# Vulnerabilities published in 2024


- [CVE-2024-28925](https://insights.sbomify.com/CVE-2024-28925/): Secure Boot Security Feature Bypass Vulnerability (high 8.0)
- [CVE-2024-28924](https://insights.sbomify.com/CVE-2024-28924/): Secure Boot Security Feature Bypass Vulnerability (medium 6.7)
- [CVE-2024-28923](https://insights.sbomify.com/CVE-2024-28923/): Secure Boot Security Feature Bypass Vulnerability (medium 6.4)
- [CVE-2024-28922](https://insights.sbomify.com/CVE-2024-28922/): Secure Boot Security Feature Bypass Vulnerability (medium 4.1)
- [CVE-2024-28921](https://insights.sbomify.com/CVE-2024-28921/): Secure Boot Security Feature Bypass Vulnerability (medium 6.7)
- [CVE-2024-28920](https://insights.sbomify.com/CVE-2024-28920/): Secure Boot Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2024-2892](https://insights.sbomify.com/CVE-2024-2892/): Tenda AC7 setcfm formSetCfm stack-based overflow (high 8.8)
- [CVE-2024-28919](https://insights.sbomify.com/CVE-2024-28919/): Secure Boot Security Feature Bypass Vulnerability (medium 6.7)
- [CVE-2024-28917](https://insights.sbomify.com/CVE-2024-28917/): Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability (medium 6.2)
- [CVE-2024-28916](https://insights.sbomify.com/CVE-2024-28916/): Xbox Gaming Services Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2024-28915](https://insights.sbomify.com/CVE-2024-28915/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28914](https://insights.sbomify.com/CVE-2024-28914/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28913](https://insights.sbomify.com/CVE-2024-28913/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28912](https://insights.sbomify.com/CVE-2024-28912/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28911](https://insights.sbomify.com/CVE-2024-28911/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28910](https://insights.sbomify.com/CVE-2024-28910/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-2891](https://insights.sbomify.com/CVE-2024-2891/): Tenda AC7 QuickIndex formQuickIndex stack-based overflow (high 8.8)
- [CVE-2024-28909](https://insights.sbomify.com/CVE-2024-28909/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28908](https://insights.sbomify.com/CVE-2024-28908/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28907](https://insights.sbomify.com/CVE-2024-28907/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-28906](https://insights.sbomify.com/CVE-2024-28906/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-28905](https://insights.sbomify.com/CVE-2024-28905/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-28904](https://insights.sbomify.com/CVE-2024-28904/): Microsoft Brokering File System Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-28903](https://insights.sbomify.com/CVE-2024-28903/): Secure Boot Security Feature Bypass Vulnerability (medium 6.7)
- [CVE-2024-28902](https://insights.sbomify.com/CVE-2024-28902/): Windows Remote Access Connection Manager Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-28901](https://insights.sbomify.com/CVE-2024-28901/): Windows Remote Access Connection Manager Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-28900](https://insights.sbomify.com/CVE-2024-28900/): Windows Remote Access Connection Manager Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-2890](https://insights.sbomify.com/CVE-2024-2890/): WordPress Tumult Hype Animations plugin <= 1.9.12 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-28899](https://insights.sbomify.com/CVE-2024-28899/): Secure Boot Security Feature Bypass Vulnerability (high 8.8)
- [CVE-2024-28898](https://insights.sbomify.com/CVE-2024-28898/): Secure Boot Security Feature Bypass Vulnerability (medium 6.3)
- [CVE-2024-28897](https://insights.sbomify.com/CVE-2024-28897/): Secure Boot Security Feature Bypass Vulnerability (medium 6.8)
- [CVE-2024-28896](https://insights.sbomify.com/CVE-2024-28896/): Secure Boot Security Feature Bypass Vulnerability (high 7.5)
- [CVE-2024-28895](https://insights.sbomify.com/CVE-2024-28895/): Cross-site scripting in 'Yahoo! JAPAN' App for Android (medium 6.1)
- [CVE-2024-28894](https://insights.sbomify.com/CVE-2024-28894/): Memory corruption in Cente IPv6 (medium 5.3)
- [CVE-2024-28893](https://insights.sbomify.com/CVE-2024-28893/): Code injection in HP software packages (SoftPaqs) (high 7.7)
- [CVE-2024-28892](https://insights.sbomify.com/CVE-2024-28892/): GoCast OS Command Injection vulnerability (critical 9.8)
- [CVE-2024-28891](https://insights.sbomify.com/CVE-2024-28891/): Delta Electronics DIAEnergie SQL injection (high 8.8)
- [CVE-2024-28890](https://insights.sbomify.com/CVE-2024-28890/): File upload in Forminator (medium 5.3)
- [CVE-2024-2889](https://insights.sbomify.com/CVE-2024-2889/): WordPress WP-Lister Lite for Amazon plugin <= 2.6.11 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-28889](https://insights.sbomify.com/CVE-2024-28889/): BIG-IP SSL vulnerability (medium 5.9)
- [CVE-2024-28888](https://insights.sbomify.com/CVE-2024-28888/): Use after free in Foxit Reader (high 8.8)
- [CVE-2024-28887](https://insights.sbomify.com/CVE-2024-28887/): Privilege escalation in Intel(R) IPP software (medium 5.4)
- [CVE-2024-28886](https://insights.sbomify.com/CVE-2024-28886/): Command injection in UTAU (high 8.4)
- [CVE-2024-28885](https://insights.sbomify.com/CVE-2024-28885/): Information disclosure in Intel(R) QAT Engine for OpenSSL software (high 8.2)
- [CVE-2024-28883](https://insights.sbomify.com/CVE-2024-28883/): BIG-IP APM browser network access VPN client vulnerability (high 7.4)
- [CVE-2024-28882](https://insights.sbomify.com/CVE-2024-28882/): Denial of service in OpenVPN (medium 4.3)
- [CVE-2024-28881](https://insights.sbomify.com/CVE-2024-28881/): Privilege escalation in Intel(R) Fortran Compiler Classic software (medium 5.4)
- [CVE-2024-28880](https://insights.sbomify.com/CVE-2024-28880/): Path traversal in MosP kintai kanri (medium 6.5)
- [CVE-2024-2888](https://insights.sbomify.com/CVE-2024-2888/): WordPress Post and Page Builder by BoldGrid plugin <= 1.26.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-28878](https://insights.sbomify.com/CVE-2024-28878/): IOSIX IO-1020 Micro ELD Download of Code Without Integrity Check (critical 9.6)
- [CVE-2024-28877](https://insights.sbomify.com/CVE-2024-28877/): MicroDicom DICOM Viewer Stack-based Buffer Overflow (high 8.7)
- [CVE-2024-28876](https://insights.sbomify.com/CVE-2024-28876/): Privilege escalation in Intel(R) MPI Library software (medium 5.4)
- [CVE-2024-28875](https://insights.sbomify.com/CVE-2024-28875/): Hardcoded credentials in WBR-6012 (high 8.1)
- [CVE-2024-28872](https://insights.sbomify.com/CVE-2024-28872/): Incorrect TLS certificate validation can lead to escalated privileges (high 8.9)
- [CVE-2024-28871](https://insights.sbomify.com/CVE-2024-28871/): Excessive CPU used on malformed traffic (high 7.5)
- [CVE-2024-28870](https://insights.sbomify.com/CVE-2024-28870/): Suricata uses excessive resource use in malformed ssh traffic parsing (high 7.5)
- [CVE-2024-2887](https://insights.sbomify.com/CVE-2024-2887/): Memory corruption in Chrome (high 8.1)
- [CVE-2024-28869](https://insights.sbomify.com/CVE-2024-28869/): Possible denial of service vulnerability with Content-length header in Traefik (high 7.5)
- [CVE-2024-28868](https://insights.sbomify.com/CVE-2024-28868/): Umbraco possible user enumeration vulnerability (low 3.7)
- [CVE-2024-28867](https://insights.sbomify.com/CVE-2024-28867/): Swift Prometheus un-sanitized metric name or labels can be used to take over exported metrics (medium 5.9)
- [CVE-2024-28866](https://insights.sbomify.com/CVE-2024-28866/): GoCD vulnerable to reflected Cross-site Scripting possible on server loading page during start-up (low 3.1)
- [CVE-2024-28865](https://insights.sbomify.com/CVE-2024-28865/): django-wiki denial of service via regular expression (high 7.5)
- [CVE-2024-28864](https://insights.sbomify.com/CVE-2024-28864/): [TagAwareCipher] - Decryption Failure (Regex Match) (low 2.6)
- [CVE-2024-28863](https://insights.sbomify.com/CVE-2024-28863/): node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation (medium 6.5)
- [CVE-2024-28862](https://insights.sbomify.com/CVE-2024-28862/): ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files. (medium 5.3)
- [CVE-2024-28861](https://insights.sbomify.com/CVE-2024-28861/): Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder (critical 9.8)
- [CVE-2024-28860](https://insights.sbomify.com/CVE-2024-28860/): Insecure IPsec transport encryption in Cilium (high 8.0)
- [CVE-2024-2886](https://insights.sbomify.com/CVE-2024-2886/): Use after free in Chrome (high 7.5)
- [CVE-2024-28859](https://insights.sbomify.com/CVE-2024-28859/): Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency (medium 5.0)
- [CVE-2024-28855](https://insights.sbomify.com/CVE-2024-28855/): ZITADEL vulnerable to improper HTML sanitization (high 8.1)
- [CVE-2024-28854](https://insights.sbomify.com/CVE-2024-28854/): Slow loris vulnerability with default configuration in tls-listener (high 7.5)
- [CVE-2024-28853](https://insights.sbomify.com/CVE-2024-28853/): Ampache Stored XSS (low 3.9)
- [CVE-2024-28852](https://insights.sbomify.com/CVE-2024-28852/): Ampache has multiple reflective XSS vulnerabilities (medium 6.1)
- [CVE-2024-28851](https://insights.sbomify.com/CVE-2024-28851/): Elevation of privilege in Snowflake Hive MetaStore Connector Helper script (medium 4.0)
- [CVE-2024-28850](https://insights.sbomify.com/CVE-2024-28850/): WP Crontrol possible RCE when combined with a pre-condition (high 8.2)
- [CVE-2024-2885](https://insights.sbomify.com/CVE-2024-2885/): Use after free in Chrome (high 8.8)
- [CVE-2024-28849](https://insights.sbomify.com/CVE-2024-28849/): Proxy-Authorization header kept across hosts in follow-redirects (medium 6.5)
- [CVE-2024-28848](https://insights.sbomify.com/CVE-2024-28848/): SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata (high 8.8)
- [CVE-2024-28847](https://insights.sbomify.com/CVE-2024-28847/): SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata (high 8.8)
- [CVE-2024-2884](https://insights.sbomify.com/CVE-2024-2884/): Memory corruption in Chrome (medium 6.3)
- [CVE-2024-28836](https://insights.sbomify.com/CVE-2024-28836/): Denial of service in trustedfirmware:mbed tls (medium 5.4)
- [CVE-2024-28835](https://insights.sbomify.com/CVE-2024-28835/): Gnutls: potential crash during chain building/verification (medium 5.0)
- [CVE-2024-28834](https://insights.sbomify.com/CVE-2024-28834/): Gnutls: vulnerable to minerva side-channel information leak (medium 5.3)
- [CVE-2024-28833](https://insights.sbomify.com/CVE-2024-28833/): Missing brute-force protection for two factor authentication (medium 5.9)
- [CVE-2024-28832](https://insights.sbomify.com/CVE-2024-28832/): XSS in Crash Report Page (medium 4.8)
- [CVE-2024-28831](https://insights.sbomify.com/CVE-2024-28831/): XSS in confirmation pop-up (medium 5.4)
- [CVE-2024-28830](https://insights.sbomify.com/CVE-2024-28830/): Automation user secrets written to audit log (low 2.7)
- [CVE-2024-2883](https://insights.sbomify.com/CVE-2024-2883/): Use after free in Chrome (high 7.5)
- [CVE-2024-28829](https://insights.sbomify.com/CVE-2024-28829/): Privilege escalation in mk_informix plugin (medium 5.2)
- [CVE-2024-28828](https://insights.sbomify.com/CVE-2024-28828/): 1-Click compromize via CSRF (high 8.8)
- [CVE-2024-28827](https://insights.sbomify.com/CVE-2024-28827/): Privilege escalation in Windows agent (high 8.8)
- [CVE-2024-28826](https://insights.sbomify.com/CVE-2024-28826/): Unrestricted upload and download paths in check_sftp (high 8.8)
- [CVE-2024-28825](https://insights.sbomify.com/CVE-2024-28825/): Brute-force protection ineffective for some login methods (medium 5.9)
- [CVE-2024-28824](https://insights.sbomify.com/CVE-2024-28824/): Privilege escalation in mk_informix plugin (high 8.8)
- [CVE-2024-28823](https://insights.sbomify.com/CVE-2024-28823/): Amazon AWS aws-js-s3-explorer (aka AWS JavaScript S3 Explorer) 1.0.0 allows XSS via a crafted S3 bucket name to index.html. (medium 6.1)
- [CVE-2024-28820](https://insights.sbomify.com/CVE-2024-28820/): Buffer overflow in the extract_openvpn_cr function in openvpn-cr.c in openvpn-auth-ldap (aka the Three Rings Auth-LDAP plugin for OpenVPN) 2 (medium 6.3)
- [CVE-2024-2882](https://insights.sbomify.com/CVE-2024-2882/): Missing Authorization in SDG Technologies PnPSCADA (critical 9.3)
- [CVE-2024-28818](https://insights.sbomify.com/CVE-2024-28818/): Information disclosure in samsung:exynos 1080 firmware (medium 5.9)
- [CVE-2024-28816](https://insights.sbomify.com/CVE-2024-28816/): Student Information Chatbot a0196ab allows SQL injection via the username to the login function in index.php. (high 7.1)
- [CVE-2024-28815](https://insights.sbomify.com/CVE-2024-28815/): A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive i (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/396/