# Vulnerabilities published in 2024


- [CVE-2024-25004](https://insights.sbomify.com/CVE-2024-25004/): Memory corruption in 9bis:kitty (high 7.8)
- [CVE-2024-25003](https://insights.sbomify.com/CVE-2024-25003/): Memory corruption in 9bis:kitty (high 7.8)
- [CVE-2024-25002](https://insights.sbomify.com/CVE-2024-25002/): Command injection in Network Synchronizer Enterprise (high 8.8)
- [CVE-2024-25000](https://insights.sbomify.com/CVE-2024-25000/): Path traversal in Avalanche (high 8.8)
- [CVE-2024-2500](https://insights.sbomify.com/CVE-2024-2500/): ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name (medium 6.4)
- [CVE-2024-24999](https://insights.sbomify.com/CVE-2024-24999/): Path traversal in Avlanche (high 8.8)
- [CVE-2024-24998](https://insights.sbomify.com/CVE-2024-24998/): Path traversal in Avalanche (high 8.8)
- [CVE-2024-24997](https://insights.sbomify.com/CVE-2024-24997/): Path traversal in Avalanche (high 8.8)
- [CVE-2024-24996](https://insights.sbomify.com/CVE-2024-24996/): Memory corruption in Avalanche (critical 9.8)
- [CVE-2024-24995](https://insights.sbomify.com/CVE-2024-24995/): Race condition in Avalanche (high 8.8)
- [CVE-2024-24994](https://insights.sbomify.com/CVE-2024-24994/): Path traversal in Avalanche (high 8.8)
- [CVE-2024-24993](https://insights.sbomify.com/CVE-2024-24993/): Race condition in Avalanche (high 8.8)
- [CVE-2024-24992](https://insights.sbomify.com/CVE-2024-24992/): Path traversal in Avalanche (high 8.8)
- [CVE-2024-24991](https://insights.sbomify.com/CVE-2024-24991/): Null dereference in Avalanche (medium 6.5)
- [CVE-2024-24990](https://insights.sbomify.com/CVE-2024-24990/): NGINX HTTP/3 QUIC vulnerability (high 7.5)
- [CVE-2024-2499](https://insights.sbomify.com/CVE-2024-2499/): Cross-site scripting in Squelch Tabs and Accordions Shortcodes (medium 6.4)
- [CVE-2024-24989](https://insights.sbomify.com/CVE-2024-24989/): NGINX HTTP/3 QUIC vulnerability (high 7.5)
- [CVE-2024-24988](https://insights.sbomify.com/CVE-2024-24988/): Excessive resource consumption when sending long emoji names in user custom status (medium 4.3)
- [CVE-2024-24986](https://insights.sbomify.com/CVE-2024-24986/): Privilege escalation in Intel(R) Ethernet Network Controllers and Adapters (critical 9.3)
- [CVE-2024-24985](https://insights.sbomify.com/CVE-2024-24985/): Privilege escalation in Intel(R) processors with Intel(R) ACTM (high 8.5)
- [CVE-2024-24984](https://insights.sbomify.com/CVE-2024-24984/): Denial of service in Intel(R) Wireless Bluetooth(R) products for Windows (medium 6.8)
- [CVE-2024-24983](https://insights.sbomify.com/CVE-2024-24983/): Security feature bypass in Intel(R) Ethernet Network Controllers and Adapters E810 Series (high 7.0)
- [CVE-2024-24981](https://insights.sbomify.com/CVE-2024-24981/): Privilege escalation in UEFI firmware for some Intel(R) Server M50FCP Family products (high 7.5)
- [CVE-2024-24980](https://insights.sbomify.com/CVE-2024-24980/): Security feature bypass in 3rd, 4th, and 5th Generation Intel(R) Xeon(R) Processors (medium 6.9)
- [CVE-2024-24978](https://insights.sbomify.com/CVE-2024-24978/): Denial of service in TvRock (medium 4.3)
- [CVE-2024-24977](https://insights.sbomify.com/CVE-2024-24977/): Privilege escalation in Intel(R) License Manager for FLEXlm product software (medium 5.4)
- [CVE-2024-24976](https://insights.sbomify.com/CVE-2024-24976/): Denial of service in OAS Platform (medium 4.9)
- [CVE-2024-24975](https://insights.sbomify.com/CVE-2024-24975/): Denial of Service for mobile app users due to automatic code highlighting (low 3.5)
- [CVE-2024-24974](https://insights.sbomify.com/CVE-2024-24974/): Missing authorization in OpenVPN 2 (high 7.5)
- [CVE-2024-24973](https://insights.sbomify.com/CVE-2024-24973/): Denial of service in Intel(R) Distribution for GDB software (low 1.0)
- [CVE-2024-24972](https://insights.sbomify.com/CVE-2024-24972/): Memory corruption in Controller 6000 and Controller 7000 (medium 6.5)
- [CVE-2024-24970](https://insights.sbomify.com/CVE-2024-24970/): Privilege escalation in HP Display Control (medium 6.5)
- [CVE-2024-2497](https://insights.sbomify.com/CVE-2024-2497/): RaspAP raspap-webgui HTTP POST Request provider.php code injection (medium 4.7)
- [CVE-2024-24968](https://insights.sbomify.com/CVE-2024-24968/): Denial of service in Intel(R) Processors (medium 5.6)
- [CVE-2024-24966](https://insights.sbomify.com/CVE-2024-24966/): F5OS vulnerability (medium 6.2)
- [CVE-2024-24964](https://insights.sbomify.com/CVE-2024-24964/): Privilege escalation in SKYSEA Client View (medium 6.3)
- [CVE-2024-24963](https://insights.sbomify.com/CVE-2024-24963/): Memory corruption in P3-550E (critical 9.8)
- [CVE-2024-24962](https://insights.sbomify.com/CVE-2024-24962/): Memory corruption in P3-550E (critical 9.8)
- [CVE-2024-2496](https://insights.sbomify.com/CVE-2024-2496/): Libvirt: null pointer dereference in udevconnectlistallinterfaces() (medium 5.0)
- [CVE-2024-24959](https://insights.sbomify.com/CVE-2024-24959/): Memory corruption in P3-550E (high 8.2)
- [CVE-2024-24958](https://insights.sbomify.com/CVE-2024-24958/): Memory corruption in P3-550E (high 8.2)
- [CVE-2024-24957](https://insights.sbomify.com/CVE-2024-24957/): Memory corruption in P3-550E (high 8.2)
- [CVE-2024-24956](https://insights.sbomify.com/CVE-2024-24956/): Memory corruption in P3-550E (high 8.2)
- [CVE-2024-24955](https://insights.sbomify.com/CVE-2024-24955/): Memory corruption in P3-550E (high 8.2)
- [CVE-2024-24954](https://insights.sbomify.com/CVE-2024-24954/): Memory corruption in P3-550E (high 8.2)
- [CVE-2024-2495](https://insights.sbomify.com/CVE-2024-2495/): Cryptographic key in plain text vulnerability in FriendlyElec's FriendlyWrt (medium 5.2)
- [CVE-2024-24947](https://insights.sbomify.com/CVE-2024-24947/): Memory corruption in P3-550E (high 8.2)
- [CVE-2024-24946](https://insights.sbomify.com/CVE-2024-24946/): Memory corruption in P3-550E (high 8.2)
- [CVE-2024-24945](https://insights.sbomify.com/CVE-2024-24945/): Cross-site scripting in remyandrade:travel journal using php and mysql with source code (medium 6.1)
- [CVE-2024-24943](https://insights.sbomify.com/CVE-2024-24943/): Denial of service in Toolbox App (medium 5.3)
- [CVE-2024-24942](https://insights.sbomify.com/CVE-2024-24942/): Path traversal in TeamCity (medium 5.3)
- [CVE-2024-24941](https://insights.sbomify.com/CVE-2024-24941/): Information disclosure in IntelliJ IDEA (medium 6.1)
- [CVE-2024-24940](https://insights.sbomify.com/CVE-2024-24940/): Path traversal in IntelliJ IDEA (low 2.8)
- [CVE-2024-2494](https://insights.sbomify.com/CVE-2024-2494/): Libvirt: negative g_new0 length can lead to unbounded memory allocation (medium 6.2)
- [CVE-2024-24939](https://insights.sbomify.com/CVE-2024-24939/): Information disclosure in Rider (low 3.3)
- [CVE-2024-24938](https://insights.sbomify.com/CVE-2024-24938/): Path traversal in TeamCity (medium 5.3)
- [CVE-2024-24937](https://insights.sbomify.com/CVE-2024-24937/): Cross-site scripting in TeamCity (medium 4.6)
- [CVE-2024-24936](https://insights.sbomify.com/CVE-2024-24936/): Missing authorization in TeamCity (medium 4.3)
- [CVE-2024-24935](https://insights.sbomify.com/CVE-2024-24935/): WordPress Basic Log Viewer Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-24934](https://insights.sbomify.com/CVE-2024-24934/): WordPress Elementor plugin <= 3.19.0 - Arbitrary File Deletion and Phar Deserialization vulnerability (high 8.5)
- [CVE-2024-24933](https://insights.sbomify.com/CVE-2024-24933/): WordPress Honeypot for WP Comment Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24932](https://insights.sbomify.com/CVE-2024-24932/): WordPress VK Poster Group Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24931](https://insights.sbomify.com/CVE-2024-24931/): WordPress Before After Image Slider WP Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-24930](https://insights.sbomify.com/CVE-2024-24930/): WordPress Buttons Shortcode and Widget Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-2493](https://insights.sbomify.com/CVE-2024-2493/): Session Hijacking Vulnerability in Hitachi Ops Center Analyzer (high 7.5)
- [CVE-2024-24929](https://insights.sbomify.com/CVE-2024-24929/): WordPress WP Contact Form Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-24928](https://insights.sbomify.com/CVE-2024-24928/): WordPress Content Cards Plugin <= 0.9.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-24927](https://insights.sbomify.com/CVE-2024-24927/): WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24926](https://insights.sbomify.com/CVE-2024-24926/): WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection (high 7.5)
- [CVE-2024-24925](https://insights.sbomify.com/CVE-2024-24925/): Memory corruption in Simcenter Femap (high 7.8)
- [CVE-2024-24924](https://insights.sbomify.com/CVE-2024-24924/): Memory corruption in Simcenter Femap (high 7.8)
- [CVE-2024-24923](https://insights.sbomify.com/CVE-2024-24923/): Memory corruption in Simcenter Femap (high 7.8)
- [CVE-2024-24922](https://insights.sbomify.com/CVE-2024-24922/): Memory corruption in Simcenter Femap (high 7.8)
- [CVE-2024-24921](https://insights.sbomify.com/CVE-2024-24921/): Memory corruption in Simcenter Femap (high 7.8)
- [CVE-2024-24920](https://insights.sbomify.com/CVE-2024-24920/): Memory corruption in Simcenter Femap (high 7.8)
- [CVE-2024-2492](https://insights.sbomify.com/CVE-2024-2492/): Cross-site scripting in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (medium 6.4)
- [CVE-2024-24919](https://insights.sbomify.com/CVE-2024-24919/): Check Point Quantum Security Gateways Information Disclosure (high 8.6, exploited in the wild)
- [CVE-2024-24916](https://insights.sbomify.com/CVE-2024-24916/): DLL-HiJacking (medium 6.5)
- [CVE-2024-24915](https://insights.sbomify.com/CVE-2024-24915/): SmartConsole Sensitive Credential Exposure via Memory Dump (medium 6.1)
- [CVE-2024-24914](https://insights.sbomify.com/CVE-2024-24914/): Code injection in ClusterXL, Multi-Domain Security Management, Quantum Appliances, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, Quantum Security Management (high 8.0)
- [CVE-2024-24912](https://insights.sbomify.com/CVE-2024-24912/): Local privilege escalation in Harmony Endpoint Security Client for Windows via crafted DLL file (medium 6.7)
- [CVE-2024-24911](https://insights.sbomify.com/CVE-2024-24911/): Out of Bounds read in the CPCA process on Check Point Management Server (medium 5.3)
- [CVE-2024-24910](https://insights.sbomify.com/CVE-2024-24910/): Privilege escalation in ZoneAlarmExtremeSecurityNextGen,IdentityAgentforWindows,IdentityAgentforWindowsTerminalServer (high 7.3)
- [CVE-2024-2491](https://insights.sbomify.com/CVE-2024-2491/): PowerPack Addons for Elementor <= 2.7.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via *_html_tag* (medium 6.4)
- [CVE-2024-24909](https://insights.sbomify.com/CVE-2024-24909/): Command injection in OpenManage (high 8.8)
- [CVE-2024-24908](https://insights.sbomify.com/CVE-2024-24908/): Path traversal in Data Manager Appliance Software (DMAS) (medium 6.5)
- [CVE-2024-24907](https://insights.sbomify.com/CVE-2024-24907/): Cross-site scripting in Secure Connect Gateway (SCG) Policy Manager (high 7.6)
- [CVE-2024-24906](https://insights.sbomify.com/CVE-2024-24906/): Cross-site scripting in Secure Connect Gateway (SCG) Policy Manager (high 7.6)
- [CVE-2024-24905](https://insights.sbomify.com/CVE-2024-24905/): Cross-site scripting in Secure Connect Gateway (SCG) Policy Manager (high 7.6)
- [CVE-2024-24904](https://insights.sbomify.com/CVE-2024-24904/): Cross-site scripting in Secure Connect Gateway (SCG) Policy Manager (high 7.6)
- [CVE-2024-24903](https://insights.sbomify.com/CVE-2024-24903/): Auth bypass in Secure Connect Gateway (SCG) Policy Manager (high 8.0)
- [CVE-2024-24902](https://insights.sbomify.com/CVE-2024-24902/): Missing authorization in RecoverPoint for Virtual Machines (medium 6.6)
- [CVE-2024-24901](https://insights.sbomify.com/CVE-2024-24901/): Other in PowerScale OneFS (low 3.0)
- [CVE-2024-24900](https://insights.sbomify.com/CVE-2024-24900/): Missing authorization in Secure Connect Gateway (SCG) Policy Manager (medium 5.8)
- [CVE-2024-2490](https://insights.sbomify.com/CVE-2024-2490/): Tenda AC18 openSchedWifi setSchedWifi stack-based overflow (high 8.8)
- [CVE-2024-24899](https://insights.sbomify.com/CVE-2024-24899/): Command injection in aops-zeus (high 7.2)
- [CVE-2024-24898](https://insights.sbomify.com/CVE-2024-24898/): Information Leakage in kernel (medium 6.0)
- [CVE-2024-24897](https://insights.sbomify.com/CVE-2024-24897/): Remote command execution in A-Tune-Collector (high 8.1)
- [CVE-2024-24892](https://insights.sbomify.com/CVE-2024-24892/): Unauthorized RCE in migration-tools (high 8.1)
- [CVE-2024-24891](https://insights.sbomify.com/CVE-2024-24891/): Information Leakage in kernel (medium 6.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/426/