# Vulnerabilities published in 2024


- [CVE-2024-43522](https://insights.sbomify.com/CVE-2024-43522/): Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2024-43521](https://insights.sbomify.com/CVE-2024-43521/): Windows Hyper-V Denial of Service Vulnerability (high 7.5)
- [CVE-2024-43520](https://insights.sbomify.com/CVE-2024-43520/): Windows Kernel Denial of Service Vulnerability (medium 5.0)
- [CVE-2024-4352](https://insights.sbomify.com/CVE-2024-4352/): Tutor LMS Pro <= 2.7.0 - Missing Authorization to SQL Injection (high 8.8)
- [CVE-2024-43519](https://insights.sbomify.com/CVE-2024-43519/): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43518](https://insights.sbomify.com/CVE-2024-43518/): Windows Telephony Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43517](https://insights.sbomify.com/CVE-2024-43517/): Microsoft ActiveX Data Objects Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43516](https://insights.sbomify.com/CVE-2024-43516/): Windows Secure Kernel Mode Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43515](https://insights.sbomify.com/CVE-2024-43515/): Internet Small Computer Systems Interface (iSCSI) Denial of Service Vulnerability (high 7.5)
- [CVE-2024-43514](https://insights.sbomify.com/CVE-2024-43514/): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43513](https://insights.sbomify.com/CVE-2024-43513/): BitLocker Security Feature Bypass Vulnerability (medium 6.4)
- [CVE-2024-43512](https://insights.sbomify.com/CVE-2024-43512/): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (medium 6.5)
- [CVE-2024-43511](https://insights.sbomify.com/CVE-2024-43511/): Windows Kernel Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2024-4351](https://insights.sbomify.com/CVE-2024-4351/): Tutor LMS Pro <= 2.7.0 - Missing Authorization to Privilege Escalation (high 8.8)
- [CVE-2024-43509](https://insights.sbomify.com/CVE-2024-43509/): Windows Graphics Component Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43508](https://insights.sbomify.com/CVE-2024-43508/): Windows Graphics Component Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-43506](https://insights.sbomify.com/CVE-2024-43506/): BranchCache Denial of Service Vulnerability (high 7.5)
- [CVE-2024-43505](https://insights.sbomify.com/CVE-2024-43505/): Microsoft Office Visio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-43504](https://insights.sbomify.com/CVE-2024-43504/): Microsoft Excel Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-43503](https://insights.sbomify.com/CVE-2024-43503/): Microsoft SharePoint Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43502](https://insights.sbomify.com/CVE-2024-43502/): Windows Kernel Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2024-43501](https://insights.sbomify.com/CVE-2024-43501/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43500](https://insights.sbomify.com/CVE-2024-43500/): Windows Resilient File System (ReFS) Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-4350](https://insights.sbomify.com/CVE-2024-4350/): Concrete CMS version 9 below 9.3.3 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer (medium 5.1)
- [CVE-2024-43499](https://insights.sbomify.com/CVE-2024-43499/): .NET and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2024-43498](https://insights.sbomify.com/CVE-2024-43498/): .NET and Visual Studio Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-43497](https://insights.sbomify.com/CVE-2024-43497/): DeepSpeed Remote Code Execution Vulnerability (high 8.4)
- [CVE-2024-43496](https://insights.sbomify.com/CVE-2024-43496/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 6.5)
- [CVE-2024-43495](https://insights.sbomify.com/CVE-2024-43495/): Windows libarchive Remote Code Execution Vulnerability (high 7.3)
- [CVE-2024-43492](https://insights.sbomify.com/CVE-2024-43492/): Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43491](https://insights.sbomify.com/CVE-2024-43491/): Microsoft Windows Update Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-4349](https://insights.sbomify.com/CVE-2024-4349/): SourceCodester Pisay Online E-Learning System controller.php unrestricted upload (high 7.3)
- [CVE-2024-43489](https://insights.sbomify.com/CVE-2024-43489/): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (medium 6.5)
- [CVE-2024-43488](https://insights.sbomify.com/CVE-2024-43488/): Visual Studio Code extension for Arduino Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43487](https://insights.sbomify.com/CVE-2024-43487/): Windows Mark of the Web Security Feature Bypass Vulnerability (medium 6.5)
- [CVE-2024-43485](https://insights.sbomify.com/CVE-2024-43485/): .NET and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2024-43484](https://insights.sbomify.com/CVE-2024-43484/): .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2024-43483](https://insights.sbomify.com/CVE-2024-43483/): .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability (high 7.5)
- [CVE-2024-43482](https://insights.sbomify.com/CVE-2024-43482/): Microsoft Outlook for iOS Information Disclosure Vulnerability (medium 6.5)
- [CVE-2024-43481](https://insights.sbomify.com/CVE-2024-43481/): Power BI Report Server Spoofing Vulnerability (medium 6.5)
- [CVE-2024-43480](https://insights.sbomify.com/CVE-2024-43480/): Azure Service Fabric for Linux Remote Code Execution Vulnerability (medium 6.6)
- [CVE-2024-4348](https://insights.sbomify.com/CVE-2024-4348/): osCommerce all-products cross site scripting (medium 4.3)
- [CVE-2024-43479](https://insights.sbomify.com/CVE-2024-43479/): Microsoft Power Automate Desktop Remote Code Execution Vulnerability (high 8.5)
- [CVE-2024-43477](https://insights.sbomify.com/CVE-2024-43477/): Microsoft Entra ID Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2024-43476](https://insights.sbomify.com/CVE-2024-43476/): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (high 7.6)
- [CVE-2024-43475](https://insights.sbomify.com/CVE-2024-43475/): Microsoft Windows Admin Center Information Disclosure Vulnerability (high 7.3)
- [CVE-2024-43474](https://insights.sbomify.com/CVE-2024-43474/): Microsoft SQL Server Information Disclosure Vulnerability (high 7.6)
- [CVE-2024-43472](https://insights.sbomify.com/CVE-2024-43472/): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (medium 5.8)
- [CVE-2024-43470](https://insights.sbomify.com/CVE-2024-43470/): Azure Network Watcher VM Agent Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2024-4347](https://insights.sbomify.com/CVE-2024-4347/): WP Fastest Cache <= 1.2.6 - Authenticated (Administrator+) Arbitrary File Deletion (high 7.2)
- [CVE-2024-43469](https://insights.sbomify.com/CVE-2024-43469/): Azure CycleCloud Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43468](https://insights.sbomify.com/CVE-2024-43468/): Microsoft Configuration Manager SQL Injection (critical 9.8, exploited in the wild)
- [CVE-2024-43467](https://insights.sbomify.com/CVE-2024-43467/): Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-43466](https://insights.sbomify.com/CVE-2024-43466/): Microsoft SharePoint Server Denial of Service Vulnerability (medium 6.5)
- [CVE-2024-43465](https://insights.sbomify.com/CVE-2024-43465/): Microsoft Excel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43464](https://insights.sbomify.com/CVE-2024-43464/): Microsoft SharePoint Server Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-43463](https://insights.sbomify.com/CVE-2024-43463/): Microsoft Office Visio Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-43462](https://insights.sbomify.com/CVE-2024-43462/): SQL Server Native Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43461](https://insights.sbomify.com/CVE-2024-43461/): Microsoft Windows MSHTML Platform Spoofing (high 8.8, exploited in the wild)
- [CVE-2024-43460](https://insights.sbomify.com/CVE-2024-43460/): Dynamics 365 Business Central Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2024-4346](https://insights.sbomify.com/CVE-2024-4346/): Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Deletion (critical 9.1)
- [CVE-2024-43459](https://insights.sbomify.com/CVE-2024-43459/): SQL Server Native Client Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43458](https://insights.sbomify.com/CVE-2024-43458/): Windows Networking Information Disclosure Vulnerability (high 7.7)
- [CVE-2024-43457](https://insights.sbomify.com/CVE-2024-43457/): Windows Setup and Deployment Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-43456](https://insights.sbomify.com/CVE-2024-43456/): Windows Remote Desktop Services Tampering Vulnerability (medium 4.8)
- [CVE-2024-43455](https://insights.sbomify.com/CVE-2024-43455/): Windows Remote Desktop Licensing Service Spoofing Vulnerability (high 8.8)
- [CVE-2024-43454](https://insights.sbomify.com/CVE-2024-43454/): Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability (high 7.1)
- [CVE-2024-43453](https://insights.sbomify.com/CVE-2024-43453/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-43452](https://insights.sbomify.com/CVE-2024-43452/): Windows Registry Elevation of Privilege Vulnerability (high 7.5)
- [CVE-2024-43451](https://insights.sbomify.com/CVE-2024-43451/): Microsoft Windows NTLMv2 Hash Disclosure Spoofing (medium 6.5, exploited in the wild)
- [CVE-2024-43450](https://insights.sbomify.com/CVE-2024-43450/): Windows DNS Spoofing Vulnerability (high 7.5)
- [CVE-2024-4345](https://insights.sbomify.com/CVE-2024-4345/): Startklar Elementor Addons <= 1.7.13 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-43449](https://insights.sbomify.com/CVE-2024-43449/): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2024-43447](https://insights.sbomify.com/CVE-2024-43447/): Windows SMBv3 Server Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-43446](https://insights.sbomify.com/CVE-2024-43446/): Improper check of permissions in Generic Interface (low 3.5)
- [CVE-2024-43445](https://insights.sbomify.com/CVE-2024-43445/): Missing X-Content-Type-Options: nosniff Header Allows MIME Type Sniffing (medium 5.4)
- [CVE-2024-43444](https://insights.sbomify.com/CVE-2024-43444/): Passwords are written to Admin Log Module (high 8.2)
- [CVE-2024-43443](https://insights.sbomify.com/CVE-2024-43443/): Stored XSS in process management (medium 4.9)
- [CVE-2024-43442](https://insights.sbomify.com/CVE-2024-43442/): Stored XSS in System Configuration (medium 4.9)
- [CVE-2024-43441](https://insights.sbomify.com/CVE-2024-43441/): Apache HugeGraph-Server: Fixed JWT Token(Secret) (critical 9.8)
- [CVE-2024-43440](https://insights.sbomify.com/CVE-2024-43440/): Moodle: lfi vulnerability when restoring malformed block backups (high 7.5)
- [CVE-2024-4344](https://insights.sbomify.com/CVE-2024-4344/): Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 19.1.13 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-43439](https://insights.sbomify.com/CVE-2024-43439/): Moodle: reflected xss via h5p error message (medium 5.4)
- [CVE-2024-43438](https://insights.sbomify.com/CVE-2024-43438/): Moodle: idor in feedback non-respondents report allows messaging arbitrary site users (high 7.5)
- [CVE-2024-43437](https://insights.sbomify.com/CVE-2024-43437/): Moodle: xss risk when restoring malicious course backup file (medium 5.4)
- [CVE-2024-43436](https://insights.sbomify.com/CVE-2024-43436/): Moodle: site administration sql injection via xmldb editor (high 7.2)
- [CVE-2024-43435](https://insights.sbomify.com/CVE-2024-43435/): Moodle: can create global glossary without being admin (medium 5.3)
- [CVE-2024-43434](https://insights.sbomify.com/CVE-2024-43434/): Moodle: csrf risk in feedback non-respondents report (high 8.1)
- [CVE-2024-43433](https://insights.sbomify.com/CVE-2024-43433/): Moodle: matrix user/power level management not always working as expected with suspended users (medium 5.3)
- [CVE-2024-43432](https://insights.sbomify.com/CVE-2024-43432/): Moodle: authorization headers preserved between "emulated redirects" (medium 5.3)
- [CVE-2024-43431](https://insights.sbomify.com/CVE-2024-43431/): Moodle: idor in badges allows deletion of arbitrary badges (high 7.5)
- [CVE-2024-43430](https://insights.sbomify.com/CVE-2024-43430/): Moodle: lack of access control when using external methods for quiz overrides (medium 5.3)
- [CVE-2024-4343](https://insights.sbomify.com/CVE-2024-4343/): Python Command Injection in imartinez/privategpt (critical 9.8)
- [CVE-2024-43429](https://insights.sbomify.com/CVE-2024-43429/): Moodle: user information visibility control issues in gradebook reports (medium 5.3)
- [CVE-2024-43428](https://insights.sbomify.com/CVE-2024-43428/): Moodle: cache poisoning via injection into storage (high 7.7)
- [CVE-2024-43427](https://insights.sbomify.com/CVE-2024-43427/): Moodle: admin presets export tool includes some secrets that should not be exported (low 3.7)
- [CVE-2024-43426](https://insights.sbomify.com/CVE-2024-43426/): Moodle: arbitrary file read risk through pdftex (high 7.5)
- [CVE-2024-43425](https://insights.sbomify.com/CVE-2024-43425/): Moodle: remote code execution via calculated question types (high 8.1)
- [CVE-2024-43424](https://insights.sbomify.com/CVE-2024-43424/): Memory corruption in Sharp Digital Full-color MFPs and Monochrome MFPs (high 7.5)
- [CVE-2024-43423](https://insights.sbomify.com/CVE-2024-43423/): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Use of Hard-coded Password (critical 9.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/282/