# Vulnerabilities published in 2024


- [CVE-2024-22267](https://insights.sbomify.com/CVE-2024-22267/): Use after free in VMware Fusion (critical 9.3)
- [CVE-2024-22266](https://insights.sbomify.com/CVE-2024-22266/): VMware Avi Load Balancer updates address multiple vulnerabilities (medium 6.5)
- [CVE-2024-22264](https://insights.sbomify.com/CVE-2024-22264/): VMware Avi Load Balancer updates address multiple vulnerabilities (high 7.2)
- [CVE-2024-22263](https://insights.sbomify.com/CVE-2024-22263/): Arbitrary File Write Vulnerability in Spring Cloud Data Flow (high 8.8)
- [CVE-2024-22262](https://insights.sbomify.com/CVE-2024-22262/): CVE-2024-22262: Spring Framework URL Parsing with Host Validation (high 8.1)
- [CVE-2024-22261](https://insights.sbomify.com/CVE-2024-22261/): SQL Injection in Harbor scan log API (low 2.7)
- [CVE-2024-22260](https://insights.sbomify.com/CVE-2024-22260/): Information disclosure in VMware Workspace One UEM (medium 6.8)
- [CVE-2024-2226](https://insights.sbomify.com/CVE-2024-2226/): Cross-site scripting in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (medium 6.4)
- [CVE-2024-22259](https://insights.sbomify.com/CVE-2024-22259/): CVE-2024-22259: Spring Framework URL Parsing with Host Validation (2nd report) (high 8.1)
- [CVE-2024-22258](https://insights.sbomify.com/CVE-2024-22258/): CVE-2024-22258: PKCE Downgrade in Spring Authorization Server (medium 6.1)
- [CVE-2024-22257](https://insights.sbomify.com/CVE-2024-22257/): Erroneous authentication pass in Spring Security (high 8.2)
- [CVE-2024-22256](https://insights.sbomify.com/CVE-2024-22256/): Information disclosure in VMware Cloud Director (medium 4.3)
- [CVE-2024-22255](https://insights.sbomify.com/CVE-2024-22255/): Information disclosure vulnerability (high 7.1)
- [CVE-2024-22254](https://insights.sbomify.com/CVE-2024-22254/): Out-of-bounds write vulnerability (high 7.9)
- [CVE-2024-22253](https://insights.sbomify.com/CVE-2024-22253/): Use-after-free vulnerability (critical 9.3)
- [CVE-2024-22252](https://insights.sbomify.com/CVE-2024-22252/): Use-after-free vulnerability (critical 9.3)
- [CVE-2024-22251](https://insights.sbomify.com/CVE-2024-22251/): Out-of-bounds read vulnerability (medium 5.9)
- [CVE-2024-22250](https://insights.sbomify.com/CVE-2024-22250/): Session Hijack Vulnerability in Deprecated EAP Browser Plugin (high 7.8)
- [CVE-2024-22248](https://insights.sbomify.com/CVE-2024-22248/): Open redirect in VMware SD-WAN Orchestrator (high 7.1)
- [CVE-2024-22247](https://insights.sbomify.com/CVE-2024-22247/): Auth bypass in VMware SD-WAN Edge (medium 4.8)
- [CVE-2024-22246](https://insights.sbomify.com/CVE-2024-22246/): Command injection in VMware SD-WAN Edge (high 7.4)
- [CVE-2024-22245](https://insights.sbomify.com/CVE-2024-22245/): Arbitrary Authentication Relay Vulnerability in Deprecated EAP Browser Plugin (critical 9.6)
- [CVE-2024-22244](https://insights.sbomify.com/CVE-2024-22244/): Harbor Open Redirect URL (medium 4.3)
- [CVE-2024-22243](https://insights.sbomify.com/CVE-2024-22243/): CVE-2024-22243: Spring Framework URL Parsing with Host Validation (high 8.1)
- [CVE-2024-22241](https://insights.sbomify.com/CVE-2024-22241/): Cross-site scripting in VMware Aria Operations for Networks (medium 4.3)
- [CVE-2024-22240](https://insights.sbomify.com/CVE-2024-22240/): Information disclosure in VMware Aria Operations for Networks (medium 4.9)
- [CVE-2024-2224](https://insights.sbomify.com/CVE-2024-2224/): Privilege Escalation via the GravityZone productManager UpdateServer.KitsManager API (VA-11466) (high 8.1)
- [CVE-2024-22239](https://insights.sbomify.com/CVE-2024-22239/): Privilege escalation in VMware Aria Operations for Networks (medium 5.3)
- [CVE-2024-22238](https://insights.sbomify.com/CVE-2024-22238/): Cross-site scripting in VMware Aria Operations for Networks (medium 6.4)
- [CVE-2024-22237](https://insights.sbomify.com/CVE-2024-22237/): Privilege escalation in VMware Aria Operations for Networks (high 7.8)
- [CVE-2024-22236](https://insights.sbomify.com/CVE-2024-22236/): Spring Cloud Contract vulnerable to local information disclosure (low 3.3)
- [CVE-2024-22235](https://insights.sbomify.com/CVE-2024-22235/): Privilege escalation in VMware Aria Operations (medium 6.7)
- [CVE-2024-22234](https://insights.sbomify.com/CVE-2024-22234/): CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated (high 7.4)
- [CVE-2024-22233](https://insights.sbomify.com/CVE-2024-22233/): CVE-2024-22233: Spring Framework server Web DoS Vulnerability (high 7.5)
- [CVE-2024-22232](https://insights.sbomify.com/CVE-2024-22232/): Specially crafted url can be created which leads to a directory traversal in the salt file server (high 7.7)
- [CVE-2024-22231](https://insights.sbomify.com/CVE-2024-22231/): Syndic cache directory creation is vulnerable to a directory traversal attack (medium 5.0)
- [CVE-2024-22230](https://insights.sbomify.com/CVE-2024-22230/): Cross-site scripting in Unity (medium 6.4)
- [CVE-2024-2223](https://insights.sbomify.com/CVE-2024-2223/): Incorrect Regular Expression in GravityZone Update Server (VA-11465) (high 8.1)
- [CVE-2024-22229](https://insights.sbomify.com/CVE-2024-22229/): Other in Unity (low 3.1)
- [CVE-2024-22228](https://insights.sbomify.com/CVE-2024-22228/): Command injection in Unity (high 7.8)
- [CVE-2024-22227](https://insights.sbomify.com/CVE-2024-22227/): Command injection in Unity (high 7.8)
- [CVE-2024-22226](https://insights.sbomify.com/CVE-2024-22226/): Path traversal in Unity (low 3.3)
- [CVE-2024-22225](https://insights.sbomify.com/CVE-2024-22225/): Command injection in Unity (high 7.8)
- [CVE-2024-22224](https://insights.sbomify.com/CVE-2024-22224/): Command injection in Unity (high 7.8)
- [CVE-2024-22223](https://insights.sbomify.com/CVE-2024-22223/): Command injection in Unity (high 7.8)
- [CVE-2024-22222](https://insights.sbomify.com/CVE-2024-22222/): Command injection in Unity (high 7.8)
- [CVE-2024-22221](https://insights.sbomify.com/CVE-2024-22221/): SQL injection in Unity (medium 4.5)
- [CVE-2024-22220](https://insights.sbomify.com/CVE-2024-22220/): Cross-site scripting in terminalfour:formbank (medium 6.3)
- [CVE-2024-2222](https://insights.sbomify.com/CVE-2024-2222/): Advanced Classifieds & Directory Pro <= 3.0.0 - Missing Authorization to Arbitrary Attachment Deletion (medium 4.3)
- [CVE-2024-22219](https://insights.sbomify.com/CVE-2024-22219/): XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users (medium 6.3)
- [CVE-2024-22218](https://insights.sbomify.com/CVE-2024-22218/): XML External Entity (XXE) vulnerability in Terminalfour 8.0.0001 through 8.3.18 and XML JDBC versions up to 1.0.4 allows authenticated users (high 8.8)
- [CVE-2024-22217](https://insights.sbomify.com/CVE-2024-22217/): Server-side request forgery in terminalfour:terminalfour (medium 6.5)
- [CVE-2024-22216](https://insights.sbomify.com/CVE-2024-22216/): Missing authorization in microchip:maxview storage manager (critical 9.8)
- [CVE-2024-22213](https://insights.sbomify.com/CVE-2024-22213/): Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app (not scored)
- [CVE-2024-22212](https://insights.sbomify.com/CVE-2024-22212/): Nextcloud global site selector authentication bypass (critical 9.7)
- [CVE-2024-22211](https://insights.sbomify.com/CVE-2024-22211/): FreeRDP integer Overflow leading to Heap Overflow (low 3.7)
- [CVE-2024-2221](https://insights.sbomify.com/CVE-2024-2221/): Path Traversal and Arbitrary File Upload Vulnerability in qdrant/qdrant (critical 9.8)
- [CVE-2024-22209](https://insights.sbomify.com/CVE-2024-22209/): XBlock custom auth does not respect JWT Scopes (medium 6.4)
- [CVE-2024-22208](https://insights.sbomify.com/CVE-2024-22208/): phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes (medium 6.5)
- [CVE-2024-22207](https://insights.sbomify.com/CVE-2024-22207/): Default swagger-ui configuration exposes all files in the module (medium 5.3)
- [CVE-2024-22206](https://insights.sbomify.com/CVE-2024-22206/): @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) (critical 9.1)
- [CVE-2024-22205](https://insights.sbomify.com/CVE-2024-22205/): Whoogle Search Server Side Request Forgery vulnerability (critical 9.1)
- [CVE-2024-22204](https://insights.sbomify.com/CVE-2024-22204/): Whoogle Search Limited File Write vulnerability (medium 5.3)
- [CVE-2024-22203](https://insights.sbomify.com/CVE-2024-22203/): Whoogle Search Server Side Request Forgery vulnerability (critical 9.1)
- [CVE-2024-22202](https://insights.sbomify.com/CVE-2024-22202/): User Removal Page Allows Spoofing Of User Details (medium 5.7)
- [CVE-2024-22201](https://insights.sbomify.com/CVE-2024-22201/): Jetty connection leaking on idle timeout when TCP congested (high 7.5)
- [CVE-2024-22200](https://insights.sbomify.com/CVE-2024-22200/): vantage6-UI docker image leaks software version information (low 3.3)
- [CVE-2024-2220](https://insights.sbomify.com/CVE-2024-2220/): Button contact VR <= 4.7 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-22199](https://insights.sbomify.com/CVE-2024-22199/): Django Template Engine Vulnerable to XSS (critical 9.3)
- [CVE-2024-22198](https://insights.sbomify.com/CVE-2024-22198/): Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268) (high 7.1)
- [CVE-2024-22197](https://insights.sbomify.com/CVE-2024-22197/): Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269) (high 7.7)
- [CVE-2024-22196](https://insights.sbomify.com/CVE-2024-22196/): Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270) (high 7.0)
- [CVE-2024-22195](https://insights.sbomify.com/CVE-2024-22195/): Jinja vulnerable to Cross-Site Scripting (XSS) (medium 5.4)
- [CVE-2024-22194](https://insights.sbomify.com/CVE-2024-22194/): cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code (low 2.2)
- [CVE-2024-22193](https://insights.sbomify.com/CVE-2024-22193/): vantage6 unencrypted task can be created in encrypted collaboration (low 3.5)
- [CVE-2024-22192](https://insights.sbomify.com/CVE-2024-22192/): Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holders (medium 6.5)
- [CVE-2024-22191](https://insights.sbomify.com/CVE-2024-22191/): Stored cross-site scripting (XSS) in `key_value` field in Avo (high 7.3)
- [CVE-2024-22190](https://insights.sbomify.com/CVE-2024-22190/): Untrusted search path under some conditions on Windows allows arbitrary code execution (high 7.8)
- [CVE-2024-22189](https://insights.sbomify.com/CVE-2024-22189/): QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack (high 7.5)
- [CVE-2024-22188](https://insights.sbomify.com/CVE-2024-22188/): TYPO3 Install Tool vulnerable to Code Execution (high 7.2)
- [CVE-2024-22187](https://insights.sbomify.com/CVE-2024-22187/): Memory corruption in P3-550E (critical 9.1)
- [CVE-2024-22186](https://insights.sbomify.com/CVE-2024-22186/): Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking (high 8.7)
- [CVE-2024-22185](https://insights.sbomify.com/CVE-2024-22185/): Race condition in Intel(R) processors with Intel(R) ACTM (high 8.5)
- [CVE-2024-22184](https://insights.sbomify.com/CVE-2024-22184/): Privilege escalation in Intel(R) Quartus(R) Prime Pro Edition Design Software (medium 5.4)
- [CVE-2024-22182](https://insights.sbomify.com/CVE-2024-22182/): Commend WS203VICM Argument Injection (high 8.6)
- [CVE-2024-22181](https://insights.sbomify.com/CVE-2024-22181/): Memory corruption in libigl (high 7.8)
- [CVE-2024-22180](https://insights.sbomify.com/CVE-2024-22180/): Camera has a use after free vulnerability (low 3.3)
- [CVE-2024-2218](https://insights.sbomify.com/CVE-2024-2218/): LuckyWP Table of Contents <= 2.1.4 - Admin+ Stored XSS (medium 4.6)
- [CVE-2024-22179](https://insights.sbomify.com/CVE-2024-22179/): Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data (high 8.7)
- [CVE-2024-22178](https://insights.sbomify.com/CVE-2024-22178/): Path traversal in OAS Platform (medium 4.9)
- [CVE-2024-22177](https://insights.sbomify.com/CVE-2024-22177/): Audio has an improper preservation of permissions vulnerability (low 3.3)
- [CVE-2024-22170](https://insights.sbomify.com/CVE-2024-22170/): Unchecked buffer in Dynamic DNS client (critical 9.2)
- [CVE-2024-2217](https://insights.sbomify.com/CVE-2024-2217/): Improper Access Control in gaizhenbiao/chuanhuchatgpt (high 7.5)
- [CVE-2024-22169](https://insights.sbomify.com/CVE-2024-22169/): Misconfiguration in node.js causing a code execution in WD Discovery (high 7.1)
- [CVE-2024-22168](https://insights.sbomify.com/CVE-2024-22168/): Cross-Site Scripting (XSS) vulnerability on Western Digital My Cloud and SanDisk ibi Web Apps (medium 5.9)
- [CVE-2024-22167](https://insights.sbomify.com/CVE-2024-22167/): SanDisk PrivateAccess DLL Hijacking Vulnerability (high 7.9)
- [CVE-2024-22165](https://insights.sbomify.com/CVE-2024-22165/): Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creation (medium 6.5)
- [CVE-2024-22164](https://insights.sbomify.com/CVE-2024-22164/): Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachments (medium 4.3)
- [CVE-2024-22163](https://insights.sbomify.com/CVE-2024-22163/): WordPress Shield Security Plugin <= 18.5.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-22162](https://insights.sbomify.com/CVE-2024-22162/): WordPress WPZOOM Shortcodes Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/445/