# Vulnerabilities published in 2024


- [CVE-2024-23706](https://insights.sbomify.com/CVE-2024-23706/): Security feature bypass in Android (high 7.4)
- [CVE-2024-23705](https://insights.sbomify.com/CVE-2024-23705/): Security feature bypass in Android (critical 9.8)
- [CVE-2024-23704](https://insights.sbomify.com/CVE-2024-23704/): Missing authorization in Android (high 7.0)
- [CVE-2024-23698](https://insights.sbomify.com/CVE-2024-23698/): Memory corruption in Android (high 7.8)
- [CVE-2024-23697](https://insights.sbomify.com/CVE-2024-23697/): Use after free in Android (high 7.3)
- [CVE-2024-23696](https://insights.sbomify.com/CVE-2024-23696/): Use after free in Android (high 8.4)
- [CVE-2024-23695](https://insights.sbomify.com/CVE-2024-23695/): Integer overflow in Android (high 8.4)
- [CVE-2024-23692](https://insights.sbomify.com/CVE-2024-23692/): Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine (critical 9.8, exploited in the wild)
- [CVE-2024-23690](https://insights.sbomify.com/CVE-2024-23690/): EOL Netgear FVS336Gv2 and FVS336Gv3 Telnet Configuration Backup Command Injection (high 7.2)
- [CVE-2024-2369](https://insights.sbomify.com/CVE-2024-2369/): Page Builder Gutenberg Blocks < 3.1.7 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-23689](https://insights.sbomify.com/CVE-2024-23689/): ClickHouse Client Certificate Password Exposure (high 8.8)
- [CVE-2024-23688](https://insights.sbomify.com/CVE-2024-23688/): Consensys Discovery Nonce Reuse (medium 5.3)
- [CVE-2024-23687](https://insights.sbomify.com/CVE-2024-23687/): FOLIO mod-data-export-spring Hard-Coded Credentials (critical 9.1)
- [CVE-2024-23686](https://insights.sbomify.com/CVE-2024-23686/): DependencyCheck Debug Mode Logging of NVD API Key (medium 5.3)
- [CVE-2024-23685](https://insights.sbomify.com/CVE-2024-23685/): FOLIO mod-remote-storage Hard Coded Credentials (medium 5.3)
- [CVE-2024-23684](https://insights.sbomify.com/CVE-2024-23684/): upokecenter CBOR Denial of Service (high 7.5)
- [CVE-2024-23683](https://insights.sbomify.com/CVE-2024-23683/): Artemis Java Test Sandbox InvocationTargetException Subclass Escape (high 8.2)
- [CVE-2024-23682](https://insights.sbomify.com/CVE-2024-23682/): Artemis Java Test Sandbox Class Loading Escape (high 8.2)
- [CVE-2024-23681](https://insights.sbomify.com/CVE-2024-23681/): Artemis Java Test Sandbox Libary Load Escape (high 8.2)
- [CVE-2024-23680](https://insights.sbomify.com/CVE-2024-23680/): AWS Encryption SDK for Java Improper Verification of Cryptographic Signature (medium 5.3)
- [CVE-2024-2368](https://insights.sbomify.com/CVE-2024-2368/): Mollie Forms <= 2.6.13 - Cross-Site Request Forgery to Arbitrary Post Duplication (medium 4.3)
- [CVE-2024-23679](https://insights.sbomify.com/CVE-2024-23679/): Enonic XP Session Fixation Vulnerability (critical 9.8)
- [CVE-2024-23678](https://insights.sbomify.com/CVE-2024-23678/): Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition (high 7.5)
- [CVE-2024-23677](https://insights.sbomify.com/CVE-2024-23677/): Server Response Disclosure in RapidDiag Salesforce.com Log File (medium 4.3)
- [CVE-2024-23676](https://insights.sbomify.com/CVE-2024-23676/): Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command (medium 4.6)
- [CVE-2024-23675](https://insights.sbomify.com/CVE-2024-23675/): Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion (medium 6.5)
- [CVE-2024-23674](https://insights.sbomify.com/CVE-2024-23674/): The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. (critical 9.6)
- [CVE-2024-23673](https://insights.sbomify.com/CVE-2024-23673/): Apache Sling Servlets Resolver: Malicious code execution via path traversal (high 8.5)
- [CVE-2024-23672](https://insights.sbomify.com/CVE-2024-23672/): Apache Tomcat: WebSocket DoS with incomplete closing handshake (medium 6.3)
- [CVE-2024-23671](https://insights.sbomify.com/CVE-2024-23671/): Path traversal in FortiSandbox (high 7.9)
- [CVE-2024-23670](https://insights.sbomify.com/CVE-2024-23670/): Missing authorization in FortiWebManager (high 7.6)
- [CVE-2024-23669](https://insights.sbomify.com/CVE-2024-23669/): Missing authorization in FortiWebManager (medium 6.4)
- [CVE-2024-23668](https://insights.sbomify.com/CVE-2024-23668/): Missing authorization in FortiWebManager (high 8.6)
- [CVE-2024-23667](https://insights.sbomify.com/CVE-2024-23667/): Missing authorization in FortiWebManager (high 7.6)
- [CVE-2024-23666](https://insights.sbomify.com/CVE-2024-23666/): Security feature bypass in FortiAnalyzer (high 7.1)
- [CVE-2024-23665](https://insights.sbomify.com/CVE-2024-23665/): Missing authorization in FortiWeb (medium 5.6)
- [CVE-2024-23664](https://insights.sbomify.com/CVE-2024-23664/): Open redirect in FortiAuthenticator (medium 5.8)
- [CVE-2024-23663](https://insights.sbomify.com/CVE-2024-23663/): Privilege escalation in FortiExtender (high 8.1)
- [CVE-2024-23662](https://insights.sbomify.com/CVE-2024-23662/): Information disclosure in FortiOS (medium 5.0)
- [CVE-2024-23660](https://insights.sbomify.com/CVE-2024-23660/): Weak cryptography in binance:trust wallet (high 7.5)
- [CVE-2024-2366](https://insights.sbomify.com/CVE-2024-2366/): Remote Code Execution in parisneo/lollms-webui (critical 9.0)
- [CVE-2024-23659](https://insights.sbomify.com/CVE-2024-23659/): Cross-site scripting in spip:spip (medium 6.1)
- [CVE-2024-23658](https://insights.sbomify.com/CVE-2024-23658/): Use after free in SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T610/T618/T760/T770/T820/S8000 (medium 4.4)
- [CVE-2024-23657](https://insights.sbomify.com/CVE-2024-23657/): Path Traversal: '../filedir' in Nuxt Devtools (high 8.8)
- [CVE-2024-23656](https://insights.sbomify.com/CVE-2024-23656/): Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphers (high 7.5)
- [CVE-2024-23655](https://insights.sbomify.com/CVE-2024-23655/): Attacker can prevent users from accessing received emails (high 7.5)
- [CVE-2024-23654](https://insights.sbomify.com/CVE-2024-23654/): discourse-ai admin-initiated SSRF when interacting with AI services (medium 4.1)
- [CVE-2024-23653](https://insights.sbomify.com/CVE-2024-23653/): BuildKit interactive containers API does not validate entitlements check (critical 9.8)
- [CVE-2024-23652](https://insights.sbomify.com/CVE-2024-23652/): BuildKit possible host system access from mount stub cleaner (critical 10.0)
- [CVE-2024-23651](https://insights.sbomify.com/CVE-2024-23651/): BuildKit possible race condition with accessing subpaths from cache mounts (high 8.7)
- [CVE-2024-23650](https://insights.sbomify.com/CVE-2024-23650/): BuildKit possible panic when incorrect parameters sent from frontend (medium 5.3)
- [CVE-2024-2365](https://insights.sbomify.com/CVE-2024-2365/): Musicshelf SHA-1 PinningTrustManager.java weak password hash (low 1.6)
- [CVE-2024-23649](https://insights.sbomify.com/CVE-2024-23649/): Any authenticated user may obtain private message details from other users on the same instance (high 7.5)
- [CVE-2024-23648](https://insights.sbomify.com/CVE-2024-23648/): Pimcore Admin Classic Bundle host header injection in the password reset (high 8.8)
- [CVE-2024-23647](https://insights.sbomify.com/CVE-2024-23647/): PKCE downgrade attack in Authentik (medium 6.5)
- [CVE-2024-23646](https://insights.sbomify.com/CVE-2024-23646/): Pimcore Admin Classic Bundle SQL Injection in Admin download files as zip (high 8.8)
- [CVE-2024-23645](https://insights.sbomify.com/CVE-2024-23645/): GLPI reflected XSS in reports pages (medium 6.5)
- [CVE-2024-23644](https://insights.sbomify.com/CVE-2024-23644/): trillium-http and trillium-client vulnerable to HTTP Request/Response Splitting (medium 6.8)
- [CVE-2024-23643](https://insights.sbomify.com/CVE-2024-23643/): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form (medium 4.8)
- [CVE-2024-23642](https://insights.sbomify.com/CVE-2024-23642/): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer (medium 4.8)
- [CVE-2024-23641](https://insights.sbomify.com/CVE-2024-23641/): Sending a GET or HEAD request with a body crashes SvelteKit (high 7.5)
- [CVE-2024-23640](https://insights.sbomify.com/CVE-2024-23640/): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher (medium 4.8)
- [CVE-2024-2364](https://insights.sbomify.com/CVE-2024-2364/): Musicshelf Backup androidmanifest.xml backup (low 1.8)
- [CVE-2024-23639](https://insights.sbomify.com/CVE-2024-23639/): micronaut-core management endpoints vulnerable to drive-by localhost attack (medium 5.1)
- [CVE-2024-23638](https://insights.sbomify.com/CVE-2024-23638/): SQUID-2023:11 Denial of Service in Cache Manager (medium 6.5)
- [CVE-2024-23637](https://insights.sbomify.com/CVE-2024-23637/): OctoPrint Unverified Password Change via Access Control Settings (medium 4.2)
- [CVE-2024-23636](https://insights.sbomify.com/CVE-2024-23636/): SOFARPC Remote Command Execution(RCE) Vulnerbility (critical 9.8)
- [CVE-2024-23635](https://insights.sbomify.com/CVE-2024-23635/): AntiSamy malicious input can provoke XSS when preserving comments (medium 6.1)
- [CVE-2024-23634](https://insights.sbomify.com/CVE-2024-23634/): GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API (medium 6.0)
- [CVE-2024-23633](https://insights.sbomify.com/CVE-2024-23633/): Label Studio XSS Vulnerability on Data Import (medium 4.7)
- [CVE-2024-23630](https://insights.sbomify.com/CVE-2024-23630/): Motorola MR2600 Arbitrary Firmware Upload Vulnerability (critical 9.0)
- [CVE-2024-2363](https://insights.sbomify.com/CVE-2024-2363/): AOL AIM Triton Invite denial of service (medium 5.3)
- [CVE-2024-23629](https://insights.sbomify.com/CVE-2024-23629/): Motorola MR2600 Authentication Bypass Vulnerability (critical 9.6)
- [CVE-2024-23628](https://insights.sbomify.com/CVE-2024-23628/): Motorola MR2600 SaveStaticRouteIPv6Params Command Injection Vulnerability (critical 9.0)
- [CVE-2024-23627](https://insights.sbomify.com/CVE-2024-23627/): Motorola MR2600 SaveStaticRouteIPv4Params Command Injection Vulnerability (critical 9.0)
- [CVE-2024-23626](https://insights.sbomify.com/CVE-2024-23626/): Motorola MR2600 SaveSysLogParams Command Injection Vulnerability (critical 9.0)
- [CVE-2024-23625](https://insights.sbomify.com/CVE-2024-23625/): D-Link DAP-1650 SUBSCRIBE Callback Command Injection Vulnerability (critical 9.6)
- [CVE-2024-23624](https://insights.sbomify.com/CVE-2024-23624/): D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection Vulnerability (critical 9.6)
- [CVE-2024-23622](https://insights.sbomify.com/CVE-2024-23622/): IBM Merge Healthcare eFilm Workstation License Server CopySLS_Request3 Buffer Overflow (critical 10.0)
- [CVE-2024-23621](https://insights.sbomify.com/CVE-2024-23621/): IBM Merge Healthcare eFilm Workstation License Server Buffer Overflow (critical 10.0)
- [CVE-2024-23620](https://insights.sbomify.com/CVE-2024-23620/): IBM Merge Healthcare eFilm Workstation SYSTEM Privilege Escalation (high 8.8)
- [CVE-2024-2362](https://insights.sbomify.com/CVE-2024-2362/): Path Traversal in parisneo/lollms-webui (critical 9.1)
- [CVE-2024-23619](https://insights.sbomify.com/CVE-2024-23619/): IBM Merge Healthcare eFilm Workstation Hardcoded Credentials (critical 9.8)
- [CVE-2024-23618](https://insights.sbomify.com/CVE-2024-23618/): Arris SURFboard SBG6950AC2 Arbitrary Code Execution Vulnerability (critical 9.6)
- [CVE-2024-23617](https://insights.sbomify.com/CVE-2024-23617/): Symantec Data Loss Prevention Buffer Overflow (critical 9.6)
- [CVE-2024-23616](https://insights.sbomify.com/CVE-2024-23616/): Symantec Server Management Suite Buffer Overflow (critical 10.0)
- [CVE-2024-23615](https://insights.sbomify.com/CVE-2024-23615/): Symantec Messaging Gateway Buffer Overflow (critical 10.0)
- [CVE-2024-23614](https://insights.sbomify.com/CVE-2024-23614/): Symantec Messaging Gateway Buffer Overflow (critical 10.0)
- [CVE-2024-23613](https://insights.sbomify.com/CVE-2024-23613/): Symantec Deployment Solution Remote Code Execution (critical 10.0)
- [CVE-2024-23612](https://insights.sbomify.com/CVE-2024-23612/): Improper Error Handling Issue in LabVIEW (high 7.8)
- [CVE-2024-23611](https://insights.sbomify.com/CVE-2024-23611/): Out of Bounds Write Due to Missing Bounds Check in LabVIEW (high 7.8)
- [CVE-2024-23610](https://insights.sbomify.com/CVE-2024-23610/): Out of Bounds Write Due to Missing Bounds Check in LabVIEW (high 7.8)
- [CVE-2024-2361](https://insights.sbomify.com/CVE-2024-2361/): Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui (critical 9.6)
- [CVE-2024-23609](https://insights.sbomify.com/CVE-2024-23609/): Improper Error Handling Issue in LabVIEW (high 7.8)
- [CVE-2024-23608](https://insights.sbomify.com/CVE-2024-23608/): Out of Bounds Write Due to Missing Bounds Check in LabVIEW (high 7.8)
- [CVE-2024-23607](https://insights.sbomify.com/CVE-2024-23607/): F5OS QKView utility vulnerability (medium 5.5)
- [CVE-2024-23606](https://insights.sbomify.com/CVE-2024-23606/): Memory corruption in libbiosig (critical 9.8)
- [CVE-2024-23605](https://insights.sbomify.com/CVE-2024-23605/): Memory corruption in llama.cpp (high 8.8)
- [CVE-2024-23604](https://insights.sbomify.com/CVE-2024-23604/): Cross-site scripting in FitNesse (medium 5.4)
- [CVE-2024-23603](https://insights.sbomify.com/CVE-2024-23603/): BIG-IP Advanced WAF and ASM Configuration utility vulnerability (low 3.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/435/