# Vulnerabilities published in 2024


- [CVE-2024-45436](https://insights.sbomify.com/CVE-2024-45436/): Ollama can extract members of a ZIP archive outside of the parent directory (critical 9.1)
- [CVE-2024-45435](https://insights.sbomify.com/CVE-2024-45435/): Code injection in chartist:chartist (critical 9.8)
- [CVE-2024-45434](https://insights.sbomify.com/CVE-2024-45434/): Use after free in opensynergy:blue sdk (critical 9.8)
- [CVE-2024-45433](https://insights.sbomify.com/CVE-2024-45433/): Security feature bypass in opensynergy:blue sdk (medium 6.5)
- [CVE-2024-45432](https://insights.sbomify.com/CVE-2024-45432/): Other in opensynergy:blue sdk (high 7.5)
- [CVE-2024-45431](https://insights.sbomify.com/CVE-2024-45431/): Other in opensynergy:blue sdk (medium 5.3)
- [CVE-2024-4543](https://insights.sbomify.com/CVE-2024-4543/): Snippet Shortcodes <= 4.1.4 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-45429](https://insights.sbomify.com/CVE-2024-45429/): Cross-site scripting in Advanced Custom Fields (medium 6.1)
- [CVE-2024-45426](https://insights.sbomify.com/CVE-2024-45426/): Zoom Workplace Apps - Incorrect Ownership Assignment (medium 4.9)
- [CVE-2024-45425](https://insights.sbomify.com/CVE-2024-45425/): Zoom Workplace Apps - Incorrect User Management (medium 4.9)
- [CVE-2024-45424](https://insights.sbomify.com/CVE-2024-45424/): Zoom Workplace Apps - Business Logic Error (medium 5.3)
- [CVE-2024-45422](https://insights.sbomify.com/CVE-2024-45422/): Zoom Apps - Improper Input Validation (medium 6.5)
- [CVE-2024-45421](https://insights.sbomify.com/CVE-2024-45421/): Zoom Apps - Buffer Overflow (high 8.5)
- [CVE-2024-45420](https://insights.sbomify.com/CVE-2024-45420/): Zoom Apps - Uncontrolled Resource Consumption (medium 4.3)
- [CVE-2024-45419](https://insights.sbomify.com/CVE-2024-45419/): Zoom Apps - Improper Input Validation (high 8.1)
- [CVE-2024-45418](https://insights.sbomify.com/CVE-2024-45418/): Zoom Apps for macOS - Symbolic Link Following (medium 5.4)
- [CVE-2024-45417](https://insights.sbomify.com/CVE-2024-45417/): Zoom Apps for macOS - Uncontrolled Resource Consumption (medium 6.0)
- [CVE-2024-45416](https://insights.sbomify.com/CVE-2024-45416/): The HTTPD binary in multiple ZTE routers has a local file inclusion vulnerability in session_init function. (high 8.1)
- [CVE-2024-45415](https://insights.sbomify.com/CVE-2024-45415/): The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in check_data_integrity function. (critical 9.8)
- [CVE-2024-45414](https://insights.sbomify.com/CVE-2024-45414/): The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in webPrivateDecrypt function. (critical 9.8)
- [CVE-2024-45413](https://insights.sbomify.com/CVE-2024-45413/): The HTTPD binary in multiple ZTE routers has a stack-based buffer overflow vulnerability in rsa_decrypt function. (high 8.1)
- [CVE-2024-45412](https://insights.sbomify.com/CVE-2024-45412/): Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack (medium 5.3)
- [CVE-2024-45411](https://insights.sbomify.com/CVE-2024-45411/): Twig has a possible sandbox bypass (high 8.6)
- [CVE-2024-45410](https://insights.sbomify.com/CVE-2024-45410/): HTTP client can remove the X-Forwarded headers in Traefik (critical 9.8)
- [CVE-2024-4541](https://insights.sbomify.com/CVE-2024-4541/): Custom Product List Table <= 3.0.0 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-45409](https://insights.sbomify.com/CVE-2024-45409/): The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector (critical 10.0)
- [CVE-2024-45408](https://insights.sbomify.com/CVE-2024-45408/): eLabFTW contains a direct and indirect information disclosure (high 7.5)
- [CVE-2024-45407](https://insights.sbomify.com/CVE-2024-45407/): Sunshine has incorrect state management during pairing process may lead to incorrectly authorized client (medium 6.5)
- [CVE-2024-45406](https://insights.sbomify.com/CVE-2024-45406/): Craft CMS stored XSS in breadcrumb list and title fields (medium 5.5)
- [CVE-2024-45405](https://insights.sbomify.com/CVE-2024-45405/): gix-path improperly resolves configuration path reported by Git (medium 6.0)
- [CVE-2024-45404](https://insights.sbomify.com/CVE-2024-45404/): OpenCTI's lack of Rate Limit lead to OTP brute forcing (high 8.1)
- [CVE-2024-45403](https://insights.sbomify.com/CVE-2024-45403/): H2O assertion failure when HTTP/3 requests are cancelled (low 3.7)
- [CVE-2024-45402](https://insights.sbomify.com/CVE-2024-45402/): Picotls double free (high 8.6)
- [CVE-2024-45401](https://insights.sbomify.com/CVE-2024-45401/): stripe-cli Path Traversal vulnerability (high 7.6)
- [CVE-2024-45400](https://insights.sbomify.com/CVE-2024-45400/): CKEditor Open Link plugin vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2024-4540](https://insights.sbomify.com/CVE-2024-4540/): Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie (high 7.5)
- [CVE-2024-45399](https://insights.sbomify.com/CVE-2024-45399/): Indico has a Cross-Site-Scripting during account creation (medium 4.3)
- [CVE-2024-45398](https://insights.sbomify.com/CVE-2024-45398/): Remote command execution through file upload in contao/core-bundle (high 8.3)
- [CVE-2024-45397](https://insights.sbomify.com/CVE-2024-45397/): H2O alllows bypassing address-based access control with 0-RTT (medium 5.9)
- [CVE-2024-45396](https://insights.sbomify.com/CVE-2024-45396/): Quicly assertion failures (high 7.5)
- [CVE-2024-45395](https://insights.sbomify.com/CVE-2024-45395/): Unbounded loop over untrusted input can lead to endless data attack (low 3.1)
- [CVE-2024-45394](https://insights.sbomify.com/CVE-2024-45394/): Secret encryption vulnerable to brute-force attacks (high 8.8)
- [CVE-2024-45393](https://insights.sbomify.com/CVE-2024-45393/): Computer Vision Annotation Tool (CVAT) is missing authorization for endpoints related to webhook deliveries (medium 6.4)
- [CVE-2024-45392](https://insights.sbomify.com/CVE-2024-45392/): SuiteCRM has wrong deletion permission checks on API delete call (high 7.7)
- [CVE-2024-45391](https://insights.sbomify.com/CVE-2024-45391/): Tina search token leak via lock file in TinaCMS (high 7.5)
- [CVE-2024-45390](https://insights.sbomify.com/CVE-2024-45390/): @blakeembrey/template vulnerable to code injection when attacker controls template input (high 7.3)
- [CVE-2024-4539](https://insights.sbomify.com/CVE-2024-4539/): Allocation of Resources Without Limits or Throttling in GitLab (medium 4.3)
- [CVE-2024-45389](https://insights.sbomify.com/CVE-2024-45389/): Pagefind DOM clobbering could escalate to Cross-site Scripting (XSS) (medium 6.4)
- [CVE-2024-45388](https://insights.sbomify.com/CVE-2024-45388/): Arbitrary file read in the `/api/v2/simulation` endpoint in hoverfly (`GHSL-2023-274`) (high 7.5)
- [CVE-2024-45387](https://insights.sbomify.com/CVE-2024-45387/): Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments (critical 9.9)
- [CVE-2024-45386](https://insights.sbomify.com/CVE-2024-45386/): Auth bypass in SIMATIC PCS neo V4.0 (high 8.7)
- [CVE-2024-45385](https://insights.sbomify.com/CVE-2024-45385/): Cross-site scripting in Industrial Edge Management OS (IEM-OS) (low 2.1)
- [CVE-2024-45384](https://insights.sbomify.com/CVE-2024-45384/): druid-pac4j, Apache Druid extension, has Padding Oracle vulnerability (medium 5.3)
- [CVE-2024-45383](https://insights.sbomify.com/CVE-2024-45383/): Denial of service in HDAudBus.sys (medium 5.0)
- [CVE-2024-45382](https://insights.sbomify.com/CVE-2024-45382/): Liteos_a has an Out-of-bounds Write vulnerability (low 3.3)
- [CVE-2024-4538](https://insights.sbomify.com/CVE-2024-4538/): IDOR vulnerability in Janto Ticketing Software (high 7.5)
- [CVE-2024-45374](https://insights.sbomify.com/CVE-2024-45374/): goTenna Pro ATAK Plugin Weak Password Requirements (medium 6.0)
- [CVE-2024-45373](https://insights.sbomify.com/CVE-2024-45373/): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Improper Privilege Management (high 8.7)
- [CVE-2024-45372](https://insights.sbomify.com/CVE-2024-45372/): Cross-site request forgery in MZK-DP300N (medium 6.5)
- [CVE-2024-45371](https://insights.sbomify.com/CVE-2024-45371/): Missing authorization in Intel(R) Arc™ &amp; Iris(R) Xe graphics software (medium 5.2)
- [CVE-2024-45370](https://insights.sbomify.com/CVE-2024-45370/): Auth bypass in Easy Config System (high 7.3)
- [CVE-2024-4537](https://insights.sbomify.com/CVE-2024-4537/): IDOR vulnerability in Janto Ticketing Software (high 7.5)
- [CVE-2024-45369](https://insights.sbomify.com/CVE-2024-45369/): mySCADA myPRO Improper Authentication (critical 9.2)
- [CVE-2024-45368](https://insights.sbomify.com/CVE-2024-45368/): AutomationDirect DirectLogic H2-DM1E Session Fixation (high 8.7)
- [CVE-2024-45367](https://insights.sbomify.com/CVE-2024-45367/): Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication (critical 9.3)
- [CVE-2024-45366](https://insights.sbomify.com/CVE-2024-45366/): Cross-site scripting in Welcart e-Commerce (medium 6.1)
- [CVE-2024-45361](https://insights.sbomify.com/CVE-2024-45361/): Mi Connect Service APP protocol flaws lead to leaking sensitive user information (medium 6.5)
- [CVE-2024-4536](https://insights.sbomify.com/CVE-2024-4536/): Eclipse EDC: OAuth2 Credential Exfiltration Vulnerability (medium 6.8)
- [CVE-2024-45356](https://insights.sbomify.com/CVE-2024-45356/): Xiaomi phone framework has unauthorized access vulnerability (high 7.3)
- [CVE-2024-45355](https://insights.sbomify.com/CVE-2024-45355/): Xiaomi phone framework has unauthorized access vulnerability (medium 5.5)
- [CVE-2024-45354](https://insights.sbomify.com/CVE-2024-45354/): xiaomi shop application Webview has code execution vulnerability (medium 4.3)
- [CVE-2024-45353](https://insights.sbomify.com/CVE-2024-45353/): quick App has intent redriction vulnerability (medium 4.3)
- [CVE-2024-45352](https://insights.sbomify.com/CVE-2024-45352/): Xiaomi smarthome application Webview has code execution vulnerability (high 8.8)
- [CVE-2024-45351](https://insights.sbomify.com/CVE-2024-45351/): Game center application has code execution Vulnerability (high 7.8)
- [CVE-2024-4535](https://insights.sbomify.com/CVE-2024-4535/): KKProgressbar2 Free <= 1.1.4.2 - Progress Bar Deletion via CSRF (high 8.8)
- [CVE-2024-45348](https://insights.sbomify.com/CVE-2024-45348/): Xiaomi Router AX9000 has a post-authorization command injection vulnerability (medium 6.4)
- [CVE-2024-45347](https://insights.sbomify.com/CVE-2024-45347/): Mi Connect Service APP protocol flaws lead to unauthorized access (critical 9.6)
- [CVE-2024-45346](https://insights.sbomify.com/CVE-2024-45346/): GetApps application has code execution vulnerability (high 8.8)
- [CVE-2024-45341](https://insights.sbomify.com/CVE-2024-45341/): Usage of IPv6 zone IDs can bypass URI name constraints in crypto/x509 (medium 6.1)
- [CVE-2024-45340](https://insights.sbomify.com/CVE-2024-45340/): GOAUTH credential leak in cmd/go (high 8.8)
- [CVE-2024-4534](https://insights.sbomify.com/CVE-2024-4534/): KKProgressbar2 Free <= 1.1.4.2 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-45339](https://insights.sbomify.com/CVE-2024-45339/): Vulnerability when creating log files in github.com/golang/glog (high 7.1)
- [CVE-2024-45338](https://insights.sbomify.com/CVE-2024-45338/): Non-linear parsing of case-insensitive content in golang.org/x/net/html (medium 5.3)
- [CVE-2024-45337](https://insights.sbomify.com/CVE-2024-45337/): Misuse of connection.serverAuthenticate may cause authorization bypass in golang.org/x/crypto (critical 9.1)
- [CVE-2024-45336](https://insights.sbomify.com/CVE-2024-45336/): Sensitive headers incorrectly sent after cross-domain redirect in net/http (medium 6.1)
- [CVE-2024-45335](https://insights.sbomify.com/CVE-2024-45335/): Security feature bypass in Trend Micro Antivirus One (high 8.4)
- [CVE-2024-45334](https://insights.sbomify.com/CVE-2024-45334/): Missing authorization in Trend Micro Antivirus One (high 7.8)
- [CVE-2024-45333](https://insights.sbomify.com/CVE-2024-45333/): Missing authorization in Intel(R) Data Center GPU Flex Series for Windows driver (medium 6.9)
- [CVE-2024-45332](https://insights.sbomify.com/CVE-2024-45332/): Information disclosure in Intel(R) Processors (medium 5.7)
- [CVE-2024-45331](https://insights.sbomify.com/CVE-2024-45331/): Privilege escalation in FortiAnalyzer (medium 6.9)
- [CVE-2024-45330](https://insights.sbomify.com/CVE-2024-45330/): Memory corruption in FortiAnalyzer (medium 6.8)
- [CVE-2024-4533](https://insights.sbomify.com/CVE-2024-4533/): KKProgressbar2 Free <= 1.1.4.2 - Admin+ SQL Injection (medium 6.5)
- [CVE-2024-45329](https://insights.sbomify.com/CVE-2024-45329/): Missing authorization in FortiPortal (low 3.9)
- [CVE-2024-45328](https://insights.sbomify.com/CVE-2024-45328/): Privilege escalation in FortiSandbox (high 7.1)
- [CVE-2024-45327](https://insights.sbomify.com/CVE-2024-45327/): Auth bypass in FortiSOAR (high 7.1)
- [CVE-2024-45326](https://insights.sbomify.com/CVE-2024-45326/): Missing authorization in FortiDeceptor (low 3.9)
- [CVE-2024-45325](https://insights.sbomify.com/CVE-2024-45325/): Command injection in FortiDDoS-F (medium 6.5)
- [CVE-2024-45324](https://insights.sbomify.com/CVE-2024-45324/): Memory corruption in FortiOS (high 7.0)
- [CVE-2024-45323](https://insights.sbomify.com/CVE-2024-45323/): Missing authorization in FortiEDR Manager (medium 4.6)
- [CVE-2024-45321](https://insights.sbomify.com/CVE-2024-45321/): Supply chain in app\:\ (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/267/