# Vulnerabilities published in 2024


- [CVE-2024-39386](https://insights.sbomify.com/CVE-2024-39386/): ZDI-CAN-24057: Adobe Bridge AVI FIle Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-39385](https://insights.sbomify.com/CVE-2024-39385/): Premiere Pro | Use After Free (CWE-416) (medium 5.5)
- [CVE-2024-39384](https://insights.sbomify.com/CVE-2024-39384/): Premiere Pro | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-39383](https://insights.sbomify.com/CVE-2024-39383/): PoC sample of unknown vulnerability detected by EXPMON system (high 7.8)
- [CVE-2024-39382](https://insights.sbomify.com/CVE-2024-39382/): After Effects | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-39381](https://insights.sbomify.com/CVE-2024-39381/): After Effects | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-39380](https://insights.sbomify.com/CVE-2024-39380/): After Effects | Heap-based Buffer Overflow (CWE-122) (high 7.8)
- [CVE-2024-3938](https://insights.sbomify.com/CVE-2024-3938/): Cross-site scripting in dotCMS core (medium 5.4)
- [CVE-2024-39379](https://insights.sbomify.com/CVE-2024-39379/): Acrobat for Edge | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-39378](https://insights.sbomify.com/CVE-2024-39378/): Audition | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-39377](https://insights.sbomify.com/CVE-2024-39377/): Media Encoder | Out-of-bounds Write (CWE-787) (high 7.8)
- [CVE-2024-39376](https://insights.sbomify.com/CVE-2024-39376/): Improper Access Control In TELSAT MarKoni FM Transmitter (critical 9.3)
- [CVE-2024-39375](https://insights.sbomify.com/CVE-2024-39375/): Use of Client-Side Authentication in TELSAT marKoni FM Transmitter (critical 9.3)
- [CVE-2024-39374](https://insights.sbomify.com/CVE-2024-39374/): Use of Hard-coded Credentials in TELSAT marKoni FM Transmitter (critical 9.3)
- [CVE-2024-39373](https://insights.sbomify.com/CVE-2024-39373/): Improper Neutralization of Special Elements used in a Command in TELSAT marKoni FM Transmitter (critical 9.3)
- [CVE-2024-39372](https://insights.sbomify.com/CVE-2024-39372/): Privilege escalation in Intel(R) XTU software for Windows (medium 5.4)
- [CVE-2024-39371](https://insights.sbomify.com/CVE-2024-39371/): io_uring: check for non-NULL file pointer in io_file_can_poll() (medium 5.5)
- [CVE-2024-39370](https://insights.sbomify.com/CVE-2024-39370/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-3937](https://insights.sbomify.com/CVE-2024-3937/): Playlist for Youtube <= 1.32 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-39368](https://insights.sbomify.com/CVE-2024-39368/): SQL injection in Intel(R) Neural Compressor software (high 8.6)
- [CVE-2024-39367](https://insights.sbomify.com/CVE-2024-39367/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39365](https://insights.sbomify.com/CVE-2024-39365/): Privilege escalation in Intel(R) oneAPI DPC++/C++ Compiler software for Windows (medium 5.4)
- [CVE-2024-39364](https://insights.sbomify.com/CVE-2024-39364/): Advantech ADAM-5630 Missing Authentication for Critical Function (high 7.0)
- [CVE-2024-39363](https://insights.sbomify.com/CVE-2024-39363/): Cross-site scripting in Wavlink AC3000 (critical 9.6)
- [CVE-2024-39361](https://insights.sbomify.com/CVE-2024-39361/): Creating posts with user-defined IDs permitted in CreatePost API (low 3.1)
- [CVE-2024-39360](https://insights.sbomify.com/CVE-2024-39360/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-3936](https://insights.sbomify.com/CVE-2024-3936/): The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid <= 7.6.1 - Missing Authorization (medium 4.3)
- [CVE-2024-39359](https://insights.sbomify.com/CVE-2024-39359/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39358](https://insights.sbomify.com/CVE-2024-39358/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39357](https://insights.sbomify.com/CVE-2024-39357/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39356](https://insights.sbomify.com/CVE-2024-39356/): Null dereference in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows (high 7.1)
- [CVE-2024-39355](https://insights.sbomify.com/CVE-2024-39355/): Denial of service in Intel(R) Processors (medium 5.7)
- [CVE-2024-39354](https://insights.sbomify.com/CVE-2024-39354/): Delta Electronics DIAScreen Stack-based Buffer Overflow (high 8.4)
- [CVE-2024-39353](https://insights.sbomify.com/CVE-2024-39353/): RemoteClusterFrame payloads are audit logged in full (low 2.7)
- [CVE-2024-39352](https://insights.sbomify.com/CVE-2024-39352/): Security feature bypass in Camera Firmware (medium 4.9)
- [CVE-2024-39351](https://insights.sbomify.com/CVE-2024-39351/): Command injection in Camera Firmware (high 7.2)
- [CVE-2024-39350](https://insights.sbomify.com/CVE-2024-39350/): Auth bypass in Camera Firmware (high 7.5)
- [CVE-2024-3935](https://insights.sbomify.com/CVE-2024-3935/): Eclipse Mosquito: Double free vulnerability (medium 6.0)
- [CVE-2024-39349](https://insights.sbomify.com/CVE-2024-39349/): Memory corruption in Camera Firmware (critical 9.8)
- [CVE-2024-39348](https://insights.sbomify.com/CVE-2024-39348/): Security feature bypass in Synology Router Manager (SRM) (high 7.5)
- [CVE-2024-39347](https://insights.sbomify.com/CVE-2024-39347/): Misconfiguration in Synology Router Manager (SRM) (medium 5.9)
- [CVE-2024-39345](https://insights.sbomify.com/CVE-2024-39345/): Hardcoded credentials in adtran:sdg smartos (high 7.5)
- [CVE-2024-39344](https://insights.sbomify.com/CVE-2024-39344/): An issue was discovered in the Docusign API package 8.142.14 for Salesforce. (high 8.1)
- [CVE-2024-39343](https://insights.sbomify.com/CVE-2024-39343/): Denial of service in samsung:exynos 1280 firmware (high 7.0)
- [CVE-2024-39342](https://insights.sbomify.com/CVE-2024-39342/): Entrust Instant Financial Issuance (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier uses a DLL library (i.e. (medium 6.6)
- [CVE-2024-39341](https://insights.sbomify.com/CVE-2024-39341/): Entrust Instant Financial Issuance (On Premise) Software (formerly known as Cardwizard) 6.10.0, 6.9.0, 6.9.1, 6.9.2, and 6.8.x and earlier l (medium 5.9)
- [CVE-2024-39340](https://insights.sbomify.com/CVE-2024-39340/): The authentication system of Securepoint UTM mishandles OTP keys. (high 8.8)
- [CVE-2024-3934](https://insights.sbomify.com/CVE-2024-3934/): Mercado Pago payments for WooCommerce 7.3.0 - 7.6.1 - Authenticated (Subscriber+) Arbitrary File Download (medium 6.5)
- [CVE-2024-39339](https://insights.sbomify.com/CVE-2024-39339/): A vulnerability has been discovered in all versions of Smartplay headunits, which are widely used in Suzuki and Toyota cars. (high 7.5)
- [CVE-2024-39338](https://insights.sbomify.com/CVE-2024-39338/): Server-Side Request Forgery in axios (medium 4.0)
- [CVE-2024-39337](https://insights.sbomify.com/CVE-2024-39337/): Click Studios Passwordstate Core before 9.8 build 9858 allows Authentication Bypass. (medium 6.5)
- [CVE-2024-39335](https://insights.sbomify.com/CVE-2024-39335/): Information disclosure in mahara:mahara (critical 9.1)
- [CVE-2024-39334](https://insights.sbomify.com/CVE-2024-39334/): MENDELSON AS4 before 2024 B376 has a client-side vulnerability when a trading partner provides prepared XML data. (medium 6.5)
- [CVE-2024-39332](https://insights.sbomify.com/CVE-2024-39332/): Path traversal in webswing:webswing (critical 9.8)
- [CVE-2024-39331](https://insights.sbomify.com/CVE-2024-39331/): Code injection in gnu:emacs (critical 9.8)
- [CVE-2024-39330](https://insights.sbomify.com/CVE-2024-39330/): Django Path Traversal vulnerability (medium 4.3)
- [CVE-2024-3933](https://insights.sbomify.com/CVE-2024-3933/): Eclipse Open J9 With -Xgc:concurrentScavenge on IBM Z, could write/read outside of a buffer (medium 5.3)
- [CVE-2024-39329](https://insights.sbomify.com/CVE-2024-39329/): Django vulnerable to user enumeration attack (medium 5.3)
- [CVE-2024-39328](https://insights.sbomify.com/CVE-2024-39328/): Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7.0. (medium 6.8)
- [CVE-2024-39327](https://insights.sbomify.com/CVE-2024-39327/): Incorrect Access Control vulnerability in Atos Eviden IDRA before 2.6.1 could allow the possibility to obtain CA signing in an illegitimate way. (critical 9.9)
- [CVE-2024-39326](https://insights.sbomify.com/CVE-2024-39326/): SkillTree CSRF Vulnerability allows an attacker to modify the Video and Captions of a Skill (medium 4.4)
- [CVE-2024-39325](https://insights.sbomify.com/CVE-2024-39325/): aimeos/ai-controller-frontend doesn't reset payment status in basket (medium 5.3)
- [CVE-2024-39324](https://insights.sbomify.com/CVE-2024-39324/): aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services (low 3.8)
- [CVE-2024-39323](https://insights.sbomify.com/CVE-2024-39323/): aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account (high 7.1)
- [CVE-2024-39322](https://insights.sbomify.com/CVE-2024-39322/): aimeos/ai-admin-jsonadm improper access control vulnerability allows editors to remove required records (medium 5.5)
- [CVE-2024-39321](https://insights.sbomify.com/CVE-2024-39321/): Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes (high 7.5)
- [CVE-2024-39320](https://insights.sbomify.com/CVE-2024-39320/): Discourse allows iframe injection though default site setting (medium 6.1)
- [CVE-2024-3932](https://insights.sbomify.com/CVE-2024-3932/): Totara LMS User Selector cross-site request forgery (low 2.3)
- [CVE-2024-39319](https://insights.sbomify.com/CVE-2024-39319/): aimeos/ai-controller-frontend has IDOR vulnerability in account profile page (medium 5.3)
- [CVE-2024-39318](https://insights.sbomify.com/CVE-2024-39318/): Ibexa Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget (medium 5.4)
- [CVE-2024-39317](https://insights.sbomify.com/CVE-2024-39317/): Wagtail regular expression denial-of-service via search query parsing (medium 6.5)
- [CVE-2024-39316](https://insights.sbomify.com/CVE-2024-39316/): Rack ReDoS Vulnerability in HTTP Accept Headers Parsing (medium 6.5)
- [CVE-2024-39315](https://insights.sbomify.com/CVE-2024-39315/): Pomerium exposed OAuth2 access and ID tokens in user info endpoint response (medium 5.7)
- [CVE-2024-39314](https://insights.sbomify.com/CVE-2024-39314/): toy-blog administrative token leaked through the command line parameter (medium 4.7)
- [CVE-2024-39313](https://insights.sbomify.com/CVE-2024-39313/): toy-blog Improper Input Validation vulnerability (medium 6.5)
- [CVE-2024-39312](https://insights.sbomify.com/CVE-2024-39312/): Botan has an Authorization Error due to Name Constraint Decoding Bug (medium 5.3)
- [CVE-2024-39311](https://insights.sbomify.com/CVE-2024-39311/): Publify Vulnerable To Cross-Site Scripting (XSS) Via Redirects Requiring User Interaction (low 1.8)
- [CVE-2024-39310](https://insights.sbomify.com/CVE-2024-39310/): WordPress Basil Theme Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability (medium 5.4)
- [CVE-2024-3931](https://insights.sbomify.com/CVE-2024-3931/): Totara LMS User Selector check.php cross site scripting (medium 5.1)
- [CVE-2024-39309](https://insights.sbomify.com/CVE-2024-39309/): ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability (critical 9.8)
- [CVE-2024-39308](https://insights.sbomify.com/CVE-2024-39308/): RailsAdmin Cross-site Scripting vulnerability in the list view (medium 6.8)
- [CVE-2024-39307](https://insights.sbomify.com/CVE-2024-39307/): Cross-Site Scripting (XSS) vulnerability via crafted ebooks in Kavita (low 3.5)
- [CVE-2024-39305](https://insights.sbomify.com/CVE-2024-39305/): Envoy Proxy use after free when route hash policy is configured with cookie attributes (medium 6.5)
- [CVE-2024-39304](https://insights.sbomify.com/CVE-2024-39304/): ChurchCRM SQL Injection Vulnerability (high 8.8)
- [CVE-2024-39303](https://insights.sbomify.com/CVE-2024-39303/): Weblate vulnerabler to improper sanitization of project backups (medium 4.4)
- [CVE-2024-39302](https://insights.sbomify.com/CVE-2024-39302/): Some bbb-record-core files installed with wrong file permission (low 3.7)
- [CVE-2024-39301](https://insights.sbomify.com/CVE-2024-39301/): net/9p: fix uninit-value in p9_client_rpc() (medium 5.5)
- [CVE-2024-39300](https://insights.sbomify.com/CVE-2024-39300/): Auth bypass in WAB-I1750-PS (high 8.1)
- [CVE-2024-3930](https://insights.sbomify.com/CVE-2024-3930/): XML External Entity in Akana (medium 6.3)
- [CVE-2024-39299](https://insights.sbomify.com/CVE-2024-39299/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39298](https://insights.sbomify.com/CVE-2024-39298/): mm/memory-failure: fix handling of dissolved but not taken off from buddy pages (medium 5.5)
- [CVE-2024-39296](https://insights.sbomify.com/CVE-2024-39296/): bonding: fix oops during rmmod (medium 4.7)
- [CVE-2024-39294](https://insights.sbomify.com/CVE-2024-39294/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39293](https://insights.sbomify.com/CVE-2024-39293/): Revert "xsk: Support redirect to any socket bound to the same umem" (critical 9.8)
- [CVE-2024-39292](https://insights.sbomify.com/CVE-2024-39292/): um: Add winch to winch_handlers before registering winch IRQ (high 7.8)
- [CVE-2024-39291](https://insights.sbomify.com/CVE-2024-39291/): drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode() (high 7.8)
- [CVE-2024-39290](https://insights.sbomify.com/CVE-2024-39290/): Information disclosure in IX-BA (medium 6.5)
- [CVE-2024-3929](https://insights.sbomify.com/CVE-2024-3929/): Cross-site scripting in Content Views – Post Grid & Filter, Recent Posts, Category Posts … (Shortcode, Gutenberg Blocks, and Widgets for Elementor) (medium 6.4)
- [CVE-2024-39289](https://insights.sbomify.com/CVE-2024-39289/): Unsafe use of eval() method in rosparam tool (high 7.8)
- [CVE-2024-39288](https://insights.sbomify.com/CVE-2024-39288/): Memory corruption in Wavlink AC3000 (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/314/