# Vulnerabilities published in 2024


- [CVE-2024-27335](https://insights.sbomify.com/CVE-2024-27335/): Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-27334](https://insights.sbomify.com/CVE-2024-27334/): Kofax Power PDF JPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-27333](https://insights.sbomify.com/CVE-2024-27333/): Kofax Power PDF GIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-27332](https://insights.sbomify.com/CVE-2024-27332/): PDF-XChange Editor JPG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-27331](https://insights.sbomify.com/CVE-2024-27331/): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-27330](https://insights.sbomify.com/CVE-2024-27330/): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-2733](https://insights.sbomify.com/CVE-2024-2733/): Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Separator Element (medium 5.4)
- [CVE-2024-27329](https://insights.sbomify.com/CVE-2024-27329/): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-27328](https://insights.sbomify.com/CVE-2024-27328/): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-27327](https://insights.sbomify.com/CVE-2024-27327/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-27326](https://insights.sbomify.com/CVE-2024-27326/): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-27325](https://insights.sbomify.com/CVE-2024-27325/): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-27324](https://insights.sbomify.com/CVE-2024-27324/): PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-27323](https://insights.sbomify.com/CVE-2024-27323/): PDF-XChange Editor Updater Improper Certificate Validation Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-27322](https://insights.sbomify.com/CVE-2024-27322/): Deserialization in R (high 8.8)
- [CVE-2024-27321](https://insights.sbomify.com/CVE-2024-27321/): Refuel Autolab Eval Injection vulnerability (high 7.8)
- [CVE-2024-27320](https://insights.sbomify.com/CVE-2024-27320/): Refuel Autolab Eval Injection vulnerability (high 7.8)
- [CVE-2024-2732](https://insights.sbomify.com/CVE-2024-2732/): Themify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-27319](https://insights.sbomify.com/CVE-2024-27319/): Onnx Out-of-bounds Read vulnerability (medium 4.4)
- [CVE-2024-27318](https://insights.sbomify.com/CVE-2024-27318/): Onnx Directory Traversal vulnerability (high 7.5)
- [CVE-2024-27317](https://insights.sbomify.com/CVE-2024-27317/): Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification (high 8.4)
- [CVE-2024-27316](https://insights.sbomify.com/CVE-2024-27316/): Apache HTTP Server: HTTP/2 DoS by memory exhaustion on endless continuation frames (high 7.5)
- [CVE-2024-27315](https://insights.sbomify.com/CVE-2024-27315/): Apache Superset: Improper error handling on alerts (medium 4.3)
- [CVE-2024-27314](https://insights.sbomify.com/CVE-2024-27314/): Stored XSS Vulnerability (low 2.4)
- [CVE-2024-27313](https://insights.sbomify.com/CVE-2024-27313/): XSS Vulnerability (medium 6.3)
- [CVE-2024-27312](https://insights.sbomify.com/CVE-2024-27312/): Authorization vulnerability in PAM360 (high 8.1)
- [CVE-2024-27311](https://insights.sbomify.com/CVE-2024-27311/): Arbitrary file writing (medium 5.5)
- [CVE-2024-27310](https://insights.sbomify.com/CVE-2024-27310/): DOS Vulnerability (medium 5.3)
- [CVE-2024-2731](https://insights.sbomify.com/CVE-2024-2731/): Improper Access Control Issues Lead to Sensitive Data Exposure in Mautic (medium 5.4)
- [CVE-2024-27309](https://insights.sbomify.com/CVE-2024-27309/): Apache Kafka: Potential incorrect access control during migration from ZK mode to KRaft mode (high 7.4)
- [CVE-2024-27308](https://insights.sbomify.com/CVE-2024-27308/): Mio's tokens for named pipes may be delivered after deregistration (high 7.5)
- [CVE-2024-27307](https://insights.sbomify.com/CVE-2024-27307/): JSONata expression can pollute the "Object" prototype (critical 9.8)
- [CVE-2024-27306](https://insights.sbomify.com/CVE-2024-27306/): aiohttp vulnerable to XSS on index pages for static file handling (medium 6.1)
- [CVE-2024-27305](https://insights.sbomify.com/CVE-2024-27305/): SMTP smuggling in aiosmtpd (medium 5.3)
- [CVE-2024-27304](https://insights.sbomify.com/CVE-2024-27304/): pgx SQL Injection via Protocol Message Size Overflow (critical 9.8)
- [CVE-2024-27303](https://insights.sbomify.com/CVE-2024-27303/): electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only) (high 7.3)
- [CVE-2024-27302](https://insights.sbomify.com/CVE-2024-27302/): Authorization Bypass Through User-Controlled Key in go-zero (critical 9.1)
- [CVE-2024-27301](https://insights.sbomify.com/CVE-2024-27301/): Privilege Escalation Abusing installer in SupportApp (high 7.3)
- [CVE-2024-27300](https://insights.sbomify.com/CVE-2024-27300/): phpMyFAQ Stored XSS at user email (medium 5.5)
- [CVE-2024-2730](https://insights.sbomify.com/CVE-2024-2730/): Predictable Page Indexing Might Lead to Sensitive Data Exposure in Mautic (medium 5.3)
- [CVE-2024-27299](https://insights.sbomify.com/CVE-2024-27299/): phpMyFAQ SQL Injection at "Save News" (high 8.8)
- [CVE-2024-27298](https://insights.sbomify.com/CVE-2024-27298/): Parse Server literalizeRegexPart SQL Injection (critical 10.0)
- [CVE-2024-27297](https://insights.sbomify.com/CVE-2024-27297/): Nix Corruption of fixed-output derivations (medium 6.3)
- [CVE-2024-27296](https://insights.sbomify.com/CVE-2024-27296/): Directus version number disclosure (medium 5.3)
- [CVE-2024-27295](https://insights.sbomify.com/CVE-2024-27295/): Directus MySQL accent insensitive email matching (high 8.2)
- [CVE-2024-27294](https://insights.sbomify.com/CVE-2024-27294/): dp-golang Go installation could be owned by wrong user (high 7.3)
- [CVE-2024-27292](https://insights.sbomify.com/CVE-2024-27292/): Docassemble unauthorized access through URL manipulation (high 7.5)
- [CVE-2024-27291](https://insights.sbomify.com/CVE-2024-27291/): Docassemble open redirect (medium 6.1)
- [CVE-2024-27290](https://insights.sbomify.com/CVE-2024-27290/): Docassemble HTML and javascript injection (medium 6.1)
- [CVE-2024-2729](https://insights.sbomify.com/CVE-2024-2729/): Otter Blocks < 2.6.6 - Contributor+ Stored XSS (medium 6.1)
- [CVE-2024-27289](https://insights.sbomify.com/CVE-2024-27289/): pgx SQL Injection via Line Comment Creation (high 8.1)
- [CVE-2024-27288](https://insights.sbomify.com/CVE-2024-27288/): 1Panel open source panel project has an unauthorized vulnerability. (medium 6.3)
- [CVE-2024-27287](https://insights.sbomify.com/CVE-2024-27287/): ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API (medium 6.5)
- [CVE-2024-27286](https://insights.sbomify.com/CVE-2024-27286/): Moving single messages from public to private streams leaves them accessible (medium 6.5)
- [CVE-2024-27285](https://insights.sbomify.com/CVE-2024-27285/): YARD's default template vulnerable to Cross-site Scripting in generated frames.html (medium 5.4)
- [CVE-2024-27284](https://insights.sbomify.com/CVE-2024-27284/): cassandra-rs non-idiomatic use of iterators leads to use after free (high 7.5)
- [CVE-2024-27283](https://insights.sbomify.com/CVE-2024-27283/): File upload in veritas:ediscovery platform (high 7.2)
- [CVE-2024-27282](https://insights.sbomify.com/CVE-2024-27282/): An issue was discovered in Ruby 3.x through 3.3.0. (medium 6.6)
- [CVE-2024-27281](https://insights.sbomify.com/CVE-2024-27281/): RDoc RCE vulnerability with .rdoc_options (medium 4.5)
- [CVE-2024-27280](https://insights.sbomify.com/CVE-2024-27280/): StringIO buffer overread vulnerability (critical 9.8)
- [CVE-2024-2728](https://insights.sbomify.com/CVE-2024-2728/): Information exposure vulnerability in the CIGESv2 system (medium 4.1)
- [CVE-2024-27279](https://insights.sbomify.com/CVE-2024-27279/): Path traversal in a-blog cms (medium 6.5)
- [CVE-2024-27278](https://insights.sbomify.com/CVE-2024-27278/): Cross-site scripting in OpenPNE Plugin "opTimelinePlugin" (medium 5.4)
- [CVE-2024-27277](https://insights.sbomify.com/CVE-2024-27277/): IBM Storage Protect Plus Server information disclosure (medium 6.2)
- [CVE-2024-27275](https://insights.sbomify.com/CVE-2024-27275/): IBM i privilege escalation (high 7.4)
- [CVE-2024-27273](https://insights.sbomify.com/CVE-2024-27273/): IBM AIX privilege escalation (high 8.1)
- [CVE-2024-27270](https://insights.sbomify.com/CVE-2024-27270/): IBM WebSphere Application Server Liberty cross-site scripting (medium 4.7)
- [CVE-2024-2727](https://insights.sbomify.com/CVE-2024-2727/): Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system (medium 6.1)
- [CVE-2024-27269](https://insights.sbomify.com/CVE-2024-27269/): IBM QRadar SIEM information disclosure (medium 6.8)
- [CVE-2024-27268](https://insights.sbomify.com/CVE-2024-27268/): IBM WebSphere Application Server Liberty denial of service (medium 5.9)
- [CVE-2024-27267](https://insights.sbomify.com/CVE-2024-27267/): IBM SDK, Java Technology Edition denial of service (medium 5.9)
- [CVE-2024-27266](https://insights.sbomify.com/CVE-2024-27266/): IBM Maximo Application Suite XML external entity injection (high 8.2)
- [CVE-2024-27265](https://insights.sbomify.com/CVE-2024-27265/): IBM Integration Bus for z/OS cross-site request forgery (medium 4.5)
- [CVE-2024-27264](https://insights.sbomify.com/CVE-2024-27264/): IBM Performance Tools for i privilege escalation (high 7.4)
- [CVE-2024-27263](https://insights.sbomify.com/CVE-2024-27263/): IBM Sterling B2B Integrator information disclosure (medium 5.3)
- [CVE-2024-27261](https://insights.sbomify.com/CVE-2024-27261/): IBM Storage Defender - Resiliency Service privilege escalation (medium 6.4)
- [CVE-2024-27260](https://insights.sbomify.com/CVE-2024-27260/): IBM AIX command execution (high 8.4)
- [CVE-2024-2726](https://insights.sbomify.com/CVE-2024-2726/): Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system (medium 6.1)
- [CVE-2024-27257](https://insights.sbomify.com/CVE-2024-27257/): IBM OpenPages information disclosure (medium 4.3)
- [CVE-2024-27256](https://insights.sbomify.com/CVE-2024-27256/): IBM MQ Operator information disclosure (medium 5.9)
- [CVE-2024-27255](https://insights.sbomify.com/CVE-2024-27255/): IBM MQ Container information disclosure (medium 5.9)
- [CVE-2024-27254](https://insights.sbomify.com/CVE-2024-27254/): IBM Db2 for Linux, UNIX and Windows denial of service (medium 5.3)
- [CVE-2024-27253](https://insights.sbomify.com/CVE-2024-27253/): IBM Engineering Requirements Management DOORS Next is impacted by vulnerability in Reviews delete request (critical 10.0)
- [CVE-2024-2725](https://insights.sbomify.com/CVE-2024-2725/): Exposure of Sensitive Information vulnerability in the CIGESv2 system (high 7.5)
- [CVE-2024-27247](https://insights.sbomify.com/CVE-2024-27247/): Zoom Desktop Client for macOS - Improper Privilege Management (medium 5.5)
- [CVE-2024-27246](https://insights.sbomify.com/CVE-2024-27246/): Zoom Workplace Apps and SDKs - Use After Free (medium 4.3)
- [CVE-2024-27245](https://insights.sbomify.com/CVE-2024-27245/): Zoom Workplace Apps and SDKs - Buffer Overflow (medium 4.3)
- [CVE-2024-27244](https://insights.sbomify.com/CVE-2024-27244/): Zoom Workplace VDI App for Windows - Insufficient Verification of Data Authenticity (medium 6.7)
- [CVE-2024-27243](https://insights.sbomify.com/CVE-2024-27243/): Zoom Apps - Buffer Overflow (medium 6.5)
- [CVE-2024-27242](https://insights.sbomify.com/CVE-2024-27242/): Zoom Desktop Client for Linux - Cross Site Scripting (medium 4.1)
- [CVE-2024-27241](https://insights.sbomify.com/CVE-2024-27241/): Zoom Apps and SDKs - Improper Input Validation (medium 5.3)
- [CVE-2024-27240](https://insights.sbomify.com/CVE-2024-27240/): Zoom Apps for Windows - Improper Input Validation (high 7.1)
- [CVE-2024-2724](https://insights.sbomify.com/CVE-2024-2724/): SQL injection vulnerability in the CIGESv2 system (critical 9.8)
- [CVE-2024-27239](https://insights.sbomify.com/CVE-2024-27239/): Zoom Workplace Apps and SDKs - Divide By Zero (medium 4.3)
- [CVE-2024-27238](https://insights.sbomify.com/CVE-2024-27238/): Zoom Apps and SDKs - Race Condition (high 7.1)
- [CVE-2024-27237](https://insights.sbomify.com/CVE-2024-27237/): Information disclosure in Android (medium 5.5)
- [CVE-2024-27236](https://insights.sbomify.com/CVE-2024-27236/): Memory corruption in Android (high 8.4)
- [CVE-2024-27235](https://insights.sbomify.com/CVE-2024-27235/): Memory corruption in Android (medium 5.5)
- [CVE-2024-27234](https://insights.sbomify.com/CVE-2024-27234/): Memory corruption in Android (medium 5.9)
- [CVE-2024-27233](https://insights.sbomify.com/CVE-2024-27233/): Privilege escalation in Android (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/407/