# Vulnerabilities published in 2024


- [CVE-2024-2193](https://insights.sbomify.com/CVE-2024-2193/): Race condition in CPU (medium 5.7)
- [CVE-2024-21927](https://insights.sbomify.com/CVE-2024-21927/): Denial of service in AMD Instinct™ MI300X (medium 5.0)
- [CVE-2024-21925](https://insights.sbomify.com/CVE-2024-21925/): Memory corruption in AMD Athlon™ 3000 Series Desktop Processors with Radeon™ Graphics (high 8.2)
- [CVE-2024-21924](https://insights.sbomify.com/CVE-2024-21924/): Privilege escalation in AMD EPYC™ 7002 Processors (high 8.2)
- [CVE-2024-21923](https://insights.sbomify.com/CVE-2024-21923/): Privilege escalation in AMD StoreMI™ (high 7.3)
- [CVE-2024-21922](https://insights.sbomify.com/CVE-2024-21922/): Privilege escalation in AMD StoreMI™ (high 7.3)
- [CVE-2024-21920](https://insights.sbomify.com/CVE-2024-21920/): Rockwell Automation Arena Simulation Vulnerable To Buffer Overflow (medium 4.4)
- [CVE-2024-21919](https://insights.sbomify.com/CVE-2024-21919/): Rockwell Automation Arena Simulation Vulnerable To Uninitialized Pointer (high 7.8)
- [CVE-2024-21918](https://insights.sbomify.com/CVE-2024-21918/): Rockwell Automation Arena Simulation Vulnerable To Memory Corruption (high 7.8)
- [CVE-2024-21917](https://insights.sbomify.com/CVE-2024-21917/): Rockwell Automation FactoryTalk® Service Platform Service Token Vulnerability (critical 9.8)
- [CVE-2024-21916](https://insights.sbomify.com/CVE-2024-21916/): Rockwell Automation Denial-of-service Vulnerability in ICE1 Controller (high 8.6)
- [CVE-2024-21915](https://insights.sbomify.com/CVE-2024-21915/): Rockwell Automation FactoryTalk® Service Platform Elevated Privileges Vulnerability Through Web Service Functionality (critical 9.0)
- [CVE-2024-21914](https://insights.sbomify.com/CVE-2024-21914/): Rockwell Automation - FactoryTalk® View ME on PanelView™ Plus 7 Boot Terminal lack Security Protections (medium 5.3)
- [CVE-2024-21913](https://insights.sbomify.com/CVE-2024-21913/): Rockwell Automation Arena Simulation Vulnerable To Memory Corruption (high 7.8)
- [CVE-2024-21912](https://insights.sbomify.com/CVE-2024-21912/): Rockwell Automation Arena Simulation vulnerable to out of bounds write (high 7.8)
- [CVE-2024-21911](https://insights.sbomify.com/CVE-2024-21911/): Cross-site scripting vulnerability in TinyMCE (medium 6.1)
- [CVE-2024-21910](https://insights.sbomify.com/CVE-2024-21910/): Cross-site scripting vulnerability in TinyMCE plugins (medium 6.1)
- [CVE-2024-2191](https://insights.sbomify.com/CVE-2024-2191/): Improper Access Control in GitLab (medium 5.3)
- [CVE-2024-21909](https://insights.sbomify.com/CVE-2024-21909/): Denial of service in CBOR library (high 7.5)
- [CVE-2024-21908](https://insights.sbomify.com/CVE-2024-21908/): Cross-site scripting vulnerability in TinyMCE (medium 6.1)
- [CVE-2024-21907](https://insights.sbomify.com/CVE-2024-21907/): Improper Handling of Exceptional Conditions in Newtonsoft.Json (high 7.5)
- [CVE-2024-21906](https://insights.sbomify.com/CVE-2024-21906/): QTS, QuTS hero (medium 4.7)
- [CVE-2024-21905](https://insights.sbomify.com/CVE-2024-21905/): QTS, QuTS hero, QuTScloud (medium 6.5)
- [CVE-2024-21904](https://insights.sbomify.com/CVE-2024-21904/): QTS, QuTS hero (medium 5.9)
- [CVE-2024-21903](https://insights.sbomify.com/CVE-2024-21903/): QTS, QuTS hero (medium 6.6)
- [CVE-2024-21902](https://insights.sbomify.com/CVE-2024-21902/): QTS, QuTS hero (medium 6.4)
- [CVE-2024-21901](https://insights.sbomify.com/CVE-2024-21901/): myQNAPcloud (medium 4.7)
- [CVE-2024-21900](https://insights.sbomify.com/CVE-2024-21900/): QTS, QuTS hero, QuTScloud (medium 4.3)
- [CVE-2024-21899](https://insights.sbomify.com/CVE-2024-21899/): QTS, QuTS hero, QuTScloud (critical 9.8)
- [CVE-2024-21898](https://insights.sbomify.com/CVE-2024-21898/): QTS, QuTS hero (high 8.8)
- [CVE-2024-21897](https://insights.sbomify.com/CVE-2024-21897/): QTS, QuTS hero (high 8.9)
- [CVE-2024-21896](https://insights.sbomify.com/CVE-2024-21896/): Path traversal in Node (high 7.9)
- [CVE-2024-21894](https://insights.sbomify.com/CVE-2024-21894/): Memory corruption in Connect Secure (high 8.2)
- [CVE-2024-21893](https://insights.sbomify.com/CVE-2024-21893/): Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) (high 8.2, exploited in the wild)
- [CVE-2024-21892](https://insights.sbomify.com/CVE-2024-21892/): Privilege escalation in Node (high 7.5)
- [CVE-2024-21891](https://insights.sbomify.com/CVE-2024-21891/): Path traversal in Node (high 7.9)
- [CVE-2024-21890](https://insights.sbomify.com/CVE-2024-21890/): Security feature bypass in Node (medium 5.0)
- [CVE-2024-2189](https://insights.sbomify.com/CVE-2024-2189/): Social Icons Widget & Block < 4.2.18 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-21888](https://insights.sbomify.com/CVE-2024-21888/): Privilege escalation in ICS (high 8.8)
- [CVE-2024-21887](https://insights.sbomify.com/CVE-2024-21887/): Ivanti Connect Secure and Policy Secure Command Injection (critical 9.1, exploited in the wild)
- [CVE-2024-21886](https://insights.sbomify.com/CVE-2024-21886/): Xorg-x11-server: heap buffer overflow in disabledevice (high 7.8)
- [CVE-2024-21885](https://insights.sbomify.com/CVE-2024-21885/): Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent (high 7.8)
- [CVE-2024-21881](https://insights.sbomify.com/CVE-2024-21881/): Upload of encrypted packages allows authenticated command execution in Enphase IQ Gateway v4.x and v5.x (high 8.6)
- [CVE-2024-21880](https://insights.sbomify.com/CVE-2024-21880/): Command injection in Envoy (high 8.6)
- [CVE-2024-2188](https://insights.sbomify.com/CVE-2024-2188/): Cross-Site Scripting vulnerability in TP-Link Archer AX50 (medium 6.1)
- [CVE-2024-21879](https://insights.sbomify.com/CVE-2024-21879/): Command injection in Envoy (high 8.7)
- [CVE-2024-21878](https://insights.sbomify.com/CVE-2024-21878/): Command injection in Envoy (high 7.1)
- [CVE-2024-21877](https://insights.sbomify.com/CVE-2024-21877/): Insecure File Generation Based on User Input in Enphase IQ Gateway version 4.x to 8.x and < 8.2.4225 (high 8.6)
- [CVE-2024-21876](https://insights.sbomify.com/CVE-2024-21876/): Unauthenticated Path Traversal via URL Parameter in Enphase IQ Gateway version < 8.2.4225 (critical 9.3)
- [CVE-2024-21875](https://insights.sbomify.com/CVE-2024-21875/): DoS attack when broadcasting billboard messages (medium 6.5)
- [CVE-2024-21872](https://insights.sbomify.com/CVE-2024-21872/): Electrolink FM/DAB/TV Transmitter Reliance on Cookies without Validation and Integrity Checking (high 8.7)
- [CVE-2024-21871](https://insights.sbomify.com/CVE-2024-21871/): Privilege escalation in UEFI firmware for some Intel(R) Processors (high 7.3)
- [CVE-2024-21870](https://insights.sbomify.com/CVE-2024-21870/): Path traversal in OAS Platform (medium 4.9)
- [CVE-2024-2187](https://insights.sbomify.com/CVE-2024-2187/): Cross-site scripting in WPZOOM Addons for Beaver Builder (medium 6.4)
- [CVE-2024-21869](https://insights.sbomify.com/CVE-2024-21869/): Plaintext Storage of a Password in Rapid SCADA (medium 6.2)
- [CVE-2024-21866](https://insights.sbomify.com/CVE-2024-21866/): Generation of Error Message Containing Sensitive Information in Rapid SCADA (medium 5.3)
- [CVE-2024-21865](https://insights.sbomify.com/CVE-2024-21865/): Hardcoded credentials in HGW BL1500HM (medium 6.5)
- [CVE-2024-21864](https://insights.sbomify.com/CVE-2024-21864/): Privilege escalation in Intel(R) Arc(TM) & Iris(R) Xe Graphics software (high 7.8)
- [CVE-2024-21863](https://insights.sbomify.com/CVE-2024-21863/): Dsoftbus has an improper input validation vulnerability (medium 4.7)
- [CVE-2024-21862](https://insights.sbomify.com/CVE-2024-21862/): Privilege escalation in Intel(R) Quartus(R) Prime Standard Edition Design software (medium 6.7)
- [CVE-2024-21861](https://insights.sbomify.com/CVE-2024-21861/): Privilege escalation in Intel(R) GPA Framework software (medium 6.7)
- [CVE-2024-21860](https://insights.sbomify.com/CVE-2024-21860/): Dsoftbus has a use after free vulnerability (high 8.2)
- [CVE-2024-2186](https://insights.sbomify.com/CVE-2024-2186/): Cross-site scripting in WPZOOM Addons for Beaver Builder (medium 6.4)
- [CVE-2024-21859](https://insights.sbomify.com/CVE-2024-21859/): Memory corruption in Intel(R) Processors (medium 6.8)
- [CVE-2024-21857](https://insights.sbomify.com/CVE-2024-21857/): Privilege escalation in Intel(R) oneAPI Compiler software (medium 5.4)
- [CVE-2024-21855](https://insights.sbomify.com/CVE-2024-21855/): Auth bypass in GoCast (critical 9.8)
- [CVE-2024-21853](https://insights.sbomify.com/CVE-2024-21853/): Denial of service in 4th and 5th Generation Intel(R) Xeon(R) Processors (medium 5.7)
- [CVE-2024-21852](https://insights.sbomify.com/CVE-2024-21852/): Rapid SCADA Path Traversal (high 8.8)
- [CVE-2024-21851](https://insights.sbomify.com/CVE-2024-21851/): Dsoftbus has an integer overflow vulnerability (low 2.9)
- [CVE-2024-21850](https://insights.sbomify.com/CVE-2024-21850/): Information disclosure in Intel(R) TDX Seamldr module software (high 8.3)
- [CVE-2024-2185](https://insights.sbomify.com/CVE-2024-2185/): Cross-site scripting in WPZOOM Addons for Beaver Builder (medium 6.4)
- [CVE-2024-21849](https://insights.sbomify.com/CVE-2024-21849/): BIG-IP Websockets vulnerability (high 7.5)
- [CVE-2024-21848](https://insights.sbomify.com/CVE-2024-21848/): Users maintain access to active call after being removed from a channel (low 3.1)
- [CVE-2024-21846](https://insights.sbomify.com/CVE-2024-21846/): Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function (medium 6.9)
- [CVE-2024-21845](https://insights.sbomify.com/CVE-2024-21845/): Dsoftbus has an integer overflow vulnerability (low 2.9)
- [CVE-2024-21844](https://insights.sbomify.com/CVE-2024-21844/): Integer overflow in Intel(R) CSME (medium 5.3)
- [CVE-2024-21843](https://insights.sbomify.com/CVE-2024-21843/): Privilege escalation in Intel(R) Computing Improvement Program software (medium 6.7)
- [CVE-2024-21841](https://insights.sbomify.com/CVE-2024-21841/): Privilege escalation in Intel(R) Distribution for GDB software (medium 6.7)
- [CVE-2024-21840](https://insights.sbomify.com/CVE-2024-21840/): Directory and File Permission Vulnerability in Hitachi Storage Plug-in for VMware vCenter (high 7.9)
- [CVE-2024-2184](https://insights.sbomify.com/CVE-2024-2184/): Memory corruption in C1127P (critical 9.8)
- [CVE-2024-21838](https://insights.sbomify.com/CVE-2024-21838/): Cross-site scripting in Command Centre Server (medium 6.8)
- [CVE-2024-21837](https://insights.sbomify.com/CVE-2024-21837/): Privilege escalation in Intel(R) Quartus(R) Prime Lite Edition Design software (medium 6.7)
- [CVE-2024-21836](https://insights.sbomify.com/CVE-2024-21836/): Memory corruption in llama.cpp (high 8.8)
- [CVE-2024-21835](https://insights.sbomify.com/CVE-2024-21835/): Privilege escalation in Intel(R) XTU software (medium 6.7)
- [CVE-2024-21834](https://insights.sbomify.com/CVE-2024-21834/): Arkui has a type confusion vulnerability (low 3.3)
- [CVE-2024-21833](https://insights.sbomify.com/CVE-2024-21833/): Command injection in Archer AX3000 (high 8.8)
- [CVE-2024-21832](https://insights.sbomify.com/CVE-2024-21832/): PingFederate REST API Data Store Injection (low 3.5)
- [CVE-2024-21831](https://insights.sbomify.com/CVE-2024-21831/): Privilege escalation in Intel(R) Processor Diagnostic Tool software (medium 6.7)
- [CVE-2024-21830](https://insights.sbomify.com/CVE-2024-21830/): Privilege escalation in Intel(R) VPL software (medium 5.4)
- [CVE-2024-2183](https://insights.sbomify.com/CVE-2024-2183/): Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading Widget (medium 6.4)
- [CVE-2024-21829](https://insights.sbomify.com/CVE-2024-21829/): Privilege escalation in Intel(R) Processors (high 8.7)
- [CVE-2024-21828](https://insights.sbomify.com/CVE-2024-21828/): Privilege escalation in Intel(R) Ethernet Controller Administrative Tools software (medium 6.7)
- [CVE-2024-21827](https://insights.sbomify.com/CVE-2024-21827/): Command injection in ER7206 Omada Gigabit VPN Router (high 7.2)
- [CVE-2024-21826](https://insights.sbomify.com/CVE-2024-21826/): Huks has an insecure storage of sensitive information vulnerability (medium 4.3)
- [CVE-2024-21825](https://insights.sbomify.com/CVE-2024-21825/): Memory corruption in llama.cpp (high 8.8)
- [CVE-2024-21824](https://insights.sbomify.com/CVE-2024-21824/): Auth bypass in Multiple printers and scanners (medium 5.3)
- [CVE-2024-21823](https://insights.sbomify.com/CVE-2024-21823/): Race condition in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generation Xeon(R) processors (high 7.5)
- [CVE-2024-21821](https://insights.sbomify.com/CVE-2024-21821/): Command injection in Archer AX3000 (high 8.0)
- [CVE-2024-21820](https://insights.sbomify.com/CVE-2024-21820/): Misconfiguration in Intel(R) Xeon(R) processor memory controller configurations when using Intel(R) SGX (high 8.5)
- [CVE-2024-2182](https://insights.sbomify.com/CVE-2024-2182/): Ovn: insufficient validation of bfd packets may lead to denial of service (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/448/