# Vulnerabilities published in 2024


- [CVE-2024-29027](https://insights.sbomify.com/CVE-2024-29027/): Parse Server crash and RCE via invalid Cloud Function or Cloud Job name (critical 9.1)
- [CVE-2024-29026](https://insights.sbomify.com/CVE-2024-29026/): Owncast cross origin request (high 8.2)
- [CVE-2024-29025](https://insights.sbomify.com/CVE-2024-29025/): Netty HttpPostRequestDecoder can OOM (medium 5.3)
- [CVE-2024-29024](https://insights.sbomify.com/CVE-2024-29024/): JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality (medium 4.6)
- [CVE-2024-29023](https://insights.sbomify.com/CVE-2024-29023/): Session Hijacking via token exposure on the session page in Xibo CMS (high 7.2)
- [CVE-2024-29022](https://insights.sbomify.com/CVE-2024-29022/): Session Hijacking via XSS attack in header and session grid in Xibo CMS (high 8.8)
- [CVE-2024-29021](https://insights.sbomify.com/CVE-2024-29021/): SSRF into Sandbox Escape through Unsafe Default Configuration (critical 9.1)
- [CVE-2024-29020](https://insights.sbomify.com/CVE-2024-29020/): JumpServer allows nn authorized attacker to get sensitive information in playbook files when playbook_id is leaked (medium 4.6)
- [CVE-2024-2902](https://insights.sbomify.com/CVE-2024-2902/): Tenda AC7 WifiGuestSet fromSetWifiGusetBasic stack-based overflow (high 8.8)
- [CVE-2024-29019](https://insights.sbomify.com/CVE-2024-29019/): ESPHome vulnerable to Authentication bypass via Cross site request forgery (high 8.1)
- [CVE-2024-29018](https://insights.sbomify.com/CVE-2024-29018/): External DNS requests from 'internal' networks could lead to data exfiltration (medium 5.9)
- [CVE-2024-29015](https://insights.sbomify.com/CVE-2024-29015/): Privilege escalation in Intel(R) VTune(TM) Profiler software (medium 5.4)
- [CVE-2024-29014](https://insights.sbomify.com/CVE-2024-29014/): Code injection in NetExtender (high 7.1)
- [CVE-2024-29013](https://insights.sbomify.com/CVE-2024-29013/): Memory corruption in SonicOS (medium 5.3)
- [CVE-2024-29012](https://insights.sbomify.com/CVE-2024-29012/): Memory corruption in SonicOS (medium 4.9)
- [CVE-2024-29011](https://insights.sbomify.com/CVE-2024-29011/): Hardcoded credentials in GMS (high 7.5)
- [CVE-2024-29010](https://insights.sbomify.com/CVE-2024-29010/): XML external entity in GMS (high 7.1)
- [CVE-2024-2901](https://insights.sbomify.com/CVE-2024-2901/): Tenda AC7 openSchedWifi setSchedWifi stack-based overflow (high 8.8)
- [CVE-2024-29009](https://insights.sbomify.com/CVE-2024-29009/): Cross-site request forgery in easy-popup-show (medium 6.1)
- [CVE-2024-29008](https://insights.sbomify.com/CVE-2024-29008/): Apache CloudStack: The extraconfig feature can be abused to load hypervisor resources on a VM instance (medium 6.4)
- [CVE-2024-29007](https://insights.sbomify.com/CVE-2024-29007/): Server-side request forgery in Apache CloudStack (high 7.3)
- [CVE-2024-29006](https://insights.sbomify.com/CVE-2024-29006/): Apache CloudStack: x-forwarded-for HTTP header parsed by default (critical 9.8)
- [CVE-2024-29004](https://insights.sbomify.com/CVE-2024-29004/): SolarWinds Platform Stored XSS Vulnerability (high 7.1)
- [CVE-2024-29003](https://insights.sbomify.com/CVE-2024-29003/): SolarWinds Platform Cross Site Scripting Vulnerability (high 7.5)
- [CVE-2024-29001](https://insights.sbomify.com/CVE-2024-29001/): SolarWinds Platform SWQL Injection Vulnerability (high 7.5)
- [CVE-2024-29000](https://insights.sbomify.com/CVE-2024-29000/): SolarWinds Platform Reflected XSS Vulnerability (high 7.9)
- [CVE-2024-2900](https://insights.sbomify.com/CVE-2024-2900/): Tenda AC7 saveParentControlInfo stack-based overflow (high 8.8)
- [CVE-2024-28999](https://insights.sbomify.com/CVE-2024-28999/): SolarWinds Platform Race Condition Vulnerability (medium 6.4)
- [CVE-2024-28996](https://insights.sbomify.com/CVE-2024-28996/): SolarWinds Platform SWQL Injection Vulnerability (high 7.5)
- [CVE-2024-28995](https://insights.sbomify.com/CVE-2024-28995/): SolarWinds Serv-U Path Traversal Vulnerability (high 8.6, exploited in the wild)
- [CVE-2024-28993](https://insights.sbomify.com/CVE-2024-28993/): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (high 7.6)
- [CVE-2024-28992](https://insights.sbomify.com/CVE-2024-28992/): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (high 7.6)
- [CVE-2024-28991](https://insights.sbomify.com/CVE-2024-28991/): SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution (critical 9.0)
- [CVE-2024-28990](https://insights.sbomify.com/CVE-2024-28990/): SolarWinds Access Rights Manager (ARM) Hardcoded Credentials Authentication Bypass Vulnerability (medium 6.3)
- [CVE-2024-2899](https://insights.sbomify.com/CVE-2024-2899/): Tenda AC7 WifiExtraSet fromSetWirelessRepeat stack-based overflow (high 8.8)
- [CVE-2024-28989](https://insights.sbomify.com/CVE-2024-28989/): SolarWinds Web Help Desk Cryptographic Key Management Vulnerability (medium 5.5)
- [CVE-2024-28988](https://insights.sbomify.com/CVE-2024-28988/): SolarWinds Web Help Desk Java Deserialization Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-28987](https://insights.sbomify.com/CVE-2024-28987/): SolarWinds Web Help Desk Hardcoded Credential (critical 9.1, exploited in the wild)
- [CVE-2024-28986](https://insights.sbomify.com/CVE-2024-28986/): SolarWinds Web Help Desk Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2024-28984](https://insights.sbomify.com/CVE-2024-28984/): Cross-site scripting in Pentaho Business Analytics Server (high 8.8)
- [CVE-2024-28983](https://insights.sbomify.com/CVE-2024-28983/): Cross-site scripting in Pentaho Business Analytics Server (high 8.8)
- [CVE-2024-28982](https://insights.sbomify.com/CVE-2024-28982/): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (high 7.1)
- [CVE-2024-28981](https://insights.sbomify.com/CVE-2024-28981/): Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials (high 8.5)
- [CVE-2024-28980](https://insights.sbomify.com/CVE-2024-28980/): Weak cryptography in RecoverPoint for Virtual Machines (medium 6.5)
- [CVE-2024-2898](https://insights.sbomify.com/CVE-2024-2898/): Tenda AC7 SetStaticRouteCfg fromSetRouteStatic stack-based overflow (high 8.8)
- [CVE-2024-28979](https://insights.sbomify.com/CVE-2024-28979/): Cross-site scripting in Dell OpenManage Enterprise (medium 5.1)
- [CVE-2024-28978](https://insights.sbomify.com/CVE-2024-28978/): Missing authorization in Dell OpenManage Enterprise (medium 5.2)
- [CVE-2024-28977](https://insights.sbomify.com/CVE-2024-28977/): Path traversal in Dell Repository Manager (DRM) (low 3.3)
- [CVE-2024-28976](https://insights.sbomify.com/CVE-2024-28976/): Path traversal in Dell Repository Manager (DRM) (high 8.8)
- [CVE-2024-28974](https://insights.sbomify.com/CVE-2024-28974/): Weak cryptography in Data Protection Advisor (high 7.6)
- [CVE-2024-28973](https://insights.sbomify.com/CVE-2024-28973/): Cross-site scripting in PowerProtect DD (medium 5.9)
- [CVE-2024-28972](https://insights.sbomify.com/CVE-2024-28972/): Weak cryptography in InsightIQ (medium 5.9)
- [CVE-2024-28971](https://insights.sbomify.com/CVE-2024-28971/): Information disclosure in Update Manager Plugin (low 3.5)
- [CVE-2024-28970](https://insights.sbomify.com/CVE-2024-28970/): Memory corruption in CPG BIOS (medium 4.7)
- [CVE-2024-2897](https://insights.sbomify.com/CVE-2024-2897/): Tenda AC7 WriteFacMac formWriteFacMac os command injection (medium 6.3)
- [CVE-2024-28969](https://insights.sbomify.com/CVE-2024-28969/): Missing authorization in Secure Connect Gateway-Appliance (medium 4.3)
- [CVE-2024-28968](https://insights.sbomify.com/CVE-2024-28968/): Missing authorization in Secure Connect Gateway-Appliance (medium 5.4)
- [CVE-2024-28967](https://insights.sbomify.com/CVE-2024-28967/): Missing authorization in Secure Connect Gateway-Appliance (medium 5.4)
- [CVE-2024-28966](https://insights.sbomify.com/CVE-2024-28966/): Missing authorization in Secure Connect Gateway-Appliance (medium 5.4)
- [CVE-2024-28965](https://insights.sbomify.com/CVE-2024-28965/): Missing authorization in Secure Connect Gateway-Appliance (medium 5.4)
- [CVE-2024-28964](https://insights.sbomify.com/CVE-2024-28964/): Deserialization in Common Event Enabler (high 7.8)
- [CVE-2024-28963](https://insights.sbomify.com/CVE-2024-28963/): Information disclosure in Wyse Proprietary OS (Modern ThinOS) (medium 6.2)
- [CVE-2024-28962](https://insights.sbomify.com/CVE-2024-28962/): Denial of service in Dell Update (DU) (medium 6.5)
- [CVE-2024-28961](https://insights.sbomify.com/CVE-2024-28961/): Information disclosure in Dell OpenManage Enterprise (medium 6.3)
- [CVE-2024-28960](https://insights.sbomify.com/CVE-2024-28960/): Other in arm:mbed crypto (high 8.2)
- [CVE-2024-2896](https://insights.sbomify.com/CVE-2024-2896/): Tenda AC7 WifiWpsStart formWifiWpsStart stack-based overflow (high 8.8)
- [CVE-2024-28957](https://insights.sbomify.com/CVE-2024-28957/): Weak cryptography in Cente IPv6 (medium 5.3)
- [CVE-2024-28956](https://insights.sbomify.com/CVE-2024-28956/): Information disclosure in Intel(R) Processors (medium 5.7)
- [CVE-2024-28955](https://insights.sbomify.com/CVE-2024-28955/): Information disclosure in Multiple MFPs (multifunction printers) (medium 5.9)
- [CVE-2024-28954](https://insights.sbomify.com/CVE-2024-28954/): Misconfiguration in Intel(R) Graphics Driver installers (medium 5.4)
- [CVE-2024-28953](https://insights.sbomify.com/CVE-2024-28953/): Privilege escalation in EMON software (medium 5.4)
- [CVE-2024-28952](https://insights.sbomify.com/CVE-2024-28952/): Privilege escalation in Intel(R) IPP software for Windows (medium 5.4)
- [CVE-2024-28951](https://insights.sbomify.com/CVE-2024-28951/): Arkcompiler runtime has a use after free vulnerability (medium 5.5)
- [CVE-2024-28950](https://insights.sbomify.com/CVE-2024-28950/): Privilege escalation in Intel(R) oneAPI Math Kernel Library software for Windows (medium 5.4)
- [CVE-2024-2895](https://insights.sbomify.com/CVE-2024-2895/): Tenda AC7 WifiWpsOOB formWifiWpsOOB stack-based overflow (high 8.8)
- [CVE-2024-28949](https://insights.sbomify.com/CVE-2024-28949/): DoS via a large number of User Preferences (medium 4.3)
- [CVE-2024-28948](https://insights.sbomify.com/CVE-2024-28948/): Advantech ADAM-5630 Cross-Site Request Forgery (high 8.5)
- [CVE-2024-28947](https://insights.sbomify.com/CVE-2024-28947/): Privilege escalation in Intel(R) Server Board S2600ST Family firmware (high 7.1)
- [CVE-2024-28945](https://insights.sbomify.com/CVE-2024-28945/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28944](https://insights.sbomify.com/CVE-2024-28944/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28943](https://insights.sbomify.com/CVE-2024-28943/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28942](https://insights.sbomify.com/CVE-2024-28942/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28941](https://insights.sbomify.com/CVE-2024-28941/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28940](https://insights.sbomify.com/CVE-2024-28940/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-2894](https://insights.sbomify.com/CVE-2024-2894/): Tenda AC7 SetNetControlList formSetQosBand stack-based overflow (high 8.8)
- [CVE-2024-28939](https://insights.sbomify.com/CVE-2024-28939/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28938](https://insights.sbomify.com/CVE-2024-28938/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28937](https://insights.sbomify.com/CVE-2024-28937/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28936](https://insights.sbomify.com/CVE-2024-28936/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28935](https://insights.sbomify.com/CVE-2024-28935/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28934](https://insights.sbomify.com/CVE-2024-28934/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28933](https://insights.sbomify.com/CVE-2024-28933/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28932](https://insights.sbomify.com/CVE-2024-28932/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28931](https://insights.sbomify.com/CVE-2024-28931/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28930](https://insights.sbomify.com/CVE-2024-28930/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-2893](https://insights.sbomify.com/CVE-2024-2893/): Tenda AC7 SetOnlineDevName formSetDeviceName stack-based overflow (high 8.8)
- [CVE-2024-28929](https://insights.sbomify.com/CVE-2024-28929/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28928](https://insights.sbomify.com/CVE-2024-28928/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28927](https://insights.sbomify.com/CVE-2024-28927/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28926](https://insights.sbomify.com/CVE-2024-28926/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/395/