# Vulnerabilities published in 2024


- [CVE-2024-39896](https://insights.sbomify.com/CVE-2024-39896/): Directus allows SSO User Enumeration (high 7.5)
- [CVE-2024-39895](https://insights.sbomify.com/CVE-2024-39895/): Directus GraphQL Field Duplication Denial of Service (DoS) (medium 6.5)
- [CVE-2024-39894](https://insights.sbomify.com/CVE-2024-39894/): OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks against echo-off password entry (e.g., for su and Sudo) because of an Obs (high 7.5)
- [CVE-2024-39891](https://insights.sbomify.com/CVE-2024-39891/): Twilio Authy Information Disclosure (medium 5.3, exploited in the wild)
- [CVE-2024-39890](https://insights.sbomify.com/CVE-2024-39890/): Memory corruption in samsung:exynos 1080 firmware (high 8.1)
- [CVE-2024-3989](https://insights.sbomify.com/CVE-2024-3989/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 6.4)
- [CVE-2024-39888](https://insights.sbomify.com/CVE-2024-39888/): Hardcoded credentials in Mendix Encryption (high 8.7)
- [CVE-2024-39887](https://insights.sbomify.com/CVE-2024-39887/): Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions (medium 4.3)
- [CVE-2024-39886](https://insights.sbomify.com/CVE-2024-39886/): Weak cryptography in TONE store App (low 3.7)
- [CVE-2024-39884](https://insights.sbomify.com/CVE-2024-39884/): Apache HTTP Server: source code disclosure with handlers configured via AddType (medium 6.2)
- [CVE-2024-39883](https://insights.sbomify.com/CVE-2024-39883/): Heap-based Buffer Overflow in Delta Electronics CNCSoft-G2 (high 8.4)
- [CVE-2024-39882](https://insights.sbomify.com/CVE-2024-39882/): Out-of-bounds Read in Delta Electronics CNCSoft-G2 (high 8.4)
- [CVE-2024-39881](https://insights.sbomify.com/CVE-2024-39881/): Out-of-bounds Write in Delta Electronics CNCSoft-G2 (high 8.4)
- [CVE-2024-39880](https://insights.sbomify.com/CVE-2024-39880/): Stack-based Buffer Overflow in Delta Electronics CNCSoft-G2 (high 8.4)
- [CVE-2024-3988](https://insights.sbomify.com/CVE-2024-3988/): Cross-site scripting in Sina Extension for Elementor (medium 6.4)
- [CVE-2024-39879](https://insights.sbomify.com/CVE-2024-39879/): Information disclosure in TeamCity (medium 5.0)
- [CVE-2024-39878](https://insights.sbomify.com/CVE-2024-39878/): Information disclosure in TeamCity (medium 4.1)
- [CVE-2024-39877](https://insights.sbomify.com/CVE-2024-39877/): Apache Airflow: DAG Author Code Execution possibility in airflow-scheduler (high 8.8)
- [CVE-2024-39876](https://insights.sbomify.com/CVE-2024-39876/): Denial of service in SINEMA Remote Connect Server (medium 5.3)
- [CVE-2024-39875](https://insights.sbomify.com/CVE-2024-39875/): Missing authorization in SINEMA Remote Connect Server (medium 5.3)
- [CVE-2024-39874](https://insights.sbomify.com/CVE-2024-39874/): Security feature bypass in SINEMA Remote Connect Server (high 8.7)
- [CVE-2024-39873](https://insights.sbomify.com/CVE-2024-39873/): Security feature bypass in SINEMA Remote Connect Server (high 8.7)
- [CVE-2024-39872](https://insights.sbomify.com/CVE-2024-39872/): Privilege escalation in SINEMA Remote Connect Server (critical 9.3)
- [CVE-2024-39871](https://insights.sbomify.com/CVE-2024-39871/): Missing authorization in SINEMA Remote Connect Server (medium 5.3)
- [CVE-2024-39870](https://insights.sbomify.com/CVE-2024-39870/): Privilege escalation in SINEMA Remote Connect Server (high 7.1)
- [CVE-2024-3987](https://insights.sbomify.com/CVE-2024-3987/): Cross-site scripting in WP Mobile Menu – The Mobile-Friendly Responsive Menu (medium 5.4)
- [CVE-2024-39869](https://insights.sbomify.com/CVE-2024-39869/): Denial of service in SINEMA Remote Connect Server (high 7.1)
- [CVE-2024-39868](https://insights.sbomify.com/CVE-2024-39868/): Missing authorization in SINEMA Remote Connect Server (high 7.2)
- [CVE-2024-39867](https://insights.sbomify.com/CVE-2024-39867/): Missing authorization in SINEMA Remote Connect Server (high 7.2)
- [CVE-2024-39866](https://insights.sbomify.com/CVE-2024-39866/): Privilege escalation in SINEMA Remote Connect Server (high 8.7)
- [CVE-2024-39865](https://insights.sbomify.com/CVE-2024-39865/): File upload in SINEMA Remote Connect Server (high 8.7)
- [CVE-2024-39864](https://insights.sbomify.com/CVE-2024-39864/): Apache CloudStack: Integration API service uses dynamic port when disabled (critical 9.8)
- [CVE-2024-39863](https://insights.sbomify.com/CVE-2024-39863/): Apache Airflow: Potential XSS Vulnerability (high 8.1)
- [CVE-2024-3986](https://insights.sbomify.com/CVE-2024-3986/): SportsPress < 2.7.22 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-39853](https://insights.sbomify.com/CVE-2024-39853/): Code injection in swiperjs:swiper (medium 6.5)
- [CVE-2024-3985](https://insights.sbomify.com/CVE-2024-3985/): Exclusive Addons for Elementor <= 2.6.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call to Action (medium 6.4)
- [CVE-2024-39848](https://insights.sbomify.com/CVE-2024-39848/): Internet2 Grouper before 5.6 allows authentication bypass when LDAP authentication is used in certain ways. (critical 9.1)
- [CVE-2024-39847](https://insights.sbomify.com/CVE-2024-39847/): Arbitrary File Read and Server Side Request Forgery via XML External Entities in 4D Server SOAP (high 8.7)
- [CVE-2024-39846](https://insights.sbomify.com/CVE-2024-39846/): NewPass before 1.2.0 stores passwords (rather than password hashes) directly, which makes it easier to obtain unauthorized access to sensitive information. (low 3.5)
- [CVE-2024-39844](https://insights.sbomify.com/CVE-2024-39844/): In ZNC before 1.9.1, remote code execution can occur in modtcl via a KICK. (critical 9.8)
- [CVE-2024-39843](https://insights.sbomify.com/CVE-2024-39843/): SQL injection in centreon:centreon (medium 6.7)
- [CVE-2024-39842](https://insights.sbomify.com/CVE-2024-39842/): SQL injection in centreon:centreon (high 7.2)
- [CVE-2024-39841](https://insights.sbomify.com/CVE-2024-39841/): SQL injection in centreon:centreon web (high 8.8)
- [CVE-2024-39840](https://insights.sbomify.com/CVE-2024-39840/): Factorio before 1.1.101 allows a crafted server to execute arbitrary code on clients via a custom map that leverages the ability of certain (high 8.8)
- [CVE-2024-3984](https://insights.sbomify.com/CVE-2024-3984/): Cross-site scripting in EmbedSocial – Social Media Feeds, Reviews and Galleries (medium 6.4)
- [CVE-2024-39839](https://insights.sbomify.com/CVE-2024-39839/): Remote username set to an arbitrary string by remote user (medium 4.3)
- [CVE-2024-39838](https://insights.sbomify.com/CVE-2024-39838/): Hardcoded credentials in ZWX-2000CSW2-HN (high 8.8)
- [CVE-2024-39837](https://insights.sbomify.com/CVE-2024-39837/): Malicious remote can create arbitrary channels (low 3.8)
- [CVE-2024-39836](https://insights.sbomify.com/CVE-2024-39836/): Munged email address used for password resets and notifications (medium 4.8)
- [CVE-2024-39835](https://insights.sbomify.com/CVE-2024-39835/): Unsafe use of eval() method in roslaunch tool (high 7.8)
- [CVE-2024-39833](https://insights.sbomify.com/CVE-2024-39833/): Privilege escalation in Intel(R) QAT software (medium 5.4)
- [CVE-2024-39832](https://insights.sbomify.com/CVE-2024-39832/): Permanently local data deletion by malicious remote (medium 6.8)
- [CVE-2024-39831](https://insights.sbomify.com/CVE-2024-39831/): AccessTokenManager has an use after free vulnerability (medium 4.4)
- [CVE-2024-39830](https://insights.sbomify.com/CVE-2024-39830/): Timing attack during remote cluster token comparison when shared channels are enabled (high 8.1)
- [CVE-2024-3983](https://insights.sbomify.com/CVE-2024-3983/): WooCommerce Customers Manager < 30.1 - Bulk Action via CSRF (high 8.1)
- [CVE-2024-39828](https://insights.sbomify.com/CVE-2024-39828/): R74n Sandboxels 1.9 through 1.9.5 allows XSS via a message in a modified saved-game file. (medium 6.1)
- [CVE-2024-39827](https://insights.sbomify.com/CVE-2024-39827/): Zoom Workplace Desktop App for Windows - Improper Input Validation (medium 5.5)
- [CVE-2024-39826](https://insights.sbomify.com/CVE-2024-39826/): Zoom Workplace Apps and SDKs - Path traversal (medium 6.8)
- [CVE-2024-39825](https://insights.sbomify.com/CVE-2024-39825/): Zoom Workplace Apps and Rooms Clients - Buffer Overflow (high 8.5)
- [CVE-2024-39824](https://insights.sbomify.com/CVE-2024-39824/): Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing Authorization (medium 4.9)
- [CVE-2024-39823](https://insights.sbomify.com/CVE-2024-39823/): Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Missing Authorization (medium 4.9)
- [CVE-2024-39822](https://insights.sbomify.com/CVE-2024-39822/): Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Sensitive Information Exposure (medium 6.5)
- [CVE-2024-39821](https://insights.sbomify.com/CVE-2024-39821/): Zoom Workplace App for Windows and Zoom Rooms App for Windows - Race Condition (medium 6.6)
- [CVE-2024-39820](https://insights.sbomify.com/CVE-2024-39820/): Zoom Workplace Desktop App for macOS - Uncontrolled Search Path Element (medium 6.6)
- [CVE-2024-3982](https://insights.sbomify.com/CVE-2024-3982/): Misconfiguration in MicroSCADA SYS600 (high 8.2)
- [CVE-2024-39819](https://insights.sbomify.com/CVE-2024-39819/): Zoom Workplace Apps and SDK for Windows - Improper Privilege Management (medium 6.7)
- [CVE-2024-39818](https://insights.sbomify.com/CVE-2024-39818/): Zoom Workplace Apps and SDKs - Protection Mechanism Failure (high 7.5)
- [CVE-2024-39817](https://insights.sbomify.com/CVE-2024-39817/): Information disclosure in Cybozu Office (medium 6.5)
- [CVE-2024-39816](https://insights.sbomify.com/CVE-2024-39816/): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (high 8.4)
- [CVE-2024-39815](https://insights.sbomify.com/CVE-2024-39815/): Vonets WiFi Bridges Improper Check or Handling of Exceptional Conditions (critical 9.4)
- [CVE-2024-39813](https://insights.sbomify.com/CVE-2024-39813/): Privilege escalation in EPCT software (medium 5.4)
- [CVE-2024-39811](https://insights.sbomify.com/CVE-2024-39811/): Other in Intel(R) Server M20NTP Family UEFI (medium 5.3)
- [CVE-2024-39810](https://insights.sbomify.com/CVE-2024-39810/): Server crash via Elasticsearch certificate file (medium 4.9)
- [CVE-2024-39809](https://insights.sbomify.com/CVE-2024-39809/): BIG-IP Next Central Manager vulnerability (high 8.9)
- [CVE-2024-39808](https://insights.sbomify.com/CVE-2024-39808/): Memory corruption in Controller 6000 and Controller 7000 (medium 4.6)
- [CVE-2024-39807](https://insights.sbomify.com/CVE-2024-39807/): Channel IDs of archived/restored channels leaked via webhook events (low 3.1)
- [CVE-2024-39806](https://insights.sbomify.com/CVE-2024-39806/): Liteos_a has an out-of-bounds Read vulnerability (medium 5.5)
- [CVE-2024-39805](https://insights.sbomify.com/CVE-2024-39805/): Privilege escalation in Intel(R) DSA software (high 7.3)
- [CVE-2024-39804](https://insights.sbomify.com/CVE-2024-39804/): Security feature bypass in PowerPoint (high 7.1)
- [CVE-2024-39803](https://insights.sbomify.com/CVE-2024-39803/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39802](https://insights.sbomify.com/CVE-2024-39802/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39801](https://insights.sbomify.com/CVE-2024-39801/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39800](https://insights.sbomify.com/CVE-2024-39800/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-3980](https://insights.sbomify.com/CVE-2024-3980/): Path traversal in MicroSCADA Pro SYS600 (critical 9.9)
- [CVE-2024-39799](https://insights.sbomify.com/CVE-2024-39799/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39798](https://insights.sbomify.com/CVE-2024-39798/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39797](https://insights.sbomify.com/CVE-2024-39797/): Missing authorization in Intel(R) Ethernet Connection I219 Series (medium 5.7)
- [CVE-2024-39795](https://insights.sbomify.com/CVE-2024-39795/): Other in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39794](https://insights.sbomify.com/CVE-2024-39794/): Other in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39793](https://insights.sbomify.com/CVE-2024-39793/): Other in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39792](https://insights.sbomify.com/CVE-2024-39792/): NGINX Plus MQTT vulnerability (high 8.7)
- [CVE-2024-39791](https://insights.sbomify.com/CVE-2024-39791/): Vonets WiFi Bridges Stack-based Buffer Overflow (critical 10.0)
- [CVE-2024-39790](https://insights.sbomify.com/CVE-2024-39790/): Other in Wavlink AC3000 (critical 9.1)
- [CVE-2024-3979](https://insights.sbomify.com/CVE-2024-3979/): COVESA vsomeip race condition (medium 4.4)
- [CVE-2024-39789](https://insights.sbomify.com/CVE-2024-39789/): Other in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39788](https://insights.sbomify.com/CVE-2024-39788/): Other in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39787](https://insights.sbomify.com/CVE-2024-39787/): Path traversal in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39786](https://insights.sbomify.com/CVE-2024-39786/): Path traversal in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39785](https://insights.sbomify.com/CVE-2024-39785/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39784](https://insights.sbomify.com/CVE-2024-39784/): Command injection in Wavlink AC3000 (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/309/