# Vulnerabilities published in 2024


- [CVE-2024-24693](https://insights.sbomify.com/CVE-2024-24693/): Zoom Rooms Client for Windows - Improper Access Control (high 7.2)
- [CVE-2024-24692](https://insights.sbomify.com/CVE-2024-24692/): Zoom Rooms Client for Windows - Race Condition (medium 5.3)
- [CVE-2024-24691](https://insights.sbomify.com/CVE-2024-24691/): Privilege escalation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows (critical 9.6)
- [CVE-2024-24690](https://insights.sbomify.com/CVE-2024-24690/): Zoom Clients - Improper Input Validation (medium 5.4)
- [CVE-2024-2469](https://insights.sbomify.com/CVE-2024-2469/): Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance (high 8.0)
- [CVE-2024-24686](https://insights.sbomify.com/CVE-2024-24686/): Memory corruption in libigl (high 7.8)
- [CVE-2024-24685](https://insights.sbomify.com/CVE-2024-24685/): Memory corruption in libigl (high 7.8)
- [CVE-2024-24684](https://insights.sbomify.com/CVE-2024-24684/): Memory corruption in libigl (high 7.8)
- [CVE-2024-24683](https://insights.sbomify.com/CVE-2024-24683/): Apache Hop Engine: ID isn't escaped when generating HTML (medium 6.5)
- [CVE-2024-24681](https://insights.sbomify.com/CVE-2024-24681/): Hardcoded credentials in yealink:configuration encryption tool (critical 9.8)
- [CVE-2024-24680](https://insights.sbomify.com/CVE-2024-24680/): Django denial-of-service attack in the intcomma template filter (high 7.5)
- [CVE-2024-2468](https://insights.sbomify.com/CVE-2024-2468/): EmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute (medium 6.4)
- [CVE-2024-2467](https://insights.sbomify.com/CVE-2024-2467/): Perl-crypt-openssl-rsa: side-channel attack in pkcs#1 v1.5 padding mode (marvin attack) (medium 5.9)
- [CVE-2024-2466](https://insights.sbomify.com/CVE-2024-2466/): TLS certificate check bypass with mbedTLS (medium 6.5)
- [CVE-2024-2465](https://insights.sbomify.com/CVE-2024-2465/): Open redirection in CDeX (high 7.1)
- [CVE-2024-2464](https://insights.sbomify.com/CVE-2024-2464/): Application users enumeration in CDeX (medium 6.3)
- [CVE-2024-2463](https://insights.sbomify.com/CVE-2024-2463/): Weak password recovery mechanism in CDeX (high 8.0)
- [CVE-2024-24623](https://insights.sbomify.com/CVE-2024-24623/): Softaculous Webuzo FTP Management Command Injection (high 8.8)
- [CVE-2024-24622](https://insights.sbomify.com/CVE-2024-24622/): Softaculous Webuzo Password Reset Command Injection (high 8.8)
- [CVE-2024-24621](https://insights.sbomify.com/CVE-2024-24621/): Softaculous Webuzo Authentication Bypass (critical 9.8)
- [CVE-2024-2462](https://insights.sbomify.com/CVE-2024-2462/): Weak cryptography in ECST (medium 6.8)
- [CVE-2024-2461](https://insights.sbomify.com/CVE-2024-2461/): Path traversal in FOX61x (medium 6.9)
- [CVE-2024-2460](https://insights.sbomify.com/CVE-2024-2460/): GamiPress – Button <= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-24595](https://insights.sbomify.com/CVE-2024-24595/): Allegro AI ClearML Stores Credentials in Plaintext in MongoDB Instance (medium 6.0)
- [CVE-2024-24594](https://insights.sbomify.com/CVE-2024-24594/): Cross-site scripting in ClearML (critical 9.9)
- [CVE-2024-24593](https://insights.sbomify.com/CVE-2024-24593/): Cross-site request forgery in ClearML (critical 9.6)
- [CVE-2024-24592](https://insights.sbomify.com/CVE-2024-24592/): Auth bypass in ClearML (critical 9.8)
- [CVE-2024-24591](https://insights.sbomify.com/CVE-2024-24591/): Allegro AI ClearML path traversal vulnerability (high 8.0)
- [CVE-2024-24590](https://insights.sbomify.com/CVE-2024-24590/): Allegro AI ClearML vulnerable to deserialization of untrusted data (high 8.0)
- [CVE-2024-2459](https://insights.sbomify.com/CVE-2024-2459/): UX Flat <= 4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (high 7.4)
- [CVE-2024-24584](https://insights.sbomify.com/CVE-2024-24584/): Memory corruption in libigl (medium 4.3)
- [CVE-2024-24583](https://insights.sbomify.com/CVE-2024-24583/): Memory corruption in libigl (medium 4.3)
- [CVE-2024-24582](https://insights.sbomify.com/CVE-2024-24582/): Privilege escalation in Intel(R) processors (high 8.7)
- [CVE-2024-24581](https://insights.sbomify.com/CVE-2024-24581/): Arkcompiler runtime has an out-of-bounds write vulnerability (medium 6.5)
- [CVE-2024-24580](https://insights.sbomify.com/CVE-2024-24580/): Denial of service in Intel(R) Data Center GPU Max Series 1100 and 1550 products (medium 6.8)
- [CVE-2024-2458](https://insights.sbomify.com/CVE-2024-2458/): Cross-site scripting in Powerkit – Supercharge your WordPress Site (medium 6.4)
- [CVE-2024-24579](https://insights.sbomify.com/CVE-2024-24579/): Tar path traversal in stereoscope when processing OCI tar archives (medium 5.3)
- [CVE-2024-24578](https://insights.sbomify.com/CVE-2024-24578/): RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload (critical 10.0)
- [CVE-2024-24577](https://insights.sbomify.com/CVE-2024-24577/): libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add` (high 8.6)
- [CVE-2024-24576](https://insights.sbomify.com/CVE-2024-24576/): Rusts's `std::process::Command` did not properly escape arguments of batch files on Windows (critical 10.0)
- [CVE-2024-24575](https://insights.sbomify.com/CVE-2024-24575/): libgit2 is vulnerable to a denial of service attack in `git_revparse_single` (high 7.5)
- [CVE-2024-24574](https://insights.sbomify.com/CVE-2024-24574/): phpMyFAQ vulnerable to stored XSS on attachments filename (medium 6.5)
- [CVE-2024-24573](https://insights.sbomify.com/CVE-2024-24573/): facileManager Privilege Escalation via Mass Assignment (high 8.8)
- [CVE-2024-24572](https://insights.sbomify.com/CVE-2024-24572/): facileManager Authenticated Variable Manipulation leading to SQL Injection (medium 6.5)
- [CVE-2024-24571](https://insights.sbomify.com/CVE-2024-24571/): facileManager Systemic Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2024-24570](https://insights.sbomify.com/CVE-2024-24570/): Statamic account takeover via XSS and password reset link (high 8.2)
- [CVE-2024-2457](https://insights.sbomify.com/CVE-2024-2457/): Cross-site scripting in Modal Window – create popup modal window (medium 6.4)
- [CVE-2024-24569](https://insights.sbomify.com/CVE-2024-24569/): `ZipSecurity#isBelowCurrentDirectory` is vulnerable to partial-path traversal vulnerability (medium 5.4)
- [CVE-2024-24568](https://insights.sbomify.com/CVE-2024-24568/): Suricata http2: header handling evasion (medium 5.3)
- [CVE-2024-24567](https://insights.sbomify.com/CVE-2024-24567/): raw_call `value=` kwargs not disabled for static and delegate calls (medium 4.8)
- [CVE-2024-24566](https://insights.sbomify.com/CVE-2024-24566/): Lobe Chat unauthorized access to plugins (medium 5.3)
- [CVE-2024-24565](https://insights.sbomify.com/CVE-2024-24565/): CrateDB database has an arbitrary file read vulnerability (medium 5.7)
- [CVE-2024-24564](https://insights.sbomify.com/CVE-2024-24564/): Vyper extract32 can ready dirty memory (low 3.7)
- [CVE-2024-24563](https://insights.sbomify.com/CVE-2024-24563/): Vyper array negative index vulnerability (critical 9.8)
- [CVE-2024-24562](https://insights.sbomify.com/CVE-2024-24562/): Security headers not set in vantage6-UI (medium 5.4)
- [CVE-2024-24561](https://insights.sbomify.com/CVE-2024-24561/): Vyper bounds check on built-in `slice()` function can be overflowed (critical 9.8)
- [CVE-2024-24560](https://insights.sbomify.com/CVE-2024-24560/): Vyper external calls can overflow return data to return input buffer (low 3.7)
- [CVE-2024-2456](https://insights.sbomify.com/CVE-2024-2456/): Ecwid Ecommerce Shopping Cart <= 6.12.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-24559](https://insights.sbomify.com/CVE-2024-24559/): Vyper SHA3 code generation bug (low 3.7)
- [CVE-2024-24558](https://insights.sbomify.com/CVE-2024-24558/): react-query-streamed-hydration xss (high 8.2)
- [CVE-2024-24557](https://insights.sbomify.com/CVE-2024-24557/): Moby classic builder cache poisoning (medium 6.9)
- [CVE-2024-24556](https://insights.sbomify.com/CVE-2024-24556/): XSS in @urql/next (high 7.2)
- [CVE-2024-24554](https://insights.sbomify.com/CVE-2024-24554/): Bludit - Insecure Token Generation (medium 6.0)
- [CVE-2024-24553](https://insights.sbomify.com/CVE-2024-24553/): Bludit uses SHA1 as Password Hashing Algorithm (medium 5.9)
- [CVE-2024-24552](https://insights.sbomify.com/CVE-2024-24552/): Bludit is Vulnerable to Session Fixation (medium 5.6)
- [CVE-2024-24551](https://insights.sbomify.com/CVE-2024-24551/): Bludit - Remote Code Execution (RCE) through Image API (high 8.9)
- [CVE-2024-24550](https://insights.sbomify.com/CVE-2024-24550/): Bludit - Remote Code Execution (RCE) through File API (high 8.9)
- [CVE-2024-2455](https://insights.sbomify.com/CVE-2024-2455/): Cross-site scripting in Element Pack Pro - Addon for Elementor Page Builder WordPress Plugin (medium 6.4)
- [CVE-2024-24549](https://insights.sbomify.com/CVE-2024-24549/): Apache Tomcat: HTTP/2 header handling DoS (high 7.5)
- [CVE-2024-24548](https://insights.sbomify.com/CVE-2024-24548/): Information disclosure in Payment EX (high 7.5)
- [CVE-2024-24543](https://insights.sbomify.com/CVE-2024-24543/): Memory corruption in tenda:ac9 firmware (critical 9.8)
- [CVE-2024-2454](https://insights.sbomify.com/CVE-2024-2454/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2024-24539](https://insights.sbomify.com/CVE-2024-24539/): Auth bypass in fusionpbx:fusionpbx (medium 5.3)
- [CVE-2024-2453](https://insights.sbomify.com/CVE-2024-2453/): Advantech WebAccess/SCADA SQL Injection (medium 6.4)
- [CVE-2024-24525](https://insights.sbomify.com/CVE-2024-24525/): Code injection in epoint:epointwebbuilder (critical 9.8)
- [CVE-2024-24524](https://insights.sbomify.com/CVE-2024-24524/): Cross-site request forgery in flusity:flusity (high 8.8)
- [CVE-2024-24520](https://insights.sbomify.com/CVE-2024-24520/): Code injection in lepton-cms:leptoncms (high 7.8)
- [CVE-2024-2452](https://insights.sbomify.com/CVE-2024-2452/): Integer wraparound, under-allocation, and heap buffer overflow in Eclipse ThreadX NetX Duo __portable_aligned_alloc() (high 7.0)
- [CVE-2024-24512](https://insights.sbomify.com/CVE-2024-24512/): Cross-site scripting in pkp.sfu:open journal systems (medium 6.1)
- [CVE-2024-24511](https://insights.sbomify.com/CVE-2024-24511/): Cross-site scripting in pkp.sfu:open journal systems (medium 6.1)
- [CVE-2024-24510](https://insights.sbomify.com/CVE-2024-24510/): Cross-site scripting in alinto:sogo (medium 6.1)
- [CVE-2024-2451](https://insights.sbomify.com/CVE-2024-2451/): Improper fingerprint validation in the TeamViewer Client (medium 6.4)
- [CVE-2024-24507](https://insights.sbomify.com/CVE-2024-24507/): Cross-site scripting in act-on:act-on (medium 4.6)
- [CVE-2024-24506](https://insights.sbomify.com/CVE-2024-24506/): Cross-site scripting in limesurvey:limesurvey (medium 6.1)
- [CVE-2024-2450](https://insights.sbomify.com/CVE-2024-2450/): Auth bypass in Mattermost (high 8.8)
- [CVE-2024-24496](https://insights.sbomify.com/CVE-2024-24496/): Missing authorization in remyandrade:daily habit tracker (critical 9.8)
- [CVE-2024-24495](https://insights.sbomify.com/CVE-2024-24495/): SQL injection in remyandrade:daily habit tracker (critical 9.8)
- [CVE-2024-24494](https://insights.sbomify.com/CVE-2024-24494/): Cross-site scripting in remyandrade:daily habit tracker (medium 6.1)
- [CVE-2024-2449](https://insights.sbomify.com/CVE-2024-2449/): LoadMaster Cross-Site Request Forgery (CSRF) (high 7.5)
- [CVE-2024-24488](https://insights.sbomify.com/CVE-2024-24488/): Information disclosure in tendacn:cp3 firmware (medium 5.5)
- [CVE-2024-24487](https://insights.sbomify.com/CVE-2024-24487/): Denial of service in silextechnology:ds-600 firmware (medium 6.8)
- [CVE-2024-24486](https://insights.sbomify.com/CVE-2024-24486/): Missing authorization in silextechnology:ds-600 firmware (critical 9.1)
- [CVE-2024-24485](https://insights.sbomify.com/CVE-2024-24485/): Information disclosure in silextechnology:ds-600 firmware (high 7.5)
- [CVE-2024-24482](https://insights.sbomify.com/CVE-2024-24482/): Path traversal in apktool:apktool (critical 9.8)
- [CVE-2024-2448](https://insights.sbomify.com/CVE-2024-2448/): LoadMaster Command Injection Vulnerability (high 8.4)
- [CVE-2024-24479](https://insights.sbomify.com/CVE-2024-24479/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2024-24478](https://insights.sbomify.com/CVE-2024-24478/): Denial of service in wireshark:wireshark (high 7.5)
- [CVE-2024-24476](https://insights.sbomify.com/CVE-2024-24476/): Memory corruption in fedoraproject:fedora (high 7.5)
- [CVE-2024-24474](https://insights.sbomify.com/CVE-2024-24474/): Integer overflow in qemu:qemu (high 8.8)
- [CVE-2024-24470](https://insights.sbomify.com/CVE-2024-24470/): Cross-site request forgery in flusity:flusity (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/429/