# Vulnerabilities published in 2024


- [CVE-2024-22476](https://insights.sbomify.com/CVE-2024-22476/): Other in Intel(R) Neural Compressor software (critical 10.0)
- [CVE-2024-22475](https://insights.sbomify.com/CVE-2024-22475/): Cross-site request forgery in Multiple printers and scanners (medium 6.1)
- [CVE-2024-22473](https://insights.sbomify.com/CVE-2024-22473/): Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices (medium 6.8)
- [CVE-2024-22472](https://insights.sbomify.com/CVE-2024-22472/): Long S0 frames received by 500 series Z-Wave devices may cause buffer overflow (high 8.1)
- [CVE-2024-2247](https://insights.sbomify.com/CVE-2024-2247/): JFrog Artifactory Cross-Site Scripting (high 8.8)
- [CVE-2024-22464](https://insights.sbomify.com/CVE-2024-22464/): Information disclosure in AppSync (medium 6.2)
- [CVE-2024-22463](https://insights.sbomify.com/CVE-2024-22463/): Weak cryptography in PowerScale OneFS (high 7.4)
- [CVE-2024-22461](https://insights.sbomify.com/CVE-2024-22461/): Command injection in RecoverPoint for Virtual Machines (high 8.8)
- [CVE-2024-22460](https://insights.sbomify.com/CVE-2024-22460/): Deserialization in Data Manager Appliance Software (DMAS) (low 2.2)
- [CVE-2024-22459](https://insights.sbomify.com/CVE-2024-22459/): Missing authorization in ECS (medium 6.8)
- [CVE-2024-22458](https://insights.sbomify.com/CVE-2024-22458/): Weak cryptography in Secure Connect Gateway (SCG) 5.0 Appliance - SRS (low 3.7)
- [CVE-2024-22457](https://insights.sbomify.com/CVE-2024-22457/): Auth bypass in Secure Connect Gateway (SCG) 5.0 Appliance - SRS (high 7.1)
- [CVE-2024-22455](https://insights.sbomify.com/CVE-2024-22455/): Missing authorization in Mobility - E-Lab Navigator (medium 4.4)
- [CVE-2024-22454](https://insights.sbomify.com/CVE-2024-22454/): Auth bypass in PowerProtect Data Manager (high 8.8)
- [CVE-2024-22453](https://insights.sbomify.com/CVE-2024-22453/): Memory corruption in PowerEdge Platform (high 7.2)
- [CVE-2024-22452](https://insights.sbomify.com/CVE-2024-22452/): Privilege escalation in Dell Display and Peripheral Manager (high 7.3)
- [CVE-2024-22451](https://insights.sbomify.com/CVE-2024-22451/): Other in Peripheral Manager (medium 6.7)
- [CVE-2024-22450](https://insights.sbomify.com/CVE-2024-22450/): Privilege escalation in Alienware Command Center (AWCC) (high 7.4)
- [CVE-2024-2245](https://insights.sbomify.com/CVE-2024-2245/): Cross-Site Scripting vulnerability in moziloCMS (medium 5.4)
- [CVE-2024-22449](https://insights.sbomify.com/CVE-2024-22449/): Missing authorization in PowerScale OneFS (medium 6.6)
- [CVE-2024-22448](https://insights.sbomify.com/CVE-2024-22448/): Memory corruption in CPG BIOS (medium 4.7)
- [CVE-2024-22447](https://insights.sbomify.com/CVE-2024-22447/): Other in Peripheral Manager (medium 6.7)
- [CVE-2024-22445](https://insights.sbomify.com/CVE-2024-22445/): Command injection in PowerProtect Data Manager (high 7.2)
- [CVE-2024-22444](https://insights.sbomify.com/CVE-2024-22444/): Cross-site scripting in HPE Aruba Networking EdgeConnect SD-WAN Orchestrator (medium 6.1)
- [CVE-2024-22443](https://insights.sbomify.com/CVE-2024-22443/): Code injection in HPE Aruba Networking EdgeConnect SD-WAN Orchestrator (high 7.2)
- [CVE-2024-22442](https://insights.sbomify.com/CVE-2024-22442/): Auth bypass in HPE 3PAR Service Processor (critical 9.8)
- [CVE-2024-22441](https://insights.sbomify.com/CVE-2024-22441/): Auth bypass in Cray System Management Software - PALS (critical 9.8)
- [CVE-2024-22440](https://insights.sbomify.com/CVE-2024-22440/): HPE Compute Scale-up Server 3200 Server, Disclosure of Sensitive Information (medium 6.8)
- [CVE-2024-2244](https://insights.sbomify.com/CVE-2024-2244/): Auth bypass in Asset Suite EAM (medium 5.3)
- [CVE-2024-22439](https://insights.sbomify.com/CVE-2024-22439/): Certain HPE FlexNetwork and FlexFabric Switches, Remote Authentication Bypass (medium 6.9)
- [CVE-2024-22438](https://insights.sbomify.com/CVE-2024-22438/): HPE OfficeConnect 1820 Network switches, Cross-Site Request Forgery (CSRF) (low 3.5)
- [CVE-2024-22437](https://insights.sbomify.com/CVE-2024-22437/): HPE MSA SAN Storage VSS Provider and CAPI Proxy Software, Elevation of Privilege (high 7.3)
- [CVE-2024-22436](https://insights.sbomify.com/CVE-2024-22436/): Denial of service in IceWall Gen11, IceWall SSO Agent (medium 6.5)
- [CVE-2024-22435](https://insights.sbomify.com/CVE-2024-22435/): HPE NonStop Web ViewPoint Enterprise software, Unauthorized access (high 8.3)
- [CVE-2024-22433](https://insights.sbomify.com/CVE-2024-22433/): Information disclosure in Data Protection Search (high 8.8)
- [CVE-2024-22432](https://insights.sbomify.com/CVE-2024-22432/): Information disclosure in NetWorker Module for Databases and Applications - Oracle (high 7.8)
- [CVE-2024-22430](https://insights.sbomify.com/CVE-2024-22430/): Misconfiguration in PowerScale OneFS (medium 5.5)
- [CVE-2024-2243](https://insights.sbomify.com/CVE-2024-2243/): Csmock: command injection vulnerability in csmock-plugin-snyk (high 7.6)
- [CVE-2024-22429](https://insights.sbomify.com/CVE-2024-22429/): Other in CPG BIOS (high 7.5)
- [CVE-2024-22428](https://insights.sbomify.com/CVE-2024-22428/): Misconfiguration in iDRAC Service Module (iSM) (high 7.0)
- [CVE-2024-22426](https://insights.sbomify.com/CVE-2024-22426/): Command injection in RecoverPoint for VMs (high 7.2)
- [CVE-2024-22425](https://insights.sbomify.com/CVE-2024-22425/): Auth bypass in RecoverPoint for VMs (medium 6.5)
- [CVE-2024-22424](https://insights.sbomify.com/CVE-2024-22424/): Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd (high 8.4)
- [CVE-2024-22423](https://insights.sbomify.com/CVE-2024-22423/): yt-dlp `--exec` command injection when using `%q` in yt-dlp on Windows (high 8.4)
- [CVE-2024-22422](https://insights.sbomify.com/CVE-2024-22422/): Unauthenticated Denial of Service (DOS) attack in AnythingLLM (high 7.5)
- [CVE-2024-22421](https://insights.sbomify.com/CVE-2024-22421/): Potential authentication and CSRF tokens leak in JupyterLab (high 7.6)
- [CVE-2024-22420](https://insights.sbomify.com/CVE-2024-22420/): Stored cross site scripting in Markdown Preview in JupyterLab (medium 6.5)
- [CVE-2024-2242](https://insights.sbomify.com/CVE-2024-2242/): Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-22419](https://insights.sbomify.com/CVE-2024-22419/): concat built-in can corrupt memory in vyper (high 7.3)
- [CVE-2024-22418](https://insights.sbomify.com/CVE-2024-22418/): Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice (medium 6.5)
- [CVE-2024-22417](https://insights.sbomify.com/CVE-2024-22417/): Whoogle Search Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-22416](https://insights.sbomify.com/CVE-2024-22416/): Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation (critical 9.7)
- [CVE-2024-22415](https://insights.sbomify.com/CVE-2024-22415/): Unsecured endpoints in the jupyter-lsp server extension (high 7.3)
- [CVE-2024-22414](https://insights.sbomify.com/CVE-2024-22414/): User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlog (medium 6.5)
- [CVE-2024-22412](https://insights.sbomify.com/CVE-2024-22412/): ClickHouse's Role-based Access Control is bypassed when query caching is enabled. (low 2.4)
- [CVE-2024-22411](https://insights.sbomify.com/CVE-2024-22411/): Cross site scripting in Action messages on Avo (medium 6.5)
- [CVE-2024-22410](https://insights.sbomify.com/CVE-2024-22410/): Binary Planting Attack on Windows Platforms in Creditcoin (low 3.3)
- [CVE-2024-2241](https://insights.sbomify.com/CVE-2024-2241/): Missing authorization in Workspace (medium 6.3)
- [CVE-2024-22409](https://insights.sbomify.com/CVE-2024-22409/): Default Privileges allow for high level operations for low privileged users in datahub (high 7.5)
- [CVE-2024-22408](https://insights.sbomify.com/CVE-2024-22408/): Server-Side Request Forgery (SSRF) in Shopware Flow Builder (high 7.6)
- [CVE-2024-22407](https://insights.sbomify.com/CVE-2024-22407/): Broken Access Control order API in Shopware (medium 4.9)
- [CVE-2024-22406](https://insights.sbomify.com/CVE-2024-22406/): Blind SQL-injection in DAL aggregations in Shopware (critical 9.3)
- [CVE-2024-22405](https://insights.sbomify.com/CVE-2024-22405/): XADMaster may not apply quarantine attribute correctly to extracted files (medium 5.5)
- [CVE-2024-22404](https://insights.sbomify.com/CVE-2024-22404/): Permissions bypass in Nextcloud with the files zip app (medium 4.1)
- [CVE-2024-22403](https://insights.sbomify.com/CVE-2024-22403/): OAuth2 authorization codes are valid indefinetly in Nextcloud server (low 3.0)
- [CVE-2024-22402](https://insights.sbomify.com/CVE-2024-22402/): Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist (medium 5.4)
- [CVE-2024-22401](https://insights.sbomify.com/CVE-2024-22401/): All users can reset the allowed apps list for Nextcloud Guest App users (medium 4.1)
- [CVE-2024-22400](https://insights.sbomify.com/CVE-2024-22400/): Open redirect in user_saml via RelayState parameter in Nextcloud User Saml (low 3.1)
- [CVE-2024-2240](https://insights.sbomify.com/CVE-2024-2240/): Docker implementation in Brocade SANnav is missing Audit Rules. (high 8.6)
- [CVE-2024-22399](https://insights.sbomify.com/CVE-2024-22399/): Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server (critical 9.8)
- [CVE-2024-22398](https://insights.sbomify.com/CVE-2024-22398/): Path traversal in Email Security (medium 4.9)
- [CVE-2024-22397](https://insights.sbomify.com/CVE-2024-22397/): Cross-site scripting in SonicOS (high 8.3)
- [CVE-2024-22396](https://insights.sbomify.com/CVE-2024-22396/): Integer overflow in SonicOS (medium 5.3)
- [CVE-2024-22395](https://insights.sbomify.com/CVE-2024-22395/): Auth bypass in SMA100 (medium 6.3)
- [CVE-2024-22394](https://insights.sbomify.com/CVE-2024-22394/): Auth bypass in SonicOS (critical 9.8)
- [CVE-2024-22393](https://insights.sbomify.com/CVE-2024-22393/): Apache Answer: Pixel Flood Attack by uploading the large pixel file (critical 9.1)
- [CVE-2024-22391](https://insights.sbomify.com/CVE-2024-22391/): Memory corruption in Grassroot DICOM (high 7.7)
- [CVE-2024-22390](https://insights.sbomify.com/CVE-2024-22390/): Denial of service in Intel(R) FPGA products (medium 4.4)
- [CVE-2024-2239](https://insights.sbomify.com/CVE-2024-2239/): Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Premium Magic Scroll Module (medium 6.4)
- [CVE-2024-22389](https://insights.sbomify.com/CVE-2024-22389/): BIG-IP iControl REST API Vulnerability (high 7.2)
- [CVE-2024-22388](https://insights.sbomify.com/CVE-2024-22388/): Insecure Default Initialization of Resource in HID Global (medium 5.9)
- [CVE-2024-22387](https://insights.sbomify.com/CVE-2024-22387/): Missing authorization in Controller 6000 and Controller 7000 (medium 6.8)
- [CVE-2024-22386](https://insights.sbomify.com/CVE-2024-22386/): Race condition vulnerability in Linux kernel drm/exynos exynos_drm_crtc_atomic_disable (medium 5.3)
- [CVE-2024-22385](https://insights.sbomify.com/CVE-2024-22385/): File and Directory Permission Vulnerability in Hitachi Storage Provider for VMware vCenter (medium 4.4)
- [CVE-2024-22384](https://insights.sbomify.com/CVE-2024-22384/): Memory corruption in Intel(R) Trace Analyzer and Collector software (low 2.8)
- [CVE-2024-22383](https://insights.sbomify.com/CVE-2024-22383/): Denial of service in Controller 7000 (medium 6.2)
- [CVE-2024-22382](https://insights.sbomify.com/CVE-2024-22382/): Privilege escalation in PprRequestLog module in UEFI firmware for some Intel(R) Server D50DNP Family products (high 7.5)
- [CVE-2024-22380](https://insights.sbomify.com/CVE-2024-22380/): XML external entity in Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) March, Heisei 31 era edition (medium 5.5)
- [CVE-2024-2238](https://insights.sbomify.com/CVE-2024-2238/): Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Mouse Cursor Module (medium 6.4)
- [CVE-2024-22379](https://insights.sbomify.com/CVE-2024-22379/): Privilege escalation in Intel(R) Inspector software (medium 6.7)
- [CVE-2024-22378](https://insights.sbomify.com/CVE-2024-22378/): Misconfiguration in Intel Unite(R) Client Extended Display Plugin software installers (medium 5.4)
- [CVE-2024-22377](https://insights.sbomify.com/CVE-2024-22377/): PingFederate Runtime Node Path Traversal (medium 5.3)
- [CVE-2024-22376](https://insights.sbomify.com/CVE-2024-22376/): Privilege escalation in installation software for Intel(R) Ethernet Adapter Driver Pack (medium 5.4)
- [CVE-2024-22374](https://insights.sbomify.com/CVE-2024-22374/): Denial of service in Intel(R) Xeon Processors (medium 6.8)
- [CVE-2024-22373](https://insights.sbomify.com/CVE-2024-22373/): Memory corruption in Grassroot DICOM (high 8.1)
- [CVE-2024-22372](https://insights.sbomify.com/CVE-2024-22372/): Command injection in WRC-X1500GS-B (medium 6.8)
- [CVE-2024-22371](https://insights.sbomify.com/CVE-2024-22371/): Apache Camel issue on ExchangeCreatedEvent (low 2.9)
- [CVE-2024-22370](https://insights.sbomify.com/CVE-2024-22370/): Cross-site scripting in YouTrack (medium 4.6)
- [CVE-2024-2237](https://insights.sbomify.com/CVE-2024-2237/): Premium Addons PRO <= 2.9.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Global Badge Module (medium 6.4)
- [CVE-2024-22369](https://insights.sbomify.com/CVE-2024-22369/): Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository (high 7.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/443/