# Vulnerabilities published in 2024


- [CVE-2024-42490](https://insights.sbomify.com/CVE-2024-42490/): authentik has Insufficient Authorization for several API endpoints (high 7.5)
- [CVE-2024-4249](https://insights.sbomify.com/CVE-2024-4249/): Tenda i21 wifiSSIDget formwrlSSIDget stack-based overflow (high 8.8)
- [CVE-2024-42489](https://insights.sbomify.com/CVE-2024-42489/): Pro Macros Remote Code Execution via Viewpdf and similar macros (critical 10.0)
- [CVE-2024-42488](https://insights.sbomify.com/CVE-2024-42488/): Cilium agent's race condition may lead to policy bypass for Host Firewall policy (medium 6.8)
- [CVE-2024-42487](https://insights.sbomify.com/CVE-2024-42487/): Cilium's Gateway API route matching order contradicts specification (medium 4.0)
- [CVE-2024-42486](https://insights.sbomify.com/CVE-2024-42486/): Cilium vulnerable to information leakage via incorrect ReferenceGrant update logic in Gateway API (medium 5.4)
- [CVE-2024-42485](https://insights.sbomify.com/CVE-2024-42485/): Filament Excel Vulnerable to Path Traversal Attack on Export Download Endpoint (high 7.5)
- [CVE-2024-42484](https://insights.sbomify.com/CVE-2024-42484/): ESP-NOW OOB Vulnerability In Group Type Message (medium 6.5)
- [CVE-2024-42483](https://insights.sbomify.com/CVE-2024-42483/): ESP-NOW Replay Attacks Vulnerability (medium 6.5)
- [CVE-2024-42482](https://insights.sbomify.com/CVE-2024-42482/): fish-shop/syntax-check Improper Neutralization of Delimiters (medium 4.8)
- [CVE-2024-42481](https://insights.sbomify.com/CVE-2024-42481/): Complete crash of host system due to calculateDirectorySize in skyportd (high 7.5)
- [CVE-2024-42480](https://insights.sbomify.com/CVE-2024-42480/): Kamaji's RBAC Roles for `etcd` are not disjunct (high 8.1)
- [CVE-2024-4248](https://insights.sbomify.com/CVE-2024-4248/): Tenda i21 formQosManage_user stack-based overflow (high 8.8)
- [CVE-2024-42479](https://insights.sbomify.com/CVE-2024-42479/): llama.cpp allows write-what-where in rpc_server::set_tensor (critical 10.0)
- [CVE-2024-42478](https://insights.sbomify.com/CVE-2024-42478/): llama.cpp allows Arbitrary Address Read in rpc_server::get_tensor (medium 5.3)
- [CVE-2024-42477](https://insights.sbomify.com/CVE-2024-42477/): llama.cpp global-buffer-overflow in ggml_type_size (medium 5.3)
- [CVE-2024-42476](https://insights.sbomify.com/CVE-2024-42476/): oauth CSRF vulnerability (medium 6.5)
- [CVE-2024-42475](https://insights.sbomify.com/CVE-2024-42475/): Weak cryptography in oauth (medium 6.5)
- [CVE-2024-42474](https://insights.sbomify.com/CVE-2024-42474/): Streamlit Path Traversal Security Vulnerability on Windows (medium 5.9)
- [CVE-2024-42473](https://insights.sbomify.com/CVE-2024-42473/): OpenFGA Authorization Bypass (high 7.5)
- [CVE-2024-42472](https://insights.sbomify.com/CVE-2024-42472/): Flatpak may allow access to files outside sandbox for certain apps (critical 10.0)
- [CVE-2024-42471](https://insights.sbomify.com/CVE-2024-42471/): Arbitrary File Write via artifact extraction in actions/artifact (high 7.3)
- [CVE-2024-42470](https://insights.sbomify.com/CVE-2024-42470/): CometVisu Backend for openHAB has a sensitive information disclosure vulnerability (medium 6.5)
- [CVE-2024-4247](https://insights.sbomify.com/CVE-2024-4247/): Tenda i21 formQosManage_auto stack-based overflow (high 8.8)
- [CVE-2024-42469](https://insights.sbomify.com/CVE-2024-42469/): CometVisu Backend for openHAB affected by RCE through path traversal (critical 9.8)
- [CVE-2024-42468](https://insights.sbomify.com/CVE-2024-42468/): Path traversal (CometVisu) (medium 5.3)
- [CVE-2024-42467](https://insights.sbomify.com/CVE-2024-42467/): CometVisu Backend for openHAB affected by SSRF/XSS (critical 10.0)
- [CVE-2024-42466](https://insights.sbomify.com/CVE-2024-42466/): Lack of resources and rate limiting - login (critical 9.5)
- [CVE-2024-42465](https://insights.sbomify.com/CVE-2024-42465/): Lack of resources and rate limiting - two factor authentication (critical 9.0)
- [CVE-2024-42464](https://insights.sbomify.com/CVE-2024-42464/): Leak of user information (high 7.6)
- [CVE-2024-42463](https://insights.sbomify.com/CVE-2024-42463/): Leak of organizations messages (high 8.6)
- [CVE-2024-42462](https://insights.sbomify.com/CVE-2024-42462/): Bypass multifactor authentication (critical 10.0)
- [CVE-2024-42461](https://insights.sbomify.com/CVE-2024-42461/): Elliptic allows BER-encoded signatures (medium 5.3)
- [CVE-2024-42460](https://insights.sbomify.com/CVE-2024-42460/): Elliptic's ECDSA missing check for whether leading bit of r and s is zero (medium 5.3)
- [CVE-2024-4246](https://insights.sbomify.com/CVE-2024-4246/): Tenda i21 formQosManageDouble_auto stack-based overflow (high 8.8)
- [CVE-2024-42459](https://insights.sbomify.com/CVE-2024-42459/): Elliptic's EDDSA missing signature length check (medium 5.3)
- [CVE-2024-42458](https://insights.sbomify.com/CVE-2024-42458/): Security feature bypass in any1:neatvnc (critical 9.8)
- [CVE-2024-42457](https://insights.sbomify.com/CVE-2024-42457/): Information disclosure in Backup & Replication (high 7.7)
- [CVE-2024-42456](https://insights.sbomify.com/CVE-2024-42456/): Missing authorization in Backup & Replication (high 8.8)
- [CVE-2024-42455](https://insights.sbomify.com/CVE-2024-42455/): Deserialization in Backup & Replication (high 7.1)
- [CVE-2024-42453](https://insights.sbomify.com/CVE-2024-42453/): Missing authorization in Backup & Replication (high 7.4)
- [CVE-2024-42452](https://insights.sbomify.com/CVE-2024-42452/): Missing authorization in Backup & Replication (high 8.8)
- [CVE-2024-42451](https://insights.sbomify.com/CVE-2024-42451/): Information disclosure in Backup & Replication (high 7.7)
- [CVE-2024-42450](https://insights.sbomify.com/CVE-2024-42450/): Hardcoded credentials in Director (critical 10.0)
- [CVE-2024-4245](https://insights.sbomify.com/CVE-2024-4245/): Tenda i21 formQosManageDouble_user stack-based overflow (high 8.8)
- [CVE-2024-42449](https://insights.sbomify.com/CVE-2024-42449/): Path traversal in Service Provider Console (high 7.1)
- [CVE-2024-42448](https://insights.sbomify.com/CVE-2024-42448/): Code injection in Service Provider Console (critical 9.9)
- [CVE-2024-42447](https://insights.sbomify.com/CVE-2024-42447/): Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for Airflow (critical 9.8)
- [CVE-2024-42446](https://insights.sbomify.com/CVE-2024-42446/): TOCTOU in SmmWhea (high 7.5)
- [CVE-2024-42444](https://insights.sbomify.com/CVE-2024-42444/): TOCTOU Race Condition between DMA and SMM (high 7.5)
- [CVE-2024-42442](https://insights.sbomify.com/CVE-2024-42442/): Runtime Service Access outside SMRAM (high 7.2)
- [CVE-2024-42441](https://insights.sbomify.com/CVE-2024-42441/): Privilege escalation in Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS (medium 6.2)
- [CVE-2024-42440](https://insights.sbomify.com/CVE-2024-42440/): Privilege escalation in Zoom Workplace Desktop App for macOS, Zoom Meeting SDK for macOS, Zoom Rooms Client for macOS (medium 6.2)
- [CVE-2024-4244](https://insights.sbomify.com/CVE-2024-4244/): Tenda W9 DhcpSetSer fromDhcpSetSer stack-based overflow (high 8.8)
- [CVE-2024-42439](https://insights.sbomify.com/CVE-2024-42439/): Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS - Untrusted Search Path (medium 6.5)
- [CVE-2024-42438](https://insights.sbomify.com/CVE-2024-42438/): Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Buffer Overflow (medium 6.5)
- [CVE-2024-42437](https://insights.sbomify.com/CVE-2024-42437/): Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Buffer Overflow (medium 6.5)
- [CVE-2024-42436](https://insights.sbomify.com/CVE-2024-42436/): Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Buffer Overflow (medium 6.5)
- [CVE-2024-42435](https://insights.sbomify.com/CVE-2024-42435/): Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Sensitive Information Exposure (medium 4.9)
- [CVE-2024-42434](https://insights.sbomify.com/CVE-2024-42434/): Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing Authorization (medium 4.9)
- [CVE-2024-4243](https://insights.sbomify.com/CVE-2024-4243/): Tenda W9 wifiSSIDset formwrlSSIDset stack-based overflow (high 8.8)
- [CVE-2024-42427](https://insights.sbomify.com/CVE-2024-42427/): Command injection in Wyse Proprietary OS (Modern ThinOS) (high 7.6)
- [CVE-2024-42426](https://insights.sbomify.com/CVE-2024-42426/): Denial of service in PowerScale OneFS (medium 4.3)
- [CVE-2024-42425](https://insights.sbomify.com/CVE-2024-42425/): Memory corruption in Dell Precision Rack BIOS (low 3.8)
- [CVE-2024-42424](https://insights.sbomify.com/CVE-2024-42424/): Information disclosure in Dell Precision Rack BIOS (medium 5.3)
- [CVE-2024-42423](https://insights.sbomify.com/CVE-2024-42423/): Missing authorization in Wyse Proprietary OS (Modern ThinOS) (medium 6.1)
- [CVE-2024-42422](https://insights.sbomify.com/CVE-2024-42422/): Missing authorization in NetWorker (high 8.3)
- [CVE-2024-42420](https://insights.sbomify.com/CVE-2024-42420/): Memory corruption in Sharp Digital Full-color MFPs and Monochrome MFPs (high 7.5)
- [CVE-2024-4242](https://insights.sbomify.com/CVE-2024-4242/): Tenda W9 wifiSSIDget formwrlSSIDget stack-based overflow (high 8.8)
- [CVE-2024-42419](https://insights.sbomify.com/CVE-2024-42419/): Misconfiguration in Intel(R) GPA and Intel(R) GPA Framework software installers (medium 5.4)
- [CVE-2024-42418](https://insights.sbomify.com/CVE-2024-42418/): Avtec Outpost Use of Hard-coded Cryptographic Key (high 8.7)
- [CVE-2024-42417](https://insights.sbomify.com/CVE-2024-42417/): Delta Electronics DIAEnergie SQL Injection (high 8.7)
- [CVE-2024-42416](https://insights.sbomify.com/CVE-2024-42416/): Multiple issues in ctl(4) CAM Target Layer (high 8.4)
- [CVE-2024-42415](https://insights.sbomify.com/CVE-2024-42415/): Integer overflow in G Structured File Library (libgsf) (high 8.4)
- [CVE-2024-42412](https://insights.sbomify.com/CVE-2024-42412/): Cross-site scripting in WAB-I1750-PS (medium 6.1)
- [CVE-2024-42411](https://insights.sbomify.com/CVE-2024-42411/): User creation date manipulation in POST /api/v4/users (medium 5.3)
- [CVE-2024-42410](https://insights.sbomify.com/CVE-2024-42410/): Denial of service in Intel(R) Graphics Drivers (medium 6.8)
- [CVE-2024-4241](https://insights.sbomify.com/CVE-2024-4241/): Tenda W9 formQosManageDouble_auto stack-based overflow (high 8.8)
- [CVE-2024-42408](https://insights.sbomify.com/CVE-2024-42408/): Dorsett Controls InfoScan Path Traversal (medium 6.9)
- [CVE-2024-42407](https://insights.sbomify.com/CVE-2024-42407/): Information disclosure in Command Centre Server (high 8.5)
- [CVE-2024-42406](https://insights.sbomify.com/CVE-2024-42406/): Unauthorized access on archived channels (medium 5.4)
- [CVE-2024-42405](https://insights.sbomify.com/CVE-2024-42405/): Privilege escalation in Intel(R) Quartus(R) Prime Software (medium 5.4)
- [CVE-2024-42404](https://insights.sbomify.com/CVE-2024-42404/): SQL injection in Welcart e-Commerce (high 8.8)
- [CVE-2024-42400](https://insights.sbomify.com/CVE-2024-42400/): Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol (medium 5.3)
- [CVE-2024-4240](https://insights.sbomify.com/CVE-2024-4240/): Tenda W9 formQosManageDouble_user stack-based overflow (high 8.8)
- [CVE-2024-42399](https://insights.sbomify.com/CVE-2024-42399/): Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol (medium 5.3)
- [CVE-2024-42398](https://insights.sbomify.com/CVE-2024-42398/): Unauthenticated Denial-of-Service (DoS) Vulnerabilities in the Soft AP Daemon Service Accessed by the PAPI Protocol (medium 5.3)
- [CVE-2024-42397](https://insights.sbomify.com/CVE-2024-42397/): Denial of service in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 (medium 5.3)
- [CVE-2024-42396](https://insights.sbomify.com/CVE-2024-42396/): Denial of service in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 (medium 5.3)
- [CVE-2024-42395](https://insights.sbomify.com/CVE-2024-42395/): Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 (critical 9.8)
- [CVE-2024-42394](https://insights.sbomify.com/CVE-2024-42394/): Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 (critical 9.8)
- [CVE-2024-42393](https://insights.sbomify.com/CVE-2024-42393/): Memory corruption in Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10 (critical 9.8)
- [CVE-2024-42392](https://insights.sbomify.com/CVE-2024-42392/): Improper Neutralization of Delimiters in Mongoose Web Server library (medium 4.0)
- [CVE-2024-42391](https://insights.sbomify.com/CVE-2024-42391/): Use of Out-of-range Pointer Offset in Mongoose Web Server library (medium 4.3)
- [CVE-2024-42390](https://insights.sbomify.com/CVE-2024-42390/): Use of Out-of-range Pointer Offset in Mongoose Web Server library (medium 4.3)
- [CVE-2024-4239](https://insights.sbomify.com/CVE-2024-4239/): Tenda AX1806 SetRebootTimer formSetRebootTimer stack-based overflow (high 8.8)
- [CVE-2024-42389](https://insights.sbomify.com/CVE-2024-42389/): Use of Out-of-range Pointer Offset in Mongoose Web Server library (medium 5.3)
- [CVE-2024-42388](https://insights.sbomify.com/CVE-2024-42388/): Use of Out-of-range Pointer Offset in Mongoose Web Server library (medium 5.3)
- [CVE-2024-42387](https://insights.sbomify.com/CVE-2024-42387/): Use of Out-of-range Pointer Offset in Mongoose Web Server library (medium 5.3)
- [CVE-2024-42386](https://insights.sbomify.com/CVE-2024-42386/): Use of Out-of-range Pointer Offset in Mongoose Web Server library (high 8.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/290/