# Vulnerabilities published in 2024


- [CVE-2024-36432](https://insights.sbomify.com/CVE-2024-36432/): An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4. (high 7.5)
- [CVE-2024-3643](https://insights.sbomify.com/CVE-2024-3643/): Newsletter Popup <= 1.2 - List Deletion via CSRF (high 8.8)
- [CVE-2024-36428](https://insights.sbomify.com/CVE-2024-36428/): SQL injection in orangehrm:orangehrm (high 8.1)
- [CVE-2024-36427](https://insights.sbomify.com/CVE-2024-36427/): The file-serving function in TARGIT Decision Suite before 24.06.19002 (TARGIT Decision Suite 2024 – June) allows authenticated attackers to (high 8.1)
- [CVE-2024-36426](https://insights.sbomify.com/CVE-2024-36426/): In TARGIT Decision Suite 23.2.15007.0 before Autumn 2023, the session token is part of the URL and may be sent in a cleartext HTTP session. (high 7.5)
- [CVE-2024-36424](https://insights.sbomify.com/CVE-2024-36424/): Null dereference in k7computing:k7 ultimate security (medium 5.5)
- [CVE-2024-36423](https://insights.sbomify.com/CVE-2024-36423/): GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/id (medium 6.1)
- [CVE-2024-36422](https://insights.sbomify.com/CVE-2024-36422/): GHSL-2023-245: Flowise xss in api/v1/chatflows/id (medium 6.1)
- [CVE-2024-36421](https://insights.sbomify.com/CVE-2024-36421/): GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.ts (high 7.5)
- [CVE-2024-36420](https://insights.sbomify.com/CVE-2024-36420/): GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-file (high 7.5)
- [CVE-2024-3642](https://insights.sbomify.com/CVE-2024-3642/): Newsletter Popup <= 1.2 - Subscriber Deletion via CSRF (medium 6.9)
- [CVE-2024-36419](https://insights.sbomify.com/CVE-2024-36419/): SuiteCRM-Core Host Header Injection in /legacy (medium 4.3)
- [CVE-2024-36418](https://insights.sbomify.com/CVE-2024-36418/): SuiteCRM authenticated RCE using connectors (high 8.6)
- [CVE-2024-36417](https://insights.sbomify.com/CVE-2024-36417/): SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame (medium 5.7)
- [CVE-2024-36416](https://insights.sbomify.com/CVE-2024-36416/): SuiteCRM v4 API Excessive log data DOS (high 8.6)
- [CVE-2024-36415](https://insights.sbomify.com/CVE-2024-36415/): File upload in SuiteCRM (critical 9.1)
- [CVE-2024-36414](https://insights.sbomify.com/CVE-2024-36414/): SuiteCRM authenticated Server-Side Request Forgery (high 7.7)
- [CVE-2024-36413](https://insights.sbomify.com/CVE-2024-36413/): SuiteCRM authenticated Reflected Cross-Site Scripting (high 8.9)
- [CVE-2024-36412](https://insights.sbomify.com/CVE-2024-36412/): SuiteCRM unauthenticated SQL Injection (critical 10.0)
- [CVE-2024-36411](https://insights.sbomify.com/CVE-2024-36411/): SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controller (critical 9.6)
- [CVE-2024-36410](https://insights.sbomify.com/CVE-2024-36410/): SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller (critical 9.6)
- [CVE-2024-3641](https://insights.sbomify.com/CVE-2024-3641/): Newsletter Popup <= 1.2 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-36409](https://insights.sbomify.com/CVE-2024-36409/): SuiteCRM authenticated SQL Injection in TreeData entrypoint (critical 9.6)
- [CVE-2024-36408](https://insights.sbomify.com/CVE-2024-36408/): SuiteCRM authenticated SQL Injection in Alerts (critical 9.6)
- [CVE-2024-36407](https://insights.sbomify.com/CVE-2024-36407/): SuiteCRM unauthenticated user password reset on php7 (low 3.7)
- [CVE-2024-36406](https://insights.sbomify.com/CVE-2024-36406/): SuiteCRM vulnerable to open redirects (medium 5.4)
- [CVE-2024-36405](https://insights.sbomify.com/CVE-2024-36405/): Information disclosure in liboqs (medium 5.9)
- [CVE-2024-36404](https://insights.sbomify.com/CVE-2024-36404/): GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions (critical 9.8)
- [CVE-2024-36403](https://insights.sbomify.com/CVE-2024-36403/): Denial of service/high operating costs through unauthenticated downloads in Matrix Media Repo (medium 5.3)
- [CVE-2024-36402](https://insights.sbomify.com/CVE-2024-36402/): Unauthenticated writes to the media repository allow planting of problematic content in Matrix Media Repo (medium 5.3)
- [CVE-2024-36401](https://insights.sbomify.com/CVE-2024-36401/): OSGeo GeoServer GeoTools Eval Injection (critical 9.8, exploited in the wild)
- [CVE-2024-36400](https://insights.sbomify.com/CVE-2024-36400/): nano-id is unable to generate the correct character set (critical 9.4)
- [CVE-2024-3640](https://insights.sbomify.com/CVE-2024-3640/): Rockwell Automation FactoryTalk® Remote Access™ has Unquoted Executables (high 7.0)
- [CVE-2024-36399](https://insights.sbomify.com/CVE-2024-36399/): Kanboard affected by Project Takeover via IDOR in ProjectPermissionController (high 8.2)
- [CVE-2024-36398](https://insights.sbomify.com/CVE-2024-36398/): Privilege escalation in SINEC NMS (high 8.5)
- [CVE-2024-36397](https://insights.sbomify.com/CVE-2024-36397/): Vantiva - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (medium 6.1)
- [CVE-2024-36396](https://insights.sbomify.com/CVE-2024-36396/): Verint - CWE-434: Unrestricted Upload of File with Dangerous Type (high 8.8)
- [CVE-2024-36395](https://insights.sbomify.com/CVE-2024-36395/): Verint - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (medium 6.1)
- [CVE-2024-36394](https://insights.sbomify.com/CVE-2024-36394/): SysAid - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (critical 9.1)
- [CVE-2024-36393](https://insights.sbomify.com/CVE-2024-36393/): SysAid - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (critical 9.9)
- [CVE-2024-36392](https://insights.sbomify.com/CVE-2024-36392/): MileSight DeviceHub - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (medium 6.1)
- [CVE-2024-36391](https://insights.sbomify.com/CVE-2024-36391/): MileSight DeviceHub - CWE-320: Key Management Errors (critical 9.1)
- [CVE-2024-36390](https://insights.sbomify.com/CVE-2024-36390/): MileSight DeviceHub - CWE-20 Improper Input Validation (high 7.5)
- [CVE-2024-3639](https://insights.sbomify.com/CVE-2024-3639/): Elementor Addons by Livemesh <= 8.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Posts Grid (medium 6.4)
- [CVE-2024-36389](https://insights.sbomify.com/CVE-2024-36389/): MileSight DeviceHub - CWE-330 Use of Insufficiently Random Values (critical 9.8)
- [CVE-2024-36388](https://insights.sbomify.com/CVE-2024-36388/): MileSight DeviceHub - CWE-305 Missing Authentication for Critical Function (critical 10.0)
- [CVE-2024-36387](https://insights.sbomify.com/CVE-2024-36387/): Apache HTTP Server: DoS by Null pointer in websocket over HTTP/2 (medium 5.4)
- [CVE-2024-36384](https://insights.sbomify.com/CVE-2024-36384/): Pointsharp Cryptshare Server before 7.0.0 has an XSS issue that is related to notification messages. (medium 6.1)
- [CVE-2024-36383](https://insights.sbomify.com/CVE-2024-36383/): Denial of service in logpoint:saml authentication (medium 5.3)
- [CVE-2024-3638](https://insights.sbomify.com/CVE-2024-3638/): Cross-site scripting in Livemesh Addons by Elementor (medium 6.4)
- [CVE-2024-36378](https://insights.sbomify.com/CVE-2024-36378/): Denial of service in TeamCity (medium 5.9)
- [CVE-2024-36377](https://insights.sbomify.com/CVE-2024-36377/): Missing authorization in TeamCity (medium 6.5)
- [CVE-2024-36376](https://insights.sbomify.com/CVE-2024-36376/): Missing authorization in TeamCity (medium 6.5)
- [CVE-2024-36375](https://insights.sbomify.com/CVE-2024-36375/): Information disclosure in TeamCity (medium 5.3)
- [CVE-2024-36374](https://insights.sbomify.com/CVE-2024-36374/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-36373](https://insights.sbomify.com/CVE-2024-36373/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-36372](https://insights.sbomify.com/CVE-2024-36372/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-36371](https://insights.sbomify.com/CVE-2024-36371/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-36370](https://insights.sbomify.com/CVE-2024-36370/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-3637](https://insights.sbomify.com/CVE-2024-3637/): Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-36369](https://insights.sbomify.com/CVE-2024-36369/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-36368](https://insights.sbomify.com/CVE-2024-36368/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-36367](https://insights.sbomify.com/CVE-2024-36367/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-36366](https://insights.sbomify.com/CVE-2024-36366/): Cross-site scripting in TeamCity (medium 5.4)
- [CVE-2024-36365](https://insights.sbomify.com/CVE-2024-36365/): Auth bypass in TeamCity (medium 6.8)
- [CVE-2024-36364](https://insights.sbomify.com/CVE-2024-36364/): Missing authorization in TeamCity (medium 6.5)
- [CVE-2024-36363](https://insights.sbomify.com/CVE-2024-36363/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-36362](https://insights.sbomify.com/CVE-2024-36362/): Path traversal in TeamCity (medium 6.5)
- [CVE-2024-36361](https://insights.sbomify.com/CVE-2024-36361/): Pug allows JavaScript code execution if an application accepts untrusted input (medium 6.8)
- [CVE-2024-36360](https://insights.sbomify.com/CVE-2024-36360/): Command injection in awkblog (critical 9.8)
- [CVE-2024-3636](https://insights.sbomify.com/CVE-2024-3636/): Pinpoint Booking System < 2.9.9.4.8 - Admin+ Stored XSS (medium 5.4)
- [CVE-2024-36359](https://insights.sbomify.com/CVE-2024-36359/): Cross-site scripting in Trend Micro InterScan Web Security Virtual Appliance (medium 5.4)
- [CVE-2024-36358](https://insights.sbomify.com/CVE-2024-36358/): Privilege escalation in Trend Micro Deep Security Agent (high 7.8)
- [CVE-2024-36357](https://insights.sbomify.com/CVE-2024-36357/): Information disclosure in AMD EPYC™ 7003 Series Processors (medium 5.6)
- [CVE-2024-36355](https://insights.sbomify.com/CVE-2024-36355/): Memory corruption in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (high 7.0)
- [CVE-2024-36354](https://insights.sbomify.com/CVE-2024-36354/): Security feature bypass in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (high 7.5)
- [CVE-2024-36353](https://insights.sbomify.com/CVE-2024-36353/): Information disclosure in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (medium 6.5)
- [CVE-2024-36352](https://insights.sbomify.com/CVE-2024-36352/): Memory corruption in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (high 8.4)
- [CVE-2024-36350](https://insights.sbomify.com/CVE-2024-36350/): Information disclosure in AMD EPYC™ 7003 Series Processors (medium 5.6)
- [CVE-2024-3635](https://insights.sbomify.com/CVE-2024-3635/): The Post Grid < 7.5.0 - Editor+ Stored XSS via Grid Creation (medium 4.8)
- [CVE-2024-36349](https://insights.sbomify.com/CVE-2024-36349/): Information disclosure in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (low 3.8)
- [CVE-2024-36348](https://insights.sbomify.com/CVE-2024-36348/): Information disclosure in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (low 3.8)
- [CVE-2024-36347](https://insights.sbomify.com/CVE-2024-36347/): Security feature bypass in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (medium 6.4)
- [CVE-2024-36346](https://insights.sbomify.com/CVE-2024-36346/): Other in AMD Instinct™ MI300A (medium 6.0)
- [CVE-2024-36345](https://insights.sbomify.com/CVE-2024-36345/): Memory corruption in AMD EPYC™ 4004 (medium 4.6)
- [CVE-2024-36343](https://insights.sbomify.com/CVE-2024-36343/): Memory corruption in AMD EPYC™ 4004 (medium 4.6)
- [CVE-2024-36342](https://insights.sbomify.com/CVE-2024-36342/): Memory corruption in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (high 8.8)
- [CVE-2024-36340](https://insights.sbomify.com/CVE-2024-36340/): Other in AMD μProf (medium 6.6)
- [CVE-2024-3634](https://insights.sbomify.com/CVE-2024-3634/): month name translation benaceur < 2.3.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-36339](https://insights.sbomify.com/CVE-2024-36339/): Privilege escalation in AMD Optimizing CPU Libraries (AOCL) (high 7.3)
- [CVE-2024-36337](https://insights.sbomify.com/CVE-2024-36337/): Integer overflow in AMD Ryzen™ AI Software (high 7.9)
- [CVE-2024-36336](https://insights.sbomify.com/CVE-2024-36336/): Integer overflow in AMD Ryzen™ AI Software (high 7.9)
- [CVE-2024-36334](https://insights.sbomify.com/CVE-2024-36334/): Security feature bypass in AMD Radeon™ RX 7000 Series Graphics Products (high 7.0)
- [CVE-2024-36333](https://insights.sbomify.com/CVE-2024-36333/): Privilege escalation in AMD Cleanup Utility (high 7.0)
- [CVE-2024-36332](https://insights.sbomify.com/CVE-2024-36332/): Memory corruption in AMD Radeon™ PRO V710 (medium 6.8)
- [CVE-2024-36331](https://insights.sbomify.com/CVE-2024-36331/): Other in AMD EPYC™ 9004 Series Processors (low 3.2)
- [CVE-2024-3633](https://insights.sbomify.com/CVE-2024-3633/): WebP & SVG Support <= 1.4.0 - Author+ Stored XSS via SVG (medium 5.4)
- [CVE-2024-36328](https://insights.sbomify.com/CVE-2024-36328/): Integer overflow in AMD Ryzen™ AI Software (high 7.3)
- [CVE-2024-36326](https://insights.sbomify.com/CVE-2024-36326/): Missing authorization in AMD Ryzen™ 7040 Series Mobile Processors with Radeon™ Graphics (high 8.4)
- [CVE-2024-36324](https://insights.sbomify.com/CVE-2024-36324/): Memory corruption in AMD Radeon™ PRO V520 (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/338/