# Vulnerabilities published in 2024


- [CVE-2024-33058](https://insights.sbomify.com/CVE-2024-33058/): Insufficient Granularity of Access Control in Core (high 7.5)
- [CVE-2024-33057](https://insights.sbomify.com/CVE-2024-33057/): Buffer Over-read in WLAN Host Communication (high 7.5)
- [CVE-2024-33056](https://insights.sbomify.com/CVE-2024-33056/): Buffer Over-read in MProc (high 8.4)
- [CVE-2024-33055](https://insights.sbomify.com/CVE-2024-33055/): Use After Free in Computer Vision (medium 6.7)
- [CVE-2024-33054](https://insights.sbomify.com/CVE-2024-33054/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision (high 7.8)
- [CVE-2024-33053](https://insights.sbomify.com/CVE-2024-33053/): Use After Free in Video (medium 6.7)
- [CVE-2024-33052](https://insights.sbomify.com/CVE-2024-33052/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host (high 7.8)
- [CVE-2024-33051](https://insights.sbomify.com/CVE-2024-33051/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2024-33050](https://insights.sbomify.com/CVE-2024-33050/): Buffer Over-read in WLAN Host Communication (high 7.5)
- [CVE-2024-3305](https://insights.sbomify.com/CVE-2024-3305/): IDOR in Utarit Information's SoliClub (high 8.8)
- [CVE-2024-33049](https://insights.sbomify.com/CVE-2024-33049/): Buffer Over-read in WLAN Host Communication (high 7.5)
- [CVE-2024-33048](https://insights.sbomify.com/CVE-2024-33048/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33047](https://insights.sbomify.com/CVE-2024-33047/): Buffer Over-read in Display (high 8.4)
- [CVE-2024-33045](https://insights.sbomify.com/CVE-2024-33045/): Return of Stack Variable Address in Buses (high 8.4)
- [CVE-2024-33044](https://insights.sbomify.com/CVE-2024-33044/): Improper Validation of Array Index in Hypervisor (high 8.4)
- [CVE-2024-33043](https://insights.sbomify.com/CVE-2024-33043/): Buffer Over-read in FM Host (medium 5.5)
- [CVE-2024-33042](https://insights.sbomify.com/CVE-2024-33042/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host (high 7.8)
- [CVE-2024-33041](https://insights.sbomify.com/CVE-2024-33041/): Use of Out-of-range Pointer Offset in Computer Vision (medium 6.7)
- [CVE-2024-33040](https://insights.sbomify.com/CVE-2024-33040/): Use After Free in Camera Driver (medium 6.7)
- [CVE-2024-33039](https://insights.sbomify.com/CVE-2024-33039/): Untrusted Pointer Dereference in Audio (medium 6.7)
- [CVE-2024-33038](https://insights.sbomify.com/CVE-2024-33038/): Untrusted Pointer Dereference in Computer Vision (high 7.8)
- [CVE-2024-33037](https://insights.sbomify.com/CVE-2024-33037/): Buffer Over-read in Neural Processing Unit (medium 6.1)
- [CVE-2024-33036](https://insights.sbomify.com/CVE-2024-33036/): Use of Out-of-range Pointer Offset in Camera Driver (medium 6.7)
- [CVE-2024-33035](https://insights.sbomify.com/CVE-2024-33035/): Integer Overflow or Wraparound in Display (high 8.4)
- [CVE-2024-33034](https://insights.sbomify.com/CVE-2024-33034/): Use After Free in Graphics Linux (high 8.4)
- [CVE-2024-33033](https://insights.sbomify.com/CVE-2024-33033/): Use After Free in ComputerVision (medium 6.7)
- [CVE-2024-33032](https://insights.sbomify.com/CVE-2024-33032/): Improper Validation of Array Index in Camera_Linux (medium 6.7)
- [CVE-2024-33031](https://insights.sbomify.com/CVE-2024-33031/): Improper Input Validation in RIL (medium 6.7)
- [CVE-2024-33030](https://insights.sbomify.com/CVE-2024-33030/): Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Performance (medium 6.7)
- [CVE-2024-3303](https://insights.sbomify.com/CVE-2024-3303/): Improper Neutralization of Input Used for LLM Prompting in GitLab (medium 6.4)
- [CVE-2024-33029](https://insights.sbomify.com/CVE-2024-33029/): Use After Free in DSP Services (medium 6.7)
- [CVE-2024-33028](https://insights.sbomify.com/CVE-2024-33028/): Use After Free in Automotive Telematics (high 8.4)
- [CVE-2024-33027](https://insights.sbomify.com/CVE-2024-33027/): Improper Access Control in Graphics Linux (high 8.4)
- [CVE-2024-33026](https://insights.sbomify.com/CVE-2024-33026/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33025](https://insights.sbomify.com/CVE-2024-33025/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33024](https://insights.sbomify.com/CVE-2024-33024/): Integer Overflow or Wraparound in WLAN Host (high 7.5)
- [CVE-2024-33023](https://insights.sbomify.com/CVE-2024-33023/): Use After Free in Graphics Linux (high 8.4)
- [CVE-2024-33022](https://insights.sbomify.com/CVE-2024-33022/): Integer Overflow or Wraparound in Automotive GPU (high 8.4)
- [CVE-2024-33021](https://insights.sbomify.com/CVE-2024-33021/): Use of Uninitialized Variable in Automotive GPU (high 8.4)
- [CVE-2024-33020](https://insights.sbomify.com/CVE-2024-33020/): Buffer Over-read in WLAN HOST (high 7.5)
- [CVE-2024-3302](https://insights.sbomify.com/CVE-2024-3302/): Denial of service in Firefox (low 3.7)
- [CVE-2024-33019](https://insights.sbomify.com/CVE-2024-33019/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33018](https://insights.sbomify.com/CVE-2024-33018/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33016](https://insights.sbomify.com/CVE-2024-33016/): Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage (medium 6.8)
- [CVE-2024-33015](https://insights.sbomify.com/CVE-2024-33015/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33014](https://insights.sbomify.com/CVE-2024-33014/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33013](https://insights.sbomify.com/CVE-2024-33013/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33012](https://insights.sbomify.com/CVE-2024-33012/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33011](https://insights.sbomify.com/CVE-2024-33011/): Buffer Over-read in WLAN Host (high 7.5)
- [CVE-2024-33010](https://insights.sbomify.com/CVE-2024-33010/): Use After Free in WLAN Host (high 7.5)
- [CVE-2024-3301](https://insights.sbomify.com/CVE-2024-3301/): Deserialization in DELMIA Apriso (high 8.5)
- [CVE-2024-33009](https://insights.sbomify.com/CVE-2024-33009/): SQL injection vulnerability in SAP Global Label Management (GLM) (medium 4.2)
- [CVE-2024-33008](https://insights.sbomify.com/CVE-2024-33008/): Memory Corruption vulnerability in SAP Replication Server (medium 4.9)
- [CVE-2024-33007](https://insights.sbomify.com/CVE-2024-33007/): Client-side script execution vulnerability in SAP UI5(PDFViewer) (low 3.5)
- [CVE-2024-33006](https://insights.sbomify.com/CVE-2024-33006/): File upload vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (critical 9.6)
- [CVE-2024-33005](https://insights.sbomify.com/CVE-2024-33005/): Missing authorization in SAP NetWeaver Application Server (ABAP and Java),SAP Web Dispatcher and SAP Content Server (medium 6.3)
- [CVE-2024-33004](https://insights.sbomify.com/CVE-2024-33004/): Insecure Storage vulnerability in SAP BusinessObjects Business Intelligence Platform (Webservices) (medium 4.3)
- [CVE-2024-33003](https://insights.sbomify.com/CVE-2024-33003/): Information Disclosure Vulnerability in SAP Commerce Cloud (high 7.4)
- [CVE-2024-33002](https://insights.sbomify.com/CVE-2024-33002/): Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS) (medium 6.1)
- [CVE-2024-33001](https://insights.sbomify.com/CVE-2024-33001/): Denial of service (DOS) in SAP NetWeaver and ABAP platform (medium 6.5)
- [CVE-2024-33000](https://insights.sbomify.com/CVE-2024-33000/): Missing Authorization check in SAP Bank Account Management (low 3.5)
- [CVE-2024-3300](https://insights.sbomify.com/CVE-2024-3300/): Deserialization in DELMIA Apriso (critical 9.0)
- [CVE-2024-32999](https://insights.sbomify.com/CVE-2024-32999/): Other in EMUI (medium 6.8)
- [CVE-2024-32998](https://insights.sbomify.com/CVE-2024-32998/): Null dereference in EMUI (medium 5.9)
- [CVE-2024-32997](https://insights.sbomify.com/CVE-2024-32997/): Race condition in EMUI (high 8.4)
- [CVE-2024-32996](https://insights.sbomify.com/CVE-2024-32996/): Privilege escalation in EMUI (medium 6.2)
- [CVE-2024-32995](https://insights.sbomify.com/CVE-2024-32995/): Denial of service in EMUI (medium 6.2)
- [CVE-2024-32993](https://insights.sbomify.com/CVE-2024-32993/): Race condition in EMUI (medium 5.6)
- [CVE-2024-32992](https://insights.sbomify.com/CVE-2024-32992/): Other in EMUI (high 7.5)
- [CVE-2024-32991](https://insights.sbomify.com/CVE-2024-32991/): Missing authorization in EMUI (high 7.5)
- [CVE-2024-32990](https://insights.sbomify.com/CVE-2024-32990/): Missing authorization in EMUI (medium 6.1)
- [CVE-2024-3299](https://insights.sbomify.com/CVE-2024-3299/): Memory corruption in eDrawings (high 7.8)
- [CVE-2024-32989](https://insights.sbomify.com/CVE-2024-32989/): Other in EMUI (low 3.3)
- [CVE-2024-32988](https://insights.sbomify.com/CVE-2024-32988/): Hardcoded credentials in 'OfferBox' App for Android (high 7.5)
- [CVE-2024-32987](https://insights.sbomify.com/CVE-2024-32987/): Microsoft SharePoint Server Information Disclosure Vulnerability (high 7.5)
- [CVE-2024-32986](https://insights.sbomify.com/CVE-2024-32986/): Arbitrary code execution due to improper sanitization of web app properties in PWAsForFirefox (critical 9.7)
- [CVE-2024-32985](https://insights.sbomify.com/CVE-2024-32985/): Stellar-core's Overlay - security fix for DDoS mitigation (medium 5.9)
- [CVE-2024-32984](https://insights.sbomify.com/CVE-2024-32984/): Yamux Memory Exhaustion Vulnerability via Active::pending_frames property (high 7.5)
- [CVE-2024-32983](https://insights.sbomify.com/CVE-2024-32983/): Misskey allows the impersonation and takeover of remote accounts with unnormalized signed activities (high 8.2)
- [CVE-2024-32982](https://insights.sbomify.com/CVE-2024-32982/): Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (high 8.2)
- [CVE-2024-32981](https://insights.sbomify.com/CVE-2024-32981/): Cross-site Scripting vulnerability with encoded payload in silverstripe/framework (medium 5.4)
- [CVE-2024-32980](https://insights.sbomify.com/CVE-2024-32980/): Spin contains a potential network sandbox escape for specifically configured Spin applications (critical 9.1)
- [CVE-2024-3298](https://insights.sbomify.com/CVE-2024-3298/): Memory corruption in eDrawings (high 7.8)
- [CVE-2024-32979](https://insights.sbomify.com/CVE-2024-32979/): Reflected Cross-site Scripting potential in all object list views in Nautobot (high 7.5)
- [CVE-2024-32978](https://insights.sbomify.com/CVE-2024-32978/): Kaminari Insecure File Permissions Vulnerability (medium 6.6)
- [CVE-2024-32977](https://insights.sbomify.com/CVE-2024-32977/): OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabled (high 7.1)
- [CVE-2024-32976](https://insights.sbomify.com/CVE-2024-32976/): Envoy can enter an endless loop while decompressing Brotli data with extra input (high 7.5)
- [CVE-2024-32975](https://insights.sbomify.com/CVE-2024-32975/): Envoy crashes in QuicheDataReader::PeekVarInt62Length() (medium 5.9)
- [CVE-2024-32974](https://insights.sbomify.com/CVE-2024-32974/): Envoy affected by a crash in EnvoyQuicServerStream::OnInitialHeadersComplete() (medium 5.9)
- [CVE-2024-32973](https://insights.sbomify.com/CVE-2024-32973/): Remote for TLS session may be trusted despite constraints in Pluto lang (medium 4.8)
- [CVE-2024-32972](https://insights.sbomify.com/CVE-2024-32972/): go-ethereum denial of service via malicious p2p message (high 7.5)
- [CVE-2024-32971](https://insights.sbomify.com/CVE-2024-32971/): Defect in query plan cache may cause incorrect operations to be executed in Apollo Router (critical 9.1)
- [CVE-2024-32970](https://insights.sbomify.com/CVE-2024-32970/): Cross-site Scripting (XSS) possible with maliciously formed HTML attribute names and values in Phlex (high 7.1)
- [CVE-2024-3297](https://insights.sbomify.com/CVE-2024-3297/): Session establishment lock-up during replay of CASE Sigma1 messages (medium 6.5)
- [CVE-2024-32969](https://insights.sbomify.com/CVE-2024-32969/): vantage6 collaboration admins can extend their influence by expanding the collaboration (low 2.7)
- [CVE-2024-32967](https://insights.sbomify.com/CVE-2024-32967/): Zitadel exposes internal database user name and host information (medium 5.3)
- [CVE-2024-32966](https://insights.sbomify.com/CVE-2024-32966/): Stored Cross-site Scripting in directory listings via file names in static-web-server (medium 5.8)
- [CVE-2024-32965](https://insights.sbomify.com/CVE-2024-32965/): ssrf vulnerability in lobe-chat (high 8.1)
- [CVE-2024-32964](https://insights.sbomify.com/CVE-2024-32964/): lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability (critical 9.0)
- [CVE-2024-32963](https://insights.sbomify.com/CVE-2024-32963/): Parameter Tampering vulnerability in Navidrome (medium 4.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/364/