# Vulnerabilities published in 2024


- [CVE-2024-45112](https://insights.sbomify.com/CVE-2024-45112/): Acrobat Reader | Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843) (high 7.8)
- [CVE-2024-45111](https://insights.sbomify.com/CVE-2024-45111/): Illustrator | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-4511](https://insights.sbomify.com/CVE-2024-4511/): Shanghai Sunfull Automation BACnet Server HMI1002-ARM Message buffer overflow (medium 6.3)
- [CVE-2024-45109](https://insights.sbomify.com/CVE-2024-45109/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-45108](https://insights.sbomify.com/CVE-2024-45108/): Photoshop Desktop | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-45107](https://insights.sbomify.com/CVE-2024-45107/): ZDI-CAN-24186: Adobe Acrobat Reader DC Doc Object Use-After-Free Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-45106](https://insights.sbomify.com/CVE-2024-45106/): Apache Ozone: Improper authentication when generating S3 secrets (high 8.1)
- [CVE-2024-45105](https://insights.sbomify.com/CVE-2024-45105/): Privilege escalation in HX1331 Certified Node (ThinkAgile) BIOS (medium 6.7)
- [CVE-2024-45104](https://insights.sbomify.com/CVE-2024-45104/): Missing authorization in XClarity Administrator (medium 6.3)
- [CVE-2024-45103](https://insights.sbomify.com/CVE-2024-45103/): Missing authorization in XClarity Administrator (medium 4.3)
- [CVE-2024-45102](https://insights.sbomify.com/CVE-2024-45102/): Privilege escalation in XClarity Administrator (medium 6.8)
- [CVE-2024-45101](https://insights.sbomify.com/CVE-2024-45101/): Information disclosure in XClarity Administrator (medium 6.8)
- [CVE-2024-45100](https://insights.sbomify.com/CVE-2024-45100/): IBM Security QRadar EDR denial of service (medium 4.9)
- [CVE-2024-4510](https://insights.sbomify.com/CVE-2024-4510/): Ruijie RG-UAC arp_add_commit.php os command injection (medium 4.7)
- [CVE-2024-45099](https://insights.sbomify.com/CVE-2024-45099/): IBM Security ReaQta cross-site scripting (low 3.1)
- [CVE-2024-45098](https://insights.sbomify.com/CVE-2024-45098/): IBM Aspera Faspex bypass security (medium 6.8)
- [CVE-2024-45097](https://insights.sbomify.com/CVE-2024-45097/): IBM Aspera Faspex bypass security (medium 5.9)
- [CVE-2024-45096](https://insights.sbomify.com/CVE-2024-45096/): IBM Aspera Faspex information disclosure (medium 6.5)
- [CVE-2024-45094](https://insights.sbomify.com/CVE-2024-45094/): IBM DS8900F and DS8A00 Hardware Management Console (HMC) cross-site scripting (medium 5.5)
- [CVE-2024-45091](https://insights.sbomify.com/CVE-2024-45091/): IBM UrbanCode Deploy information disclosure (medium 6.2)
- [CVE-2024-4509](https://insights.sbomify.com/CVE-2024-4509/): Ruijie RG-UAC add_commit.php os command injection (medium 4.7)
- [CVE-2024-45089](https://insights.sbomify.com/CVE-2024-45089/): IBM Sterling B2B Integrator information disclosure (medium 4.3)
- [CVE-2024-45088](https://insights.sbomify.com/CVE-2024-45088/): IBM Maximo Asset Management cross-site scripting (medium 6.4)
- [CVE-2024-45087](https://insights.sbomify.com/CVE-2024-45087/): IBM WebSphere Application Server cross-site scripting (medium 4.8)
- [CVE-2024-45086](https://insights.sbomify.com/CVE-2024-45086/): IBM WebSphere Application Server XML external entity injection (medium 5.5)
- [CVE-2024-45085](https://insights.sbomify.com/CVE-2024-45085/): IBM WebSphere Application Server denial of service (medium 5.9)
- [CVE-2024-45084](https://insights.sbomify.com/CVE-2024-45084/): IBM Cognos Controller CSV injection (high 8.0)
- [CVE-2024-45082](https://insights.sbomify.com/CVE-2024-45082/): IBM Cognos Analytics HTTP open redirection (medium 6.8)
- [CVE-2024-45081](https://insights.sbomify.com/CVE-2024-45081/): IBM Cognos Controller incorrect authorization (medium 6.5)
- [CVE-2024-4508](https://insights.sbomify.com/CVE-2024-4508/): Ruijie RG-UAC static_route_edit_ipv6.php os command injection (medium 4.7)
- [CVE-2024-45077](https://insights.sbomify.com/CVE-2024-45077/): IBM Maximo Asset Management file upload (medium 6.5)
- [CVE-2024-45076](https://insights.sbomify.com/CVE-2024-45076/): IBM webMethods Integration code execution (critical 9.9)
- [CVE-2024-45075](https://insights.sbomify.com/CVE-2024-45075/): IBM webMethods Integration privilege escalation (high 8.8)
- [CVE-2024-45074](https://insights.sbomify.com/CVE-2024-45074/): IBM webMethods Integration directory traversal (medium 6.5)
- [CVE-2024-45073](https://insights.sbomify.com/CVE-2024-45073/): IBM WebSphere Application Server cross-site scripting (medium 4.8)
- [CVE-2024-45072](https://insights.sbomify.com/CVE-2024-45072/): IBM WebSphere Application Server XML external entity injection (medium 5.5)
- [CVE-2024-45071](https://insights.sbomify.com/CVE-2024-45071/): IBM WebSphere Application Server cross-site scripting (medium 5.5)
- [CVE-2024-45070](https://insights.sbomify.com/CVE-2024-45070/): Liteos_a has an out-of-bounds read vulnerability (medium 5.5)
- [CVE-2024-4507](https://insights.sbomify.com/CVE-2024-4507/): Ruijie RG-UAC static_route_add_ipv6.php os command injection (medium 4.7)
- [CVE-2024-45068](https://insights.sbomify.com/CVE-2024-45068/): Authentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA (high 7.1)
- [CVE-2024-45067](https://insights.sbomify.com/CVE-2024-45067/): Misconfiguration in Intel(R) Gaudi(R) software installers (medium 5.4)
- [CVE-2024-45066](https://insights.sbomify.com/CVE-2024-45066/): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection (critical 10.0)
- [CVE-2024-45064](https://insights.sbomify.com/CVE-2024-45064/): Memory corruption in X-CUBE-AZRT-H7RS (high 8.5)
- [CVE-2024-45063](https://insights.sbomify.com/CVE-2024-45063/): Multiple issues in ctl(4) CAM Target Layer (critical 9.8)
- [CVE-2024-45062](https://insights.sbomify.com/CVE-2024-45062/): Memory corruption in ippusbxd (medium 6.4)
- [CVE-2024-45061](https://insights.sbomify.com/CVE-2024-45061/): Cross-site scripting in Observium (high 8.7)
- [CVE-2024-45060](https://insights.sbomify.com/CVE-2024-45060/): Unauthenticated Cross-Site-Scripting (XSS) in sample file in PHPSpreadsheet (high 7.1)
- [CVE-2024-4506](https://insights.sbomify.com/CVE-2024-4506/): Ruijie RG-UAC ip_addr_edit_commit.php os command injection (medium 4.7)
- [CVE-2024-45059](https://insights.sbomify.com/CVE-2024-45059/): Authenticated SQL Injection in i-Educar (high 8.8)
- [CVE-2024-45058](https://insights.sbomify.com/CVE-2024-45058/): Privilege escalation in i-Educar (high 8.1)
- [CVE-2024-45057](https://insights.sbomify.com/CVE-2024-45057/): Reflected Cross-Site Scripting in i-Educar (medium 6.3)
- [CVE-2024-45056](https://insights.sbomify.com/CVE-2024-45056/): `fold (xor (shl 1, x), -1) -> (rotl ~1, x)` misoptimization in zksolc (medium 5.9)
- [CVE-2024-45054](https://insights.sbomify.com/CVE-2024-45054/): Potential Permission Leakage of Cluster Level in hwameistor (low 2.8)
- [CVE-2024-45053](https://insights.sbomify.com/CVE-2024-45053/): Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine (critical 9.1)
- [CVE-2024-45052](https://insights.sbomify.com/CVE-2024-45052/): Fides Webserver Authentication Timing-Based Username Enumeration Vulnerability (medium 5.3)
- [CVE-2024-45051](https://insights.sbomify.com/CVE-2024-45051/): Bypass of email address validation via encoded email addresses in Discourse (high 8.2)
- [CVE-2024-45050](https://insights.sbomify.com/CVE-2024-45050/): Ringer Server Does Not Check Members When Loading Messages (high 7.1)
- [CVE-2024-4505](https://insights.sbomify.com/CVE-2024-4505/): Ruijie RG-UAC ip_addr_add_commit.php os command injection (medium 4.7)
- [CVE-2024-45049](https://insights.sbomify.com/CVE-2024-45049/): Nix Hydra Missing authentication when triggering evaluations (high 7.5)
- [CVE-2024-45048](https://insights.sbomify.com/CVE-2024-45048/): XML External Entity Reference (XXE) in PHPSpreadsheet (high 8.8)
- [CVE-2024-45047](https://insights.sbomify.com/CVE-2024-45047/): Potential mXSS vulnerability due to improper HTML escaping in svelte (medium 5.4)
- [CVE-2024-45046](https://insights.sbomify.com/CVE-2024-45046/): PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information (medium 5.4)
- [CVE-2024-45045](https://insights.sbomify.com/CVE-2024-45045/): JavaScript Injection via url encoded values in links in Collabora Office Android (medium 6.3)
- [CVE-2024-45044](https://insights.sbomify.com/CVE-2024-45044/): Bareos's negative command ACLs can be circumvented by abbreviating commands (high 8.8)
- [CVE-2024-45043](https://insights.sbomify.com/CVE-2024-45043/): OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability (medium 5.3)
- [CVE-2024-45042](https://insights.sbomify.com/CVE-2024-45042/): Ory Kratos's `highest_available` setting does not properly respect code + mfa credentials (medium 4.4)
- [CVE-2024-45041](https://insights.sbomify.com/CVE-2024-45041/): External Secrets Operator vulnerable to privilege escalation (high 8.3)
- [CVE-2024-45040](https://insights.sbomify.com/CVE-2024-45040/): gnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge property (medium 5.9)
- [CVE-2024-4504](https://insights.sbomify.com/CVE-2024-4504/): Ruijie RG-UAC commit.php os command injection (medium 4.7)
- [CVE-2024-45039](https://insights.sbomify.com/CVE-2024-45039/): gnark's Groth16 commitment extension unsound for more than one commitment (medium 6.2)
- [CVE-2024-45038](https://insights.sbomify.com/CVE-2024-45038/): Device crash via malformed MQTT packet when downlink is enabled in Meshtastic device firmware (high 7.5)
- [CVE-2024-45037](https://insights.sbomify.com/CVE-2024-45037/): AWS CDK RestApi not generating authorizationScope correctly in resultant CFN template (medium 6.4)
- [CVE-2024-45036](https://insights.sbomify.com/CVE-2024-45036/): Improper Access Control Vulnerability When Accessing a Maliciously Crafted Tophat Link (medium 4.3)
- [CVE-2024-45034](https://insights.sbomify.com/CVE-2024-45034/): Apache Airflow: Authenticated DAG authors could execute code on scheduler nodes (high 8.8)
- [CVE-2024-45033](https://insights.sbomify.com/CVE-2024-45033/): Apache Airflow Fab Provider: Application does not invalidate session after password change via Airflow cli (high 8.1)
- [CVE-2024-45032](https://insights.sbomify.com/CVE-2024-45032/): Auth bypass in Industrial Edge Management Pro (critical 10.0)
- [CVE-2024-45031](https://insights.sbomify.com/CVE-2024-45031/): Apache Syncope: Stored XSS in Console and Enduser (medium 6.1)
- [CVE-2024-45030](https://insights.sbomify.com/CVE-2024-45030/): igb: cope with large MAX_SKB_FRAGS (critical 9.8)
- [CVE-2024-4503](https://insights.sbomify.com/CVE-2024-4503/): Ruijie RG-UAC dhcp_relay_commit.php os command injection (medium 4.7)
- [CVE-2024-45029](https://insights.sbomify.com/CVE-2024-45029/): i2c: tegra: Do not mark ACPI devices as irq safe (medium 5.5)
- [CVE-2024-45028](https://insights.sbomify.com/CVE-2024-45028/): mmc: mmc_test: Fix NULL dereference on allocation failure (medium 5.5)
- [CVE-2024-45027](https://insights.sbomify.com/CVE-2024-45027/): usb: xhci: Check for xhci->interrupters being allocated in xhci_mem_clearup() (medium 5.5)
- [CVE-2024-45026](https://insights.sbomify.com/CVE-2024-45026/): s390/dasd: fix error recovery leading to data corruption on ESE devices (high 7.0)
- [CVE-2024-45025](https://insights.sbomify.com/CVE-2024-45025/): fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE (medium 5.5)
- [CVE-2024-45024](https://insights.sbomify.com/CVE-2024-45024/): mm/hugetlb: fix hugetlb vs. core-mm PT locking (high 7.8)
- [CVE-2024-45023](https://insights.sbomify.com/CVE-2024-45023/): md/raid1: Fix data corruption for degraded array with slow disk (high 7.8)
- [CVE-2024-45022](https://insights.sbomify.com/CVE-2024-45022/): mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 (high 7.8)
- [CVE-2024-45021](https://insights.sbomify.com/CVE-2024-45021/): memcg_write_event_control(): fix a user-triggerable oops (high 7.1)
- [CVE-2024-45020](https://insights.sbomify.com/CVE-2024-45020/): bpf: Fix a kernel verifier crash in stacksafe() (high 7.8)
- [CVE-2024-4502](https://insights.sbomify.com/CVE-2024-4502/): Ruijie RG-UAC dhcp_client_commit.php os command injection (medium 4.7)
- [CVE-2024-45019](https://insights.sbomify.com/CVE-2024-45019/): net/mlx5e: Take state lock during tx timeout reporter (high 7.8)
- [CVE-2024-45018](https://insights.sbomify.com/CVE-2024-45018/): netfilter: flowtable: initialise extack before use (medium 5.5)
- [CVE-2024-45017](https://insights.sbomify.com/CVE-2024-45017/): net/mlx5: Fix IPsec RoCE MPV trace call (high 7.8)
- [CVE-2024-45016](https://insights.sbomify.com/CVE-2024-45016/): netem: fix return value if duplicate enqueue fails (high 7.8)
- [CVE-2024-45015](https://insights.sbomify.com/CVE-2024-45015/): drm/msm/dpu: move dpu_encoder's connector assignment to atomic_enable() (medium 5.5)
- [CVE-2024-45014](https://insights.sbomify.com/CVE-2024-45014/): s390/boot: Avoid possible physmem_info segment corruption (medium 5.5)
- [CVE-2024-45013](https://insights.sbomify.com/CVE-2024-45013/): nvme: move stopping keep-alive into nvme_uninit_ctrl() (critical 9.8)
- [CVE-2024-45012](https://insights.sbomify.com/CVE-2024-45012/): nouveau/firmware: use dma non-coherent allocator (medium 5.5)
- [CVE-2024-45011](https://insights.sbomify.com/CVE-2024-45011/): char: xillybus: Check USB endpoints when probing device (medium 5.5)
- [CVE-2024-45010](https://insights.sbomify.com/CVE-2024-45010/): mptcp: pm: only mark 'subflow' endp as available (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/270/