# Vulnerabilities published in 2024


- [CVE-2024-43737](https://insights.sbomify.com/CVE-2024-43737/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43736](https://insights.sbomify.com/CVE-2024-43736/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43735](https://insights.sbomify.com/CVE-2024-43735/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43734](https://insights.sbomify.com/CVE-2024-43734/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43733](https://insights.sbomify.com/CVE-2024-43733/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43732](https://insights.sbomify.com/CVE-2024-43732/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 4.6)
- [CVE-2024-43731](https://insights.sbomify.com/CVE-2024-43731/): Adobe Experience Manager | Improper Authorization (CWE-285) (medium 4.3)
- [CVE-2024-43730](https://insights.sbomify.com/CVE-2024-43730/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-4373](https://insights.sbomify.com/CVE-2024-4373/): Cross-site scripting in Sina Extension for Elementor (medium 6.4)
- [CVE-2024-43729](https://insights.sbomify.com/CVE-2024-43729/): Adobe Experience Manager | Improper Authorization (CWE-285) (medium 6.5)
- [CVE-2024-43728](https://insights.sbomify.com/CVE-2024-43728/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43727](https://insights.sbomify.com/CVE-2024-43727/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43726](https://insights.sbomify.com/CVE-2024-43726/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43725](https://insights.sbomify.com/CVE-2024-43725/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43724](https://insights.sbomify.com/CVE-2024-43724/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43723](https://insights.sbomify.com/CVE-2024-43723/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43722](https://insights.sbomify.com/CVE-2024-43722/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43721](https://insights.sbomify.com/CVE-2024-43721/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43720](https://insights.sbomify.com/CVE-2024-43720/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-4372](https://insights.sbomify.com/CVE-2024-4372/): Carousel Slider < 2.2.11 - Editor+ Stored XSS (medium 5.4)
- [CVE-2024-43719](https://insights.sbomify.com/CVE-2024-43719/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43718](https://insights.sbomify.com/CVE-2024-43718/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43717](https://insights.sbomify.com/CVE-2024-43717/): Adobe Experience Manager | Improper Access Control (CWE-284) (medium 4.3)
- [CVE-2024-43716](https://insights.sbomify.com/CVE-2024-43716/): Adobe Experience Manager | Improper Access Control (CWE-284) (medium 4.3)
- [CVE-2024-43715](https://insights.sbomify.com/CVE-2024-43715/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43714](https://insights.sbomify.com/CVE-2024-43714/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43713](https://insights.sbomify.com/CVE-2024-43713/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43712](https://insights.sbomify.com/CVE-2024-43712/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-43710](https://insights.sbomify.com/CVE-2024-43710/): Kibana server-side request forgery (medium 4.3)
- [CVE-2024-4371](https://insights.sbomify.com/CVE-2024-4371/): Deserialization in CoDesigner – All in One Elementor WooCommerce Builder (critical 9.0)
- [CVE-2024-43709](https://insights.sbomify.com/CVE-2024-43709/): Elasticsearch allocation of resources without limits or throttling leads to crash (medium 6.5)
- [CVE-2024-43708](https://insights.sbomify.com/CVE-2024-43708/): Denial of service in Kibana (medium 6.5)
- [CVE-2024-43707](https://insights.sbomify.com/CVE-2024-43707/): Kibana exposure of sensitive information to an unauthorized actor (high 7.7)
- [CVE-2024-43706](https://insights.sbomify.com/CVE-2024-43706/): Kibana Improper Authorization (high 7.6)
- [CVE-2024-43705](https://insights.sbomify.com/CVE-2024-43705/): Security feature bypass in Graphics DDK (high 7.8)
- [CVE-2024-43704](https://insights.sbomify.com/CVE-2024-43704/): GPU DDK - PowerVR: PVRSRVAcquireProcessHandleBase can cause psProcessHandleBase reuse when PIDs are reused (high 8.4)
- [CVE-2024-43703](https://insights.sbomify.com/CVE-2024-43703/): GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF (high 8.1)
- [CVE-2024-43702](https://insights.sbomify.com/CVE-2024-43702/): GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages (high 8.1)
- [CVE-2024-43701](https://insights.sbomify.com/CVE-2024-43701/): GPU DDK - PowerVR: TLB invalidate UAF of dma_buf imported into multiple GPU devices (high 7.8)
- [CVE-2024-43700](https://insights.sbomify.com/CVE-2024-43700/): Memory corruption in xfpt (high 7.0)
- [CVE-2024-4370](https://insights.sbomify.com/CVE-2024-4370/): Cross-site scripting in WPZOOM Addons for Elementor – Starter Templates & Widgets (medium 6.4)
- [CVE-2024-43699](https://insights.sbomify.com/CVE-2024-43699/): Delta Electronics DIAEnergie SQL Injection (critical 9.3)
- [CVE-2024-43698](https://insights.sbomify.com/CVE-2024-43698/): Kieback&Peter DDC4000 Series Use of Weak Credentials (critical 9.3)
- [CVE-2024-43697](https://insights.sbomify.com/CVE-2024-43697/): Liteos_a has an Improper Input Validation vulnerability (low 3.3)
- [CVE-2024-43696](https://insights.sbomify.com/CVE-2024-43696/): Liteos_a has an Memory Leak vulnerability (low 3.3)
- [CVE-2024-43694](https://insights.sbomify.com/CVE-2024-43694/): goTenna Pro ATAK Plugin Insecure Storage of Sensitive Information (medium 5.1)
- [CVE-2024-43693](https://insights.sbomify.com/CVE-2024-43693/): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Command Injection (critical 10.0)
- [CVE-2024-43692](https://insights.sbomify.com/CVE-2024-43692/): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Authentication Bypass Using an Alternate Path or Channel (critical 9.3)
- [CVE-2024-43690](https://insights.sbomify.com/CVE-2024-43690/): Code injection in Command Centre Server (high 8.0)
- [CVE-2024-4369](https://insights.sbomify.com/CVE-2024-4369/): Cluster-image-registry-operator: exposes a secret via env variable in pod definition on azure (medium 6.8)
- [CVE-2024-43689](https://insights.sbomify.com/CVE-2024-43689/): Memory corruption in WAB-I1750-PS (high 8.8)
- [CVE-2024-43688](https://insights.sbomify.com/CVE-2024-43688/): cron/entry.c in vixie cron before 9cc8ab1, as used in OpenBSD 7.4 and 7.5, allows a heap-based buffer underflow and memory corruption. (high 7.3)
- [CVE-2024-43687](https://insights.sbomify.com/CVE-2024-43687/): XSS vulnerability in bannerconfig endpoint in TimeProvider 4100 (high 7.7)
- [CVE-2024-43686](https://insights.sbomify.com/CVE-2024-43686/): Reflected XSS in TimeProvider 4100 chart component (medium 5.4)
- [CVE-2024-43685](https://insights.sbomify.com/CVE-2024-43685/): Session token fixation in TimeProvider 4100 (high 8.7)
- [CVE-2024-43684](https://insights.sbomify.com/CVE-2024-43684/): Cross-Site Request Forgery vulnerability in TimeProvider 4100 (high 8.7)
- [CVE-2024-43683](https://insights.sbomify.com/CVE-2024-43683/): Improper verification of the Host header in TimeProvider 4100 (high 8.7)
- [CVE-2024-4368](https://insights.sbomify.com/CVE-2024-4368/): Use after free in Chrome (medium 6.3)
- [CVE-2024-4367](https://insights.sbomify.com/CVE-2024-4367/): PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF (medium 5.6)
- [CVE-2024-43663](https://insights.sbomify.com/CVE-2024-43663/): Buffer overflow vulnerabilities in CGI scripts lead to segfault (medium 5.3)
- [CVE-2024-43662](https://insights.sbomify.com/CVE-2024-43662/): Authenticated arbitrary file upload to /tmp/ and /tmp/upload/ (medium 5.3)
- [CVE-2024-43661](https://insights.sbomify.com/CVE-2024-43661/): Buffer overflow in <redacted>.so leads to DoS of OCPP service (high 7.1)
- [CVE-2024-43660](https://insights.sbomify.com/CVE-2024-43660/): Arbitrary file download using <redacted>.sh (high 7.1)
- [CVE-2024-4366](https://insights.sbomify.com/CVE-2024-4366/): Spectra – WordPress Gutenberg Blocks <= 2.13.0 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-43659](https://insights.sbomify.com/CVE-2024-43659/): Plaintext default credentials in firmware (high 8.3)
- [CVE-2024-43658](https://insights.sbomify.com/CVE-2024-43658/): Path traversal in Iocharger firmware for AC models (high 7.2)
- [CVE-2024-43657](https://insights.sbomify.com/CVE-2024-43657/): Command injection in Iocharger firmware for AC models (critical 9.3)
- [CVE-2024-43656](https://insights.sbomify.com/CVE-2024-43656/): Command injection in Iocharger firmware for AC models (critical 9.3)
- [CVE-2024-43655](https://insights.sbomify.com/CVE-2024-43655/): Any authenticated users can execute OS commands as root using the <redacted>.sh CGI script. (critical 9.3)
- [CVE-2024-43654](https://insights.sbomify.com/CVE-2024-43654/): Command injection in Iocharger firmware for AC models (critical 9.3)
- [CVE-2024-43653](https://insights.sbomify.com/CVE-2024-43653/): Command injection in Iocharger firmware for AC models (critical 9.3)
- [CVE-2024-43652](https://insights.sbomify.com/CVE-2024-43652/): Command injection in Iocharger firmware for AC chargers (critical 9.3)
- [CVE-2024-43651](https://insights.sbomify.com/CVE-2024-43651/): Command injection in Iocharger firmware for AC models (critical 9.3)
- [CVE-2024-43650](https://insights.sbomify.com/CVE-2024-43650/): Command injection in Iocharger firmware for AC models (critical 9.3)
- [CVE-2024-4365](https://insights.sbomify.com/CVE-2024-4365/): Advanced iFrame <= 2024.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-43649](https://insights.sbomify.com/CVE-2024-43649/): Authenticated command injection via <redacted>.exe <redacted> parameter (critical 9.3)
- [CVE-2024-43648](https://insights.sbomify.com/CVE-2024-43648/): Authenticated command injection via <redacted>.exe <redacted> parameter (critical 9.3)
- [CVE-2024-43647](https://insights.sbomify.com/CVE-2024-43647/): Denial of service in SIMATIC S7-200 SMART CPU CR40 (high 8.7)
- [CVE-2024-43646](https://insights.sbomify.com/CVE-2024-43646/): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2024-43645](https://insights.sbomify.com/CVE-2024-43645/): Windows Defender Application Control (WDAC) Security Feature Bypass Vulnerability (medium 6.7)
- [CVE-2024-43644](https://insights.sbomify.com/CVE-2024-43644/): Windows Client-Side Caching Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43643](https://insights.sbomify.com/CVE-2024-43643/): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2024-43642](https://insights.sbomify.com/CVE-2024-43642/): Windows SMB Denial of Service Vulnerability (high 7.5)
- [CVE-2024-43641](https://insights.sbomify.com/CVE-2024-43641/): Windows Registry Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43640](https://insights.sbomify.com/CVE-2024-43640/): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-4364](https://insights.sbomify.com/CVE-2024-4364/): Qi Addons For Elementor <= 1.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (medium 6.4)
- [CVE-2024-43639](https://insights.sbomify.com/CVE-2024-43639/): Windows KDC Proxy Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-43638](https://insights.sbomify.com/CVE-2024-43638/): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2024-43637](https://insights.sbomify.com/CVE-2024-43637/): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2024-43636](https://insights.sbomify.com/CVE-2024-43636/): Win32k Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43635](https://insights.sbomify.com/CVE-2024-43635/): Windows Telephony Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43634](https://insights.sbomify.com/CVE-2024-43634/): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2024-43633](https://insights.sbomify.com/CVE-2024-43633/): Windows Hyper-V Denial of Service Vulnerability (medium 6.5)
- [CVE-2024-43631](https://insights.sbomify.com/CVE-2024-43631/): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2024-43630](https://insights.sbomify.com/CVE-2024-43630/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-4363](https://insights.sbomify.com/CVE-2024-4363/): Cross-site scripting in Visual Portfolio, Photo Gallery & Post Grid (medium 6.4)
- [CVE-2024-43629](https://insights.sbomify.com/CVE-2024-43629/): Windows DWM Core Library Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43628](https://insights.sbomify.com/CVE-2024-43628/): Windows Telephony Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43627](https://insights.sbomify.com/CVE-2024-43627/): Windows Telephony Service Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43626](https://insights.sbomify.com/CVE-2024-43626/): Windows Telephony Service Elevation of Privilege Vulnerability (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/280/