# Vulnerabilities published in 2024


- [CVE-2024-36323](https://insights.sbomify.com/CVE-2024-36323/): Security feature bypass in AMD Instinct™ MI300A (high 8.8)
- [CVE-2024-36321](https://insights.sbomify.com/CVE-2024-36321/): Privilege escalation in AIM-T Manageability Service (high 7.3)
- [CVE-2024-36320](https://insights.sbomify.com/CVE-2024-36320/): Integer overflow in AMD Athlon™ 3000 Series Mobile Processors with Radeon™ Graphics (high 7.0)
- [CVE-2024-3632](https://insights.sbomify.com/CVE-2024-3632/): Smart Image Gallery < 1.0.19 - Update/Delete Google API Key via CSRF (medium 6.8)
- [CVE-2024-36319](https://insights.sbomify.com/CVE-2024-36319/): Other in AMD Instinct™ MI300A (medium 6.3)
- [CVE-2024-36316](https://insights.sbomify.com/CVE-2024-36316/): Integer overflow in AMD Radeon™ PRO V520 (medium 5.5)
- [CVE-2024-36315](https://insights.sbomify.com/CVE-2024-36315/): Security feature bypass in AMD EPYC™ 8004 Series Processors (medium 5.7)
- [CVE-2024-36311](https://insights.sbomify.com/CVE-2024-36311/): Race condition in AMD Ryzen™ 7000 Series Desktop Processors (medium 4.6)
- [CVE-2024-36310](https://insights.sbomify.com/CVE-2024-36310/): Memory corruption in AMD EPYC™ 9004 Series Processors (medium 4.6)
- [CVE-2024-3631](https://insights.sbomify.com/CVE-2024-3631/): HL Twitter <= 2014.1.18 - Unlink Twitter Account via CSRF (medium 4.3)
- [CVE-2024-36307](https://insights.sbomify.com/CVE-2024-36307/): Information disclosure in Trend Micro Apex One (medium 4.7)
- [CVE-2024-36306](https://insights.sbomify.com/CVE-2024-36306/): Other in Trend Micro Apex One (medium 6.1)
- [CVE-2024-36305](https://insights.sbomify.com/CVE-2024-36305/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2024-36304](https://insights.sbomify.com/CVE-2024-36304/): Race condition in Trend Micro Apex One (high 7.8)
- [CVE-2024-36303](https://insights.sbomify.com/CVE-2024-36303/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2024-36302](https://insights.sbomify.com/CVE-2024-36302/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2024-3630](https://insights.sbomify.com/CVE-2024-3630/): HL Twitter <= 2014.1.18 - Admin+ Stored XSS via Widget (medium 5.4)
- [CVE-2024-36295](https://insights.sbomify.com/CVE-2024-36295/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-36294](https://insights.sbomify.com/CVE-2024-36294/): Privilege escalation in Intel(R) DSA software (medium 5.4)
- [CVE-2024-36293](https://insights.sbomify.com/CVE-2024-36293/): Missing authorization in Intel(R) Processors with Intel(R) SGX (medium 6.8)
- [CVE-2024-36292](https://insights.sbomify.com/CVE-2024-36292/): Memory corruption in Intel(R) Data Center GPU Flex Series for Windows driver (high 8.2)
- [CVE-2024-36291](https://insights.sbomify.com/CVE-2024-36291/): Privilege escalation in Intel(R) Chipset Software Installation Utility (medium 5.4)
- [CVE-2024-36290](https://insights.sbomify.com/CVE-2024-36290/): Memory corruption in Wavlink AC3000 (critical 10.0)
- [CVE-2024-3629](https://insights.sbomify.com/CVE-2024-3629/): HL Twitter <= 2014.1.18 - Settings Update via CSRF (low 2.4)
- [CVE-2024-36289](https://insights.sbomify.com/CVE-2024-36289/): Weak cryptography in "FreeFrom - the nostr client" App for Android (medium 5.3)
- [CVE-2024-36288](https://insights.sbomify.com/CVE-2024-36288/): SUNRPC: Fix loop termination condition in gss_free_in_token_pages() (critical 9.8)
- [CVE-2024-36287](https://insights.sbomify.com/CVE-2024-36287/): Bypass of TCC restrictions on macOS (low 3.8)
- [CVE-2024-36286](https://insights.sbomify.com/CVE-2024-36286/): netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (high 7.8)
- [CVE-2024-36285](https://insights.sbomify.com/CVE-2024-36285/): Race condition in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows (medium 5.7)
- [CVE-2024-36284](https://insights.sbomify.com/CVE-2024-36284/): Privilege escalation in Intel(R) Neural Compressor software (medium 5.1)
- [CVE-2024-36283](https://insights.sbomify.com/CVE-2024-36283/): Privilege escalation in Intel(R) Thread Director Visualizer software (medium 5.4)
- [CVE-2024-36282](https://insights.sbomify.com/CVE-2024-36282/): Privilege escalation in Intel(R) Server Board S2600ST Family BIOS and Firmware Update software (high 7.1)
- [CVE-2024-36281](https://insights.sbomify.com/CVE-2024-36281/): net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules (medium 5.5)
- [CVE-2024-36280](https://insights.sbomify.com/CVE-2024-36280/): Privilege escalation in Intel(R) High Level Synthesis Compiler software (medium 5.4)
- [CVE-2024-3628](https://insights.sbomify.com/CVE-2024-3628/): EasyEvent <= 1.0.0 - Admin+ Stored XSS (low 3.8)
- [CVE-2024-36279](https://insights.sbomify.com/CVE-2024-36279/): Weak cryptography in "FreeFrom - the nostr client" App for Android (medium 5.3)
- [CVE-2024-36278](https://insights.sbomify.com/CVE-2024-36278/): Arkcompiler Ets Runtime has a type confusion vulnerability (low 3.3)
- [CVE-2024-36277](https://insights.sbomify.com/CVE-2024-36277/): Security feature bypass in "FreeFrom - the nostr client" App for Android (medium 5.3)
- [CVE-2024-36276](https://insights.sbomify.com/CVE-2024-36276/): Privilege escalation in Intel(R) CIP software (medium 5.4)
- [CVE-2024-36275](https://insights.sbomify.com/CVE-2024-36275/): Null dereference in Intel(R) Optane(TM) PMem Management software versions (medium 5.8)
- [CVE-2024-36274](https://insights.sbomify.com/CVE-2024-36274/): Memory corruption in Intel(R) 800 Series Ethernet Driver for Intel(R) Ethernet Adapter Complete Driver Pack (high 7.1)
- [CVE-2024-36272](https://insights.sbomify.com/CVE-2024-36272/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-36270](https://insights.sbomify.com/CVE-2024-36270/): netfilter: tproxy: bail out if IP has been disabled on the device (medium 5.5)
- [CVE-2024-3627](https://insights.sbomify.com/CVE-2024-3627/): Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints (medium 5.4)
- [CVE-2024-36268](https://insights.sbomify.com/CVE-2024-36268/): Apache InLong TubeMQ Client: Remote Code Execution vulnerability (high 7.6)
- [CVE-2024-36267](https://insights.sbomify.com/CVE-2024-36267/): Path traversal in Redmine DMSF Plugin (high 8.1)
- [CVE-2024-36266](https://insights.sbomify.com/CVE-2024-36266/): Auth bypass in PowerSys (high 8.5)
- [CVE-2024-36265](https://insights.sbomify.com/CVE-2024-36265/): Apache Submarine Server Core: authorization bypass (critical 9.8)
- [CVE-2024-36264](https://insights.sbomify.com/CVE-2024-36264/): Apache Submarine Commons Utils: default secret (critical 9.8)
- [CVE-2024-36263](https://insights.sbomify.com/CVE-2024-36263/): Apache Submarine Server Core: SQL injection (high 8.1)
- [CVE-2024-36262](https://insights.sbomify.com/CVE-2024-36262/): Race condition in Intel(R) System Security Report and System Resources Defense firmware (high 8.6)
- [CVE-2024-36261](https://insights.sbomify.com/CVE-2024-36261/): Missing authorization in Intel(R) RAID Web Console software (low 3.5)
- [CVE-2024-36260](https://insights.sbomify.com/CVE-2024-36260/): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (high 8.2)
- [CVE-2024-3626](https://insights.sbomify.com/CVE-2024-3626/): Missing authorization in Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress (medium 4.3)
- [CVE-2024-36259](https://insights.sbomify.com/CVE-2024-36259/): Information disclosure in Odoo Community (high 7.5)
- [CVE-2024-36258](https://insights.sbomify.com/CVE-2024-36258/): Memory corruption in Wavlink AC3000 (critical 10.0)
- [CVE-2024-36257](https://insights.sbomify.com/CVE-2024-36257/): Lack of permission check when updating the profile picture of a remote user (shared channels enabled) (low 2.7)
- [CVE-2024-36255](https://insights.sbomify.com/CVE-2024-36255/): Post actions can run playbook checklist task commands (medium 5.7)
- [CVE-2024-36254](https://insights.sbomify.com/CVE-2024-36254/): Memory corruption in Multiple MFPs (multifunction printers) (high 7.5)
- [CVE-2024-36253](https://insights.sbomify.com/CVE-2024-36253/): Privilege escalation in Intel(R) SDP Tool for Windows software (medium 5.4)
- [CVE-2024-36252](https://insights.sbomify.com/CVE-2024-36252/): Other in Ricoh Streamline NX PC Client (medium 6.3)
- [CVE-2024-36251](https://insights.sbomify.com/CVE-2024-36251/): Denial of service in Multiple MFPs (multifunction printers) (high 7.5)
- [CVE-2024-36250](https://insights.sbomify.com/CVE-2024-36250/): MFA Code Replay (low 3.1)
- [CVE-2024-3625](https://insights.sbomify.com/CVE-2024-3625/): Mirror-registry: redis password stored in plain-text (high 7.3)
- [CVE-2024-36249](https://insights.sbomify.com/CVE-2024-36249/): Cross-site scripting in Multiple MFPs (multifunction printers) (high 7.4)
- [CVE-2024-36248](https://insights.sbomify.com/CVE-2024-36248/): Hardcoded credentials in Multiple MFPs (multifunction printers) (critical 9.1)
- [CVE-2024-36247](https://insights.sbomify.com/CVE-2024-36247/): Missing authorization in Intel(R) RAID Web Console (medium 4.6)
- [CVE-2024-36246](https://insights.sbomify.com/CVE-2024-36246/): Missing authorization in Unifier (critical 9.8)
- [CVE-2024-36245](https://insights.sbomify.com/CVE-2024-36245/): Privilege escalation in Intel(R) VTune(TM) Profiler software (medium 5.4)
- [CVE-2024-36244](https://insights.sbomify.com/CVE-2024-36244/): net/sched: taprio: extend minimum interval restriction to entire cycle too (medium 5.5)
- [CVE-2024-36243](https://insights.sbomify.com/CVE-2024-36243/): Arkcompiler Ets Runtime has an out-of-bounds read vulnerability (high 8.2)
- [CVE-2024-36242](https://insights.sbomify.com/CVE-2024-36242/): Security feature bypass in Intel(R) Processors (high 7.3)
- [CVE-2024-36241](https://insights.sbomify.com/CVE-2024-36241/): /playbook add slash command allows viewing arbitrary post contents (low 3.1)
- [CVE-2024-3624](https://insights.sbomify.com/CVE-2024-3624/): Mirror-registry: database user and password stored in plain-text (high 7.3)
- [CVE-2024-36239](https://insights.sbomify.com/CVE-2024-36239/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36238](https://insights.sbomify.com/CVE-2024-36238/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36236](https://insights.sbomify.com/CVE-2024-36236/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36235](https://insights.sbomify.com/CVE-2024-36235/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36234](https://insights.sbomify.com/CVE-2024-36234/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36233](https://insights.sbomify.com/CVE-2024-36233/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36232](https://insights.sbomify.com/CVE-2024-36232/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36231](https://insights.sbomify.com/CVE-2024-36231/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36230](https://insights.sbomify.com/CVE-2024-36230/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-3623](https://insights.sbomify.com/CVE-2024-3623/): Mirror-registry: default database secret key stored in plain-text on initial configuration file (medium 6.5)
- [CVE-2024-36229](https://insights.sbomify.com/CVE-2024-36229/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36228](https://insights.sbomify.com/CVE-2024-36228/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36227](https://insights.sbomify.com/CVE-2024-36227/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36226](https://insights.sbomify.com/CVE-2024-36226/): Adobe Experience Manager | Improper Input Validation (CWE-20) (low 3.5)
- [CVE-2024-36225](https://insights.sbomify.com/CVE-2024-36225/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36224](https://insights.sbomify.com/CVE-2024-36224/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36222](https://insights.sbomify.com/CVE-2024-36222/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36221](https://insights.sbomify.com/CVE-2024-36221/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36220](https://insights.sbomify.com/CVE-2024-36220/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2024-3622](https://insights.sbomify.com/CVE-2024-3622/): Mirror-registry: plain-text default csrf secret key (high 8.8)
- [CVE-2024-36219](https://insights.sbomify.com/CVE-2024-36219/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36218](https://insights.sbomify.com/CVE-2024-36218/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36217](https://insights.sbomify.com/CVE-2024-36217/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36216](https://insights.sbomify.com/CVE-2024-36216/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36215](https://insights.sbomify.com/CVE-2024-36215/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-36214](https://insights.sbomify.com/CVE-2024-36214/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/339/