# Vulnerabilities published in 2024


- [CVE-2024-38485](https://insights.sbomify.com/CVE-2024-38485/): Open redirect in ECS (medium 4.3)
- [CVE-2024-38483](https://insights.sbomify.com/CVE-2024-38483/): Other in Dell Client Platform BIOS (medium 5.8)
- [CVE-2024-38482](https://insights.sbomify.com/CVE-2024-38482/): Other in CloudLink (medium 6.6)
- [CVE-2024-38481](https://insights.sbomify.com/CVE-2024-38481/): Memory corruption in iDRAC Service Module (iSM) (medium 4.8)
- [CVE-2024-38480](https://insights.sbomify.com/CVE-2024-38480/): Hardcoded credentials in "Piccoma" App for Android (medium 4.0)
- [CVE-2024-3848](https://insights.sbomify.com/CVE-2024-3848/): Path Traversal Bypass in mlflow/mlflow (high 7.5)
- [CVE-2024-38479](https://insights.sbomify.com/CVE-2024-38479/): Apache Traffic Server: Cache key plugin is vulnerable to cache poisoning attack (high 7.5)
- [CVE-2024-38477](https://insights.sbomify.com/CVE-2024-38477/): Apache HTTP Server: Crash resulting in Denial of Service in mod_proxy via a malicious request (high 7.5)
- [CVE-2024-38476](https://insights.sbomify.com/CVE-2024-38476/): Apache HTTP Server may use exploitable/malicious backend application output to run local handlers via internal redirect (critical 9.8)
- [CVE-2024-38475](https://insights.sbomify.com/CVE-2024-38475/): Apache HTTP Server Improper Escaping of Output (critical 9.1, exploited in the wild)
- [CVE-2024-38474](https://insights.sbomify.com/CVE-2024-38474/): Apache HTTP Server weakness with encoded question marks in backreferences (high 8.1)
- [CVE-2024-38473](https://insights.sbomify.com/CVE-2024-38473/): Apache HTTP Server proxy encoding problem (high 8.1)
- [CVE-2024-38472](https://insights.sbomify.com/CVE-2024-38472/): Apache HTTP Server on WIndows UNC SSRF (high 7.5)
- [CVE-2024-38471](https://insights.sbomify.com/CVE-2024-38471/): Command injection in Archer AX3000 (medium 6.8)
- [CVE-2024-38470](https://insights.sbomify.com/CVE-2024-38470/): Cross-site scripting in ibarn project:ibarn (medium 6.1)
- [CVE-2024-3847](https://insights.sbomify.com/CVE-2024-3847/): Security feature bypass in Chrome (critical 9.8)
- [CVE-2024-38469](https://insights.sbomify.com/CVE-2024-38469/): Cross-site scripting in ibarn project:ibarn (medium 6.3)
- [CVE-2024-38468](https://insights.sbomify.com/CVE-2024-38468/): Auth bypass in guoxinled:synthesis image system (critical 9.8)
- [CVE-2024-38467](https://insights.sbomify.com/CVE-2024-38467/): Missing authorization in guoxinled:synthesis image system (high 7.5)
- [CVE-2024-38466](https://insights.sbomify.com/CVE-2024-38466/): Hardcoded credentials in guoxinled:synthesis image system (critical 9.8)
- [CVE-2024-38465](https://insights.sbomify.com/CVE-2024-38465/): Information disclosure in guoxinled:synthesis image system (medium 4.0)
- [CVE-2024-38462](https://insights.sbomify.com/CVE-2024-38462/): Other in irods:irods (critical 9.8)
- [CVE-2024-38461](https://insights.sbomify.com/CVE-2024-38461/): Other in irods:irods (high 7.5)
- [CVE-2024-38460](https://insights.sbomify.com/CVE-2024-38460/): SonarQube logs sensitive information (medium 4.9)
- [CVE-2024-3846](https://insights.sbomify.com/CVE-2024-3846/): Other in Chrome (medium 5.4)
- [CVE-2024-38459](https://insights.sbomify.com/CVE-2024-38459/): langchain_experimental Code Execution via Python REPL access (high 7.8)
- [CVE-2024-38458](https://insights.sbomify.com/CVE-2024-38458/): Code injection in xenforo:xenforo (high 8.8)
- [CVE-2024-38457](https://insights.sbomify.com/CVE-2024-38457/): Xenforo before 2.2.16 allows CSRF. (high 8.8)
- [CVE-2024-38456](https://insights.sbomify.com/CVE-2024-38456/): HIGH-LEIT V05.08.01.03 and HIGH-LEIT V04.25.00.00 to 4.25.01.01 for Windows from Vivavis contain an insecure file and folder permissions vul (high 7.8)
- [CVE-2024-38454](https://insights.sbomify.com/CVE-2024-38454/): Cross-site scripting in expressionengine:expressionengine (medium 6.1)
- [CVE-2024-38453](https://insights.sbomify.com/CVE-2024-38453/): The Avalara for Salesforce CPQ app before 7.0 for Salesforce allows attackers to read an API key. (high 7.5)
- [CVE-2024-3845](https://insights.sbomify.com/CVE-2024-3845/): Security feature bypass in Chrome (critical 9.8)
- [CVE-2024-38449](https://insights.sbomify.com/CVE-2024-38449/): A Directory Traversal vulnerability in KasmVNC 1.3.1.230e50f7b89663316c70de7b0e3db6f6b9340489 and possibly earlier versions allows remote au (high 7.7)
- [CVE-2024-38448](https://insights.sbomify.com/CVE-2024-38448/): htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used. (critical 9.1)
- [CVE-2024-38447](https://insights.sbomify.com/CVE-2024-38447/): Missing authorization in ncia:advisor network (high 8.1)
- [CVE-2024-38446](https://insights.sbomify.com/CVE-2024-38446/): Missing authorization in ncia:advisor network (medium 6.5)
- [CVE-2024-38443](https://insights.sbomify.com/CVE-2024-38443/): C/sorting/binary_insertion_sort.c in The Algorithms - C through e5dad3f has a segmentation fault for deep recursion, which may affect common (medium 6.2)
- [CVE-2024-38441](https://insights.sbomify.com/CVE-2024-38441/): Memory corruption in netatalk:netatalk (critical 9.8)
- [CVE-2024-38440](https://insights.sbomify.com/CVE-2024-38440/): Memory corruption in netatalk:netatalk (high 7.5)
- [CVE-2024-3844](https://insights.sbomify.com/CVE-2024-3844/): Other in Chrome (medium 4.3)
- [CVE-2024-38439](https://insights.sbomify.com/CVE-2024-38439/): Memory corruption in netatalk:netatalk (critical 9.8)
- [CVE-2024-38438](https://insights.sbomify.com/CVE-2024-38438/): D-Link - CWE-294: Authentication Bypass by Capture-replay (critical 9.8)
- [CVE-2024-38437](https://insights.sbomify.com/CVE-2024-38437/): D-Link - CWE-288: Authentication Bypass Using an Alternate Path or Channel (critical 9.8)
- [CVE-2024-38436](https://insights.sbomify.com/CVE-2024-38436/): Commugen SOX 365 – CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (medium 6.1)
- [CVE-2024-38435](https://insights.sbomify.com/CVE-2024-38435/): Unitronics Vision PLC - CWE-703: Improper Check or Handling of Exceptional Conditions (medium 6.5)
- [CVE-2024-38434](https://insights.sbomify.com/CVE-2024-38434/): Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function (medium 6.5)
- [CVE-2024-38433](https://insights.sbomify.com/CVE-2024-38433/): Nuvoton - CWE-305: Authentication Bypass by Primary Weakness (medium 6.7)
- [CVE-2024-38432](https://insights.sbomify.com/CVE-2024-38432/): Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File (medium 5.5)
- [CVE-2024-38431](https://insights.sbomify.com/CVE-2024-38431/): Matrix Tafnit v8 - CWE-204: Observable Response Discrepancy (medium 5.3)
- [CVE-2024-38430](https://insights.sbomify.com/CVE-2024-38430/): Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (medium 5.4)
- [CVE-2024-3843](https://insights.sbomify.com/CVE-2024-3843/): Other in Chrome (medium 4.6)
- [CVE-2024-38429](https://insights.sbomify.com/CVE-2024-38429/): Matrix - CWE-552: Files or Directories Accessible to External Parties (high 7.5)
- [CVE-2024-38428](https://insights.sbomify.com/CVE-2024-38428/): Security feature bypass in gnu:wget (critical 9.1)
- [CVE-2024-38427](https://insights.sbomify.com/CVE-2024-38427/): In International Color Consortium DemoIccMAX before 85ce74e, a logic flaw in CIccTagXmlProfileSequenceId::ParseXml in IccXML/IccLibXML/IccTa (high 8.8)
- [CVE-2024-38426](https://insights.sbomify.com/CVE-2024-38426/): Improper Authentication in Modem (medium 5.4)
- [CVE-2024-38425](https://insights.sbomify.com/CVE-2024-38425/): Improper Authorization in Performance (medium 6.1)
- [CVE-2024-38424](https://insights.sbomify.com/CVE-2024-38424/): Use After Free in GPS (high 7.8)
- [CVE-2024-38423](https://insights.sbomify.com/CVE-2024-38423/): Buffer Copy Without Checking Size of Input in Graphics Linux (high 7.8)
- [CVE-2024-38422](https://insights.sbomify.com/CVE-2024-38422/): Integer Overflow to Buffer Overflow in Audio (high 7.8)
- [CVE-2024-38421](https://insights.sbomify.com/CVE-2024-38421/): Use After Free in Graphics Linux (high 7.8)
- [CVE-2024-38420](https://insights.sbomify.com/CVE-2024-38420/): Improper Input Validation in Hypervisor (high 8.8)
- [CVE-2024-38419](https://insights.sbomify.com/CVE-2024-38419/): Use After Free in Automotive GPU (high 7.8)
- [CVE-2024-38418](https://insights.sbomify.com/CVE-2024-38418/): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Linux (high 7.8)
- [CVE-2024-38417](https://insights.sbomify.com/CVE-2024-38417/): Buffer Over-read in Automotive Multimedia (medium 6.1)
- [CVE-2024-38416](https://insights.sbomify.com/CVE-2024-38416/): Buffer Over-read in Audio (medium 6.1)
- [CVE-2024-38415](https://insights.sbomify.com/CVE-2024-38415/): Use After Free in Computer Vision (high 7.8)
- [CVE-2024-38414](https://insights.sbomify.com/CVE-2024-38414/): Buffer Over-read in Computer Vision (medium 6.1)
- [CVE-2024-38413](https://insights.sbomify.com/CVE-2024-38413/): Improper Input Validation in Computer Vision (medium 6.6)
- [CVE-2024-38412](https://insights.sbomify.com/CVE-2024-38412/): Use After Free in Computer Vision (medium 6.6)
- [CVE-2024-38411](https://insights.sbomify.com/CVE-2024-38411/): Use After Free in Computer Vision (medium 6.6)
- [CVE-2024-38410](https://insights.sbomify.com/CVE-2024-38410/): Stack-based Buffer Overflow in WLAN Windows Host (high 7.8)
- [CVE-2024-3841](https://insights.sbomify.com/CVE-2024-3841/): Cross-site scripting in Chrome (high 7.6)
- [CVE-2024-38409](https://insights.sbomify.com/CVE-2024-38409/): Buffer Copy Without Checking Size of Input in WLAN Windows Host (high 7.8)
- [CVE-2024-38408](https://insights.sbomify.com/CVE-2024-38408/): Cryptographic Issues in BT Controller (high 8.2)
- [CVE-2024-38407](https://insights.sbomify.com/CVE-2024-38407/): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera (high 7.8)
- [CVE-2024-38406](https://insights.sbomify.com/CVE-2024-38406/): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera (high 7.8)
- [CVE-2024-38405](https://insights.sbomify.com/CVE-2024-38405/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-38404](https://insights.sbomify.com/CVE-2024-38404/): Buffer Over-read in Multi Mode Call Processor (high 7.5)
- [CVE-2024-38403](https://insights.sbomify.com/CVE-2024-38403/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2024-38402](https://insights.sbomify.com/CVE-2024-38402/): Use After Free in DSP Services (high 7.8)
- [CVE-2024-38401](https://insights.sbomify.com/CVE-2024-38401/): Use After Free in Qualcomm IPC (high 7.8)
- [CVE-2024-3840](https://insights.sbomify.com/CVE-2024-3840/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2024-38399](https://insights.sbomify.com/CVE-2024-38399/): Use After Free in Graphics (high 8.4)
- [CVE-2024-38397](https://insights.sbomify.com/CVE-2024-38397/): Buffer Over-read in WLAN Host Communication (high 7.5)
- [CVE-2024-38396](https://insights.sbomify.com/CVE-2024-38396/): Code injection in iterm2:iterm2 (critical 9.8)
- [CVE-2024-38395](https://insights.sbomify.com/CVE-2024-38395/): Code injection in iterm2:iterm2 (critical 9.8)
- [CVE-2024-38394](https://insights.sbomify.com/CVE-2024-38394/): Mismatches in interpreting USB authorization policy between GNOME Settings Daemon (GSD) through 46.0 and the Linux kernel's underlying devic (medium 4.3)
- [CVE-2024-38392](https://insights.sbomify.com/CVE-2024-38392/): Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cau (critical 9.1)
- [CVE-2024-38390](https://insights.sbomify.com/CVE-2024-38390/): drm/msm/a6xx: Avoid a nullptr dereference when speedbin setting fails (medium 5.5)
- [CVE-2024-3839](https://insights.sbomify.com/CVE-2024-3839/): Memory corruption in Chrome (medium 6.5)
- [CVE-2024-38389](https://insights.sbomify.com/CVE-2024-38389/): Memory corruption in TELLUS (high 7.8)
- [CVE-2024-38388](https://insights.sbomify.com/CVE-2024-38388/): ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup (high 7.8)
- [CVE-2024-38387](https://insights.sbomify.com/CVE-2024-38387/): Privilege escalation in Intel(R) Graphics Driver installers (medium 5.4)
- [CVE-2024-38386](https://insights.sbomify.com/CVE-2024-38386/): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (high 8.4)
- [CVE-2024-38385](https://insights.sbomify.com/CVE-2024-38385/): genirq/irqdesc: Prevent use-after-free in irq_find_at_or_after() (high 7.8)
- [CVE-2024-38384](https://insights.sbomify.com/CVE-2024-38384/): blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (high 7.8)
- [CVE-2024-38383](https://insights.sbomify.com/CVE-2024-38383/): Privilege escalation in Intel(R) Quartus(R) Prime Pro Edition software for Windows (medium 5.4)
- [CVE-2024-38382](https://insights.sbomify.com/CVE-2024-38382/): Ability Runtime has an out-of-bounds read permission bypass vulnerability (medium 5.5)
- [CVE-2024-38381](https://insights.sbomify.com/CVE-2024-38381/): nfc: nci: Fix uninit-value in nci_rx_work (high 8.8)
- [CVE-2024-38380](https://insights.sbomify.com/CVE-2024-38380/): Millbeck Communications Proroute H685t-w Cross-site Scripting. (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/321/