# Vulnerabilities published in 2024


- [CVE-2024-39783](https://insights.sbomify.com/CVE-2024-39783/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39782](https://insights.sbomify.com/CVE-2024-39782/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39781](https://insights.sbomify.com/CVE-2024-39781/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39780](https://insights.sbomify.com/CVE-2024-39780/): Use of unsafe yaml load in dynparam (high 7.8)
- [CVE-2024-3978](https://insights.sbomify.com/CVE-2024-3978/): WordPress Jitsi Shortcode <= 0.1 - Contributor+ Stored XSS via Shortcode (medium 5.4)
- [CVE-2024-39779](https://insights.sbomify.com/CVE-2024-39779/): Memory corruption in Intel(R) Ethernet Connection I219 Series (medium 5.7)
- [CVE-2024-39778](https://insights.sbomify.com/CVE-2024-39778/): BIG-IP HSB vulnerability (high 8.7)
- [CVE-2024-39777](https://insights.sbomify.com/CVE-2024-39777/): Malicious remote can invite itself to an arbitrary local channel (high 8.7)
- [CVE-2024-39776](https://insights.sbomify.com/CVE-2024-39776/): Avtec Outpost Storage of File with Sensitive Data Under Web Root (high 8.7)
- [CVE-2024-39775](https://insights.sbomify.com/CVE-2024-39775/): Net Manager has an out-of-bounds read permission bypass vulnerability (medium 6.5)
- [CVE-2024-39774](https://insights.sbomify.com/CVE-2024-39774/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39773](https://insights.sbomify.com/CVE-2024-39773/): Information disclosure in Wavlink AC3000 (medium 5.3)
- [CVE-2024-39772](https://insights.sbomify.com/CVE-2024-39772/): Silent Desktop Screenshot Capture (low 3.7)
- [CVE-2024-39771](https://insights.sbomify.com/CVE-2024-39771/): Security feature bypass in QBiC CLOUD CC-2L (medium 4.2)
- [CVE-2024-39770](https://insights.sbomify.com/CVE-2024-39770/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-3977](https://insights.sbomify.com/CVE-2024-3977/): WordPress Jitsi Shortcode <= 0.1 - Admin+ Stored XSS (medium 5.1)
- [CVE-2024-39769](https://insights.sbomify.com/CVE-2024-39769/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39768](https://insights.sbomify.com/CVE-2024-39768/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39767](https://insights.sbomify.com/CVE-2024-39767/): Spoofed push notifications from malicious server (medium 4.2)
- [CVE-2024-39766](https://insights.sbomify.com/CVE-2024-39766/): SQL injection in Intel(R) Neural Compressor software (high 7.3)
- [CVE-2024-39765](https://insights.sbomify.com/CVE-2024-39765/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39764](https://insights.sbomify.com/CVE-2024-39764/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39763](https://insights.sbomify.com/CVE-2024-39763/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39762](https://insights.sbomify.com/CVE-2024-39762/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39761](https://insights.sbomify.com/CVE-2024-39761/): Command injection in Wavlink AC3000 (critical 10.0)
- [CVE-2024-39760](https://insights.sbomify.com/CVE-2024-39760/): Command injection in Wavlink AC3000 (critical 10.0)
- [CVE-2024-3976](https://insights.sbomify.com/CVE-2024-3976/): Missing Authorization in GitLab (medium 6.5)
- [CVE-2024-39759](https://insights.sbomify.com/CVE-2024-39759/): Command injection in Wavlink AC3000 (critical 10.0)
- [CVE-2024-39758](https://insights.sbomify.com/CVE-2024-39758/): Missing authorization in Intel(R) Arc™ &amp; Iris(R) Xe graphics software (medium 5.1)
- [CVE-2024-39757](https://insights.sbomify.com/CVE-2024-39757/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39756](https://insights.sbomify.com/CVE-2024-39756/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39755](https://insights.sbomify.com/CVE-2024-39755/): Privilege escalation in Anka Build (high 7.8)
- [CVE-2024-39754](https://insights.sbomify.com/CVE-2024-39754/): Hardcoded credentials in Wavlink AC3000 (critical 10.0)
- [CVE-2024-39753](https://insights.sbomify.com/CVE-2024-39753/): SQL injection in Trend Micro Apex One (high 7.5)
- [CVE-2024-39752](https://insights.sbomify.com/CVE-2024-39752/): IBM Analytics Content Hub file upload (medium 6.8)
- [CVE-2024-39751](https://insights.sbomify.com/CVE-2024-39751/): IBM InfoSphere Information Server information disclosure (medium 4.3)
- [CVE-2024-39750](https://insights.sbomify.com/CVE-2024-39750/): IBM Analytics Content Hub buffer overflow (high 8.8)
- [CVE-2024-39747](https://insights.sbomify.com/CVE-2024-39747/): IBM Sterling Connect:Direct Web Services information disclosure (high 8.1)
- [CVE-2024-39746](https://insights.sbomify.com/CVE-2024-39746/): IBM Sterling Connect:Direct Web Services information disclosure (medium 5.9)
- [CVE-2024-39745](https://insights.sbomify.com/CVE-2024-39745/): IBM Sterling Connect:Direct Web Services information disclosure (medium 5.9)
- [CVE-2024-39744](https://insights.sbomify.com/CVE-2024-39744/): IBM Sterling Connect:Direct Web Services cross-site request forgery (medium 4.3)
- [CVE-2024-39743](https://insights.sbomify.com/CVE-2024-39743/): IBM MQ Container denial of service (medium 5.9)
- [CVE-2024-39742](https://insights.sbomify.com/CVE-2024-39742/): IBM MQ Container authentication bypass (high 8.1)
- [CVE-2024-39741](https://insights.sbomify.com/CVE-2024-39741/): IBM Datacap Navigator directory traversal (medium 4.3)
- [CVE-2024-39740](https://insights.sbomify.com/CVE-2024-39740/): IBM Datacap Navigator information disclosure (medium 4.3)
- [CVE-2024-3974](https://insights.sbomify.com/CVE-2024-3974/): BuddyPress <= 12.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-39739](https://insights.sbomify.com/CVE-2024-39739/): IBM Datacap Navigator server-side request forgery (medium 5.4)
- [CVE-2024-39737](https://insights.sbomify.com/CVE-2024-39737/): IBM Datacap Navigator information disclosure (medium 5.4)
- [CVE-2024-39736](https://insights.sbomify.com/CVE-2024-39736/): IBM Datacap Navigator HTTP HOST header injection (medium 6.5)
- [CVE-2024-39735](https://insights.sbomify.com/CVE-2024-39735/): IBM Datacap Navigator cross-site scripting (medium 5.4)
- [CVE-2024-39734](https://insights.sbomify.com/CVE-2024-39734/): IBM Datacap Navigator information disclosure (medium 4.3)
- [CVE-2024-39733](https://insights.sbomify.com/CVE-2024-39733/): IBM Datacap Navigator information disclosure (medium 5.5)
- [CVE-2024-39732](https://insights.sbomify.com/CVE-2024-39732/): IBM Datacap Navigator information disclosure (medium 4.1)
- [CVE-2024-39731](https://insights.sbomify.com/CVE-2024-39731/): IBM Datacap Navigator information disclosure (medium 5.9)
- [CVE-2024-39730](https://insights.sbomify.com/CVE-2024-39730/): IBM Datacap clickjacking (medium 5.4)
- [CVE-2024-3973](https://insights.sbomify.com/CVE-2024-3973/): House Manager <= 1.0.8.4 - Reflected XSS (medium 4.8)
- [CVE-2024-39729](https://insights.sbomify.com/CVE-2024-39729/): IBM Datacap Navigator information disclosure (medium 4.3)
- [CVE-2024-39728](https://insights.sbomify.com/CVE-2024-39728/): IBM Datacap Navigator cross-site scripting (medium 6.4)
- [CVE-2024-39727](https://insights.sbomify.com/CVE-2024-39727/): IBM Engineering Lifecycle Optimization - Engineering Insights tabnabbing (medium 6.1)
- [CVE-2024-39726](https://insights.sbomify.com/CVE-2024-39726/): IBM Engineering Insights XML external entity injection (high 8.2)
- [CVE-2024-39725](https://insights.sbomify.com/CVE-2024-39725/): IBM Engineering Lifecycle Optimization - Engineering Insights information disclosure (medium 5.3)
- [CVE-2024-39724](https://insights.sbomify.com/CVE-2024-39724/): IBM Db2 Big SQL on Cloud Pak for Data is vulnerable to a denial of service due to lack of throttling on an API (medium 5.3)
- [CVE-2024-39723](https://insights.sbomify.com/CVE-2024-39723/): IBM FlashSystem denial of service (medium 4.6)
- [CVE-2024-39722](https://insights.sbomify.com/CVE-2024-39722/): Path traversal in ollama:ollama (high 7.5)
- [CVE-2024-39721](https://insights.sbomify.com/CVE-2024-39721/): Denial of service in ollama:ollama (high 7.5)
- [CVE-2024-39720](https://insights.sbomify.com/CVE-2024-39720/): Ollama Out-of-bounds Read (high 8.2)
- [CVE-2024-3972](https://insights.sbomify.com/CVE-2024-3972/): Similarity <= 3.0 - Stored XSS via CSRF (medium 5.7)
- [CVE-2024-39719](https://insights.sbomify.com/CVE-2024-39719/): Information disclosure in ollama:ollama (high 7.5)
- [CVE-2024-39718](https://insights.sbomify.com/CVE-2024-39718/): Other in Backup and Recovery (high 8.1)
- [CVE-2024-39717](https://insights.sbomify.com/CVE-2024-39717/): Versa Director Dangerous File Type Upload (medium 6.6, exploited in the wild)
- [CVE-2024-39715](https://insights.sbomify.com/CVE-2024-39715/): Code injection in Veeam Service Provider Console (high 8.5)
- [CVE-2024-39714](https://insights.sbomify.com/CVE-2024-39714/): Code injection in Veeam Service Provider Console (critical 9.9)
- [CVE-2024-39713](https://insights.sbomify.com/CVE-2024-39713/): Rocket.Chat Server-Side Request Forgery (SSRF) vulnerability (high 8.6)
- [CVE-2024-39712](https://insights.sbomify.com/CVE-2024-39712/): Command injection in Connect Secure (critical 9.1)
- [CVE-2024-39711](https://insights.sbomify.com/CVE-2024-39711/): Command injection in Connect Secure (critical 9.1)
- [CVE-2024-39710](https://insights.sbomify.com/CVE-2024-39710/): Command injection in Connect Secure (critical 9.1)
- [CVE-2024-3971](https://insights.sbomify.com/CVE-2024-3971/): Similarity <= 3.0 - Plugin Reset via CSRF (medium 5.4)
- [CVE-2024-39709](https://insights.sbomify.com/CVE-2024-39709/): Privilege escalation in Connect Secure (high 7.8)
- [CVE-2024-39708](https://insights.sbomify.com/CVE-2024-39708/): An issue was discovered in the Agent in Delinea Privilege Manager (formerly Thycotic Privilege Manager) before 12.0.1096 on Windows. (high 7.0)
- [CVE-2024-39707](https://insights.sbomify.com/CVE-2024-39707/): Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could le (medium 5.3)
- [CVE-2024-39705](https://insights.sbomify.com/CVE-2024-39705/): ntlk unsafe deserialization vulnerability (critical 9.8)
- [CVE-2024-39704](https://insights.sbomify.com/CVE-2024-39704/): Code injection in unknown-corp:melty blood actress again current code (critical 9.8)
- [CVE-2024-39703](https://insights.sbomify.com/CVE-2024-39703/): Command injection in ThreatQ (high 8.7)
- [CVE-2024-39702](https://insights.sbomify.com/CVE-2024-39702/): Denial of service in openresty:openresty (medium 5.9)
- [CVE-2024-39701](https://insights.sbomify.com/CVE-2024-39701/): Directus Incorrectly handles _in` filter (medium 6.3)
- [CVE-2024-39700](https://insights.sbomify.com/CVE-2024-39700/): Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action (critical 10.0)
- [CVE-2024-3970](https://insights.sbomify.com/CVE-2024-3970/): Server-Side Request Forgery vulnerability in iManager (medium 5.3)
- [CVE-2024-39699](https://insights.sbomify.com/CVE-2024-39699/): Directus has a Blind SSRF On File Import (medium 5.0)
- [CVE-2024-39698](https://insights.sbomify.com/CVE-2024-39698/): Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6 (high 7.5)
- [CVE-2024-39697](https://insights.sbomify.com/CVE-2024-39697/): phonenumber panics on parsing crafted phonenumber inputs (high 8.6)
- [CVE-2024-39696](https://insights.sbomify.com/CVE-2024-39696/): Evmos vulnerable to exploit of smart contract account and vesting (high 8.8)
- [CVE-2024-39695](https://insights.sbomify.com/CVE-2024-39695/): Exiv2 has an out-of-bounds read in AsfVideo::streamProperties (medium 5.3)
- [CVE-2024-39694](https://insights.sbomify.com/CVE-2024-39694/): Duende IdentityServer Open Redirect vulnerability (medium 4.7)
- [CVE-2024-39693](https://insights.sbomify.com/CVE-2024-39693/): Next.js Denial of Service (DoS) condition (high 7.5)
- [CVE-2024-39691](https://insights.sbomify.com/CVE-2024-39691/): Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access to (medium 4.3)
- [CVE-2024-39690](https://insights.sbomify.com/CVE-2024-39690/): Capsule tenant owner with "patch namespace" permission can hijack system namespaces (high 8.5)
- [CVE-2024-3969](https://insights.sbomify.com/CVE-2024-3969/): XML External Entity injection vulnerability in iManager (high 7.8)
- [CVE-2024-39689](https://insights.sbomify.com/CVE-2024-39689/): Certifi removes GLOBALTRUST root certificate (high 7.5)
- [CVE-2024-39688](https://insights.sbomify.com/CVE-2024-39688/): fishaudio/Bert-VITS2 Limited File Write in webui_preprocess.py generate_config function (medium 6.5)
- [CVE-2024-39687](https://insights.sbomify.com/CVE-2024-39687/): Fedify vulnerable to allowing access to internal network resources (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/310/