# Vulnerabilities published in 2024


- [CVE-2024-45547](https://insights.sbomify.com/CVE-2024-45547/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host (high 7.8)
- [CVE-2024-45546](https://insights.sbomify.com/CVE-2024-45546/): Buffer Over-read in WLAN Windows Host (high 7.8)
- [CVE-2024-45544](https://insights.sbomify.com/CVE-2024-45544/): Use After Free in Data Network Stack & Connectivity (medium 6.6)
- [CVE-2024-45543](https://insights.sbomify.com/CVE-2024-45543/): Out-of-bounds Write in Audio (medium 6.6)
- [CVE-2024-45542](https://insights.sbomify.com/CVE-2024-45542/): Stack-based Buffer Overflow in WLAN Windows Host (high 7.8)
- [CVE-2024-45541](https://insights.sbomify.com/CVE-2024-45541/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Windows Host (high 7.8)
- [CVE-2024-45540](https://insights.sbomify.com/CVE-2024-45540/): Use After Free in HLOS (medium 6.6)
- [CVE-2024-4554](https://insights.sbomify.com/CVE-2024-4554/): Multiple xss vulnerability in NetIQ Access Manager (high 7.3)
- [CVE-2024-45539](https://insights.sbomify.com/CVE-2024-45539/): Memory corruption in DiskStation Manager (DSM) (high 7.5)
- [CVE-2024-45538](https://insights.sbomify.com/CVE-2024-45538/): Cross-site request forgery in DiskStation Manager (DSM) (critical 9.6)
- [CVE-2024-45537](https://insights.sbomify.com/CVE-2024-45537/): Apache Druid: Users can provide MySQL JDBC properties not on allow list (medium 6.5)
- [CVE-2024-4553](https://insights.sbomify.com/CVE-2024-4553/): Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (medium 6.4)
- [CVE-2024-45528](https://insights.sbomify.com/CVE-2024-45528/): Cross-site scripting in codeastro:membership management system (medium 5.4)
- [CVE-2024-45527](https://insights.sbomify.com/CVE-2024-45527/): Cross-site scripting in vanderbilt:redcap (medium 6.1)
- [CVE-2024-45526](https://insights.sbomify.com/CVE-2024-45526/): Security Update for the OPC UA .NET Standard Stack (medium 5.3)
- [CVE-2024-45523](https://insights.sbomify.com/CVE-2024-45523/): An issue was discovered in Bravura Security Fabric versions 12.3.x before 12.3.5.32784, 12.4.x before 12.4.3.35110, 12.5.x before 12.5.2.359 (critical 9.1)
- [CVE-2024-45522](https://insights.sbomify.com/CVE-2024-45522/): Business logic in linen:linen (critical 9.1)
- [CVE-2024-45520](https://insights.sbomify.com/CVE-2024-45520/): WithSecure Atlant (formerly F-Secure Atlant) 1.0.35-1 allows a remote Denial of Service because of memory corruption during scanning of a PE32 file. (high 7.5)
- [CVE-2024-4552](https://insights.sbomify.com/CVE-2024-4552/): Social Login Lite For WooCommerce <= 1.6.0 - Authentication Bypass (critical 9.8)
- [CVE-2024-45519](https://insights.sbomify.com/CVE-2024-45519/): Synacor Zimbra Collaboration Suite (ZCS) Command Execution (critical 10.0, exploited in the wild)
- [CVE-2024-45518](https://insights.sbomify.com/CVE-2024-45518/): Server-side request forgery in zimbra:collaboration (high 7.5)
- [CVE-2024-45517](https://insights.sbomify.com/CVE-2024-45517/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2024-45516](https://insights.sbomify.com/CVE-2024-45516/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2024-45515](https://insights.sbomify.com/CVE-2024-45515/): Cross-site scripting in zimbra:collaboration (medium 6.1)
- [CVE-2024-45514](https://insights.sbomify.com/CVE-2024-45514/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2024-45513](https://insights.sbomify.com/CVE-2024-45513/): Cross-site scripting in synacor:zimbra collaboration suite (medium 4.8)
- [CVE-2024-45512](https://insights.sbomify.com/CVE-2024-45512/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2024-45511](https://insights.sbomify.com/CVE-2024-45511/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2024-45510](https://insights.sbomify.com/CVE-2024-45510/): Cross-site scripting in synacor:zimbra collaboration suite (medium 6.1)
- [CVE-2024-4551](https://insights.sbomify.com/CVE-2024-4551/): Path traversal in Video Gallery – YouTube Playlist, Channel Gallery by YotuWP (medium 6.4)
- [CVE-2024-45509](https://insights.sbomify.com/CVE-2024-45509/): Missing authorization in misp-project:misp (critical 9.8)
- [CVE-2024-45508](https://insights.sbomify.com/CVE-2024-45508/): Memory corruption in htmldoc project:htmldoc (critical 9.8)
- [CVE-2024-45507](https://insights.sbomify.com/CVE-2024-45507/): Apache OFBiz: Prevent use of URLs in files when loading them from Java or Groovy, leading to a RCE (high 8.8)
- [CVE-2024-45506](https://insights.sbomify.com/CVE-2024-45506/): Denial of service in haproxy:haproxy (high 7.5)
- [CVE-2024-45505](https://insights.sbomify.com/CVE-2024-45505/): Apache HertzBeat: Exists Native Deser RCE and file writing vulnerabilities (high 8.8)
- [CVE-2024-45504](https://insights.sbomify.com/CVE-2024-45504/): Cross-site request forgery in AssetView F (medium 6.5)
- [CVE-2024-4550](https://insights.sbomify.com/CVE-2024-4550/): Memory corruption in P360 Workstation (ThinkStation) BIOS (medium 6.7)
- [CVE-2024-45498](https://insights.sbomify.com/CVE-2024-45498/): Apache Airflow: Command Injection in an example DAG (high 8.8)
- [CVE-2024-45497](https://insights.sbomify.com/CVE-2024-45497/): Misconfiguration in Red Hat Fuse 7 (high 7.6)
- [CVE-2024-45496](https://insights.sbomify.com/CVE-2024-45496/): Openshift-controller-manager: elevated build pods can lead to node compromise in openshift (critical 9.9)
- [CVE-2024-45495](https://insights.sbomify.com/CVE-2024-45495/): MSA FieldServer Gateway 5.0.0 through 6.5.2 allows cross-origin WebSocket hijacking. (medium 4.3)
- [CVE-2024-45494](https://insights.sbomify.com/CVE-2024-45494/): An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). (critical 9.8)
- [CVE-2024-45493](https://insights.sbomify.com/CVE-2024-45493/): An issue was discovered in MSA FieldServer Gateway 5.0.0 through 6.5.2 (Fixed in 7.0.0). (critical 9.8)
- [CVE-2024-45492](https://insights.sbomify.com/CVE-2024-45492/): Integer overflow in libexpat project:libexpat (high 7.3)
- [CVE-2024-45491](https://insights.sbomify.com/CVE-2024-45491/): Integer overflow in libexpat project:libexpat (high 7.3)
- [CVE-2024-45490](https://insights.sbomify.com/CVE-2024-45490/): Integer overflow in libexpat project:libexpat (critical 9.8)
- [CVE-2024-4549](https://insights.sbomify.com/CVE-2024-4549/): Delta Electronics DIAEnergie SQL Injection (high 7.5)
- [CVE-2024-45489](https://insights.sbomify.com/CVE-2024-45489/): Arc before 2024-08-26 allows remote code execution in JavaScript boosts. (critical 9.8)
- [CVE-2024-45488](https://insights.sbomify.com/CVE-2024-45488/): One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. (critical 9.8)
- [CVE-2024-45484](https://insights.sbomify.com/CVE-2024-45484/): Enabled ICMP redirection in B&R APROL (high 7.2)
- [CVE-2024-45483](https://insights.sbomify.com/CVE-2024-45483/): Missing GRUB password in B&R APROL (high 7.0)
- [CVE-2024-45482](https://insights.sbomify.com/CVE-2024-45482/): Privilege escalation in B&R APROL (high 8.5)
- [CVE-2024-45481](https://insights.sbomify.com/CVE-2024-45481/): Improper authentication in SSH of B&R APROL (high 8.5)
- [CVE-2024-45480](https://insights.sbomify.com/CVE-2024-45480/): Unauthorized local file reading in B&R APROL (critical 9.2)
- [CVE-2024-4548](https://insights.sbomify.com/CVE-2024-4548/): Delta Electronics DIAEnergie SQL Injection (critical 9.8)
- [CVE-2024-45479](https://insights.sbomify.com/CVE-2024-45479/): Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost (critical 9.1)
- [CVE-2024-45478](https://insights.sbomify.com/CVE-2024-45478/): Apache Ranger: Stored XSS in Edit Service page - Add logic to validate user input (medium 4.8)
- [CVE-2024-45477](https://insights.sbomify.com/CVE-2024-45477/): Apache NiFi: Improper Neutralization of Input in Parameter Description (medium 4.6)
- [CVE-2024-45476](https://insights.sbomify.com/CVE-2024-45476/): Null dereference in Teamcenter Visualization V14.2 (medium 4.8)
- [CVE-2024-45475](https://insights.sbomify.com/CVE-2024-45475/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45474](https://insights.sbomify.com/CVE-2024-45474/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45473](https://insights.sbomify.com/CVE-2024-45473/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45472](https://insights.sbomify.com/CVE-2024-45472/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45471](https://insights.sbomify.com/CVE-2024-45471/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45470](https://insights.sbomify.com/CVE-2024-45470/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-4547](https://insights.sbomify.com/CVE-2024-4547/): Delta Electronics DIAEnergie Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-45469](https://insights.sbomify.com/CVE-2024-45469/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45468](https://insights.sbomify.com/CVE-2024-45468/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45467](https://insights.sbomify.com/CVE-2024-45467/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45466](https://insights.sbomify.com/CVE-2024-45466/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45465](https://insights.sbomify.com/CVE-2024-45465/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45464](https://insights.sbomify.com/CVE-2024-45464/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45463](https://insights.sbomify.com/CVE-2024-45463/): Memory corruption in Teamcenter Visualization V14.2 (high 7.3)
- [CVE-2024-45462](https://insights.sbomify.com/CVE-2024-45462/): Apache CloudStack: Incomplete session invalidation on web interface logout (medium 6.3)
- [CVE-2024-45461](https://insights.sbomify.com/CVE-2024-45461/): Apache CloudStack Quota plugin: Access checks not enforced in Quota (medium 5.7)
- [CVE-2024-45460](https://insights.sbomify.com/CVE-2024-45460/): WordPress Flipping Cards plugin <= 1.30 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-4546](https://insights.sbomify.com/CVE-2024-4546/): Cross-site scripting in Custom Post Type Attachment (medium 6.4)
- [CVE-2024-45459](https://insights.sbomify.com/CVE-2024-45459/): Cross-site scripting in Product Slider for WooCommerce (high 7.1)
- [CVE-2024-45458](https://insights.sbomify.com/CVE-2024-45458/): WordPress Spiffy Calendar plugin <= 4.9.13 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-45457](https://insights.sbomify.com/CVE-2024-45457/): WordPress Spiffy Calendar plugin <= 4.9.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-45456](https://insights.sbomify.com/CVE-2024-45456/): WordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-45455](https://insights.sbomify.com/CVE-2024-45455/): WordPress WP Meta SEO plugin <= 4.5.13 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-45454](https://insights.sbomify.com/CVE-2024-45454/): WordPress Unlimited Elements for Elementor plugin <= 1.5.121 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-45453](https://insights.sbomify.com/CVE-2024-45453/): WordPress Maintenance Redirect plugin <= 2.0.1 - IP Bypass vulnerability (low 3.7)
- [CVE-2024-45452](https://insights.sbomify.com/CVE-2024-45452/): WordPress Septera theme <= 1.5.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-45451](https://insights.sbomify.com/CVE-2024-45451/): WordPress Roseta theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-45450](https://insights.sbomify.com/CVE-2024-45450/): Missing authorization in EMUI (medium 4.0)
- [CVE-2024-4545](https://insights.sbomify.com/CVE-2024-4545/): EDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldr (high 7.7)
- [CVE-2024-45449](https://insights.sbomify.com/CVE-2024-45449/): Missing authorization in EMUI (medium 5.1)
- [CVE-2024-45448](https://insights.sbomify.com/CVE-2024-45448/): Misconfiguration in EMUI (medium 4.1)
- [CVE-2024-45447](https://insights.sbomify.com/CVE-2024-45447/): Missing authorization in EMUI (medium 4.4)
- [CVE-2024-45446](https://insights.sbomify.com/CVE-2024-45446/): Missing authorization in EMUI (medium 5.5)
- [CVE-2024-45445](https://insights.sbomify.com/CVE-2024-45445/): Denial of service in EMUI (medium 4.0)
- [CVE-2024-45444](https://insights.sbomify.com/CVE-2024-45444/): Missing authorization in EMUI (medium 5.5)
- [CVE-2024-45443](https://insights.sbomify.com/CVE-2024-45443/): Path traversal in HarmonyOS (medium 6.1)
- [CVE-2024-45442](https://insights.sbomify.com/CVE-2024-45442/): Missing authorization in EMUI (medium 5.1)
- [CVE-2024-45441](https://insights.sbomify.com/CVE-2024-45441/): Other in EMUI (medium 6.2)
- [CVE-2024-45440](https://insights.sbomify.com/CVE-2024-45440/): Drupal Full Path Disclosure (medium 5.3)
- [CVE-2024-4544](https://insights.sbomify.com/CVE-2024-4544/): Pie Register - Social Sites Login (Add on) <= 1.7.7 - Authentication Bypass (critical 9.8)
- [CVE-2024-45438](https://insights.sbomify.com/CVE-2024-45438/): An issue was discovered in TitanHQ SpamTitan Email Security Gateway 8.00.x before 8.00.101 and 8.01.x before 8.01.14. (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/266/