# Vulnerabilities published in 2024


- [CVE-2024-23813](https://insights.sbomify.com/CVE-2024-23813/): Auth bypass in Polarion ALM (high 7.3)
- [CVE-2024-23812](https://insights.sbomify.com/CVE-2024-23812/): Command injection in SINEC NMS (high 8.0)
- [CVE-2024-23811](https://insights.sbomify.com/CVE-2024-23811/): File upload in SINEC NMS (high 8.8)
- [CVE-2024-23810](https://insights.sbomify.com/CVE-2024-23810/): SQL injection in SINEC NMS (high 8.8)
- [CVE-2024-2381](https://insights.sbomify.com/CVE-2024-2381/): AliExpress Dropshipping with AliNext Lite <= 3.3.5 - Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-23809](https://insights.sbomify.com/CVE-2024-23809/): Memory corruption in libbiosig (critical 9.8)
- [CVE-2024-23808](https://insights.sbomify.com/CVE-2024-23808/): Arkcompiler ets frontend has an out-of-bounds read vulnerability (medium 5.2)
- [CVE-2024-23807](https://insights.sbomify.com/CVE-2024-23807/): Apache Xerces C++: Use-after-free on external DTD scan (high 8.1)
- [CVE-2024-23806](https://insights.sbomify.com/CVE-2024-23806/): HID Global Reader Configuration Cards Improper Authorization (medium 5.3)
- [CVE-2024-23805](https://insights.sbomify.com/CVE-2024-23805/): F5 Application Visibility and Reporting module and BIG-IP Advanced WAF/ASM vulnerability (high 7.5)
- [CVE-2024-23804](https://insights.sbomify.com/CVE-2024-23804/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2024-23803](https://insights.sbomify.com/CVE-2024-23803/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2024-23802](https://insights.sbomify.com/CVE-2024-23802/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2024-23801](https://insights.sbomify.com/CVE-2024-23801/): Null dereference in Tecnomatix Plant Simulation V2201 (low 3.3)
- [CVE-2024-23800](https://insights.sbomify.com/CVE-2024-23800/): Null dereference in Tecnomatix Plant Simulation V2201 (low 3.3)
- [CVE-2024-2380](https://insights.sbomify.com/CVE-2024-2380/): XSS in graph rendering (medium 4.6)
- [CVE-2024-23799](https://insights.sbomify.com/CVE-2024-23799/): Null dereference in Tecnomatix Plant Simulation V2201 (low 3.3)
- [CVE-2024-23798](https://insights.sbomify.com/CVE-2024-23798/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2024-23797](https://insights.sbomify.com/CVE-2024-23797/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2024-23796](https://insights.sbomify.com/CVE-2024-23796/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2024-23795](https://insights.sbomify.com/CVE-2024-23795/): Memory corruption in Tecnomatix Plant Simulation V2201 (high 7.8)
- [CVE-2024-23794](https://insights.sbomify.com/CVE-2024-23794/): Agents are able to lock the ticket without the "Owner" permission (medium 5.2)
- [CVE-2024-23793](https://insights.sbomify.com/CVE-2024-23793/): Upload of files outside application directory (medium 6.3)
- [CVE-2024-23792](https://insights.sbomify.com/CVE-2024-23792/): Insufficient access control (medium 5.3)
- [CVE-2024-23791](https://insights.sbomify.com/CVE-2024-23791/): Unnecessary data is written to log if issues during indexing occurs (medium 4.9)
- [CVE-2024-23790](https://insights.sbomify.com/CVE-2024-23790/): Missing file type check in avatar picture upload (low 3.5)
- [CVE-2024-2379](https://insights.sbomify.com/CVE-2024-2379/): QUIC certificate check bypass with wolfSSL (medium 6.3)
- [CVE-2024-23789](https://insights.sbomify.com/CVE-2024-23789/): Command injection in Energy Management Controller with Cloud Services (critical 9.8)
- [CVE-2024-23788](https://insights.sbomify.com/CVE-2024-23788/): Server-side request forgery in Energy Management Controller with Cloud Services (critical 9.1)
- [CVE-2024-23787](https://insights.sbomify.com/CVE-2024-23787/): Path traversal in Energy Management Controller with Cloud Services (high 7.5)
- [CVE-2024-23786](https://insights.sbomify.com/CVE-2024-23786/): Cross-site scripting in Energy Management Controller with Cloud Services (critical 9.3)
- [CVE-2024-23785](https://insights.sbomify.com/CVE-2024-23785/): Cross-site request forgery in Energy Management Controller with Cloud Services (medium 6.1)
- [CVE-2024-23784](https://insights.sbomify.com/CVE-2024-23784/): Missing authorization in Energy Management Controller with Cloud Services (medium 6.5)
- [CVE-2024-23783](https://insights.sbomify.com/CVE-2024-23783/): Auth bypass in Energy Management Controller with Cloud Services (high 8.8)
- [CVE-2024-23782](https://insights.sbomify.com/CVE-2024-23782/): Cross-site scripting in a-blog cms (medium 5.4)
- [CVE-2024-2378](https://insights.sbomify.com/CVE-2024-2378/): Privilege escalation in SDM600 (high 8.0)
- [CVE-2024-23775](https://insights.sbomify.com/CVE-2024-23775/): Integer overflow in arm:mbed tls (high 7.5)
- [CVE-2024-23774](https://insights.sbomify.com/CVE-2024-23774/): An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. (high 7.8)
- [CVE-2024-23773](https://insights.sbomify.com/CVE-2024-23773/): An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. (high 7.8)
- [CVE-2024-23772](https://insights.sbomify.com/CVE-2024-23772/): An issue was discovered in Quest KACE Agent for Windows 12.0.38 and 13.1.23.0. (medium 6.6)
- [CVE-2024-23771](https://insights.sbomify.com/CVE-2024-23771/): Auth bypass in unix4lyfe:darkhttpd (critical 9.8)
- [CVE-2024-23770](https://insights.sbomify.com/CVE-2024-23770/): Information disclosure in unix4lyfe:darkhttpd (medium 5.5)
- [CVE-2024-2377](https://insights.sbomify.com/CVE-2024-2377/): Misconfiguration in SDM600 (high 7.6)
- [CVE-2024-23769](https://insights.sbomify.com/CVE-2024-23769/): Privilege escalation in samsung:magician (high 7.3)
- [CVE-2024-23768](https://insights.sbomify.com/CVE-2024-23768/): Path traversal in dremio:dremio (high 8.8)
- [CVE-2024-23767](https://insights.sbomify.com/CVE-2024-23767/): An issue was discovered on HMS Anybus X-Gateway AB7832-F firmware version 3. (high 8.8)
- [CVE-2024-23766](https://insights.sbomify.com/CVE-2024-23766/): An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. (high 7.5)
- [CVE-2024-23765](https://insights.sbomify.com/CVE-2024-23765/): An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. (medium 4.0)
- [CVE-2024-23764](https://insights.sbomify.com/CVE-2024-23764/): Privilege escalation in withsecure:client security (medium 6.7)
- [CVE-2024-23763](https://insights.sbomify.com/CVE-2024-23763/): SQL injection in gambio:gambio (critical 9.8)
- [CVE-2024-23762](https://insights.sbomify.com/CVE-2024-23762/): File upload in gambio:gambio (high 7.8)
- [CVE-2024-23761](https://insights.sbomify.com/CVE-2024-23761/): Code injection in gambio:gambio (critical 9.8)
- [CVE-2024-23760](https://insights.sbomify.com/CVE-2024-23760/): Information disclosure in gambio:gambio (low 2.7)
- [CVE-2024-2376](https://insights.sbomify.com/CVE-2024-2376/): WPQA < 6.1.1 - Arbitrary Category and Tag Follow/Unfollow via CSRF (high 8.8)
- [CVE-2024-23759](https://insights.sbomify.com/CVE-2024-23759/): Deserialization in gambio:gambio (critical 9.8)
- [CVE-2024-23758](https://insights.sbomify.com/CVE-2024-23758/): Information disclosure in unisys:stealth (high 7.5)
- [CVE-2024-23756](https://insights.sbomify.com/CVE-2024-23756/): Missing authorization in plone:plone (high 7.5)
- [CVE-2024-23755](https://insights.sbomify.com/CVE-2024-23755/): Code injection in clickup:clickup (high 8.8)
- [CVE-2024-23752](https://insights.sbomify.com/CVE-2024-23752/): Code execution in pandasai (critical 9.8)
- [CVE-2024-23751](https://insights.sbomify.com/CVE-2024-23751/): SQL injection in llama-index (critical 9.8)
- [CVE-2024-23750](https://insights.sbomify.com/CVE-2024-23750/): Code execution in metagpt (high 8.8)
- [CVE-2024-2375](https://insights.sbomify.com/CVE-2024-2375/): WPQA < 6.1.1 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-23749](https://insights.sbomify.com/CVE-2024-23749/): Command injection in 9bis:kitty (high 7.8)
- [CVE-2024-23747](https://insights.sbomify.com/CVE-2024-23747/): Missing authorization in modernasistemas:modernanet hospital management system 2024 (high 7.5)
- [CVE-2024-23746](https://insights.sbomify.com/CVE-2024-23746/): Code injection in miro:miro (critical 9.8)
- [CVE-2024-23745](https://insights.sbomify.com/CVE-2024-23745/): Command injection in notion:web clipper (critical 9.8)
- [CVE-2024-23744](https://insights.sbomify.com/CVE-2024-23744/): Denial of service in trustedfirmware:mbed tls (high 7.5)
- [CVE-2024-23743](https://insights.sbomify.com/CVE-2024-23743/): Code injection in notion:notion (low 3.3)
- [CVE-2024-23742](https://insights.sbomify.com/CVE-2024-23742/): Code injection in loom:loom (critical 9.8)
- [CVE-2024-23741](https://insights.sbomify.com/CVE-2024-23741/): Code injection in vercel:hyper (critical 9.8)
- [CVE-2024-23740](https://insights.sbomify.com/CVE-2024-23740/): Code injection in getkap:kap (critical 9.8)
- [CVE-2024-2374](https://insights.sbomify.com/CVE-2024-2374/): XML External Entity Injection in Multiple WSO2 Products Allows Arbitrary file read and Denial of Service (high 7.5)
- [CVE-2024-23739](https://insights.sbomify.com/CVE-2024-23739/): Code injection in discord:discord (critical 9.8)
- [CVE-2024-23738](https://insights.sbomify.com/CVE-2024-23738/): Code injection in postman:postman (critical 9.8)
- [CVE-2024-23737](https://insights.sbomify.com/CVE-2024-23737/): Cross-site request forgery in savignano:s-notify (medium 5.4)
- [CVE-2024-23736](https://insights.sbomify.com/CVE-2024-23736/): Cross Site Request Forgery (CSRF) vulnerability in savignano S/Notify before 4.0.2 for Confluence allows attackers to manipulate a user's S/ (high 8.8)
- [CVE-2024-23735](https://insights.sbomify.com/CVE-2024-23735/): Cross-site scripting in savignano:s-notify (medium 6.1)
- [CVE-2024-23734](https://insights.sbomify.com/CVE-2024-23734/): Cross-site request forgery in savignano:s-notify (medium 5.2)
- [CVE-2024-23733](https://insights.sbomify.com/CVE-2024-23733/): The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote (high 7.5)
- [CVE-2024-23732](https://insights.sbomify.com/CVE-2024-23732/): ReDoS in Embedchain (high 7.5)
- [CVE-2024-23731](https://insights.sbomify.com/CVE-2024-23731/): Code execution in Embedchain (critical 9.8)
- [CVE-2024-23730](https://insights.sbomify.com/CVE-2024-23730/): Unsafe yaml deserialization in llama-hub (critical 9.8)
- [CVE-2024-23729](https://insights.sbomify.com/CVE-2024-23729/): Cross-site scripting in heytap:internet browser (medium 6.1)
- [CVE-2024-23727](https://insights.sbomify.com/CVE-2024-23727/): The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary (high 8.4)
- [CVE-2024-23726](https://insights.sbomify.com/CVE-2024-23726/): Weak cryptography in ubeeinteractive:ddw365 firmware (high 8.8)
- [CVE-2024-23725](https://insights.sbomify.com/CVE-2024-23725/): Cross-site Scripting in Ghost (medium 6.1)
- [CVE-2024-23724](https://insights.sbomify.com/CVE-2024-23724/): Ghost has possible Cross-site Scripting issue (critical 9.0)
- [CVE-2024-23722](https://insights.sbomify.com/CVE-2024-23722/): Null dereference in treasuredata:fluent bit (high 7.5)
- [CVE-2024-23721](https://insights.sbomify.com/CVE-2024-23721/): Path traversal in draytek:vigor3910 firmware (high 7.5)
- [CVE-2024-23717](https://insights.sbomify.com/CVE-2024-23717/): Other in Android (critical 9.1)
- [CVE-2024-23716](https://insights.sbomify.com/CVE-2024-23716/): Use after free in Android (high 7.4)
- [CVE-2024-23715](https://insights.sbomify.com/CVE-2024-23715/): Memory corruption in Android (high 7.8)
- [CVE-2024-23713](https://insights.sbomify.com/CVE-2024-23713/): Privilege escalation in Android (high 7.8)
- [CVE-2024-23712](https://insights.sbomify.com/CVE-2024-23712/): Denial of service in Android (medium 5.5)
- [CVE-2024-23711](https://insights.sbomify.com/CVE-2024-23711/): Privilege escalation in Android (high 7.8)
- [CVE-2024-23710](https://insights.sbomify.com/CVE-2024-23710/): Privilege escalation in Android (high 7.8)
- [CVE-2024-2371](https://insights.sbomify.com/CVE-2024-2371/): Information exposure vulnerability in Korenix JetI/O 6550 (medium 6.2)
- [CVE-2024-23709](https://insights.sbomify.com/CVE-2024-23709/): Memory corruption in Android (medium 6.5)
- [CVE-2024-23708](https://insights.sbomify.com/CVE-2024-23708/): Security feature bypass in Android (critical 9.8)
- [CVE-2024-23707](https://insights.sbomify.com/CVE-2024-23707/): Privilege escalation in Android (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/434/