# Vulnerabilities published in 2024


- [CVE-2024-35263](https://insights.sbomify.com/CVE-2024-35263/): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (medium 5.7)
- [CVE-2024-35261](https://insights.sbomify.com/CVE-2024-35261/): Azure Network Watcher VM Extension Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-35260](https://insights.sbomify.com/CVE-2024-35260/): Microsoft Dataverse Remote Code Execution Vulnerability (high 8.0)
- [CVE-2024-3526](https://insights.sbomify.com/CVE-2024-3526/): Campcodes Online Event Management System index.php cross site scripting (low 3.5)
- [CVE-2024-35256](https://insights.sbomify.com/CVE-2024-35256/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-35255](https://insights.sbomify.com/CVE-2024-35255/): Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability (medium 5.5)
- [CVE-2024-35254](https://insights.sbomify.com/CVE-2024-35254/): Azure Monitor Agent Elevation of Privilege Vulnerability (high 7.1)
- [CVE-2024-35253](https://insights.sbomify.com/CVE-2024-35253/): Microsoft Azure File Sync Elevation of Privilege Vulnerability (medium 4.4)
- [CVE-2024-35252](https://insights.sbomify.com/CVE-2024-35252/): Azure Storage Movement Client Library Denial of Service Vulnerability (high 7.5)
- [CVE-2024-35250](https://insights.sbomify.com/CVE-2024-35250/): Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability (high 7.8, exploited in the wild)
- [CVE-2024-3525](https://insights.sbomify.com/CVE-2024-3525/): Campcodes Online Event Management System index.php cross site scripting (low 3.5)
- [CVE-2024-35249](https://insights.sbomify.com/CVE-2024-35249/): Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-35248](https://insights.sbomify.com/CVE-2024-35248/): Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2024-35247](https://insights.sbomify.com/CVE-2024-35247/): fpga: region: add owner module and take its refcount (medium 5.5)
- [CVE-2024-35246](https://insights.sbomify.com/CVE-2024-35246/): Westermo L210-F2G Lynx Improper Control of Interaction Frequency (high 8.7)
- [CVE-2024-35245](https://insights.sbomify.com/CVE-2024-35245/): Privilege escalation in Intel(R) PROSet/Wireless WiFi software for Windows (medium 5.4)
- [CVE-2024-35244](https://insights.sbomify.com/CVE-2024-35244/): Hardcoded credentials in Multiple MFPs (multifunction printers) (critical 9.1)
- [CVE-2024-35242](https://insights.sbomify.com/CVE-2024-35242/): Composer vulnerable to command injection via malicious git/hg branch names (high 8.8)
- [CVE-2024-35241](https://insights.sbomify.com/CVE-2024-35241/): Composer vulnerable to command injection via malicious git branch name (high 8.8)
- [CVE-2024-35240](https://insights.sbomify.com/CVE-2024-35240/): Stored Cross-site Scripting on Print Functionality in Umbraco Commerce (medium 5.4)
- [CVE-2024-3524](https://insights.sbomify.com/CVE-2024-3524/): Campcodes Online Event Management System process.php cross site scripting (low 3.5)
- [CVE-2024-35239](https://insights.sbomify.com/CVE-2024-35239/): Stored Cross-site Scripting on Components of Umbraco Forms (low 2.7)
- [CVE-2024-35238](https://insights.sbomify.com/CVE-2024-35238/): Denial of service of Minder Server from maliciously crafted GitHub attestations (medium 5.3)
- [CVE-2024-35237](https://insights.sbomify.com/CVE-2024-35237/): MIT IdentiBot User-Kerberos Mapping Publicly Available (high 7.5)
- [CVE-2024-35236](https://insights.sbomify.com/CVE-2024-35236/): Audiobookshelf Cross-Site-Scripting vulnerability via crafted ebooks (medium 4.8)
- [CVE-2024-35235](https://insights.sbomify.com/CVE-2024-35235/): Cupsd Listen arbitrary chmod 0140777 (medium 4.4)
- [CVE-2024-35234](https://insights.sbomify.com/CVE-2024-35234/): Discourse vulnerable to stored-dom XSS via Facebook Oneboxes (medium 4.2)
- [CVE-2024-35232](https://insights.sbomify.com/CVE-2024-35232/): github.com/huandu/facebook may expose access_token in error message (low 3.7)
- [CVE-2024-35231](https://insights.sbomify.com/CVE-2024-35231/): rack-contrib vulnerable to Denial of Service due to the unconstrained value of the incoming "profiler_runs" parameter (high 8.6)
- [CVE-2024-35230](https://insights.sbomify.com/CVE-2024-35230/): Welcome and About GeoServer pages communicate version and revision information (medium 5.3)
- [CVE-2024-3523](https://insights.sbomify.com/CVE-2024-3523/): Campcodes Online Event Management System index.php sql injection (medium 6.3)
- [CVE-2024-35229](https://insights.sbomify.com/CVE-2024-35229/): ZKsync Era evaluation order of Yul function arguments (medium 5.3)
- [CVE-2024-35228](https://insights.sbomify.com/CVE-2024-35228/): Improper Handling of Insufficient Permissions in Wagtail (medium 5.5)
- [CVE-2024-35227](https://insights.sbomify.com/CVE-2024-35227/): Discourse vulnerable to DoS through Onebox (high 7.5)
- [CVE-2024-35226](https://insights.sbomify.com/CVE-2024-35226/): PHP Code Injection by malicious attribute in extends-tag in Smarty (high 7.3)
- [CVE-2024-35225](https://insights.sbomify.com/CVE-2024-35225/): Jupyter Server Proxy has a reflected XSS issue in host parameter (critical 9.7)
- [CVE-2024-35224](https://insights.sbomify.com/CVE-2024-35224/): Stored Cross-Site Scripting (XSS) in OpenProject (high 7.6)
- [CVE-2024-35223](https://insights.sbomify.com/CVE-2024-35223/): Dapr API Token Exposure (medium 5.3)
- [CVE-2024-35222](https://insights.sbomify.com/CVE-2024-35222/): iFrames Bypass Origin Checks for Tauri API Access Control (medium 5.9)
- [CVE-2024-35221](https://insights.sbomify.com/CVE-2024-35221/): Denial of service when publishing a package on rubygems.org (medium 4.3)
- [CVE-2024-35220](https://insights.sbomify.com/CVE-2024-35220/): @fastify/session reuses destroyed session cookie (high 7.4)
- [CVE-2024-3522](https://insights.sbomify.com/CVE-2024-3522/): Campcodes Online Event Management System process.php sql injection (medium 6.3)
- [CVE-2024-35219](https://insights.sbomify.com/CVE-2024-35219/): OpenAPI Generator Online - Arbitrary File Read/Delete (high 8.3)
- [CVE-2024-35218](https://insights.sbomify.com/CVE-2024-35218/): Umbraco CMS Vulnerable to Stored XSS on Content Page Through Markdown Editor Preview Pane (medium 4.2)
- [CVE-2024-35215](https://insights.sbomify.com/CVE-2024-35215/): Null dereference in QNX Software Development Platform (SDP) (medium 6.2)
- [CVE-2024-35214](https://insights.sbomify.com/CVE-2024-35214/): Vulnerability in CylanceOPTICS Windows Installer Package Impacts CylanceOPTICS for Windows (high 7.1)
- [CVE-2024-35213](https://insights.sbomify.com/CVE-2024-35213/): Vulnerability in SGI Image Codec Impacts BlackBerry QNX Software Development Platform (SDP) (critical 9.0)
- [CVE-2024-35212](https://insights.sbomify.com/CVE-2024-35212/): Other in SINEC Traffic Analyzer (medium 6.9)
- [CVE-2024-35211](https://insights.sbomify.com/CVE-2024-35211/): Misconfiguration in SINEC Traffic Analyzer (medium 6.8)
- [CVE-2024-35210](https://insights.sbomify.com/CVE-2024-35210/): Misconfiguration in SINEC Traffic Analyzer (medium 5.1)
- [CVE-2024-3521](https://insights.sbomify.com/CVE-2024-3521/): Byzoro Smart S80 Management Platform userattestation.php unrestricted upload (medium 4.7)
- [CVE-2024-35209](https://insights.sbomify.com/CVE-2024-35209/): Other in SINEC Traffic Analyzer (medium 6.9)
- [CVE-2024-35208](https://insights.sbomify.com/CVE-2024-35208/): Information disclosure in SINEC Traffic Analyzer (medium 4.8)
- [CVE-2024-35207](https://insights.sbomify.com/CVE-2024-35207/): Cross-site request forgery in SINEC Traffic Analyzer (high 8.5)
- [CVE-2024-35206](https://insights.sbomify.com/CVE-2024-35206/): Auth bypass in SINEC Traffic Analyzer (high 8.5)
- [CVE-2024-35205](https://insights.sbomify.com/CVE-2024-35205/): The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names before processing them t (high 7.8)
- [CVE-2024-35204](https://insights.sbomify.com/CVE-2024-35204/): Veritas System Recovery before 23.3_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus low-privileged users can conduct attacks. (high 8.4)
- [CVE-2024-35203](https://insights.sbomify.com/CVE-2024-35203/): Cross-site scripting in mahara:mahara (medium 6.1)
- [CVE-2024-35202](https://insights.sbomify.com/CVE-2024-35202/): Denial of service in bitcoin:bitcoin core (high 7.5)
- [CVE-2024-35201](https://insights.sbomify.com/CVE-2024-35201/): Misconfiguration in Intel(R) SDP Tool for Windows software (medium 5.4)
- [CVE-2024-35200](https://insights.sbomify.com/CVE-2024-35200/): NGINX HTTP/3 QUIC vulnerability (medium 5.3)
- [CVE-2024-3520](https://insights.sbomify.com/CVE-2024-3520/): Country State City Dropdown CF7 <= 2.7.1 - Missing Authorization (medium 4.3)
- [CVE-2024-35199](https://insights.sbomify.com/CVE-2024-35199/): TorchServe gRPC Port Exposure (high 8.2)
- [CVE-2024-35198](https://insights.sbomify.com/CVE-2024-35198/): TorchServe bypass allowed_urls configuration (critical 9.8)
- [CVE-2024-35197](https://insights.sbomify.com/CVE-2024-35197/): gix refs and paths with reserved Windows device names access the devices (medium 5.4)
- [CVE-2024-35196](https://insights.sbomify.com/CVE-2024-35196/): Slack integration leaks sensitive information in logs in Sentry (low 2.0)
- [CVE-2024-35195](https://insights.sbomify.com/CVE-2024-35195/): Requests `Session` object does not verify requests after making first request with verify=False (medium 5.6)
- [CVE-2024-35194](https://insights.sbomify.com/CVE-2024-35194/): Stacklok Minder vulnerable to denial of service from maliciously crafted templates (medium 5.3)
- [CVE-2024-35192](https://insights.sbomify.com/CVE-2024-35192/): Trivy possibly leaks registry credential when scanning images from malicious registries (medium 5.5)
- [CVE-2024-35191](https://insights.sbomify.com/CVE-2024-35191/): verbb/formie Server-Side Template Injection for variable-enabled settings (medium 4.4)
- [CVE-2024-35190](https://insights.sbomify.com/CVE-2024-35190/): Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests (medium 5.8)
- [CVE-2024-3519](https://insights.sbomify.com/CVE-2024-3519/): Media Library Assistant <= 3.15 - Reflected Cross-Site Scripting via lang (medium 6.1)
- [CVE-2024-35189](https://insights.sbomify.com/CVE-2024-35189/): Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides (medium 6.5)
- [CVE-2024-35187](https://insights.sbomify.com/CVE-2024-35187/): Stalwart Mail Server has privilege escalation by design (critical 9.1)
- [CVE-2024-35186](https://insights.sbomify.com/CVE-2024-35186/): gix traversal outside working tree enables arbitrary code execution (high 8.8)
- [CVE-2024-35185](https://insights.sbomify.com/CVE-2024-35185/): Denial of service of Minder Server with attacker-controlled REST endpoint (medium 5.3)
- [CVE-2024-35184](https://insights.sbomify.com/CVE-2024-35184/): paperless-ngx's remote user auth via header works even when disabling it for API (medium 5.5)
- [CVE-2024-35183](https://insights.sbomify.com/CVE-2024-35183/): wolfictl leaks GitHub tokens to remote non-GitHub git servers (medium 4.4)
- [CVE-2024-35182](https://insights.sbomify.com/CVE-2024-35182/): GHSL-2024-014 Meshery SQL Injection vulnerability (medium 5.9)
- [CVE-2024-35181](https://insights.sbomify.com/CVE-2024-35181/): GHSL-2024-013 Meshery SQL Injection vulnerability (medium 5.9)
- [CVE-2024-35180](https://insights.sbomify.com/CVE-2024-35180/): OMERO.web JSONP callback vulnerability (medium 6.1)
- [CVE-2024-3518](https://insights.sbomify.com/CVE-2024-3518/): Media Library Assistant <= 3.15 - Authenticated (Contributor+) SQL Injection via Shortcode (high 8.8)
- [CVE-2024-35179](https://insights.sbomify.com/CVE-2024-35179/): Unprivileged Stalwart Mail Server user can read files as root (medium 6.8)
- [CVE-2024-35178](https://insights.sbomify.com/CVE-2024-35178/): Jupyter server on Windows discloses Windows user password hash (high 7.5)
- [CVE-2024-35177](https://insights.sbomify.com/CVE-2024-35177/): Improper Access Control in wazuh-agent (high 7.8)
- [CVE-2024-35176](https://insights.sbomify.com/CVE-2024-35176/): REXML contains a denial of service vulnerability (medium 5.3)
- [CVE-2024-35175](https://insights.sbomify.com/CVE-2024-35175/): sshpiper's Enabling of Proxy Protocol without proper feature flagging allows faking source address (medium 5.3)
- [CVE-2024-35174](https://insights.sbomify.com/CVE-2024-35174/): WordPress Flo Forms plugin <= 1.0.42 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35172](https://insights.sbomify.com/CVE-2024-35172/): WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2024-35171](https://insights.sbomify.com/CVE-2024-35171/): WordPress Academy LMS plugin <= 1.9.25 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-35170](https://insights.sbomify.com/CVE-2024-35170/): WordPress Sticky banner plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3517](https://insights.sbomify.com/CVE-2024-3517/): Cross-site scripting in Shortcodes and extra features for Phlox theme (medium 6.4)
- [CVE-2024-35169](https://insights.sbomify.com/CVE-2024-35169/): WordPress All Bootstrap Blocks plugin <= 1.3.15 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35168](https://insights.sbomify.com/CVE-2024-35168/): WordPress WP Discourse plugin <= 2.5.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35167](https://insights.sbomify.com/CVE-2024-35167/): Cross-site scripting in Envo's Elementor Templates & Widgets for WooCommerce (medium 6.5)
- [CVE-2024-35166](https://insights.sbomify.com/CVE-2024-35166/): Information disclosure in Filebird (medium 5.3)
- [CVE-2024-35165](https://insights.sbomify.com/CVE-2024-35165/): WordPress Gutenify plugin <= 1.4.0 - Sensitive Data Exposure via API vulnerability (medium 5.3)
- [CVE-2024-35164](https://insights.sbomify.com/CVE-2024-35164/): Apache Guacamole: Improper input validation of console codes (medium 6.8)
- [CVE-2024-35162](https://insights.sbomify.com/CVE-2024-35162/): Path traversal in Download Plugins and Themes from Dashboard (medium 6.5)
- [CVE-2024-35161](https://insights.sbomify.com/CVE-2024-35161/): Apache Traffic Server: Incomplete check for chunked trailer section allows request smuggling (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/348/