# Vulnerabilities published in 2024


- [CVE-2024-34206](https://insights.sbomify.com/CVE-2024-34206/): Command injection in totolink:cp450 firmware (medium 6.5)
- [CVE-2024-34205](https://insights.sbomify.com/CVE-2024-34205/): Command injection in totolink:cp450 firmware (high 7.3)
- [CVE-2024-34204](https://insights.sbomify.com/CVE-2024-34204/): Command injection in totolink:cp450 firmware (critical 9.8)
- [CVE-2024-34203](https://insights.sbomify.com/CVE-2024-34203/): Memory corruption in totolink:cp450 firmware (low 3.8)
- [CVE-2024-34202](https://insights.sbomify.com/CVE-2024-34202/): Memory corruption in totolink:cp450 firmware (medium 6.5)
- [CVE-2024-34201](https://insights.sbomify.com/CVE-2024-34201/): Memory corruption in totolink:cp450 firmware (high 7.3)
- [CVE-2024-34200](https://insights.sbomify.com/CVE-2024-34200/): Memory corruption in totolink:cp450 firmware (high 8.8)
- [CVE-2024-3420](https://insights.sbomify.com/CVE-2024-3420/): SourceCodester Online Courseware saveedit.php sql injection (medium 6.3)
- [CVE-2024-34199](https://insights.sbomify.com/CVE-2024-34199/): Memory corruption in ritlabs:tinyweb (high 8.6)
- [CVE-2024-34198](https://insights.sbomify.com/CVE-2024-34198/): Memory corruption in totolink:a3002ru firmware (critical 9.8)
- [CVE-2024-34196](https://insights.sbomify.com/CVE-2024-34196/): Memory corruption in totolink:a3002ru-v3 firmware (high 8.8)
- [CVE-2024-34195](https://insights.sbomify.com/CVE-2024-34195/): Memory corruption in totolink:a3002r firmware (high 8.8)
- [CVE-2024-34193](https://insights.sbomify.com/CVE-2024-34193/): Path traversal in lkw199711:smanga (high 7.5)
- [CVE-2024-34191](https://insights.sbomify.com/CVE-2024-34191/): Path traversal in htmly:htmly (medium 6.5)
- [CVE-2024-3419](https://insights.sbomify.com/CVE-2024-3419/): SourceCodester Online Courseware edit.php sql injection (medium 6.3)
- [CVE-2024-3418](https://insights.sbomify.com/CVE-2024-3418/): SourceCodester Online Courseware deactivateteach.php sql injection (medium 6.3)
- [CVE-2024-34171](https://insights.sbomify.com/CVE-2024-34171/): Fuji Electric Monitouch V-SFT Stack-Based Buffer Overflow (high 8.5)
- [CVE-2024-34170](https://insights.sbomify.com/CVE-2024-34170/): Memory corruption in Intel(R) Graphics Drivers (medium 6.9)
- [CVE-2024-3417](https://insights.sbomify.com/CVE-2024-3417/): SourceCodester Online Courseware saveeditt.php sql injection (medium 6.3)
- [CVE-2024-34167](https://insights.sbomify.com/CVE-2024-34167/): Privilege escalation in Intel(R) Server Board S2600ST Family BIOS and Firmware Update software (medium 5.4)
- [CVE-2024-34166](https://insights.sbomify.com/CVE-2024-34166/): Command injection in Wavlink AC3000 (critical 10.0)
- [CVE-2024-34165](https://insights.sbomify.com/CVE-2024-34165/): Privilege escalation in Intel(R) oneAPI DPC++/C++ Compiler (medium 5.4)
- [CVE-2024-34164](https://insights.sbomify.com/CVE-2024-34164/): Privilege escalation in Intel(R) MAS software (medium 5.4)
- [CVE-2024-34163](https://insights.sbomify.com/CVE-2024-34163/): Privilege escalation in Intel(R) NUC (high 8.7)
- [CVE-2024-34162](https://insights.sbomify.com/CVE-2024-34162/): Information disclosure in Multiple MFPs (multifunction printers) (medium 5.3)
- [CVE-2024-34161](https://insights.sbomify.com/CVE-2024-34161/): NGINX HTTP/3 QUIC vulnerability (medium 5.3)
- [CVE-2024-3416](https://insights.sbomify.com/CVE-2024-3416/): SourceCodester Online Courseware editt.php sql injection (medium 6.3)
- [CVE-2024-34158](https://insights.sbomify.com/CVE-2024-34158/): Stack exhaustion in Parse in go/build/constraint (high 7.5)
- [CVE-2024-34156](https://insights.sbomify.com/CVE-2024-34156/): Stack exhaustion in Decoder.Decode in encoding/gob (high 7.5)
- [CVE-2024-34155](https://insights.sbomify.com/CVE-2024-34155/): Stack exhaustion in all Parse functions in go/parser (medium 4.3)
- [CVE-2024-34153](https://insights.sbomify.com/CVE-2024-34153/): Privilege escalation in Intel(R) RAID Web Console software (medium 6.7)
- [CVE-2024-34152](https://insights.sbomify.com/CVE-2024-34152/): Playbook Run Metadata leak to Guest (medium 4.3)
- [CVE-2024-3415](https://insights.sbomify.com/CVE-2024-3415/): SourceCodester Human Resource Information System addbranches_process.php cross site scripting (low 3.5)
- [CVE-2024-34149](https://insights.sbomify.com/CVE-2024-34149/): In Bitcoin Core through 27.0 and Bitcoin Knots before 25.1.knots20231115, tapscript lacks a policy size limit check, a different issue than CVE-2023-50428. (medium 6.3)
- [CVE-2024-34148](https://insights.sbomify.com/CVE-2024-34148/): Jenkins Subversion Partial Release Manager Plugin programmatically disables the fix for CVE-2016-3721 (medium 6.8)
- [CVE-2024-34147](https://insights.sbomify.com/CVE-2024-34147/): Jenkins Telegram Bot Plugin stores the Telegram Bot token in plaintext (medium 4.3)
- [CVE-2024-34146](https://insights.sbomify.com/CVE-2024-34146/): Jenkins Git server Plugin does not perform a permission check (medium 6.5)
- [CVE-2024-34145](https://insights.sbomify.com/CVE-2024-34145/): Jenkins Script Security Plugin sandbox bypass vulnerability (high 8.8)
- [CVE-2024-34144](https://insights.sbomify.com/CVE-2024-34144/): Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies (critical 9.8)
- [CVE-2024-34142](https://insights.sbomify.com/CVE-2024-34142/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-34141](https://insights.sbomify.com/CVE-2024-34141/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-34140](https://insights.sbomify.com/CVE-2024-34140/): Adobe Bridge PDF File Parsing Memory Corruption (medium 5.5)
- [CVE-2024-3414](https://insights.sbomify.com/CVE-2024-3414/): SourceCodester Human Resource Information System addcorporate_process.php cross site scripting (low 3.5)
- [CVE-2024-34139](https://insights.sbomify.com/CVE-2024-34139/): Adobe Bridge has an integer overflow vulnerability when parsing SVG file (high 7.8)
- [CVE-2024-34138](https://insights.sbomify.com/CVE-2024-34138/): Adobe Illustrator CGM File Parsing Division By zero (medium 5.5)
- [CVE-2024-34137](https://insights.sbomify.com/CVE-2024-34137/): Adobe Illustrator 2024 CGM File Parsing Null Pointer Dereference (medium 5.5)
- [CVE-2024-34136](https://insights.sbomify.com/CVE-2024-34136/): Adobe Illustrator PSD File Parsing Null Pointer dereference (medium 5.5)
- [CVE-2024-34135](https://insights.sbomify.com/CVE-2024-34135/): Adobe Illustrator CC 2023 v27.9 Vulnerability II (medium 5.5)
- [CVE-2024-34134](https://insights.sbomify.com/CVE-2024-34134/): Illustrator | Out-of-bounds Read (CWE-125) (medium 5.5)
- [CVE-2024-34133](https://insights.sbomify.com/CVE-2024-34133/): Adobe Illustrator CC 2023 v27.9 Vulnerability I (high 7.8)
- [CVE-2024-34130](https://insights.sbomify.com/CVE-2024-34130/): Acrobat Android : OverSecured Finding : Access to arbitrary* content providers via insecure Intent configuration (medium 5.5)
- [CVE-2024-3413](https://insights.sbomify.com/CVE-2024-3413/): SourceCodester Human Resource Information System login_process.php sql injection (high 7.3)
- [CVE-2024-34129](https://insights.sbomify.com/CVE-2024-34129/): Acrobat Android : OverSecured Finding : Overwriting arbitrary files via attacker-controlled output file paths (high 7.5)
- [CVE-2024-34128](https://insights.sbomify.com/CVE-2024-34128/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-34127](https://insights.sbomify.com/CVE-2024-34127/): Adobe Indesign TIF File Parsing Out Of Bound Read (medium 5.5)
- [CVE-2024-34126](https://insights.sbomify.com/CVE-2024-34126/): ZDI-CAN-24028: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-34125](https://insights.sbomify.com/CVE-2024-34125/): ZDI-CAN-24027: Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-34124](https://insights.sbomify.com/CVE-2024-34124/): ZDI-CAN-24031: Adobe Dimension SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-34123](https://insights.sbomify.com/CVE-2024-34123/): Adobe Premiere Pro arbitrary DLL loading lead to remote code execution (high 7.0)
- [CVE-2024-34122](https://insights.sbomify.com/CVE-2024-34122/): T5 Acrobat Vulnerability - Exploitable crash in DecodeTile (high 7.8)
- [CVE-2024-34121](https://insights.sbomify.com/CVE-2024-34121/): Illustrator | Integer Overflow or Wraparound (CWE-190) (high 7.8)
- [CVE-2024-34120](https://insights.sbomify.com/CVE-2024-34120/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-3412](https://insights.sbomify.com/CVE-2024-3412/): WP STAGING WordPress Backup Plugin – Migration Backup Restore <= 3.4.3 - Authenticated (Admin+) Arbitrary File Upload (critical 9.1)
- [CVE-2024-34119](https://insights.sbomify.com/CVE-2024-34119/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-34118](https://insights.sbomify.com/CVE-2024-34118/): Adobe illustrator 2024 TIF File parsing Division by zero denial of service (medium 5.5)
- [CVE-2024-34117](https://insights.sbomify.com/CVE-2024-34117/): Adobe Photoshop 2024 MPO File Parsing Use-After-Free vulnerability (high 7.8)
- [CVE-2024-34116](https://insights.sbomify.com/CVE-2024-34116/): Adobe Creative Cloud App Install Arbitrary Folder Delete Vulnerability can be abuse to Privilege Escalation (high 7.1)
- [CVE-2024-34115](https://insights.sbomify.com/CVE-2024-34115/): ZDI-CAN-24054: Adobe Substance 3D Stager SKP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-34113](https://insights.sbomify.com/CVE-2024-34113/): ColdFusion | Weak Cryptography for Passwords (CWE-261) (medium 5.5)
- [CVE-2024-34112](https://insights.sbomify.com/CVE-2024-34112/): ColdFusion CFDOCUMENT file retrieval / access control bypass (high 7.5)
- [CVE-2024-34111](https://insights.sbomify.com/CVE-2024-34111/): SSRF in service connector (medium 6.5)
- [CVE-2024-34110](https://insights.sbomify.com/CVE-2024-34110/): RCE in the Adobe Commerce Webhook module through a legit webhook definition (high 7.2)
- [CVE-2024-3411](https://insights.sbomify.com/CVE-2024-3411/): Insufficient Randomness When Validating an IPMI Authenticated Session (critical 9.1)
- [CVE-2024-34109](https://insights.sbomify.com/CVE-2024-34109/): Adobe Commerce | Improper Input Validation (CWE-20) (high 7.2)
- [CVE-2024-34108](https://insights.sbomify.com/CVE-2024-34108/): Large attack surface through legit webhook usage in Adobe Commerce (critical 9.1)
- [CVE-2024-34107](https://insights.sbomify.com/CVE-2024-34107/): Adobe Commerce | Improper Access Control (CWE-284) (medium 5.3)
- [CVE-2024-34106](https://insights.sbomify.com/CVE-2024-34106/): Insecure Direct Object Reference - An attacker can able to erase the victim quote details (medium 5.3)
- [CVE-2024-34105](https://insights.sbomify.com/CVE-2024-34105/): Stored Cross Site Scripting in Order Comment (medium 4.8)
- [CVE-2024-34104](https://insights.sbomify.com/CVE-2024-34104/): Adobe Commerce | Improper Authorization (CWE-285) (high 8.2)
- [CVE-2024-34103](https://insights.sbomify.com/CVE-2024-34103/): Customer account takeover via web API call & subsequent password reset (high 8.1)
- [CVE-2024-34102](https://insights.sbomify.com/CVE-2024-34102/): Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference (XXE) (critical 9.8, exploited in the wild)
- [CVE-2024-34101](https://insights.sbomify.com/CVE-2024-34101/): ZDI-CAN-23614: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-34100](https://insights.sbomify.com/CVE-2024-34100/): Use-After-Free vulnerability in the latest Adobe Acrobat Reader DC when open malicious PDF file (high 7.8)
- [CVE-2024-3410](https://insights.sbomify.com/CVE-2024-3410/): DN Footer Contacts < 1.6.3 - Admin+ Stored XSS (medium 4.3)
- [CVE-2024-34099](https://insights.sbomify.com/CVE-2024-34099/): ZDI-CAN-XXXX: [Pwn2Own] Acrobat sandbox bypass part 2 of 2 (high 7.8)
- [CVE-2024-34098](https://insights.sbomify.com/CVE-2024-34098/): ZDI-CAN-XXXX: [Pwn2Own] Acrobat sandbox bypass part 1 of 2 (high 7.8)
- [CVE-2024-34097](https://insights.sbomify.com/CVE-2024-34097/): ZDI-CAN-23473: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-34096](https://insights.sbomify.com/CVE-2024-34096/): ZDI-CAN-23472: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-34095](https://insights.sbomify.com/CVE-2024-34095/): ZDI-CAN-23475: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-34094](https://insights.sbomify.com/CVE-2024-34094/): ZDI-CAN-23474: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-34093](https://insights.sbomify.com/CVE-2024-34093/): Security feature bypass in archerirm:archer (medium 5.3)
- [CVE-2024-34092](https://insights.sbomify.com/CVE-2024-34092/): Auth bypass in archerirm:archer (medium 6.3)
- [CVE-2024-34091](https://insights.sbomify.com/CVE-2024-34091/): Cross-site scripting in archerirm:archer (high 7.3)
- [CVE-2024-34090](https://insights.sbomify.com/CVE-2024-34090/): Cross-site scripting in archerirm:archer (high 7.3)
- [CVE-2024-34089](https://insights.sbomify.com/CVE-2024-34089/): Cross-site scripting in archerirm:archer (high 7.3)
- [CVE-2024-34088](https://insights.sbomify.com/CVE-2024-34088/): Null dereference in frrouting:frrouting (high 7.5)
- [CVE-2024-34087](https://insights.sbomify.com/CVE-2024-34087/): An SEH-based buffer overflow in the BPQ32 HTTP Server in BPQ32 6.0.24.1 allows remote attackers with access to the Web Terminal to achieve r (critical 9.8)
- [CVE-2024-34086](https://insights.sbomify.com/CVE-2024-34086/): Memory corruption in JT2Go (high 7.8)
- [CVE-2024-34085](https://insights.sbomify.com/CVE-2024-34085/): Memory corruption in JT2Go (high 7.8)
- [CVE-2024-34084](https://insights.sbomify.com/CVE-2024-34084/): Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/356/