# Vulnerabilities published in 2024


- [CVE-2024-26194](https://insights.sbomify.com/CVE-2024-26194/): Secure Boot Security Feature Bypass Vulnerability (high 7.4)
- [CVE-2024-26193](https://insights.sbomify.com/CVE-2024-26193/): Azure Migrate Remote Code Execution Vulnerability (medium 6.4)
- [CVE-2024-26192](https://insights.sbomify.com/CVE-2024-26192/): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (high 8.2)
- [CVE-2024-26191](https://insights.sbomify.com/CVE-2024-26191/): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-26190](https://insights.sbomify.com/CVE-2024-26190/): Microsoft QUIC Denial of Service Vulnerability (high 7.5)
- [CVE-2024-2619](https://insights.sbomify.com/CVE-2024-2619/): Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Author+) HTML Injection (medium 5.0)
- [CVE-2024-26189](https://insights.sbomify.com/CVE-2024-26189/): Secure Boot Security Feature Bypass Vulnerability (high 8.0)
- [CVE-2024-26188](https://insights.sbomify.com/CVE-2024-26188/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 4.3)
- [CVE-2024-26186](https://insights.sbomify.com/CVE-2024-26186/): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-26185](https://insights.sbomify.com/CVE-2024-26185/): Windows Compressed Folder Tampering Vulnerability (medium 6.5)
- [CVE-2024-26184](https://insights.sbomify.com/CVE-2024-26184/): Secure Boot Security Feature Bypass Vulnerability (medium 6.8)
- [CVE-2024-26183](https://insights.sbomify.com/CVE-2024-26183/): Windows Kerberos Denial of Service Vulnerability (medium 6.5)
- [CVE-2024-26182](https://insights.sbomify.com/CVE-2024-26182/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-26181](https://insights.sbomify.com/CVE-2024-26181/): Windows Kernel Denial of Service Vulnerability (medium 5.5)
- [CVE-2024-26180](https://insights.sbomify.com/CVE-2024-26180/): Secure Boot Security Feature Bypass Vulnerability (high 8.0)
- [CVE-2024-2618](https://insights.sbomify.com/CVE-2024-2618/): Elementor Header & Footer Builder <= 1.6.26 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-26179](https://insights.sbomify.com/CVE-2024-26179/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-26178](https://insights.sbomify.com/CVE-2024-26178/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-26177](https://insights.sbomify.com/CVE-2024-26177/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-26176](https://insights.sbomify.com/CVE-2024-26176/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-26175](https://insights.sbomify.com/CVE-2024-26175/): Secure Boot Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2024-26174](https://insights.sbomify.com/CVE-2024-26174/): Windows Kernel Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-26173](https://insights.sbomify.com/CVE-2024-26173/): Windows Kernel Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-26172](https://insights.sbomify.com/CVE-2024-26172/): Windows DWM Core Library Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-26171](https://insights.sbomify.com/CVE-2024-26171/): Secure Boot Security Feature Bypass Vulnerability (medium 6.7)
- [CVE-2024-26170](https://insights.sbomify.com/CVE-2024-26170/): Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-2617](https://insights.sbomify.com/CVE-2024-2617/): Security feature bypass in RTU500 series CMU firmware (high 7.2)
- [CVE-2024-26169](https://insights.sbomify.com/CVE-2024-26169/): Microsoft Windows Error Reporting Service Improper Privilege Management (high 7.8, exploited in the wild)
- [CVE-2024-26168](https://insights.sbomify.com/CVE-2024-26168/): Secure Boot Security Feature Bypass Vulnerability (medium 6.8)
- [CVE-2024-26167](https://insights.sbomify.com/CVE-2024-26167/): Microsoft Edge for Android Spoofing Vulnerability (medium 4.3)
- [CVE-2024-26166](https://insights.sbomify.com/CVE-2024-26166/): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-26165](https://insights.sbomify.com/CVE-2024-26165/): Visual Studio Code Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2024-26164](https://insights.sbomify.com/CVE-2024-26164/): Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-26163](https://insights.sbomify.com/CVE-2024-26163/): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (medium 4.7)
- [CVE-2024-26162](https://insights.sbomify.com/CVE-2024-26162/): Microsoft ODBC Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-26161](https://insights.sbomify.com/CVE-2024-26161/): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-26160](https://insights.sbomify.com/CVE-2024-26160/): Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-2616](https://insights.sbomify.com/CVE-2024-2616/): Memory corruption in Firefox ESR (low 2.7)
- [CVE-2024-26159](https://insights.sbomify.com/CVE-2024-26159/): Microsoft ODBC Driver Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-26158](https://insights.sbomify.com/CVE-2024-26158/): Microsoft Install Service Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-26157](https://insights.sbomify.com/CVE-2024-26157/): ETIC Telecom Remote Access Server (RAS) Cross-site Scripting (medium 5.3)
- [CVE-2024-26156](https://insights.sbomify.com/CVE-2024-26156/): ETIC Telecom Remote Access Server (RAS) Cross-site Scripting (medium 4.8)
- [CVE-2024-26155](https://insights.sbomify.com/CVE-2024-26155/): ETIC Telecom Remote Access Server (RAS) Cleartext Transmission of Sensitive Information (medium 6.1)
- [CVE-2024-26154](https://insights.sbomify.com/CVE-2024-26154/): ETIC Telecom Remote Access Server (RAS) Cross-site Scripting (medium 4.8)
- [CVE-2024-26153](https://insights.sbomify.com/CVE-2024-26153/): ETIC Telecom Remote Access Server (RAS) Cross-Site Request Forgery (medium 6.3)
- [CVE-2024-26152](https://insights.sbomify.com/CVE-2024-26152/): Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config (medium 4.7)
- [CVE-2024-26151](https://insights.sbomify.com/CVE-2024-26151/): Potentially untrusted input is rendered as HTML in final output (high 8.2)
- [CVE-2024-26150](https://insights.sbomify.com/CVE-2024-26150/): `@backstage/backend-common` vulnerable to path traversal through symlinks (high 8.7)
- [CVE-2024-2615](https://insights.sbomify.com/CVE-2024-2615/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-26149](https://insights.sbomify.com/CVE-2024-26149/): Vyper _abi_decode Memory Overflow (low 3.7)
- [CVE-2024-26148](https://insights.sbomify.com/CVE-2024-26148/): Querybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevation (medium 6.1)
- [CVE-2024-26147](https://insights.sbomify.com/CVE-2024-26147/): Helm's Missing YAML Content Leads To Panic (high 7.5)
- [CVE-2024-26146](https://insights.sbomify.com/CVE-2024-26146/): Possible Denial of Service Vulnerability in Rack Header Parsing (medium 5.3)
- [CVE-2024-26145](https://insights.sbomify.com/CVE-2024-26145/): Uninvited user is able to join and mark the attendance of the the private event (medium 6.5)
- [CVE-2024-26144](https://insights.sbomify.com/CVE-2024-26144/): Possible Sensitive Session Information Leak in Active Storage (medium 5.3)
- [CVE-2024-26143](https://insights.sbomify.com/CVE-2024-26143/): Rails Possible XSS Vulnerability in Action Controller (medium 6.1)
- [CVE-2024-26142](https://insights.sbomify.com/CVE-2024-26142/): Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch (high 7.5)
- [CVE-2024-26141](https://insights.sbomify.com/CVE-2024-26141/): Possible DoS Vulnerability with Range Header in Rack (medium 5.8)
- [CVE-2024-26140](https://insights.sbomify.com/CVE-2024-26140/): com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browser (medium 4.6)
- [CVE-2024-2614](https://insights.sbomify.com/CVE-2024-2614/): Memory corruption in Firefox (high 8.8)
- [CVE-2024-26139](https://insights.sbomify.com/CVE-2024-26139/): OpenCTI Authenticated Privilege Escalation (high 8.3)
- [CVE-2024-26138](https://insights.sbomify.com/CVE-2024-26138/): License information is public, exposing instance id and license holder details (medium 5.3)
- [CVE-2024-26136](https://insights.sbomify.com/CVE-2024-26136/): kedi ElectronCord's Discord Token is public (high 7.5)
- [CVE-2024-26135](https://insights.sbomify.com/CVE-2024-26135/): MeshCentral cross-site websocket hijacking (CSWSH) vulnerability (high 8.4)
- [CVE-2024-26134](https://insights.sbomify.com/CVE-2024-26134/): CBOR2 decoder has potential buffer overflow (high 7.5)
- [CVE-2024-26133](https://insights.sbomify.com/CVE-2024-26133/): EventStoreDB Projections Subsystem has potential password leak (medium 5.5)
- [CVE-2024-26132](https://insights.sbomify.com/CVE-2024-26132/): Element Android can be asked to share internal files. (medium 4.0)
- [CVE-2024-26131](https://insights.sbomify.com/CVE-2024-26131/): Element Android Intent Redirection (high 8.4)
- [CVE-2024-26130](https://insights.sbomify.com/CVE-2024-26130/): cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override (high 7.5)
- [CVE-2024-2613](https://insights.sbomify.com/CVE-2024-2613/): Denial of service in Firefox (high 7.5)
- [CVE-2024-26129](https://insights.sbomify.com/CVE-2024-26129/): Prestashop vulnerable to path disclosure in JavaScript variable (medium 5.8)
- [CVE-2024-26128](https://insights.sbomify.com/CVE-2024-26128/): baserCMS Cross-site Scripting vulnerability in Content Management (medium 5.4)
- [CVE-2024-26127](https://insights.sbomify.com/CVE-2024-26127/): Adobe Experience Manager | Improper Input Validation (CWE-20) (low 3.5)
- [CVE-2024-26126](https://insights.sbomify.com/CVE-2024-26126/): Adobe Experience Manager | Improper Input Validation (CWE-20) (low 3.5)
- [CVE-2024-26125](https://insights.sbomify.com/CVE-2024-26125/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26124](https://insights.sbomify.com/CVE-2024-26124/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26123](https://insights.sbomify.com/CVE-2024-26123/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26122](https://insights.sbomify.com/CVE-2024-26122/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26121](https://insights.sbomify.com/CVE-2024-26121/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26120](https://insights.sbomify.com/CVE-2024-26120/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-2612](https://insights.sbomify.com/CVE-2024-2612/): Use after free in Firefox (high 8.1)
- [CVE-2024-26119](https://insights.sbomify.com/CVE-2024-26119/): Adobe Experience Manager | Information Exposure (CWE-200) (medium 5.3)
- [CVE-2024-26118](https://insights.sbomify.com/CVE-2024-26118/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26117](https://insights.sbomify.com/CVE-2024-26117/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26116](https://insights.sbomify.com/CVE-2024-26116/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26115](https://insights.sbomify.com/CVE-2024-26115/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26114](https://insights.sbomify.com/CVE-2024-26114/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26113](https://insights.sbomify.com/CVE-2024-26113/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26111](https://insights.sbomify.com/CVE-2024-26111/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26110](https://insights.sbomify.com/CVE-2024-26110/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)
- [CVE-2024-2611](https://insights.sbomify.com/CVE-2024-2611/): Security feature bypass in Firefox (medium 5.5)
- [CVE-2024-26107](https://insights.sbomify.com/CVE-2024-26107/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26106](https://insights.sbomify.com/CVE-2024-26106/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26105](https://insights.sbomify.com/CVE-2024-26105/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26104](https://insights.sbomify.com/CVE-2024-26104/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26103](https://insights.sbomify.com/CVE-2024-26103/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26102](https://insights.sbomify.com/CVE-2024-26102/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-26101](https://insights.sbomify.com/CVE-2024-26101/): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (medium 5.4)
- [CVE-2024-2610](https://insights.sbomify.com/CVE-2024-2610/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2024-26098](https://insights.sbomify.com/CVE-2024-26098/): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/417/