# Vulnerabilities published in 2024


- [CVE-2024-4188](https://insights.sbomify.com/CVE-2024-4188/): Information disclosure in Documentum™ Server (high 7.1)
- [CVE-2024-41879](https://insights.sbomify.com/CVE-2024-41879/): RE: New Edge T5 MSRC Case [DCMSFT-1294] (high 7.8)
- [CVE-2024-41878](https://insights.sbomify.com/CVE-2024-41878/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41877](https://insights.sbomify.com/CVE-2024-41877/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41876](https://insights.sbomify.com/CVE-2024-41876/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41875](https://insights.sbomify.com/CVE-2024-41875/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41874](https://insights.sbomify.com/CVE-2024-41874/): ColdFusion | Deserialization of Untrusted Data (CWE-502) (critical 9.8)
- [CVE-2024-41873](https://insights.sbomify.com/CVE-2024-41873/): Media Encoder | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-41872](https://insights.sbomify.com/CVE-2024-41872/): Media Encoder | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-41871](https://insights.sbomify.com/CVE-2024-41871/): Media Encoder | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-41870](https://insights.sbomify.com/CVE-2024-41870/): Media Encoder | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-4187](https://insights.sbomify.com/CVE-2024-4187/): Cross-site scripting in Filr (low 2.1)
- [CVE-2024-41869](https://insights.sbomify.com/CVE-2024-41869/): Acrobat Reader | Use After Free (CWE-416) (high 7.8)
- [CVE-2024-41868](https://insights.sbomify.com/CVE-2024-41868/): Audition | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-41867](https://insights.sbomify.com/CVE-2024-41867/): After Effects | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-41866](https://insights.sbomify.com/CVE-2024-41866/): Adobe Indesign 2024 DOC File Parsing Null Pointer Dereference (medium 5.5)
- [CVE-2024-41865](https://insights.sbomify.com/CVE-2024-41865/): Adobe Dimension Untrusted Search Path lead to load malicious DLL swift.dll (high 7.8)
- [CVE-2024-41864](https://insights.sbomify.com/CVE-2024-41864/): Adobe Substance 3D Designer ICO Parsing Out-Of-Bounds Write Vulnerability (high 7.8)
- [CVE-2024-41863](https://insights.sbomify.com/CVE-2024-41863/): Adobe Substance 3D Sampler Memory Corruption Out-of-Bounds-READ Vulnerability III, when parsing DNG file (medium 5.5)
- [CVE-2024-41862](https://insights.sbomify.com/CVE-2024-41862/): Adobe Substance 3D Sampler Memory Corruption Out-of-Bounds-READ Vulnerability II, when parsing PSD file (medium 5.5)
- [CVE-2024-41861](https://insights.sbomify.com/CVE-2024-41861/): Adobe Substance 3D Sampler Memory Corruption Out-of-Bounds-READ Vulnerability I, when parsing PSD file (medium 5.5)
- [CVE-2024-41860](https://insights.sbomify.com/CVE-2024-41860/): Adobe Substance 3D Sampler Memory Corruption Vulnerability I, when parsing PSD file (medium 5.5)
- [CVE-2024-4186](https://insights.sbomify.com/CVE-2024-4186/): Edwiser Bridge <= 3.0.5 - Authentication Bypass due to Missing Empty Value Check (critical 9.8)
- [CVE-2024-41859](https://insights.sbomify.com/CVE-2024-41859/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-41858](https://insights.sbomify.com/CVE-2024-41858/): Adobe InCopy has an integer overflow vulnerability when parsing SVG file (high 7.8)
- [CVE-2024-41857](https://insights.sbomify.com/CVE-2024-41857/): Illustrator | Integer Underflow (Wrap or Wraparound) (CWE-191) (high 7.8)
- [CVE-2024-41856](https://insights.sbomify.com/CVE-2024-41856/): Illustrator | Improper Input Validation (CWE-20) (high 7.8)
- [CVE-2024-41854](https://insights.sbomify.com/CVE-2024-41854/): Adobe Indesign 2024 PDF File parsing memory corruption (medium 5.5)
- [CVE-2024-41853](https://insights.sbomify.com/CVE-2024-41853/): Indesign 2024 EPS File Parsing Heap Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-41852](https://insights.sbomify.com/CVE-2024-41852/): Adobe Indesign 2024 AVI File Parsing Stack Based Buffer Overflow (high 7.8)
- [CVE-2024-41851](https://insights.sbomify.com/CVE-2024-41851/): Adobe InDesign (Beta) has an integer overflow vulnerability when parsing SVG file (high 7.8)
- [CVE-2024-41850](https://insights.sbomify.com/CVE-2024-41850/): Adobe Indesign 2024 TIF File Parsing Heap Memory Corruption (high 7.8)
- [CVE-2024-4185](https://insights.sbomify.com/CVE-2024-4185/): Weak cryptography in Customer Email Verification for WooCommerce (high 8.1)
- [CVE-2024-41849](https://insights.sbomify.com/CVE-2024-41849/): Adobe Experience Manager | Improper Input Validation (CWE-20) (medium 4.1)
- [CVE-2024-41848](https://insights.sbomify.com/CVE-2024-41848/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41847](https://insights.sbomify.com/CVE-2024-41847/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41846](https://insights.sbomify.com/CVE-2024-41846/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41845](https://insights.sbomify.com/CVE-2024-41845/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41844](https://insights.sbomify.com/CVE-2024-41844/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41843](https://insights.sbomify.com/CVE-2024-41843/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41842](https://insights.sbomify.com/CVE-2024-41842/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 4.8)
- [CVE-2024-41841](https://insights.sbomify.com/CVE-2024-41841/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-41840](https://insights.sbomify.com/CVE-2024-41840/): ZDI-CAN-24607: Adobe Bridge JP2 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-4184](https://insights.sbomify.com/CVE-2024-4184/): Multiple XXE sinks in ALM archive post-build step in OpenText Application Automation Tools (medium 5.9)
- [CVE-2024-41839](https://insights.sbomify.com/CVE-2024-41839/): Adobe Experience Manager | Improper Input Validation (CWE-20) (low 3.5)
- [CVE-2024-41836](https://insights.sbomify.com/CVE-2024-41836/): InDesign Desktop | NULL Pointer Dereference (CWE-476) (medium 5.5)
- [CVE-2024-41835](https://insights.sbomify.com/CVE-2024-41835/): TALOS-2024-2003 | Adobe Acrobat Reader Font Packed Point Numbers Out-Of-Bounds Read Vulnerability (medium 5.5)
- [CVE-2024-41834](https://insights.sbomify.com/CVE-2024-41834/): ZDI-CAN-24311: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-41833](https://insights.sbomify.com/CVE-2024-41833/): ZDI-CAN-24310: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-41832](https://insights.sbomify.com/CVE-2024-41832/): TALOS-2024-2002 | Adobe Acrobat Reader Font gvar TupleVariation Data Out-Of-Bounds Read Vulnerability (medium 5.5)
- [CVE-2024-41831](https://insights.sbomify.com/CVE-2024-41831/): ZDI-CAN-24569: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-41830](https://insights.sbomify.com/CVE-2024-41830/): Talos Security Advisory for Adobe (TALOS-2024-2009) (high 7.8)
- [CVE-2024-4183](https://insights.sbomify.com/CVE-2024-4183/): Mattermost fails to limit the number of active sessions (medium 4.3)
- [CVE-2024-41829](https://insights.sbomify.com/CVE-2024-41829/): Auth bypass in TeamCity (low 3.5)
- [CVE-2024-41828](https://insights.sbomify.com/CVE-2024-41828/): Information disclosure in TeamCity (low 2.6)
- [CVE-2024-41827](https://insights.sbomify.com/CVE-2024-41827/): Auth bypass in TeamCity (high 7.4)
- [CVE-2024-41826](https://insights.sbomify.com/CVE-2024-41826/): Cross-site scripting in TeamCity (low 3.5)
- [CVE-2024-41825](https://insights.sbomify.com/CVE-2024-41825/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-41824](https://insights.sbomify.com/CVE-2024-41824/): Information disclosure in TeamCity (medium 6.4)
- [CVE-2024-41820](https://insights.sbomify.com/CVE-2024-41820/): Cluster-level privilege escalation in kubean (medium 6.0)
- [CVE-2024-4182](https://insights.sbomify.com/CVE-2024-4182/): Mattermost crashes web clients via a malformed custom status (medium 4.3)
- [CVE-2024-41819](https://insights.sbomify.com/CVE-2024-41819/): Note Mark has a stored XSS in the note link href attribute (high 8.7)
- [CVE-2024-41818](https://insights.sbomify.com/CVE-2024-41818/): ReDOS at currency parsing fast-xml-parser (high 7.5)
- [CVE-2024-41817](https://insights.sbomify.com/CVE-2024-41817/): Arbitrary Code Execution in `AppImage` version `ImageMagick` (high 7.0)
- [CVE-2024-41816](https://insights.sbomify.com/CVE-2024-41816/): WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode (medium 5.4)
- [CVE-2024-41815](https://insights.sbomify.com/CVE-2024-41815/): Starship vulnerable to shell injection via undocumented, unpredictable shell expansion in custom commands (high 7.4)
- [CVE-2024-41813](https://insights.sbomify.com/CVE-2024-41813/): txtdot SSRF vulnerability in /proxy (high 7.5)
- [CVE-2024-41812](https://insights.sbomify.com/CVE-2024-41812/): txtdot SSRF vulnerability in /get (high 7.5)
- [CVE-2024-41811](https://insights.sbomify.com/CVE-2024-41811/): ipl/web susceptible to Cross-Site Request Forgery (CSRF) (low 3.9)
- [CVE-2024-41810](https://insights.sbomify.com/CVE-2024-41810/): HTML injection in HTTP redirect body (medium 6.1)
- [CVE-2024-4181](https://insights.sbomify.com/CVE-2024-4181/): Command Injection in run-llama/llama_index (high 8.8)
- [CVE-2024-41809](https://insights.sbomify.com/CVE-2024-41809/): OpenObserve Cross-site Scripting (XSS) vulnerability in `openobserve/web/src/views/MemberSubscription.vue` (high 7.2)
- [CVE-2024-41808](https://insights.sbomify.com/CVE-2024-41808/): OpenObserve stored XSS vulnerability may lead to complete account takeover (high 8.8)
- [CVE-2024-41806](https://insights.sbomify.com/CVE-2024-41806/): Open edX Platform's instructor upload CSV for cohort creation not Private by Default (medium 5.3)
- [CVE-2024-41805](https://insights.sbomify.com/CVE-2024-41805/): Tracks vulnerable to reflected cross-site scripting (medium 6.1)
- [CVE-2024-41804](https://insights.sbomify.com/CVE-2024-41804/): Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Column Formula (medium 6.5)
- [CVE-2024-41803](https://insights.sbomify.com/CVE-2024-41803/): Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Filter (medium 4.9)
- [CVE-2024-41802](https://insights.sbomify.com/CVE-2024-41802/): Xibo allows Sensitive Information Disclosure abusing SQL Injection in Xibo CMS DataSet Data Import (high 8.1)
- [CVE-2024-41801](https://insights.sbomify.com/CVE-2024-41801/): OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration (medium 4.7)
- [CVE-2024-41800](https://insights.sbomify.com/CVE-2024-41800/): Craft CMS Allows TOTP Token To Stay Valid After Use (medium 4.8)
- [CVE-2024-4180](https://insights.sbomify.com/CVE-2024-4180/): The Events Calendar < 6.4.0.1 - Reflected XSS (critical 9.1)
- [CVE-2024-41799](https://insights.sbomify.com/CVE-2024-41799/): tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users (high 8.4)
- [CVE-2024-41798](https://insights.sbomify.com/CVE-2024-41798/): Auth bypass in SENTRON 7KM PAC3200 (critical 9.3)
- [CVE-2024-41797](https://insights.sbomify.com/CVE-2024-41797/): Privilege escalation in RUGGEDCOM RST2428P (medium 5.3)
- [CVE-2024-41796](https://insights.sbomify.com/CVE-2024-41796/): Auth bypass in SENTRON 7KT PAC1260 Data Manager (medium 6.9)
- [CVE-2024-41795](https://insights.sbomify.com/CVE-2024-41795/): Cross-site request forgery in SENTRON 7KT PAC1260 Data Manager (medium 6.9)
- [CVE-2024-41794](https://insights.sbomify.com/CVE-2024-41794/): Hardcoded credentials in SENTRON 7KT PAC1260 Data Manager (critical 10.0)
- [CVE-2024-41793](https://insights.sbomify.com/CVE-2024-41793/): Auth bypass in SENTRON 7KT PAC1260 Data Manager (high 7.7)
- [CVE-2024-41792](https://insights.sbomify.com/CVE-2024-41792/): Path traversal in SENTRON 7KT PAC1260 Data Manager (critical 9.2)
- [CVE-2024-41791](https://insights.sbomify.com/CVE-2024-41791/): Missing authorization in SENTRON 7KT PAC1260 Data Manager (medium 6.9)
- [CVE-2024-41790](https://insights.sbomify.com/CVE-2024-41790/): Command injection in SENTRON 7KT PAC1260 Data Manager (critical 9.4)
- [CVE-2024-41789](https://insights.sbomify.com/CVE-2024-41789/): Command injection in SENTRON 7KT PAC1260 Data Manager (critical 9.4)
- [CVE-2024-41788](https://insights.sbomify.com/CVE-2024-41788/): Command injection in SENTRON 7KT PAC1260 Data Manager (critical 9.4)
- [CVE-2024-41787](https://insights.sbomify.com/CVE-2024-41787/): IBM Engineering Requirements Management DOORS Next code execution (critical 9.8)
- [CVE-2024-41785](https://insights.sbomify.com/CVE-2024-41785/): IBM Concert cross-site scripting (medium 6.1)
- [CVE-2024-41784](https://insights.sbomify.com/CVE-2024-41784/): IBM Sterling Secure Proxy directory traversal (high 7.5)
- [CVE-2024-41783](https://insights.sbomify.com/CVE-2024-41783/): IBM Sterling Secure Proxy improper input validation (critical 9.1)
- [CVE-2024-41781](https://insights.sbomify.com/CVE-2024-41781/): IBM PowerVM Hypervisor information disclosure (medium 5.1)
- [CVE-2024-41780](https://insights.sbomify.com/CVE-2024-41780/): IBM Jazz Foundation information disclosure (medium 4.2)
- [CVE-2024-41779](https://insights.sbomify.com/CVE-2024-41779/): IBM Engineering Systems Design Rhapsody - Model Manager (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/296/