# Vulnerabilities published in 2024


- [CVE-2024-23492](https://insights.sbomify.com/CVE-2024-23492/): Commend WS203VICM Weak Encoding for Password (medium 5.7)
- [CVE-2024-23491](https://insights.sbomify.com/CVE-2024-23491/): Privilege escalation in Intel(R) Distribution for GDB software (medium 5.4)
- [CVE-2024-2349](https://insights.sbomify.com/CVE-2024-2349/): Cross-site scripting in Fancy Elementor Flipbox (medium 6.4)
- [CVE-2024-23489](https://insights.sbomify.com/CVE-2024-23489/): Privilege escalation in Intel(R) VROC software (medium 5.4)
- [CVE-2024-23488](https://insights.sbomify.com/CVE-2024-23488/): Files of archived channels accessible with the “Allow users to view archived channels” option disabled (low 3.1)
- [CVE-2024-23487](https://insights.sbomify.com/CVE-2024-23487/): Privilege escalation in UEFI firmware for some Intel(R) Server D50DNP Family products (high 7.5)
- [CVE-2024-23486](https://insights.sbomify.com/CVE-2024-23486/): Information disclosure in WSR-2533DHP (critical 9.8)
- [CVE-2024-23485](https://insights.sbomify.com/CVE-2024-23485/): Security feature bypass in Controller 6000 and Controller 7000 (medium 4.6)
- [CVE-2024-23483](https://insights.sbomify.com/CVE-2024-23483/): Local Privilege Escalation via lack of input validation (high 7.0)
- [CVE-2024-23482](https://insights.sbomify.com/CVE-2024-23482/): ZScalerService Local Privilege Escalation (high 7.0)
- [CVE-2024-23480](https://insights.sbomify.com/CVE-2024-23480/): Insecure MacOS code sign check fallback (high 7.5)
- [CVE-2024-2348](https://insights.sbomify.com/CVE-2024-2348/): Gum Elementor Addon <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Widget (medium 6.4)
- [CVE-2024-23479](https://insights.sbomify.com/CVE-2024-23479/): SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2024-23478](https://insights.sbomify.com/CVE-2024-23478/): SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution (high 8.0)
- [CVE-2024-23477](https://insights.sbomify.com/CVE-2024-23477/): SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability (high 7.9)
- [CVE-2024-23476](https://insights.sbomify.com/CVE-2024-23476/): SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2024-23475](https://insights.sbomify.com/CVE-2024-23475/): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (critical 9.6)
- [CVE-2024-23474](https://insights.sbomify.com/CVE-2024-23474/): Path traversal in Access Rights Manager (high 7.6)
- [CVE-2024-23473](https://insights.sbomify.com/CVE-2024-23473/): SolarWinds Access Rights Manager (ARM) Hard-Coded Credentials Authentication Bypass Vulnerability (high 8.6)
- [CVE-2024-23472](https://insights.sbomify.com/CVE-2024-23472/): SolarWinds Access Rights Manager Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability (critical 9.6)
- [CVE-2024-23471](https://insights.sbomify.com/CVE-2024-23471/): SolarWinds Access Rights Manager (ARM) CreateFile Directory Traversal Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2024-23470](https://insights.sbomify.com/CVE-2024-23470/): Auth bypass in Access Rights Manager (critical 9.6)
- [CVE-2024-2347](https://insights.sbomify.com/CVE-2024-2347/): Astra <= 4.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name (medium 6.4)
- [CVE-2024-23469](https://insights.sbomify.com/CVE-2024-23469/): SolarWinds Access Rights Manager Exposed Dangerous Method Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2024-23468](https://insights.sbomify.com/CVE-2024-23468/): SolarWinds Access Rights Manager Directory Traversal and Information Disclosure Vulnerability (high 7.6)
- [CVE-2024-23467](https://insights.sbomify.com/CVE-2024-23467/): SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2024-23466](https://insights.sbomify.com/CVE-2024-23466/): SolarWinds Access Rights Manager Directory Traversal Remote Code Execution Vulnerability (critical 9.6)
- [CVE-2024-23465](https://insights.sbomify.com/CVE-2024-23465/): SolarWinds Access Rights Manager (ARM) ChangeHumster Exposed Dangerous Method Authentication Bypass Vulnerability (high 8.3)
- [CVE-2024-23464](https://insights.sbomify.com/CVE-2024-23464/): Zscaler bypass with administrative privileges on Windows (high 7.2)
- [CVE-2024-23463](https://insights.sbomify.com/CVE-2024-23463/): Anti-Tampering bypass via Repair App functionality (high 8.8)
- [CVE-2024-23462](https://insights.sbomify.com/CVE-2024-23462/): ZCC Mac validinstaller file integrity check missing (low 3.3)
- [CVE-2024-23461](https://insights.sbomify.com/CVE-2024-23461/): ZCC macOS Upgrade ZIP Bomb DoS (medium 4.2)
- [CVE-2024-23460](https://insights.sbomify.com/CVE-2024-23460/): Incorrect signature validation of package (medium 6.4)
- [CVE-2024-2346](https://insights.sbomify.com/CVE-2024-2346/): Missing authorization in FileBird – WordPress Media Library Folders & File Manager (medium 5.4)
- [CVE-2024-23459](https://insights.sbomify.com/CVE-2024-23459/): Multiple Arbitrary Creates/Overwrites by link following (high 7.1)
- [CVE-2024-23458](https://insights.sbomify.com/CVE-2024-23458/): Local Privilege Escalation on Zscaler Client Connector on Windows (high 7.3)
- [CVE-2024-23457](https://insights.sbomify.com/CVE-2024-23457/): Anti-tampering can be disabled with uninstall password enforced (high 7.8)
- [CVE-2024-23456](https://insights.sbomify.com/CVE-2024-23456/): Signature validation issue leads to Anti-Tampering bypass (high 7.8)
- [CVE-2024-23454](https://insights.sbomify.com/CVE-2024-23454/): Apache Hadoop: Temporary File Local Information Disclosure (medium 6.2)
- [CVE-2024-23453](https://insights.sbomify.com/CVE-2024-23453/): Hardcoded credentials in Android Spoon application (medium 5.5)
- [CVE-2024-23452](https://insights.sbomify.com/CVE-2024-23452/): Apache bRPC: HTTP request smuggling vulnerability (high 7.5)
- [CVE-2024-23451](https://insights.sbomify.com/CVE-2024-23451/): Elasticsearch Incorrect Authorization in the Remote Cluster Security API key based security model (medium 4.4)
- [CVE-2024-23450](https://insights.sbomify.com/CVE-2024-23450/): Elasticsearch Uncontrolled Resource Consumption vulnerability (medium 4.9)
- [CVE-2024-2345](https://insights.sbomify.com/CVE-2024-2345/): Cross-site scripting in FileBird – WordPress Media Library Folders & File Manager (medium 6.4)
- [CVE-2024-23449](https://insights.sbomify.com/CVE-2024-23449/): Elasticsearch Uncaught Exception (medium 4.3)
- [CVE-2024-23448](https://insights.sbomify.com/CVE-2024-23448/): APM Server Insertion of Sensitive Information into Log File (medium 5.7)
- [CVE-2024-23447](https://insights.sbomify.com/CVE-2024-23447/): Elastic Network Drive Connector Improper Access Control (medium 5.3)
- [CVE-2024-23446](https://insights.sbomify.com/CVE-2024-23446/): Kibana Broken Access Control issue (medium 6.5)
- [CVE-2024-23445](https://insights.sbomify.com/CVE-2024-23445/): Elasticsearch Remote Cluster Search Cross Cluster API Key insufficient restrictions (medium 6.5)
- [CVE-2024-23444](https://insights.sbomify.com/CVE-2024-23444/): Elasticsearch elasticsearch-certutil csr fails to encrypt private key (medium 4.9)
- [CVE-2024-23443](https://insights.sbomify.com/CVE-2024-23443/): Denial of service in Kibana (medium 4.9)
- [CVE-2024-23442](https://insights.sbomify.com/CVE-2024-23442/): Kibana open redirect issue (medium 6.1)
- [CVE-2024-23441](https://insights.sbomify.com/CVE-2024-23441/): Vba32 Antivirus v3.36.0 - Denial of Service (DoS) (medium 5.5)
- [CVE-2024-23440](https://insights.sbomify.com/CVE-2024-23440/): Vba32 Antivirus v3.36.0 - Arbitrary Memory Read (high 7.1)
- [CVE-2024-2344](https://insights.sbomify.com/CVE-2024-2344/): Avada <= 7.11.6 - Authenticated (Admin+) SQL Injection via entry (high 7.2)
- [CVE-2024-23439](https://insights.sbomify.com/CVE-2024-23439/): Vba32 Antivirus v3.36.0 - Arbitrary Memory Read (high 7.1)
- [CVE-2024-2343](https://insights.sbomify.com/CVE-2024-2343/): Avada <= 7.11.6 - Authenticated (Contributor+) Server-Side Request Forgery via form_to_url_action (medium 6.4)
- [CVE-2024-2342](https://insights.sbomify.com/CVE-2024-2342/): SQL injection in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin (high 8.8)
- [CVE-2024-2341](https://insights.sbomify.com/CVE-2024-2341/): SQL injection in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin (high 8.8)
- [CVE-2024-2340](https://insights.sbomify.com/CVE-2024-2340/): Avada <= 7.11.6 - Unauthenticated Sensitive Information Exposure via Form Uploads Directory Listing (medium 5.3)
- [CVE-2024-2339](https://insights.sbomify.com/CVE-2024-2339/): Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule (high 8.0)
- [CVE-2024-23388](https://insights.sbomify.com/CVE-2024-23388/): Open redirect in "Mercari" App for Android (medium 6.1)
- [CVE-2024-23387](https://insights.sbomify.com/CVE-2024-23387/): Cross-site scripting in FusionPBX (medium 4.8)
- [CVE-2024-23386](https://insights.sbomify.com/CVE-2024-23386/): Improper Input Validation in Video (medium 6.7)
- [CVE-2024-23385](https://insights.sbomify.com/CVE-2024-23385/): Reachable Assertion in Modem (high 7.5)
- [CVE-2024-23384](https://insights.sbomify.com/CVE-2024-23384/): Use After Free in Graphics Linux (high 8.4)
- [CVE-2024-23383](https://insights.sbomify.com/CVE-2024-23383/): Use After Free in Graphics Linux (high 8.4)
- [CVE-2024-23382](https://insights.sbomify.com/CVE-2024-23382/): Use After Free in Graphics Linux (high 8.4)
- [CVE-2024-23381](https://insights.sbomify.com/CVE-2024-23381/): Use After Free in Graphics Linux (high 8.4)
- [CVE-2024-23380](https://insights.sbomify.com/CVE-2024-23380/): Use After Free in Graphics (high 8.4)
- [CVE-2024-2338](https://insights.sbomify.com/CVE-2024-2338/): SQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule (high 8.0)
- [CVE-2024-23379](https://insights.sbomify.com/CVE-2024-23379/): Double Free in DSP Services (medium 6.7)
- [CVE-2024-23378](https://insights.sbomify.com/CVE-2024-23378/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio (medium 6.7)
- [CVE-2024-23377](https://insights.sbomify.com/CVE-2024-23377/): Use of Out-of-range Pointer Offset in ComputerVision (medium 6.7)
- [CVE-2024-23376](https://insights.sbomify.com/CVE-2024-23376/): Use After Free in ComputerVision (medium 6.7)
- [CVE-2024-23375](https://insights.sbomify.com/CVE-2024-23375/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in RIL (medium 6.7)
- [CVE-2024-23374](https://insights.sbomify.com/CVE-2024-23374/): Stack-based Buffer Overflow in Power Management IC (medium 6.7)
- [CVE-2024-23373](https://insights.sbomify.com/CVE-2024-23373/): Use After Free in Graphics (high 8.4)
- [CVE-2024-23372](https://insights.sbomify.com/CVE-2024-23372/): Integer Overflow or Wraparound in Graphics (high 8.4)
- [CVE-2024-23370](https://insights.sbomify.com/CVE-2024-23370/): Use After Free in Automotive Multimedia (medium 6.7)
- [CVE-2024-2337](https://insights.sbomify.com/CVE-2024-2337/): Easy Testimonials <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-23369](https://insights.sbomify.com/CVE-2024-23369/): Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS (high 7.8)
- [CVE-2024-23368](https://insights.sbomify.com/CVE-2024-23368/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Qualcomm IPC (high 7.8)
- [CVE-2024-23366](https://insights.sbomify.com/CVE-2024-23366/): Buffer Over-read in Automotive Autonomy (medium 6.6)
- [CVE-2024-23365](https://insights.sbomify.com/CVE-2024-23365/): Use After Free in SCE-Mink (high 8.4)
- [CVE-2024-23364](https://insights.sbomify.com/CVE-2024-23364/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2024-23363](https://insights.sbomify.com/CVE-2024-23363/): Buffer Over-read in WLAN Firmware (high 7.5)
- [CVE-2024-23362](https://insights.sbomify.com/CVE-2024-23362/): Improper Input Validation in Trusted Execution Environment (high 7.1)
- [CVE-2024-23360](https://insights.sbomify.com/CVE-2024-23360/): Improper Access Control in Graphics Windows (high 8.4)
- [CVE-2024-2336](https://insights.sbomify.com/CVE-2024-2336/): Popup Maker – Popup for opt-ins, lead gen, & more <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-23359](https://insights.sbomify.com/CVE-2024-23359/): Buffer Over-read in Multi Mode Call Processor (high 8.2)
- [CVE-2024-23358](https://insights.sbomify.com/CVE-2024-23358/): Buffer Over-read in Multi Mode Call Processor (high 7.5)
- [CVE-2024-23357](https://insights.sbomify.com/CVE-2024-23357/): NULL Pointer Dereference in HLOS (medium 6.2)
- [CVE-2024-23356](https://insights.sbomify.com/CVE-2024-23356/): Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS (high 7.8)
- [CVE-2024-23355](https://insights.sbomify.com/CVE-2024-23355/): Improper Restriction of Operations within the Bounds of a Memory Buffer in Automotive (high 7.8)
- [CVE-2024-23354](https://insights.sbomify.com/CVE-2024-23354/): Use After Free in Graphics Linux (high 8.4)
- [CVE-2024-23353](https://insights.sbomify.com/CVE-2024-23353/): Buffer Over-read in Multi Mode Call Processor (high 7.5)
- [CVE-2024-23352](https://insights.sbomify.com/CVE-2024-23352/): Loop with Unreachable Exit Condition (`Infinite Loop`) in Multi Mode Call Processor (high 7.5)
- [CVE-2024-23351](https://insights.sbomify.com/CVE-2024-23351/): Improper Access Control in Graphics Linux (high 8.4)
- [CVE-2024-23350](https://insights.sbomify.com/CVE-2024-23350/): Reachable Assertion in Multi Mode Call Processor (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/437/