# Vulnerabilities published in 2024


- [CVE-2024-21818](https://insights.sbomify.com/CVE-2024-21818/): Privilege escalation in Intel(R) PCM software (medium 6.7)
- [CVE-2024-21816](https://insights.sbomify.com/CVE-2024-21816/): Background task manager has an improper preservation of permissions vulnerability (medium 4.0)
- [CVE-2024-21815](https://insights.sbomify.com/CVE-2024-21815/): Information disclosure in Command Centre Server (critical 9.1)
- [CVE-2024-21814](https://insights.sbomify.com/CVE-2024-21814/): Privilege escalation in Intel(R) Chipset Device Software (medium 6.7)
- [CVE-2024-21813](https://insights.sbomify.com/CVE-2024-21813/): Privilege escalation in Intel(R) DTT software installers (high 7.9)
- [CVE-2024-21812](https://insights.sbomify.com/CVE-2024-21812/): Integer overflow in libbiosig (critical 9.8)
- [CVE-2024-21810](https://insights.sbomify.com/CVE-2024-21810/): Privilege escalation in Intel(R) Ethernet Network Controllers and Adapters (critical 9.3)
- [CVE-2024-2181](https://insights.sbomify.com/CVE-2024-2181/): Beaver Builder Addons by WPZOOM <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget (medium 6.4)
- [CVE-2024-21809](https://insights.sbomify.com/CVE-2024-21809/): Privilege escalation in Intel(R) Quartus(R) Prime Lite Edition Design software (medium 6.7)
- [CVE-2024-21808](https://insights.sbomify.com/CVE-2024-21808/): Memory corruption in Intel(R) VPL software (low 1.0)
- [CVE-2024-21807](https://insights.sbomify.com/CVE-2024-21807/): Privilege escalation in Intel(R) Ethernet Network Controllers and Adapters (critical 9.3)
- [CVE-2024-21806](https://insights.sbomify.com/CVE-2024-21806/): Denial of service in Intel(R) Ethernet Network Controllers and Adapters E810 Series (medium 6.8)
- [CVE-2024-21805](https://insights.sbomify.com/CVE-2024-21805/): Missing authorization in SKYSEA Client View (high 7.8)
- [CVE-2024-21803](https://insights.sbomify.com/CVE-2024-21803/): Possible UAF in bt_accept_poll in Linux kernel (low 3.5)
- [CVE-2024-21802](https://insights.sbomify.com/CVE-2024-21802/): Memory corruption in llama.cpp (high 8.8)
- [CVE-2024-21801](https://insights.sbomify.com/CVE-2024-21801/): Denial of service in Intel(R) TDX module software (high 8.3)
- [CVE-2024-2180](https://insights.sbomify.com/CVE-2024-2180/): Zemana AntiLogger v2.74.204.664 - Kernel Memory Leak (medium 5.5)
- [CVE-2024-21799](https://insights.sbomify.com/CVE-2024-21799/): Path traversal in Intel(R) Extension for Transformers software (medium 6.9)
- [CVE-2024-21798](https://insights.sbomify.com/CVE-2024-21798/): Cross-site scripting in WMC-X1800GST-B (medium 4.8)
- [CVE-2024-21797](https://insights.sbomify.com/CVE-2024-21797/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-21796](https://insights.sbomify.com/CVE-2024-21796/): XML external entity in Electronic Deliverables Creation Support Tool (Construction Edition) (medium 5.5)
- [CVE-2024-21795](https://insights.sbomify.com/CVE-2024-21795/): Memory corruption in libbiosig (critical 9.8)
- [CVE-2024-21794](https://insights.sbomify.com/CVE-2024-21794/): Open Redirect in Rapid SCADA (medium 5.4)
- [CVE-2024-21793](https://insights.sbomify.com/CVE-2024-21793/): BIG-IP Central Manager OData Injection Vulnerability (high 7.5)
- [CVE-2024-21792](https://insights.sbomify.com/CVE-2024-21792/): Race condition in Intel(R) Neural Compressor software (medium 4.7)
- [CVE-2024-21791](https://insights.sbomify.com/CVE-2024-21791/): SQL Injection in ADAudit Plus (medium 4.7)
- [CVE-2024-2179](https://insights.sbomify.com/CVE-2024-2179/): Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type (low 2.2)
- [CVE-2024-21789](https://insights.sbomify.com/CVE-2024-21789/): BIG-IP ASM and Advanced WAF vulnerability (high 7.5)
- [CVE-2024-21788](https://insights.sbomify.com/CVE-2024-21788/): Privilege escalation in Intel(R) GPA software (medium 6.7)
- [CVE-2024-21787](https://insights.sbomify.com/CVE-2024-21787/): Weak cryptography in BMRA software (high 7.1)
- [CVE-2024-21786](https://insights.sbomify.com/CVE-2024-21786/): Command injection in MC LR Router (high 7.2)
- [CVE-2024-21785](https://insights.sbomify.com/CVE-2024-21785/): Auth bypass in P3-550E (critical 9.8)
- [CVE-2024-21784](https://insights.sbomify.com/CVE-2024-21784/): Privilege escalation in Intel(R) IPP Cryptography software (medium 5.4)
- [CVE-2024-21783](https://insights.sbomify.com/CVE-2024-21783/): Integer overflow in Intel(R) VPL software (low 2.4)
- [CVE-2024-21782](https://insights.sbomify.com/CVE-2024-21782/): BIG-IP and BIG-IQ secure copy vulnerability (medium 6.7)
- [CVE-2024-21781](https://insights.sbomify.com/CVE-2024-21781/): Other in UEFI firmware for some Intel(R) Processors (high 7.0)
- [CVE-2024-21780](https://insights.sbomify.com/CVE-2024-21780/): Memory corruption in HOME SPOT CUBE2 (high 7.5)
- [CVE-2024-2178](https://insights.sbomify.com/CVE-2024-2178/): Path Traversal Vulnerability in parisneo/lollms-webui (high 7.5)
- [CVE-2024-21778](https://insights.sbomify.com/CVE-2024-21778/): Memory corruption in WBR-6013 (high 7.2)
- [CVE-2024-21777](https://insights.sbomify.com/CVE-2024-21777/): Privilege escalation in Intel(R) Quartus(R) Prime Pro Edition Design software (medium 6.7)
- [CVE-2024-21775](https://insights.sbomify.com/CVE-2024-21775/): SQL Injection (high 8.3)
- [CVE-2024-21774](https://insights.sbomify.com/CVE-2024-21774/): Privilege escalation in Intel(R) Processor Identification Utility software (medium 6.7)
- [CVE-2024-21773](https://insights.sbomify.com/CVE-2024-21773/): Command injection in Archer AX3000 (high 8.8)
- [CVE-2024-21772](https://insights.sbomify.com/CVE-2024-21772/): Privilege escalation in Intel(R) Advisor software (medium 6.7)
- [CVE-2024-21771](https://insights.sbomify.com/CVE-2024-21771/): F5 AFM Signature Matching Vulnerability (high 7.5)
- [CVE-2024-2177](https://insights.sbomify.com/CVE-2024-2177/): Improper Restriction of Rendered UI Layers or Frames in GitLab (medium 6.8)
- [CVE-2024-21769](https://insights.sbomify.com/CVE-2024-21769/): Privilege escalation in Intel(R) Ethernet Connection I219-LM install software (medium 5.4)
- [CVE-2024-21767](https://insights.sbomify.com/CVE-2024-21767/): Commend WS203VICM Improper Access Control (critical 9.4)
- [CVE-2024-21766](https://insights.sbomify.com/CVE-2024-21766/): Privilege escalation in Intel(R) oneAPI Math Kernel Library software (medium 5.4)
- [CVE-2024-21765](https://insights.sbomify.com/CVE-2024-21765/): XML external entity in Electronic Delivery Check System (Dentsu) (medium 5.5)
- [CVE-2024-21764](https://insights.sbomify.com/CVE-2024-21764/): Use of Hard-Coded Credentials in Rapid SCADA (critical 9.8)
- [CVE-2024-21763](https://insights.sbomify.com/CVE-2024-21763/): BIG-IP AFM vulnerability (high 7.5)
- [CVE-2024-21762](https://insights.sbomify.com/CVE-2024-21762/): Fortinet FortiOS Out-of-Bound Write (critical 9.6, exploited in the wild)
- [CVE-2024-21761](https://insights.sbomify.com/CVE-2024-21761/): Missing authorization in FortiPortal (low 3.9)
- [CVE-2024-21760](https://insights.sbomify.com/CVE-2024-21760/): Code injection in FortiSOAR (high 7.7)
- [CVE-2024-2176](https://insights.sbomify.com/CVE-2024-2176/): Use after free in Chrome (high 8.8)
- [CVE-2024-21759](https://insights.sbomify.com/CVE-2024-21759/): Missing authorization in FortiPortal (low 3.9)
- [CVE-2024-21758](https://insights.sbomify.com/CVE-2024-21758/): Memory corruption in FortiWeb (medium 6.1)
- [CVE-2024-21757](https://insights.sbomify.com/CVE-2024-21757/): Auth bypass in FortiAnalyzer (medium 5.5)
- [CVE-2024-21756](https://insights.sbomify.com/CVE-2024-21756/): Command injection in FortiSandbox (high 8.6)
- [CVE-2024-21755](https://insights.sbomify.com/CVE-2024-21755/): Command injection in FortiSandbox (high 8.6)
- [CVE-2024-21754](https://insights.sbomify.com/CVE-2024-21754/): Weak cryptography in FortiOS (low 1.7)
- [CVE-2024-21753](https://insights.sbomify.com/CVE-2024-21753/): Path traversal in FortiClientEMS (medium 5.5)
- [CVE-2024-21752](https://insights.sbomify.com/CVE-2024-21752/): WordPress Ajax Search Lite Plugin <= 4.11.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-21751](https://insights.sbomify.com/CVE-2024-21751/): WordPress RabbitLoader plugin <= 2.19.13 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-21750](https://insights.sbomify.com/CVE-2024-21750/): WordPress Shortcodes Finder Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-2175](https://insights.sbomify.com/CVE-2024-2175/): Privilege escalation in Accessories and Display Manager (high 7.8)
- [CVE-2024-21749](https://insights.sbomify.com/CVE-2024-21749/): WordPress 1 click disable all Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2024-21748](https://insights.sbomify.com/CVE-2024-21748/): WordPress Icegram Engage plugin <= 3.1.21 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-21747](https://insights.sbomify.com/CVE-2024-21747/): WordPress WP ERP Plugin <= 1.12.8 is vulnerable to SQL Injection (high 7.6)
- [CVE-2024-21746](https://insights.sbomify.com/CVE-2024-21746/): WordPress Wp Ultimate Review plugin <= 2.3.6 - IP limit Bypass vulnerability (medium 5.3)
- [CVE-2024-21745](https://insights.sbomify.com/CVE-2024-21745/): WordPress Laybuy Payment Extension for WooCommerce Plugin <= 5.3.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-21744](https://insights.sbomify.com/CVE-2024-21744/): WordPress Mapster WP Maps Plugin <= 1.2.38 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-21743](https://insights.sbomify.com/CVE-2024-21743/): WordPress Houzez Login Register plugin <= 3.2.5 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-21742](https://insights.sbomify.com/CVE-2024-21742/): Apache James Mime4J: Mime4J DOM header injection (medium 5.3)
- [CVE-2024-21741](https://insights.sbomify.com/CVE-2024-21741/): GigaDevice GD32E103C8T6 devices have Incorrect Access Control. (critical 9.8)
- [CVE-2024-21740](https://insights.sbomify.com/CVE-2024-21740/): Artery AT32F415CBT7 and AT32F421C8T7 devices have Incorrect Access Control. (high 7.4)
- [CVE-2024-2174](https://insights.sbomify.com/CVE-2024-2174/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-21739](https://insights.sbomify.com/CVE-2024-21739/): Geehy APM32F103CCT6, APM32F103RCT6, APM32F103RCT7, and APM32F103VCT6 devices have Incorrect Access Control. (medium 5.3)
- [CVE-2024-21738](https://insights.sbomify.com/CVE-2024-21738/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform (medium 4.1)
- [CVE-2024-21737](https://insights.sbomify.com/CVE-2024-21737/): Code Injection vulnerability in SAP Application Interface Framework (File Adapter) (high 8.4)
- [CVE-2024-21736](https://insights.sbomify.com/CVE-2024-21736/): Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management) (medium 6.4)
- [CVE-2024-21735](https://insights.sbomify.com/CVE-2024-21735/): Improper Authorization check in SAP LT Replication Server (high 7.3)
- [CVE-2024-21734](https://insights.sbomify.com/CVE-2024-21734/): URL Redirection vulnerability in SAP Marketing (Contacts App) (low 3.7)
- [CVE-2024-21733](https://insights.sbomify.com/CVE-2024-21733/): Apache Tomcat: Leaking of unrelated request bodies in default error page (medium 5.3)
- [CVE-2024-21732](https://insights.sbomify.com/CVE-2024-21732/): Cross-site scripting in flycms project:flycms (medium 6.1)
- [CVE-2024-21731](https://insights.sbomify.com/CVE-2024-21731/): [20240703] - Core - XSS in StringHelper::truncate method (medium 6.1)
- [CVE-2024-21730](https://insights.sbomify.com/CVE-2024-21730/): [20240702] - Core - Self-XSS in fancyselect list field layout (medium 5.4)
- [CVE-2024-2173](https://insights.sbomify.com/CVE-2024-2173/): Memory corruption in Chrome (medium 6.8)
- [CVE-2024-21729](https://insights.sbomify.com/CVE-2024-21729/): [20240701] - Core - XSS in accessible media selection field (medium 6.1)
- [CVE-2024-21728](https://insights.sbomify.com/CVE-2024-21728/): Extension - smartcalc.es - Open redirect vulnerability in osTicky component for Joomla <= 2.2.8 (medium 6.1)
- [CVE-2024-21727](https://insights.sbomify.com/CVE-2024-21727/): Extension - digtal-peak.com - XSS vulnerability in DP Calendar component for Joomla 8.0.0-8.0.14 (medium 6.1)
- [CVE-2024-21726](https://insights.sbomify.com/CVE-2024-21726/): [20240205] - Core - Inadequate content filtering within the filter code (medium 6.5)
- [CVE-2024-21725](https://insights.sbomify.com/CVE-2024-21725/): [20240204] - Core - XSS in mail address outputs (medium 6.1)
- [CVE-2024-21724](https://insights.sbomify.com/CVE-2024-21724/): [20240203] - Core - XSS in media selection fields (medium 6.1)
- [CVE-2024-21723](https://insights.sbomify.com/CVE-2024-21723/): [20240202] - Core - Open redirect in installation application (medium 4.3)
- [CVE-2024-21722](https://insights.sbomify.com/CVE-2024-21722/): [20240201] - Core - Insufficient session expiration in MFA management views (medium 6.3)
- [CVE-2024-2172](https://insights.sbomify.com/CVE-2024-2172/): Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2024-2171](https://insights.sbomify.com/CVE-2024-2171/): Stored XSS in zenml-io/zenml (low 3.4)
- [CVE-2024-21703](https://insights.sbomify.com/CVE-2024-21703/): Misconfiguration in Confluence Data Center (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/449/