# Vulnerabilities published in 2024


- [CVE-2024-2335](https://insights.sbomify.com/CVE-2024-2335/): Elements Plus! <= 2.16.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via widget links (medium 6.4)
- [CVE-2024-23349](https://insights.sbomify.com/CVE-2024-23349/): Apache Answer: XSS vulnerability when submitting summary (medium 5.4)
- [CVE-2024-23348](https://insights.sbomify.com/CVE-2024-23348/): Cross-site scripting in a-blog cms (high 8.8)
- [CVE-2024-23347](https://insights.sbomify.com/CVE-2024-23347/): Code injection in Meta Spark Studio (high 7.8)
- [CVE-2024-23346](https://insights.sbomify.com/CVE-2024-23346/): pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string (critical 9.4)
- [CVE-2024-23345](https://insights.sbomify.com/CVE-2024-23345/): Nautobot has XSS potential in rendered Markdown fields (high 7.1)
- [CVE-2024-23344](https://insights.sbomify.com/CVE-2024-23344/): Tuleap's content of artifacts might be readable by unauthorized users (medium 5.3)
- [CVE-2024-23342](https://insights.sbomify.com/CVE-2024-23342/): python-ecdsa vulnerable to Minerva attack on P-256 (high 7.4)
- [CVE-2024-23341](https://insights.sbomify.com/CVE-2024-23341/): TuiTse-TsuSin html injection vulnerability in `tuitse_html` function (medium 6.1)
- [CVE-2024-23340](https://insights.sbomify.com/CVE-2024-23340/): @hono/node-server can't handle "double dots" in URL (medium 5.3)
- [CVE-2024-2334](https://insights.sbomify.com/CVE-2024-2334/): Template Kit – Import <= 1.0.14 - Authenticated(Author+) Stored Cross-Site Scripting via template upload (medium 6.4)
- [CVE-2024-23339](https://insights.sbomify.com/CVE-2024-23339/): hoolock does not block Prototype pollution with object-path related utilities (medium 6.3)
- [CVE-2024-23337](https://insights.sbomify.com/CVE-2024-23337/): jq has signed integer overflow in jv.c:jvp_array_write (medium 4.3)
- [CVE-2024-23336](https://insights.sbomify.com/CVE-2024-23336/): Incomplete disallowed remote addresses list in MyBB (medium 5.0)
- [CVE-2024-23335](https://insights.sbomify.com/CVE-2024-23335/): Backups directory .htaccess deletion in. MyBB (medium 4.7)
- [CVE-2024-23334](https://insights.sbomify.com/CVE-2024-23334/): aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal (medium 5.9)
- [CVE-2024-23333](https://insights.sbomify.com/CVE-2024-23333/): LAM vulnerable to Authenticated Remote Code Execution (high 7.9)
- [CVE-2024-23332](https://insights.sbomify.com/CVE-2024-23332/): Client configured with permissive trust policies susceptible to rollback attack in Notary Project (medium 4.0)
- [CVE-2024-23331](https://insights.sbomify.com/CVE-2024-23331/): Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem (high 7.5)
- [CVE-2024-23330](https://insights.sbomify.com/CVE-2024-23330/): Tuta loads images from external resources (medium 5.3)
- [CVE-2024-2333](https://insights.sbomify.com/CVE-2024-2333/): CodeAstro Membership Management System add_members.php sql injection (medium 6.3)
- [CVE-2024-23329](https://insights.sbomify.com/CVE-2024-23329/): changedetection.io API endpoint is not secured with API token (low 3.7)
- [CVE-2024-23328](https://insights.sbomify.com/CVE-2024-23328/): The Dataease datasource exists deserialization and arbitrary file read vulnerability (critical 9.1)
- [CVE-2024-23327](https://insights.sbomify.com/CVE-2024-23327/): Crash in proxy protocol when command type of LOCAL in Envoy (high 7.5)
- [CVE-2024-23326](https://insights.sbomify.com/CVE-2024-23326/): Envoy incorrectly accepts HTTP 200 response for entering upgrade mode (medium 5.9)
- [CVE-2024-23325](https://insights.sbomify.com/CVE-2024-23325/): Envoy crashes when using an address type that isn’t supported by the OS (high 7.5)
- [CVE-2024-23324](https://insights.sbomify.com/CVE-2024-23324/): Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata (high 8.6)
- [CVE-2024-23323](https://insights.sbomify.com/CVE-2024-23323/): Excessive CPU usage when URI template matcher is configured using regex in Envoy (medium 4.3)
- [CVE-2024-23322](https://insights.sbomify.com/CVE-2024-23322/): Envoy crashes when idle and request per try timeout occur within the backoff interval (high 7.5)
- [CVE-2024-23321](https://insights.sbomify.com/CVE-2024-23321/): Apache RocketMQ: Unauthorized Exposure of Sensitive Data (high 7.5)
- [CVE-2024-23320](https://insights.sbomify.com/CVE-2024-23320/): Apache DolphinScheduler: Arbitrary js execution as root for authenticated users (high 8.8)
- [CVE-2024-2332](https://insights.sbomify.com/CVE-2024-2332/): SourceCodester Online Mobile Management Store HTTP GET Request manage_category.php sql injection (medium 6.3)
- [CVE-2024-23319](https://insights.sbomify.com/CVE-2024-23319/): CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin) (low 3.5)
- [CVE-2024-23317](https://insights.sbomify.com/CVE-2024-23317/): Path traversal in Controller 6000 and Controller 7000 (medium 6.3)
- [CVE-2024-23316](https://insights.sbomify.com/CVE-2024-23316/): PingAccess HTTP Request Desynchronization Weakness (high 8.8)
- [CVE-2024-23315](https://insights.sbomify.com/CVE-2024-23315/): Information disclosure in P3-550E (high 7.5)
- [CVE-2024-23314](https://insights.sbomify.com/CVE-2024-23314/): BIG-IP HTTP/2 vulnerability (high 7.5)
- [CVE-2024-23313](https://insights.sbomify.com/CVE-2024-23313/): Integer overflow in libbiosig (critical 9.8)
- [CVE-2024-23312](https://insights.sbomify.com/CVE-2024-23312/): Privilege escalation in Intel(R) Binary Configuration Tool software for Windows (medium 5.4)
- [CVE-2024-23310](https://insights.sbomify.com/CVE-2024-23310/): Use after free in libbiosig (critical 9.8)
- [CVE-2024-2331](https://insights.sbomify.com/CVE-2024-2331/): SourceCodester Tourist Reservation System System.cpp ad_writedata buffer overflow (medium 6.3)
- [CVE-2024-23309](https://insights.sbomify.com/CVE-2024-23309/): Auth bypass in WBR-6012 (critical 9.0)
- [CVE-2024-23308](https://insights.sbomify.com/CVE-2024-23308/): BIG-IP Advanced WAF and ASM vulnerability (high 7.5)
- [CVE-2024-23307](https://insights.sbomify.com/CVE-2024-23307/): Integer overflow in raid5_cache_count in Linux kernel (medium 4.4)
- [CVE-2024-23306](https://insights.sbomify.com/CVE-2024-23306/): BIG-IP Next CNF & SPK vulnerability (high 7.1)
- [CVE-2024-23305](https://insights.sbomify.com/CVE-2024-23305/): Memory corruption in libbiosig (critical 9.8)
- [CVE-2024-23304](https://insights.sbomify.com/CVE-2024-23304/): Denial of service in Cybozu KUNAI for Android (high 7.5)
- [CVE-2024-23302](https://insights.sbomify.com/CVE-2024-23302/): Information disclosure in couchbase:couchbase server (high 7.5)
- [CVE-2024-23301](https://insights.sbomify.com/CVE-2024-23301/): Misconfiguration in fedoraproject:fedora (medium 5.5)
- [CVE-2024-23300](https://insights.sbomify.com/CVE-2024-23300/): Use after free in GarageBand (high 7.8)
- [CVE-2024-2330](https://insights.sbomify.com/CVE-2024-2330/): Netentsec NS-ASG Application Security Gateway index.php sql injection (medium 6.3)
- [CVE-2024-23299](https://insights.sbomify.com/CVE-2024-23299/): Security feature bypass in macOS (high 8.6)
- [CVE-2024-23298](https://insights.sbomify.com/CVE-2024-23298/): Security feature bypass in Xcode (medium 4.3)
- [CVE-2024-23297](https://insights.sbomify.com/CVE-2024-23297/): Information disclosure in iOS and iPadOS (medium 5.5)
- [CVE-2024-23296](https://insights.sbomify.com/CVE-2024-23296/): Apple Multiple Products Memory Corruption (high 7.8, exploited in the wild)
- [CVE-2024-23295](https://insights.sbomify.com/CVE-2024-23295/): Misconfiguration in visionOS (medium 6.2)
- [CVE-2024-23294](https://insights.sbomify.com/CVE-2024-23294/): Other in macOS (high 7.8)
- [CVE-2024-23293](https://insights.sbomify.com/CVE-2024-23293/): Information disclosure in iOS and iPadOS (medium 4.6)
- [CVE-2024-23292](https://insights.sbomify.com/CVE-2024-23292/): Information disclosure in iOS and iPadOS (low 3.3)
- [CVE-2024-23291](https://insights.sbomify.com/CVE-2024-23291/): Information disclosure in iOS and iPadOS (high 7.5)
- [CVE-2024-23290](https://insights.sbomify.com/CVE-2024-23290/): Business logic in iOS and iPadOS (medium 5.3)
- [CVE-2024-2329](https://insights.sbomify.com/CVE-2024-2329/): Netentsec NS-ASG Application Security Gateway sql injection (medium 6.3)
- [CVE-2024-23289](https://insights.sbomify.com/CVE-2024-23289/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2024-23288](https://insights.sbomify.com/CVE-2024-23288/): Privilege escalation in iOS and iPadOS (high 8.4)
- [CVE-2024-23287](https://insights.sbomify.com/CVE-2024-23287/): Information disclosure in iOS and iPadOS (medium 6.5)
- [CVE-2024-23286](https://insights.sbomify.com/CVE-2024-23286/): Memory corruption in iOS and iPadOS (critical 9.8)
- [CVE-2024-23285](https://insights.sbomify.com/CVE-2024-23285/): Path traversal in macOS (high 7.8)
- [CVE-2024-23284](https://insights.sbomify.com/CVE-2024-23284/): Security feature bypass in Safari (medium 6.5)
- [CVE-2024-23283](https://insights.sbomify.com/CVE-2024-23283/): Information disclosure in iOS and iPadOS (medium 6.2)
- [CVE-2024-23282](https://insights.sbomify.com/CVE-2024-23282/): Security feature bypass in iOS and iPadOS (medium 5.5)
- [CVE-2024-23281](https://insights.sbomify.com/CVE-2024-23281/): Information disclosure in macOS (medium 6.2)
- [CVE-2024-23280](https://insights.sbomify.com/CVE-2024-23280/): Information disclosure in Safari (high 7.5)
- [CVE-2024-2328](https://insights.sbomify.com/CVE-2024-2328/): Real Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-23279](https://insights.sbomify.com/CVE-2024-23279/): Information disclosure in macOS (medium 5.3)
- [CVE-2024-23278](https://insights.sbomify.com/CVE-2024-23278/): Security feature bypass in iOS and iPadOS (high 7.7)
- [CVE-2024-23277](https://insights.sbomify.com/CVE-2024-23277/): Security feature bypass in iOS and iPadOS (medium 5.9)
- [CVE-2024-23276](https://insights.sbomify.com/CVE-2024-23276/): Privilege escalation in macOS (high 8.4)
- [CVE-2024-23275](https://insights.sbomify.com/CVE-2024-23275/): Race condition in macOS (medium 4.7)
- [CVE-2024-23274](https://insights.sbomify.com/CVE-2024-23274/): Privilege escalation in macOS (high 8.4)
- [CVE-2024-23273](https://insights.sbomify.com/CVE-2024-23273/): Auth bypass in Safari (medium 4.3)
- [CVE-2024-23272](https://insights.sbomify.com/CVE-2024-23272/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-23271](https://insights.sbomify.com/CVE-2024-23271/): Business logic in Safari (high 7.3)
- [CVE-2024-23270](https://insights.sbomify.com/CVE-2024-23270/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2024-2327](https://insights.sbomify.com/CVE-2024-2327/): Global Elementor Buttons <= 1.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via button link (medium 6.4)
- [CVE-2024-23269](https://insights.sbomify.com/CVE-2024-23269/): Security feature bypass in macOS (medium 6.2)
- [CVE-2024-23268](https://insights.sbomify.com/CVE-2024-23268/): Privilege escalation in macOS (high 8.4)
- [CVE-2024-23267](https://insights.sbomify.com/CVE-2024-23267/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-23266](https://insights.sbomify.com/CVE-2024-23266/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-23265](https://insights.sbomify.com/CVE-2024-23265/): Memory corruption in iOS and iPadOS (critical 9.8)
- [CVE-2024-23264](https://insights.sbomify.com/CVE-2024-23264/): Memory corruption in iOS and iPadOS (medium 5.3)
- [CVE-2024-23263](https://insights.sbomify.com/CVE-2024-23263/): Security feature bypass in Safari (high 8.1)
- [CVE-2024-23262](https://insights.sbomify.com/CVE-2024-23262/): Security feature bypass in iOS and iPadOS (medium 4.3)
- [CVE-2024-23261](https://insights.sbomify.com/CVE-2024-23261/): Business logic in macOS (high 7.5)
- [CVE-2024-23260](https://insights.sbomify.com/CVE-2024-23260/): Missing authorization in macOS (medium 5.5)
- [CVE-2024-2326](https://insights.sbomify.com/CVE-2024-2326/): Cross-site request forgery in PrettyLinks – Affiliate Links, Link Branding, Link Tracking, Marketing and Stripe Payments Plugin (medium 4.3)
- [CVE-2024-23259](https://insights.sbomify.com/CVE-2024-23259/): Denial of service in iOS and iPadOS (medium 6.5)
- [CVE-2024-23258](https://insights.sbomify.com/CVE-2024-23258/): Memory corruption in macOS (high 7.8)
- [CVE-2024-23257](https://insights.sbomify.com/CVE-2024-23257/): Memory corruption in iOS and iPadOS (low 3.3)
- [CVE-2024-23256](https://insights.sbomify.com/CVE-2024-23256/): Security feature bypass in iOS and iPadOS (low 2.4)
- [CVE-2024-23255](https://insights.sbomify.com/CVE-2024-23255/): Auth bypass in iOS and iPadOS (critical 9.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/438/