# Vulnerabilities published in 2024


- [CVE-2024-44387](https://insights.sbomify.com/CVE-2024-44387/): Memory corruption in tenda:fh1206 firmware (medium 6.5)
- [CVE-2024-44386](https://insights.sbomify.com/CVE-2024-44386/): Memory corruption in tenda:fh1206 firmware (high 7.3)
- [CVE-2024-44383](https://insights.sbomify.com/CVE-2024-44383/): Command injection in wayos:fbm-291w firmware (high 8.0)
- [CVE-2024-44382](https://insights.sbomify.com/CVE-2024-44382/): Command injection in dlink:di 8004w firmware (high 8.8)
- [CVE-2024-44381](https://insights.sbomify.com/CVE-2024-44381/): Command injection in dlink:di 8004w firmware (high 8.8)
- [CVE-2024-4438](https://insights.sbomify.com/CVE-2024-4438/): Etcd: incomplete fix for cve-2023-39325/cve-2023-44487 in openstack platform (high 7.5)
- [CVE-2024-44375](https://insights.sbomify.com/CVE-2024-44375/): Memory corruption in dlink:di-8100 firmware (high 7.5)
- [CVE-2024-44373](https://insights.sbomify.com/CVE-2024-44373/): A Path Traversal vulnerability in AllSky v2023.05.01 through v2024.12.06_06 allows an unauthenticated attacker to create a webshell and remo (critical 9.8)
- [CVE-2024-4437](https://insights.sbomify.com/CVE-2024-4437/): Etcd: incomplete fix for cve-2021-44716 in openstack platform (high 7.5)
- [CVE-2024-4436](https://insights.sbomify.com/CVE-2024-4436/): Etcd: incomplete fix for cve-2022-41723 in openstack platform (high 7.5)
- [CVE-2024-4435](https://insights.sbomify.com/CVE-2024-4435/): BTreeMap memory leak when deallocating nodes with overflows (medium 5.9)
- [CVE-2024-44349](https://insights.sbomify.com/CVE-2024-44349/): A SQL injection vulnerability in login portal in AnteeoWMS before v4.7.34 allows unauthenticated attackers to execute arbitrary SQL commands (critical 9.8)
- [CVE-2024-44342](https://insights.sbomify.com/CVE-2024-44342/): Command injection in dlink:dir-846w firmware (high 8.8)
- [CVE-2024-44341](https://insights.sbomify.com/CVE-2024-44341/): Command injection in dlink:dir-846w firmware (high 8.8)
- [CVE-2024-44340](https://insights.sbomify.com/CVE-2024-44340/): Command injection in dlink:dir-846w firmware (high 8.8)
- [CVE-2024-4434](https://insights.sbomify.com/CVE-2024-4434/): LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Time-Based SQL Injection (critical 9.8)
- [CVE-2024-44337](https://insights.sbomify.com/CVE-2024-44337/): Infinite loop in github.com/gomarkdown/markdown (medium 5.1)
- [CVE-2024-44336](https://insights.sbomify.com/CVE-2024-44336/): An issue in AnkiDroid Android Application v2.17.6 allows attackers to retrieve internal files from the /data/data/com.ichi2.anki/ directory (medium 5.3)
- [CVE-2024-44335](https://insights.sbomify.com/CVE-2024-44335/): D-Link DI-7003G v19.12.24A1, DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v2 (high 8.8)
- [CVE-2024-44334](https://insights.sbomify.com/CVE-2024-44334/): D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400 (high 8.8)
- [CVE-2024-44333](https://insights.sbomify.com/CVE-2024-44333/): D-Link DI-7003GV2 v24.04.18D1, DI-7100G+V2 v24.04.18D1, DI-7100GV2 v24.04.18D1, DI-7200GV2 v24.04.18E1, DI-7300G+V2 v24.04.18D1, and DI-7400 (high 8.8)
- [CVE-2024-44331](https://insights.sbomify.com/CVE-2024-44331/): Incorrect Access Control in GStreamer RTSP server 1.25.0 in gst-rtsp-server/rtsp-media.c allows remote attackers to cause a denial of servic (high 7.5)
- [CVE-2024-4433](https://insights.sbomify.com/CVE-2024-4433/): WordPress Simple Image Popup plugin <= 2.4.0 - Cross-Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-4432](https://insights.sbomify.com/CVE-2024-4432/): Piotnet Addons For Elementor <= 2.4.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (medium 6.4)
- [CVE-2024-44314](https://insights.sbomify.com/CVE-2024-44314/): TastyIgniter Has an Incorrect Access Control Vulnerability (medium 6.5)
- [CVE-2024-44313](https://insights.sbomify.com/CVE-2024-44313/): TastyIgniter Has an Incorrect Access Control Vulnerability via `invoice()` Function (high 8.1)
- [CVE-2024-4431](https://insights.sbomify.com/CVE-2024-4431/): Cross-site scripting in LA-Studio Element Kit for Elementor (medium 6.4)
- [CVE-2024-44309](https://insights.sbomify.com/CVE-2024-44309/): Apple Multiple Products Cross-Site Scripting (XSS) (medium 6.3, exploited in the wild)
- [CVE-2024-44308](https://insights.sbomify.com/CVE-2024-44308/): Apple Multiple Products Code Execution (high 8.8, exploited in the wild)
- [CVE-2024-44307](https://insights.sbomify.com/CVE-2024-44307/): Memory corruption in macOS (high 7.8)
- [CVE-2024-44306](https://insights.sbomify.com/CVE-2024-44306/): Memory corruption in macOS (high 7.8)
- [CVE-2024-44305](https://insights.sbomify.com/CVE-2024-44305/): Privilege escalation in macOS (high 7.8)
- [CVE-2024-44303](https://insights.sbomify.com/CVE-2024-44303/): Security feature bypass in macOS (high 7.5)
- [CVE-2024-44302](https://insights.sbomify.com/CVE-2024-44302/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-44301](https://insights.sbomify.com/CVE-2024-44301/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-44300](https://insights.sbomify.com/CVE-2024-44300/): Business logic in macOS (medium 5.5)
- [CVE-2024-4430](https://insights.sbomify.com/CVE-2024-4430/): Beaver Builder <= 2.8.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photo widget crop attribute (medium 6.4)
- [CVE-2024-44299](https://insights.sbomify.com/CVE-2024-44299/): Memory corruption in iOS and iPadOS (high 8.8)
- [CVE-2024-44298](https://insights.sbomify.com/CVE-2024-44298/): Information disclosure in macOS (medium 5.5)
- [CVE-2024-44297](https://insights.sbomify.com/CVE-2024-44297/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2024-44296](https://insights.sbomify.com/CVE-2024-44296/): Security feature bypass in Safari (medium 5.4)
- [CVE-2024-44295](https://insights.sbomify.com/CVE-2024-44295/): Missing authorization in macOS (high 7.7)
- [CVE-2024-44294](https://insights.sbomify.com/CVE-2024-44294/): Path traversal in macOS (medium 6.5)
- [CVE-2024-44293](https://insights.sbomify.com/CVE-2024-44293/): Information disclosure in macOS (medium 5.5)
- [CVE-2024-44292](https://insights.sbomify.com/CVE-2024-44292/): Information disclosure in macOS (medium 5.5)
- [CVE-2024-44291](https://insights.sbomify.com/CVE-2024-44291/): Privilege escalation in macOS (high 7.8)
- [CVE-2024-44290](https://insights.sbomify.com/CVE-2024-44290/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2024-4429](https://insights.sbomify.com/CVE-2024-4429/): Cross Site Request Forgery vulnerability in iManager (medium 5.4)
- [CVE-2024-44289](https://insights.sbomify.com/CVE-2024-44289/): Information disclosure in macOS (high 7.5)
- [CVE-2024-44287](https://insights.sbomify.com/CVE-2024-44287/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-44286](https://insights.sbomify.com/CVE-2024-44286/): Auth bypass in macOS (high 7.5)
- [CVE-2024-44285](https://insights.sbomify.com/CVE-2024-44285/): Use after free in iOS and iPadOS (high 8.4)
- [CVE-2024-44284](https://insights.sbomify.com/CVE-2024-44284/): Memory corruption in macOS (medium 6.5)
- [CVE-2024-44283](https://insights.sbomify.com/CVE-2024-44283/): Memory corruption in macOS (medium 6.5)
- [CVE-2024-44282](https://insights.sbomify.com/CVE-2024-44282/): Memory corruption in iOS and iPadOS (medium 6.5)
- [CVE-2024-44281](https://insights.sbomify.com/CVE-2024-44281/): Memory corruption in macOS (medium 5.5)
- [CVE-2024-44280](https://insights.sbomify.com/CVE-2024-44280/): Security feature bypass in macOS (high 7.7)
- [CVE-2024-4428](https://insights.sbomify.com/CVE-2024-4428/): Sensetive Data Exposure in Menulux Managment Portal (medium 6.9)
- [CVE-2024-44279](https://insights.sbomify.com/CVE-2024-44279/): Memory corruption in macOS (medium 6.5)
- [CVE-2024-44278](https://insights.sbomify.com/CVE-2024-44278/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-44277](https://insights.sbomify.com/CVE-2024-44277/): Memory corruption in iOS and iPadOS (high 7.7)
- [CVE-2024-44276](https://insights.sbomify.com/CVE-2024-44276/): Information disclosure in iOS and iPadOS (high 7.3)
- [CVE-2024-44275](https://insights.sbomify.com/CVE-2024-44275/): Security feature bypass in macOS (low 3.3)
- [CVE-2024-44274](https://insights.sbomify.com/CVE-2024-44274/): Auth bypass in iOS and iPadOS (medium 4.6)
- [CVE-2024-44273](https://insights.sbomify.com/CVE-2024-44273/): Path traversal in iOS and iPadOS (medium 5.5)
- [CVE-2024-44271](https://insights.sbomify.com/CVE-2024-44271/): Security feature bypass in macOS (low 3.3)
- [CVE-2024-44270](https://insights.sbomify.com/CVE-2024-44270/): Security feature bypass in macOS (high 7.5)
- [CVE-2024-4427](https://insights.sbomify.com/CVE-2024-4427/): Comparison Slider <= 1.0.5 - Missing Authorization (medium 4.3)
- [CVE-2024-44269](https://insights.sbomify.com/CVE-2024-44269/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2024-44267](https://insights.sbomify.com/CVE-2024-44267/): Security feature bypass in macOS (low 2.7)
- [CVE-2024-44265](https://insights.sbomify.com/CVE-2024-44265/): Missing authorization in macOS (high 7.5)
- [CVE-2024-44264](https://insights.sbomify.com/CVE-2024-44264/): Path traversal in macOS (high 7.5)
- [CVE-2024-44263](https://insights.sbomify.com/CVE-2024-44263/): Business logic in iOS and iPadOS (medium 4.0)
- [CVE-2024-44262](https://insights.sbomify.com/CVE-2024-44262/): Information disclosure in visionOS (medium 5.5)
- [CVE-2024-44261](https://insights.sbomify.com/CVE-2024-44261/): Security feature bypass in iOS and iPadOS (medium 6.2)
- [CVE-2024-44260](https://insights.sbomify.com/CVE-2024-44260/): Other in macOS (medium 6.7)
- [CVE-2024-4426](https://insights.sbomify.com/CVE-2024-4426/): Comparison Slider <= 1.0.5 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-44259](https://insights.sbomify.com/CVE-2024-44259/): Security feature bypass in Safari (high 8.8)
- [CVE-2024-44258](https://insights.sbomify.com/CVE-2024-44258/): Path traversal in iOS and iPadOS (high 7.1)
- [CVE-2024-44257](https://insights.sbomify.com/CVE-2024-44257/): Information disclosure in macOS (medium 6.2)
- [CVE-2024-44256](https://insights.sbomify.com/CVE-2024-44256/): Security feature bypass in macOS (critical 9.3)
- [CVE-2024-44255](https://insights.sbomify.com/CVE-2024-44255/): Path traversal in iOS and iPadOS (high 8.4)
- [CVE-2024-44254](https://insights.sbomify.com/CVE-2024-44254/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-44253](https://insights.sbomify.com/CVE-2024-44253/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-44252](https://insights.sbomify.com/CVE-2024-44252/): Business logic in iOS and iPadOS (high 7.1)
- [CVE-2024-44251](https://insights.sbomify.com/CVE-2024-44251/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2024-44250](https://insights.sbomify.com/CVE-2024-44250/): Privilege escalation in macOS (high 8.2)
- [CVE-2024-4425](https://insights.sbomify.com/CVE-2024-4425/): Storing credentials in plaintext in CemiPark (medium 5.4)
- [CVE-2024-44248](https://insights.sbomify.com/CVE-2024-44248/): Missing authorization in macOS (medium 6.5)
- [CVE-2024-44247](https://insights.sbomify.com/CVE-2024-44247/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-44246](https://insights.sbomify.com/CVE-2024-44246/): Information disclosure in Safari (medium 4.3)
- [CVE-2024-44245](https://insights.sbomify.com/CVE-2024-44245/): Memory corruption in iOS and iPadOS (high 7.1)
- [CVE-2024-44244](https://insights.sbomify.com/CVE-2024-44244/): Memory corruption in Safari (medium 4.3)
- [CVE-2024-44243](https://insights.sbomify.com/CVE-2024-44243/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-44242](https://insights.sbomify.com/CVE-2024-44242/): Memory corruption in iOS and iPadOS (critical 9.8)
- [CVE-2024-44241](https://insights.sbomify.com/CVE-2024-44241/): Memory corruption in iOS and iPadOS (critical 9.8)
- [CVE-2024-44240](https://insights.sbomify.com/CVE-2024-44240/): Information disclosure in iOS and iPadOS (medium 6.5)
- [CVE-2024-4424](https://insights.sbomify.com/CVE-2024-4424/): Stored XSS in CemiPark (medium 6.1)
- [CVE-2024-44239](https://insights.sbomify.com/CVE-2024-44239/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-44238](https://insights.sbomify.com/CVE-2024-44238/): Memory corruption in iOS and iPadOS (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/274/