# Vulnerabilities published in 2024


- [CVE-2024-39589](https://insights.sbomify.com/CVE-2024-39589/): Null dereference in OpenPLC v3 (high 7.5)
- [CVE-2024-39586](https://insights.sbomify.com/CVE-2024-39586/): XML external entity in AppSync (low 2.9)
- [CVE-2024-39585](https://insights.sbomify.com/CVE-2024-39585/): Hardcoded credentials in SmartFabric OS10 Software (high 7.9)
- [CVE-2024-39584](https://insights.sbomify.com/CVE-2024-39584/): Hardcoded credentials in Dell Client Platform BIOS (high 8.2)
- [CVE-2024-39583](https://insights.sbomify.com/CVE-2024-39583/): Weak cryptography in PowerScale InsightIQ (high 8.1)
- [CVE-2024-39582](https://insights.sbomify.com/CVE-2024-39582/): Hardcoded credentials in PowerScale InsightIQ (low 2.3)
- [CVE-2024-39581](https://insights.sbomify.com/CVE-2024-39581/): Information disclosure in PowerScale InsightIQ (high 7.3)
- [CVE-2024-39580](https://insights.sbomify.com/CVE-2024-39580/): Privilege escalation in PowerScale InsightIQ (medium 6.7)
- [CVE-2024-3958](https://insights.sbomify.com/CVE-2024-3958/): Improper Control of Generation of Code ('Code Injection') in GitLab (medium 5.3)
- [CVE-2024-39579](https://insights.sbomify.com/CVE-2024-39579/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2024-39578](https://insights.sbomify.com/CVE-2024-39578/): Path traversal in PowerScale OneFS (medium 6.3)
- [CVE-2024-39577](https://insights.sbomify.com/CVE-2024-39577/): Command injection in SmartFabric OS10 Software (high 7.1)
- [CVE-2024-39576](https://insights.sbomify.com/CVE-2024-39576/): Privilege escalation in Dell Power Manager (DPM) (high 8.8)
- [CVE-2024-39575](https://insights.sbomify.com/CVE-2024-39575/): Information disclosure in Dell EMC VxRail Appliance (high 7.4)
- [CVE-2024-39574](https://insights.sbomify.com/CVE-2024-39574/): Privilege escalation in PowerScale InsightIQ (medium 6.7)
- [CVE-2024-39573](https://insights.sbomify.com/CVE-2024-39573/): Apache HTTP Server: mod_rewrite proxy handler substitution (high 7.5)
- [CVE-2024-39571](https://insights.sbomify.com/CVE-2024-39571/): Command injection in SINEMA Remote Connect Server (high 8.7)
- [CVE-2024-39570](https://insights.sbomify.com/CVE-2024-39570/): Command injection in SINEMA Remote Connect Server (high 8.7)
- [CVE-2024-3957](https://insights.sbomify.com/CVE-2024-3957/): Booster for WooCommerce <= 7.1.8 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-39569](https://insights.sbomify.com/CVE-2024-39569/): Command injection in SINEMA Remote Connect Client (high 7.5)
- [CVE-2024-39568](https://insights.sbomify.com/CVE-2024-39568/): Command injection in SINEMA Remote Connect Client (high 8.5)
- [CVE-2024-39567](https://insights.sbomify.com/CVE-2024-39567/): Command injection in SINEMA Remote Connect Client (high 8.5)
- [CVE-2024-39565](https://insights.sbomify.com/CVE-2024-39565/): Junos OS: J-Web: An unauthenticated, network-based attacker can perform XPATH injection attack against a device. (high 7.7)
- [CVE-2024-39564](https://insights.sbomify.com/CVE-2024-39564/): Junos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to RPD crash (high 8.7)
- [CVE-2024-39563](https://insights.sbomify.com/CVE-2024-39563/): Junos Space: Remote Command Execution (RCE) vulnerability in web application (medium 6.9)
- [CVE-2024-39562](https://insights.sbomify.com/CVE-2024-39562/): Junos OS Evolved: A high rate of SSH connections causes a Denial of Service (high 8.7)
- [CVE-2024-39561](https://insights.sbomify.com/CVE-2024-39561/): Security feature bypass in Junos OS (medium 6.9)
- [CVE-2024-39560](https://insights.sbomify.com/CVE-2024-39560/): Junos OS and Junos OS Evolved: Memory leak due to RSVP neighbor persistent error leading to kernel crash (high 7.1)
- [CVE-2024-3956](https://insights.sbomify.com/CVE-2024-3956/): Cross-site scripting in Pods – Custom Content Types and Fields (medium 5.4)
- [CVE-2024-39559](https://insights.sbomify.com/CVE-2024-39559/): Race condition in Junos OS Evolved (high 8.2)
- [CVE-2024-39558](https://insights.sbomify.com/CVE-2024-39558/): Junos OS and Junos OS Evolved: Receipt of specific PIM packet causes rpd crash when PIM is configured along with MoFRR (high 7.1)
- [CVE-2024-39557](https://insights.sbomify.com/CVE-2024-39557/): Junos OS Evolved: MAC table changes cause a memory leak (high 7.1)
- [CVE-2024-39556](https://insights.sbomify.com/CVE-2024-39556/): Junos OS and Junos OS Evolved: Loading a malicious certificate from the CLI may result in a stack-based overflow (high 7.1)
- [CVE-2024-39555](https://insights.sbomify.com/CVE-2024-39555/): Junos OS and Junos OS Evolved: Receipt of a specific malformed BGP update causes the session to reset (high 8.7)
- [CVE-2024-39554](https://insights.sbomify.com/CVE-2024-39554/): Junos OS and Junos OS Evolved: BGP multipath incremental calculation is resulting in an rpd crash (high 8.2)
- [CVE-2024-39553](https://insights.sbomify.com/CVE-2024-39553/): Junos OS Evolved: Receipt of arbitrary data when sampling service is enabled, leads to partial Denial of Service (DoS). (medium 6.9)
- [CVE-2024-39552](https://insights.sbomify.com/CVE-2024-39552/): Junos OS and Junos OS Evolved: Malformed BGP UPDATE causes RPD crash (high 8.7)
- [CVE-2024-39551](https://insights.sbomify.com/CVE-2024-39551/): Denial of service in Junos OS (high 8.7)
- [CVE-2024-39550](https://insights.sbomify.com/CVE-2024-39550/): Junos OS: MX Series with SPC3 line card: Port flaps causes rtlogd memory leak leading to Denial of Service (high 7.1)
- [CVE-2024-3955](https://insights.sbomify.com/CVE-2024-3955/): Arbitrary code execution in CraftBeerPi 4 (critical 9.8)
- [CVE-2024-39549](https://insights.sbomify.com/CVE-2024-39549/): Junos OS and Junos OS Evolved: Receipt of malformed BGP path attributes leads to a memory leak (high 8.7)
- [CVE-2024-39548](https://insights.sbomify.com/CVE-2024-39548/): Junos OS Evolved: Receipt of specific packets in the aftmand process will lead to a memory leak (high 7.1)
- [CVE-2024-39547](https://insights.sbomify.com/CVE-2024-39547/): Junos OS and Junos OS Evolved: cRPD: Receipt of crafted TCP traffic can trigger high CPU utilization (high 8.7)
- [CVE-2024-39546](https://insights.sbomify.com/CVE-2024-39546/): Junos OS Evolved: Local low-privilege user can gain root permissions leading to privilege escalation (high 7.0)
- [CVE-2024-39545](https://insights.sbomify.com/CVE-2024-39545/): Denial of service in Junos OS (high 8.7)
- [CVE-2024-39544](https://insights.sbomify.com/CVE-2024-39544/): Junos OS Evolved: Low privileged local user able to view NETCONF traceoptions files (medium 5.1)
- [CVE-2024-39543](https://insights.sbomify.com/CVE-2024-39543/): Junos OS and Junos OS Evolved: Receipt of a large RPKI-RTR PDU packet can cause rpd to crash (high 7.1)
- [CVE-2024-39542](https://insights.sbomify.com/CVE-2024-39542/): Junos OS and Junos OS Evolved: A malformed CFM packet or specific transit traffic leads to FPC crash (high 8.7)
- [CVE-2024-39541](https://insights.sbomify.com/CVE-2024-39541/): Junos OS and Junos OS Evolved: Inconsistent information in the TE database can lead to an rpd crash (high 7.1)
- [CVE-2024-39540](https://insights.sbomify.com/CVE-2024-39540/): Junos OS: SRX Series, and MX Series with SPC3: Specific valid TCP traffic can cause a pfe crash (high 8.7)
- [CVE-2024-3954](https://insights.sbomify.com/CVE-2024-3954/): Ditty – Responsive News Tickers, Sliders, and Lists <= 3.1.38 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-39539](https://insights.sbomify.com/CVE-2024-39539/): Junos OS: MX Series: Continuous subscriber logins will lead to a memory leak and eventually an FPC crash (medium 6.0)
- [CVE-2024-39538](https://insights.sbomify.com/CVE-2024-39538/): Junos OS Evolved: ACX7000 Series: When multicast traffic with a specific (S,G) is received evo-pfemand crashes (high 7.1)
- [CVE-2024-39537](https://insights.sbomify.com/CVE-2024-39537/): Junos OS Evolved: ACX7000 Series: Ports which have been inadvertently exposed can be reached over the network (medium 6.9)
- [CVE-2024-39536](https://insights.sbomify.com/CVE-2024-39536/): Junos OS and Junos OS Evolved: Flaps of BFD sessions with authentication cause a ppmd memory leak (medium 6.0)
- [CVE-2024-39535](https://insights.sbomify.com/CVE-2024-39535/): Junos OS Evolved: ACX 7000 Series: When specific traffic is received in a VPLS scenario evo-pfemand crashes (high 7.1)
- [CVE-2024-39534](https://insights.sbomify.com/CVE-2024-39534/): Junos OS Evolved: Connections to the network and broadcast address accepted (medium 5.3)
- [CVE-2024-39533](https://insights.sbomify.com/CVE-2024-39533/): Junos OS: QFX5000 Series and EX4600 Series: Output firewall filter is not applied if certain match criteria are used (medium 6.9)
- [CVE-2024-39532](https://insights.sbomify.com/CVE-2024-39532/): Junos OS and Junos OS Evolved: Confidential information in logs can be accessed by another user (medium 6.3)
- [CVE-2024-39531](https://insights.sbomify.com/CVE-2024-39531/): Junos OS Evolved: ACX 7000 Series: Protocol specific DDoS configuration affects other protocols (high 8.7)
- [CVE-2024-39530](https://insights.sbomify.com/CVE-2024-39530/): Junos OS: Attempting to access specific sensors on platforms not supporting these will lead to a chassisd crash (high 8.7)
- [CVE-2024-39529](https://insights.sbomify.com/CVE-2024-39529/): Denial of service in Junos OS (high 8.7)
- [CVE-2024-39528](https://insights.sbomify.com/CVE-2024-39528/): Use after free in Junos OS (medium 6.0)
- [CVE-2024-39527](https://insights.sbomify.com/CVE-2024-39527/): Junos OS: SRX Series: Low privileged user able to access sensitive information on file system (medium 6.8)
- [CVE-2024-39526](https://insights.sbomify.com/CVE-2024-39526/): Denial of service in Junos OS (high 7.1)
- [CVE-2024-39525](https://insights.sbomify.com/CVE-2024-39525/): Denial of service in Junos OS (high 8.7)
- [CVE-2024-39524](https://insights.sbomify.com/CVE-2024-39524/): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (high 8.5)
- [CVE-2024-39523](https://insights.sbomify.com/CVE-2024-39523/): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (high 8.5)
- [CVE-2024-39522](https://insights.sbomify.com/CVE-2024-39522/): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (high 8.5)
- [CVE-2024-39521](https://insights.sbomify.com/CVE-2024-39521/): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (high 8.5)
- [CVE-2024-39520](https://insights.sbomify.com/CVE-2024-39520/): Junos OS Evolved: CLI parameter processing issue allows privilege escalation (high 8.5)
- [CVE-2024-3952](https://insights.sbomify.com/CVE-2024-3952/): Advanced Ads – Ad Manager & AdSense <= 1.52.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Ad Widget (medium 6.4)
- [CVE-2024-39519](https://insights.sbomify.com/CVE-2024-39519/): Junos OS Evolved: ACX 7000 Series: Multicast traffic is looped in a multihoming EVPN MPLS scenario (high 7.1)
- [CVE-2024-39518](https://insights.sbomify.com/CVE-2024-39518/): Denial of service in Junos OS (high 8.7)
- [CVE-2024-39517](https://insights.sbomify.com/CVE-2024-39517/): Junos OS and Junos OS Evolved: Upon processing specific L2 traffic, rpd can hang in devices with EVPN/VXLAN configured (high 7.1)
- [CVE-2024-39516](https://insights.sbomify.com/CVE-2024-39516/): Memory corruption in Junos OS (high 8.7)
- [CVE-2024-39515](https://insights.sbomify.com/CVE-2024-39515/): Denial of service in Junos OS (high 8.7)
- [CVE-2024-39514](https://insights.sbomify.com/CVE-2024-39514/): Denial of service in Junos OS (high 7.1)
- [CVE-2024-39513](https://insights.sbomify.com/CVE-2024-39513/): Junos OS Evolved: Execution of a specific CLI command will cause a crash in the AFT manager (medium 6.8)
- [CVE-2024-39512](https://insights.sbomify.com/CVE-2024-39512/): Junos OS Evolved: User is not logged out when the console cable is disconnected (high 7.0)
- [CVE-2024-39511](https://insights.sbomify.com/CVE-2024-39511/): Junos OS: The 802.1X Authentication Daemon crashes on running a specific command (medium 6.8)
- [CVE-2024-39510](https://insights.sbomify.com/CVE-2024-39510/): cachefiles: fix slab-use-after-free in cachefiles_ondemand_daemon_read() (high 7.8)
- [CVE-2024-3951](https://insights.sbomify.com/CVE-2024-3951/): Cross-site Scripting in PTC Codebeamer (high 7.1)
- [CVE-2024-39509](https://insights.sbomify.com/CVE-2024-39509/): HID: core: remove unnecessary WARN_ON() in implement() (medium 5.5)
- [CVE-2024-39508](https://insights.sbomify.com/CVE-2024-39508/): io_uring/io-wq: Use set_bit() and test_bit() at worker->flags (high 7.8)
- [CVE-2024-39507](https://insights.sbomify.com/CVE-2024-39507/): net: hns3: fix kernel crash problem in concurrent scenario (high 7.0)
- [CVE-2024-39506](https://insights.sbomify.com/CVE-2024-39506/): liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (medium 5.5)
- [CVE-2024-39505](https://insights.sbomify.com/CVE-2024-39505/): drm/komeda: check for error-valued pointer (medium 5.5)
- [CVE-2024-39504](https://insights.sbomify.com/CVE-2024-39504/): netfilter: nft_inner: validate mandatory meta and payload (medium 5.5)
- [CVE-2024-39503](https://insights.sbomify.com/CVE-2024-39503/): netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (high 7.8)
- [CVE-2024-39502](https://insights.sbomify.com/CVE-2024-39502/): ionic: fix use after netif_napi_del() (high 7.8)
- [CVE-2024-39500](https://insights.sbomify.com/CVE-2024-39500/): sock_map: avoid race between sock_map_close and sk_psock_put (high 7.8)
- [CVE-2024-39499](https://insights.sbomify.com/CVE-2024-39499/): vmci: prevent speculation leaks by sanitizing event in event_deliver() (high 7.1)
- [CVE-2024-39498](https://insights.sbomify.com/CVE-2024-39498/): drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 (medium 5.5)
- [CVE-2024-39497](https://insights.sbomify.com/CVE-2024-39497/): drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) (medium 5.5)
- [CVE-2024-39496](https://insights.sbomify.com/CVE-2024-39496/): btrfs: zoned: fix use-after-free due to race with dev replace (high 7.8)
- [CVE-2024-39495](https://insights.sbomify.com/CVE-2024-39495/): greybus: Fix use-after-free bug in gb_interface_release due to race condition. (high 7.8)
- [CVE-2024-39494](https://insights.sbomify.com/CVE-2024-39494/): ima: Fix use-after-free on a dentry's dname.name (high 7.8)
- [CVE-2024-39493](https://insights.sbomify.com/CVE-2024-39493/): crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (medium 5.5)
- [CVE-2024-39492](https://insights.sbomify.com/CVE-2024-39492/): mailbox: mtk-cmdq: Fix pm_runtime_get_sync() warning in mbox shutdown (high 7.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/312/