free in Camera Driver (high 7.8)
- [CVE-2024-45565](https://insights.sbomify.com/CVE-2024-45565/): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Driver (high 7.8)
- [CVE-2024-45564](https://insights.sbomify.com/CVE-2024-45564/): Use After Free in HLOS (high 7.8)
- [CVE-2024-45563](https://insights.sbomify.com/CVE-2024-45563/): Out-of-bounds Write in Camera Driver (medium 6.6)
- [CVE-2024-45562](https://insights.sbomify.com/CVE-2024-45562/): Use After Free in HLOS (medium 6.6)
- [CVE-2024-45561](https://insights.sbomify.com/CVE-2024-45561/): Use After Free in Windows WLAN Host (high 7.8)
- [CVE-2024-45560](https://insights.sbomify.com/CVE-2024-45560/): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera (high 7.8)
- [CVE-2024-4556](https://insights.sbomify.com/CVE-2024-4556/): Directory traversal vulnerability in NetIQ Access Manager (medium 5.7)
- [CVE-2024-45559](https://insights.sbomify.com/CVE-2024-45559/): Buffer Over-read in Automotive OS Platform (medium 5.5)
- [CVE-2024-45558](https://insights.sbomify.com/CVE-2024-45558/): Buffer Over-read in WLAN Host Cmn (high 7.5)
- [CVE-2024-45557](https://insights.sbomify.com/CVE-2024-45557/): Use of Out-of-range Pointer Offset in Trust Management Engine (high 7.8)
- [CVE-2024-45556](https://insights.sbomify.com/CVE-2024-45556/): Improper Access Control for Register Interface in TZ Firmware (medium 6.5)
- [CVE-2024-45555](https://insights.sbomify.com/CVE-2024-45555/): Integer Overflow to Buffer Overflow in Automotive OS Platform (high 8.4)
- [CVE-2024-45554](https://insights.sbomify.com/CVE-2024-45554/): Use After Free in DSP Service (high 7.8)
- [CVE-2024-45553](https://insights.sbomify.com/CVE-2024-45553/): Use After Free in DSP Services (high 7.8)
- [CVE-2024-45552](https://insights.sbomify.com/CVE-2024-45552/): Buffer Over-read in Data Network Stack & Connectivity (high 8.2)
- [CVE-2024-45551](https://insights.sbomify.com/CVE-2024-45551/): Weak Authentication in HLOS (medium 6.2)
- [CVE-2024-45550](https://insights.sbomify.com/CVE-2024-45550/): Improper Validation of Array Index in DSP Services (high 7.8)
- [CVE-2024-4555](https://insights.sbomify.com/CVE-2024-4555/): User impersonation with MFA when configure in specific way (high 7.7)
- [CVE-2024-45549](https://insights.sbomify.com/CVE-2024-45549/): Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNEL (high 7.7)
- [CVE-2024-45548](https://insights.sbomify.com/CVE-2024-45548/): Buffer Over-read in WLAN Windows Host (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/265/