# Vulnerabilities published in 2024


- [CVE-2024-3838](https://insights.sbomify.com/CVE-2024-3838/): Other in Chrome (medium 4.3)
- [CVE-2024-38379](https://insights.sbomify.com/CVE-2024-38379/): Apache Allura: Stored authenticated XSS (medium 4.8)
- [CVE-2024-38375](https://insights.sbomify.com/CVE-2024-38375/): @fastly/js-compute use-after-free in some host call implementations (medium 5.3)
- [CVE-2024-38374](https://insights.sbomify.com/CVE-2024-38374/): Improper Restriction of XML External Entity Reference in org.cyclonedx:cyclonedx-core-java (high 7.5)
- [CVE-2024-38373](https://insights.sbomify.com/CVE-2024-38373/): FreeRTOS-Plus-TCP Buffer Over-Read in DNS Response Parser (critical 9.6)
- [CVE-2024-38372](https://insights.sbomify.com/CVE-2024-38372/): Undici vulnerable to data leak when using response.arrayBuffer() (low 2.0)
- [CVE-2024-38371](https://insights.sbomify.com/CVE-2024-38371/): Insufficient access control for OAuth2 Device Code flow in authentik (high 8.6)
- [CVE-2024-38370](https://insights.sbomify.com/CVE-2024-38370/): GLPI allows API document download without rights (medium 5.3)
- [CVE-2024-3837](https://insights.sbomify.com/CVE-2024-3837/): Use after free in Chrome (medium 5.9)
- [CVE-2024-38369](https://insights.sbomify.com/CVE-2024-38369/): XWiki programming rights may be inherited by inclusion (critical 10.0)
- [CVE-2024-38368](https://insights.sbomify.com/CVE-2024-38368/): Trunk's 'Claim your pod' could be used to obtain un-used pods (critical 9.3)
- [CVE-2024-38367](https://insights.sbomify.com/CVE-2024-38367/): CoacoaPods trunk sessions verification step could be manipulated for owner session hijacking (high 8.2)
- [CVE-2024-38366](https://insights.sbomify.com/CVE-2024-38366/): CoacoaPods trunk RCE in email verification system rfc-822 (critical 10.0)
- [CVE-2024-38365](https://insights.sbomify.com/CVE-2024-38365/): btcd did not correctly re-implement Bitcoin Core's "FindAndDelete()" functionality (high 7.4)
- [CVE-2024-38364](https://insights.sbomify.com/CVE-2024-38364/): DSpace Cross Site Scripting (XSS) via a deposited HTML/XML document (low 2.6)
- [CVE-2024-38363](https://insights.sbomify.com/CVE-2024-38363/): Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte (high 8.6)
- [CVE-2024-38361](https://insights.sbomify.com/CVE-2024-38361/): Permissions processing error in spacedb (low 3.7)
- [CVE-2024-38360](https://insights.sbomify.com/CVE-2024-38360/): Denial of service via Watched Words in Discourse (medium 4.9)
- [CVE-2024-38359](https://insights.sbomify.com/CVE-2024-38359/): Lightning Network Daemon Onion Bomb (medium 6.5)
- [CVE-2024-38358](https://insights.sbomify.com/CVE-2024-38358/): Symlink bypasses filesystem sandbox in wasmer (low 2.9)
- [CVE-2024-38357](https://insights.sbomify.com/CVE-2024-38357/): TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements (medium 6.1)
- [CVE-2024-38356](https://insights.sbomify.com/CVE-2024-38356/): TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option (medium 6.1)
- [CVE-2024-38355](https://insights.sbomify.com/CVE-2024-38355/): Unhandled 'error' event in socket.io (high 7.3)
- [CVE-2024-38354](https://insights.sbomify.com/CVE-2024-38354/): Cross-site Scripting in Hackmd.io Notes lead by HTML Injection (high 8.1)
- [CVE-2024-38353](https://insights.sbomify.com/CVE-2024-38353/): CodiMD - Missing Image Access Controls and Unauthorized Image Access (medium 5.3)
- [CVE-2024-38351](https://insights.sbomify.com/CVE-2024-38351/): Password auth and OAuth2 unverified email linking (medium 5.4)
- [CVE-2024-38348](https://insights.sbomify.com/CVE-2024-38348/): SQL injection in health care hospital management system project:health care hospital management system (medium 6.5)
- [CVE-2024-38347](https://insights.sbomify.com/CVE-2024-38347/): SQL injection in health care hospital management system project:health care hospital management system (high 8.8)
- [CVE-2024-38346](https://insights.sbomify.com/CVE-2024-38346/): Apache CloudStack: Unauthenticated cluster service port leads to remote execution (critical 9.8)
- [CVE-2024-38345](https://insights.sbomify.com/CVE-2024-38345/): Cross-site request forgery in Sola Testimonials (high 8.1)
- [CVE-2024-38344](https://insights.sbomify.com/CVE-2024-38344/): Cross-site request forgery in WP Tweet Walls (medium 5.4)
- [CVE-2024-38341](https://insights.sbomify.com/CVE-2024-38341/): IBM Sterling Secure Proxy information disclosure (medium 5.9)
- [CVE-2024-3834](https://insights.sbomify.com/CVE-2024-3834/): Use after free in Chrome (high 8.8)
- [CVE-2024-38337](https://insights.sbomify.com/CVE-2024-38337/): IBM Sterling Secure Proxy improper input validation (critical 9.1)
- [CVE-2024-38335](https://insights.sbomify.com/CVE-2024-38335/): IBM Security QRadar Network Threat Analytics denial of service (medium 4.5)
- [CVE-2024-38330](https://insights.sbomify.com/CVE-2024-38330/): IBM i privilege escalation (high 7.0)
- [CVE-2024-3833](https://insights.sbomify.com/CVE-2024-3833/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-38329](https://insights.sbomify.com/CVE-2024-38329/): IBM Storage Protect for Virtual Environments: Data Protection for VMware security bypass (high 7.7)
- [CVE-2024-38327](https://insights.sbomify.com/CVE-2024-38327/): IBM Analytics Content Hub information disclosure (medium 6.8)
- [CVE-2024-38325](https://insights.sbomify.com/CVE-2024-38325/): IBM Storage Defender information disclosure (medium 5.9)
- [CVE-2024-38324](https://insights.sbomify.com/CVE-2024-38324/): IBM Storage Defender improper certificate validation (medium 5.9)
- [CVE-2024-38322](https://insights.sbomify.com/CVE-2024-38322/): IBM Storage Defender information disclosure (medium 5.3)
- [CVE-2024-38321](https://insights.sbomify.com/CVE-2024-38321/): IBM Business Automation Workflow information disclosure (medium 5.3)
- [CVE-2024-38320](https://insights.sbomify.com/CVE-2024-38320/): IBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosure (medium 5.9)
- [CVE-2024-3832](https://insights.sbomify.com/CVE-2024-3832/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-38319](https://insights.sbomify.com/CVE-2024-38319/): IBM Security SOAR code execution (high 7.5)
- [CVE-2024-38318](https://insights.sbomify.com/CVE-2024-38318/): IBM Aspera Shares HTML injection (medium 4.8)
- [CVE-2024-38317](https://insights.sbomify.com/CVE-2024-38317/): IBM Aspera Shares Cross-Site Scripting (medium 4.8)
- [CVE-2024-38316](https://insights.sbomify.com/CVE-2024-38316/): IBM Aspera Shares Denial of Service (medium 4.3)
- [CVE-2024-38315](https://insights.sbomify.com/CVE-2024-38315/): IBM Aspera Shares session fixation (medium 6.3)
- [CVE-2024-38314](https://insights.sbomify.com/CVE-2024-38314/): IBM Maximo Application Suite - Monitor Component information disclosure (medium 5.9)
- [CVE-2024-38313](https://insights.sbomify.com/CVE-2024-38313/): Other in Firefox for iOS (medium 4.3)
- [CVE-2024-38312](https://insights.sbomify.com/CVE-2024-38312/): Information disclosure in Firefox for iOS (medium 6.5)
- [CVE-2024-38311](https://insights.sbomify.com/CVE-2024-38311/): Apache Traffic Server: Request smuggling via pipelining after a chunked message body (medium 6.3)
- [CVE-2024-38310](https://insights.sbomify.com/CVE-2024-38310/): Privilege escalation in Intel(R) Graphics Driver software installers (medium 5.4)
- [CVE-2024-3831](https://insights.sbomify.com/CVE-2024-3831/): Cross-site scripting in Enter Addons – Ultimate Template Builder for Elementor (medium 6.4)
- [CVE-2024-38309](https://insights.sbomify.com/CVE-2024-38309/): Memory corruption in TELLUS (high 7.8)
- [CVE-2024-38308](https://insights.sbomify.com/CVE-2024-38308/): Advantech ADAM-5550 Cross-site Scripting (high 8.7)
- [CVE-2024-38307](https://insights.sbomify.com/CVE-2024-38307/): Denial of service in Intel(R) AMT and Intel(R) Standard Manageability (high 7.1)
- [CVE-2024-38306](https://insights.sbomify.com/CVE-2024-38306/): btrfs: protect folio::private when attaching extent buffer folios (high 7.8)
- [CVE-2024-38305](https://insights.sbomify.com/CVE-2024-38305/): Privilege escalation in SupportAssist for Home PCs (high 7.3)
- [CVE-2024-38304](https://insights.sbomify.com/CVE-2024-38304/): Memory corruption in PowerEdge Platform (low 3.8)
- [CVE-2024-38303](https://insights.sbomify.com/CVE-2024-38303/): Information disclosure in PowerEdge Platform (medium 5.3)
- [CVE-2024-38302](https://insights.sbomify.com/CVE-2024-38302/): Information disclosure in Dell Data Lakehouse (medium 6.8)
- [CVE-2024-38301](https://insights.sbomify.com/CVE-2024-38301/): Missing authorization in Alienware Command Center (AWCC) (medium 6.7)
- [CVE-2024-38296](https://insights.sbomify.com/CVE-2024-38296/): Information disclosure in Edge Gateway 5200 (medium 6.7)
- [CVE-2024-38295](https://insights.sbomify.com/CVE-2024-38295/): Code injection in alcasar:alcasar (high 8.8)
- [CVE-2024-38294](https://insights.sbomify.com/CVE-2024-38294/): Code injection in alcasar:alcasar (high 8.8)
- [CVE-2024-38293](https://insights.sbomify.com/CVE-2024-38293/): Cross-site request forgery in alcasar:alcasar (critical 9.6)
- [CVE-2024-38292](https://insights.sbomify.com/CVE-2024-38292/): Path traversal in extremenetworks:xiq-se (critical 9.8)
- [CVE-2024-38291](https://insights.sbomify.com/CVE-2024-38291/): Information disclosure in extremenetworks:xiq-se (high 8.8)
- [CVE-2024-38290](https://insights.sbomify.com/CVE-2024-38290/): Information disclosure in extremenetworks:xiq-se (medium 5.3)
- [CVE-2024-3829](https://insights.sbomify.com/CVE-2024-3829/): Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrant (critical 9.8)
- [CVE-2024-38289](https://insights.sbomify.com/CVE-2024-38289/): SQL injection in rhubcom:turbomeeting (critical 9.8)
- [CVE-2024-38288](https://insights.sbomify.com/CVE-2024-38288/): Command injection in rhubcom:turbomeeting (high 7.2)
- [CVE-2024-38287](https://insights.sbomify.com/CVE-2024-38287/): Business logic in rhubcom:turbomeeting (critical 9.1)
- [CVE-2024-38286](https://insights.sbomify.com/CVE-2024-38286/): Apache Tomcat: Denial of Service (high 8.6)
- [CVE-2024-38285](https://insights.sbomify.com/CVE-2024-38285/): Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) (high 7.0)
- [CVE-2024-38284](https://insights.sbomify.com/CVE-2024-38284/): Authentication Bypass by Capture-replay in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) (high 8.7)
- [CVE-2024-38283](https://insights.sbomify.com/CVE-2024-38283/): Missing Encryption of Sensitive Data in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) (medium 5.1)
- [CVE-2024-38282](https://insights.sbomify.com/CVE-2024-38282/): Insufficiently Protected Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) (high 8.5)
- [CVE-2024-38281](https://insights.sbomify.com/CVE-2024-38281/): Use of Hard-coded Credentials in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) (high 8.6)
- [CVE-2024-38280](https://insights.sbomify.com/CVE-2024-38280/): Cleartext Storage in a File or on Disk in Motorola Solutions Vigilant Fixed LPR Coms Box (BCAV1F2-C600) (high 7.0)
- [CVE-2024-3828](https://insights.sbomify.com/CVE-2024-3828/): Spectra Pro <= 1.1.5 - Authenticated (Author+) Privilege Escalation (high 8.8)
- [CVE-2024-38279](https://insights.sbomify.com/CVE-2024-38279/): Auth bypass in Vigilant Fixed LPR Coms Box (BCAV1F2-C600) (medium 5.1)
- [CVE-2024-38278](https://insights.sbomify.com/CVE-2024-38278/): Misconfiguration in RUGGEDCOM RMC8388 V5.X (high 7.5)
- [CVE-2024-38277](https://insights.sbomify.com/CVE-2024-38277/): moodle: QR login key and auto-login key for the Moodle mobile app should be generated as separate keys (medium 5.4)
- [CVE-2024-38276](https://insights.sbomify.com/CVE-2024-38276/): moodle: CSRF risks due to misuse of confirm_sesskey (high 8.8)
- [CVE-2024-38275](https://insights.sbomify.com/CVE-2024-38275/): moodle: HTTP authorization header is preserved between "emulated redirects" (high 7.5)
- [CVE-2024-38274](https://insights.sbomify.com/CVE-2024-38274/): moodle: stored XSS via calendar's event title when deleting the event (medium 6.1)
- [CVE-2024-38273](https://insights.sbomify.com/CVE-2024-38273/): moodle: BigBlueButton web service leaks meeting joining information to users who should not have access (medium 5.4)
- [CVE-2024-38272](https://insights.sbomify.com/CVE-2024-38272/): Auth Bypass in Quick Share (high 7.1)
- [CVE-2024-38271](https://insights.sbomify.com/CVE-2024-38271/): Denial of Service in Quick Share (medium 5.9)
- [CVE-2024-38270](https://insights.sbomify.com/CVE-2024-38270/): Weak cryptography in GS1900-10HP firmware (medium 5.3)
- [CVE-2024-3827](https://insights.sbomify.com/CVE-2024-3827/): Spectra Pro <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block IDs (medium 6.4)
- [CVE-2024-38269](https://insights.sbomify.com/CVE-2024-38269/): Memory corruption in VMG8825-T50K firmware (medium 4.9)
- [CVE-2024-38268](https://insights.sbomify.com/CVE-2024-38268/): Memory corruption in VMG8825-T50K firmware (medium 4.9)
- [CVE-2024-38267](https://insights.sbomify.com/CVE-2024-38267/): Memory corruption in VMG8825-T50K firmware (medium 4.9)
- [CVE-2024-38266](https://insights.sbomify.com/CVE-2024-38266/): Memory corruption in VMG8825-T50K firmware (medium 4.9)
- [CVE-2024-38265](https://insights.sbomify.com/CVE-2024-38265/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/322/