# Vulnerabilities published in 2024


- [CVE-2024-2170](https://insights.sbomify.com/CVE-2024-2170/): VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className (medium 6.4)
- [CVE-2024-21697](https://insights.sbomify.com/CVE-2024-21697/): Other in Sourcetree for Mac (high 8.8)
- [CVE-2024-21690](https://insights.sbomify.com/CVE-2024-21690/): Cross-site scripting in Confluence Data Center (high 7.1)
- [CVE-2024-2169](https://insights.sbomify.com/CVE-2024-2169/): Implementations of UDP application protocols are susceptible to network loops and denial of service (high 7.5)
- [CVE-2024-21689](https://insights.sbomify.com/CVE-2024-21689/): Code injection in Bamboo Data Center (high 7.6)
- [CVE-2024-21687](https://insights.sbomify.com/CVE-2024-21687/): Path traversal in Bamboo Data Center (high 8.1)
- [CVE-2024-21686](https://insights.sbomify.com/CVE-2024-21686/): Cross-site scripting in Confluence Data Center (high 7.3)
- [CVE-2024-21685](https://insights.sbomify.com/CVE-2024-21685/): Information disclosure in Jira Core Data Center (high 7.4)
- [CVE-2024-21684](https://insights.sbomify.com/CVE-2024-21684/): Open redirect in Bitbucket Data Center (low 3.1)
- [CVE-2024-21683](https://insights.sbomify.com/CVE-2024-21683/): Code injection in Confluence Data Center (high 7.2)
- [CVE-2024-21682](https://insights.sbomify.com/CVE-2024-21682/): Code injection in Assets Discovery Data Center (high 7.2)
- [CVE-2024-2168](https://insights.sbomify.com/CVE-2024-2168/): SourceCodester Online Tours & Travels Management System HTTP POST Request expense_category.php sql injection (medium 4.7)
- [CVE-2024-21678](https://insights.sbomify.com/CVE-2024-21678/): Cross-site scripting in Confluence Data Center (high 8.5)
- [CVE-2024-21677](https://insights.sbomify.com/CVE-2024-21677/): Path traversal in Confluence Data Center (high 8.3)
- [CVE-2024-21674](https://insights.sbomify.com/CVE-2024-21674/): Code injection in Confluence Data Center (high 8.6)
- [CVE-2024-21673](https://insights.sbomify.com/CVE-2024-21673/): Code injection in Confluence Data Center (high 8.0)
- [CVE-2024-21672](https://insights.sbomify.com/CVE-2024-21672/): Code injection in Confluence Data Center (high 8.3)
- [CVE-2024-21671](https://insights.sbomify.com/CVE-2024-21671/): vantage6 username timing attack (low 3.7)
- [CVE-2024-21670](https://insights.sbomify.com/CVE-2024-21670/): CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credential (medium 6.5)
- [CVE-2024-21669](https://insights.sbomify.com/CVE-2024-21669/): Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC (critical 9.9)
- [CVE-2024-21668](https://insights.sbomify.com/CVE-2024-21668/): Insertion of Sensitive Information into Log File in react-native-mmkv (medium 4.4)
- [CVE-2024-21667](https://insights.sbomify.com/CVE-2024-21667/): Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts (medium 6.5)
- [CVE-2024-21666](https://insights.sbomify.com/CVE-2024-21666/): Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list (medium 6.5)
- [CVE-2024-21665](https://insights.sbomify.com/CVE-2024-21665/): Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list (medium 4.3)
- [CVE-2024-21664](https://insights.sbomify.com/CVE-2024-21664/): Parsing JSON serialized payload without protected field can lead to segfault (medium 4.3)
- [CVE-2024-21663](https://insights.sbomify.com/CVE-2024-21663/): Remote code execution on ReconServer due to improper input sanitization on the prips command (critical 10.0)
- [CVE-2024-21662](https://insights.sbomify.com/CVE-2024-21662/): Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow (high 7.5)
- [CVE-2024-21661](https://insights.sbomify.com/CVE-2024-21661/): Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment (high 7.5)
- [CVE-2024-2166](https://insights.sbomify.com/CVE-2024-2166/): Cross-site scripting in Email Security (high 8.8)
- [CVE-2024-21658](https://insights.sbomify.com/CVE-2024-21658/): Insufficient control of region value length in discourse-calendar (medium 4.3)
- [CVE-2024-21655](https://insights.sbomify.com/CVE-2024-21655/): Insufficient control of custom field value sizes (medium 4.3)
- [CVE-2024-21654](https://insights.sbomify.com/CVE-2024-21654/): rubygems.org MFA Bypass through password reset function could allow account takeover (medium 4.8)
- [CVE-2024-21653](https://insights.sbomify.com/CVE-2024-21653/): vantage6 insecure SSH configuration for node and server containers (medium 6.5)
- [CVE-2024-21652](https://insights.sbomify.com/CVE-2024-21652/): Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss (critical 9.8)
- [CVE-2024-21651](https://insights.sbomify.com/CVE-2024-21651/): XWiki Denial of Service attack through attachments (high 7.5)
- [CVE-2024-21650](https://insights.sbomify.com/CVE-2024-21650/): XWiki Remote Code Execution vulnerability via user registration (critical 10.0)
- [CVE-2024-2165](https://insights.sbomify.com/CVE-2024-2165/): SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-21649](https://insights.sbomify.com/CVE-2024-21649/): Remote code execution (high 8.8)
- [CVE-2024-21648](https://insights.sbomify.com/CVE-2024-21648/): XWiki has no right protection on rollback action (high 8.0)
- [CVE-2024-21647](https://insights.sbomify.com/CVE-2024-21647/): HTTP Request/Response Smuggling in puma (medium 5.9)
- [CVE-2024-21646](https://insights.sbomify.com/CVE-2024-21646/): Azure IoT Platform Device SDK Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-21645](https://insights.sbomify.com/CVE-2024-21645/): pyLoad Log Injection (medium 5.3)
- [CVE-2024-21644](https://insights.sbomify.com/CVE-2024-21644/): pyLoad unauthenticated flask configuration leakage (high 7.5)
- [CVE-2024-21643](https://insights.sbomify.com/CVE-2024-21643/): Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability (high 7.1)
- [CVE-2024-21642](https://insights.sbomify.com/CVE-2024-21642/): D-Tale server-side request forgery through Web uploads (high 7.5)
- [CVE-2024-21641](https://insights.sbomify.com/CVE-2024-21641/): Flarum's Logout Route allows open redirects (medium 6.5)
- [CVE-2024-21640](https://insights.sbomify.com/CVE-2024-21640/): OOB Access in CefVideoConsumerOSR::OnFrameCaptured (medium 5.4)
- [CVE-2024-21639](https://insights.sbomify.com/CVE-2024-21639/): OOB Access in CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory (medium 5.3)
- [CVE-2024-21638](https://insights.sbomify.com/CVE-2024-21638/): Azure IPAM solution Elevation of Privilege Vulnerability (critical 9.1)
- [CVE-2024-21637](https://insights.sbomify.com/CVE-2024-21637/): XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Mode (high 7.7)
- [CVE-2024-21636](https://insights.sbomify.com/CVE-2024-21636/): view_component Cross-site Scripting vulnerability (medium 6.1)
- [CVE-2024-21635](https://insights.sbomify.com/CVE-2024-21635/): Memos Access Tokens Stay Valid after User Password Change (high 7.1)
- [CVE-2024-21634](https://insights.sbomify.com/CVE-2024-21634/): Ion Java StackOverflow vulnerability (high 7.5)
- [CVE-2024-21633](https://insights.sbomify.com/CVE-2024-21633/): Arbitrary file write on Decoding (high 7.8)
- [CVE-2024-21632](https://insights.sbomify.com/CVE-2024-21632/): omniauth-microsoft_graph vulnerable to account takeover (nOAuth) (high 8.6)
- [CVE-2024-21631](https://insights.sbomify.com/CVE-2024-21631/): Integer overflow in URI leading to potential host spoofing (medium 6.5)
- [CVE-2024-21630](https://insights.sbomify.com/CVE-2024-21630/): Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users to (medium 4.3)
- [CVE-2024-2163](https://insights.sbomify.com/CVE-2024-2163/): Cross-site scripting in Ninja Beaver Add-ons for Beaver Builder (medium 6.4)
- [CVE-2024-21629](https://insights.sbomify.com/CVE-2024-21629/): Erroneous handling of `record_external_operation` error return (medium 5.9)
- [CVE-2024-21628](https://insights.sbomify.com/CVE-2024-21628/): XSS can be stored in DB from "add a message form" in order detail page (FO) (medium 5.4)
- [CVE-2024-21627](https://insights.sbomify.com/CVE-2024-21627/): Some attribute not escaped in Validate::isCleanHTML method (high 8.1)
- [CVE-2024-21626](https://insights.sbomify.com/CVE-2024-21626/): runc container breakout through process.cwd trickery and leaked fds (high 8.6)
- [CVE-2024-21625](https://insights.sbomify.com/CVE-2024-21625/): One-click remote code execution via malicious deep link (high 8.8)
- [CVE-2024-21624](https://insights.sbomify.com/CVE-2024-21624/): Potential Information Leak in User-Constructed Message Templates in nonebot2 (medium 5.7)
- [CVE-2024-21623](https://insights.sbomify.com/CVE-2024-21623/): Arbitrary Expression Injection in github workflow leads to Command execution & leaking secrets (critical 9.8)
- [CVE-2024-21622](https://insights.sbomify.com/CVE-2024-21622/): Craft CMS Privilege Escalation (medium 5.4)
- [CVE-2024-21620](https://insights.sbomify.com/CVE-2024-21620/): Junos OS: SRX Series and EX Series: J-Web doesn't sufficiently sanitize input to prevent XSS (high 8.8)
- [CVE-2024-2162](https://insights.sbomify.com/CVE-2024-2162/): Authenticated Remote Code Execution in Kiloview NDI N series products (high 8.8)
- [CVE-2024-21619](https://insights.sbomify.com/CVE-2024-21619/): Junos OS: SRX Series and EX Series: J-Web - unauthenticated access to temporary files containing sensitive information (medium 5.3)
- [CVE-2024-21618](https://insights.sbomify.com/CVE-2024-21618/): Junos OS and Junos OS Evolved: When LLDP is enabled and a malformed LLDP packet is received, l2cpd crashes (high 7.1)
- [CVE-2024-21617](https://insights.sbomify.com/CVE-2024-21617/): Junos OS: BGP flap on NSR-enabled devices causes memory leak (medium 6.5)
- [CVE-2024-21616](https://insights.sbomify.com/CVE-2024-21616/): Junos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to fail (high 7.5)
- [CVE-2024-21615](https://insights.sbomify.com/CVE-2024-21615/): Junos OS and Junos OS Evolved: A low-privileged user can access confidential information (medium 5.1)
- [CVE-2024-21614](https://insights.sbomify.com/CVE-2024-21614/): Junos OS and Junos OS Evolved: A specific query via DREND causes rpd crash (high 7.5)
- [CVE-2024-21613](https://insights.sbomify.com/CVE-2024-21613/): Junos OS and Junos OS Evolved: A link flap causes patroot memory leak which leads to rpd crash (medium 6.5)
- [CVE-2024-21612](https://insights.sbomify.com/CVE-2024-21612/): Junos OS Evolved: Specific TCP traffic causes OFP core and restart of RE (high 7.5)
- [CVE-2024-21611](https://insights.sbomify.com/CVE-2024-21611/): Denial of service in Junos OS (high 7.5)
- [CVE-2024-21610](https://insights.sbomify.com/CVE-2024-21610/): Junos OS: If in a scaled CoS scenario information on CoS state is gathered mgd processes get stuck (medium 5.3)
- [CVE-2024-2161](https://insights.sbomify.com/CVE-2024-2161/): Use of Hard-coded Credentials in Kiloview NDI N series products API middleware (critical 9.8)
- [CVE-2024-21609](https://insights.sbomify.com/CVE-2024-21609/): Denial of service in Junos OS (high 7.1)
- [CVE-2024-21607](https://insights.sbomify.com/CVE-2024-21607/): Security feature bypass in Junos OS (medium 5.3)
- [CVE-2024-21606](https://insights.sbomify.com/CVE-2024-21606/): Junos OS: SRX Series: When "tcp-encap" is configured and specific packets are received flowd will crash (high 7.5)
- [CVE-2024-21605](https://insights.sbomify.com/CVE-2024-21605/): Junos OS: SRX 300 Series: Specific link local traffic causes a control plane overload (high 7.1)
- [CVE-2024-21604](https://insights.sbomify.com/CVE-2024-21604/): Junos OS Evolved: A high rate of specific traffic will cause a complete system outage (high 7.5)
- [CVE-2024-21603](https://insights.sbomify.com/CVE-2024-21603/): Junos OS: MX Series: Gathering statistics in a scaled SCU/DCU configuration will lead to a device crash (medium 6.5)
- [CVE-2024-21602](https://insights.sbomify.com/CVE-2024-21602/): Null dereference in Junos OS Evolved (high 7.5)
- [CVE-2024-21601](https://insights.sbomify.com/CVE-2024-21601/): Junos OS: SRX Series: Due to an error in processing TCP events flowd will crash (medium 5.9)
- [CVE-2024-21600](https://insights.sbomify.com/CVE-2024-21600/): Junos OS: PTX Series: In an FTI scenario MPLS packets hitting reject next-hop will cause a host path wedge condition (medium 6.5)
- [CVE-2024-21599](https://insights.sbomify.com/CVE-2024-21599/): Junos OS: MX Series: MPC3E memory leak with PTP configuration (medium 6.5)
- [CVE-2024-21598](https://insights.sbomify.com/CVE-2024-21598/): Junos OS and Junos OS Evolved: A malformed BGP tunnel encapsulation attribute will lead to an rpd crash (high 8.7)
- [CVE-2024-21597](https://insights.sbomify.com/CVE-2024-21597/): Junos OS: MX Series: In an AF scenario traffic can bypass configured lo0 firewall filters (medium 5.3)
- [CVE-2024-21596](https://insights.sbomify.com/CVE-2024-21596/): Memory corruption in Junos OS (medium 5.3)
- [CVE-2024-21595](https://insights.sbomify.com/CVE-2024-21595/): Junos OS: EX4100, EX4400, EX4600, QFX5000 Series: A high rate of specific ICMP traffic will cause the PFE to hang (high 7.5)
- [CVE-2024-21594](https://insights.sbomify.com/CVE-2024-21594/): Junos OS: SRX 5000 Series: Repeated execution of a specific CLI command causes a flowd crash (medium 5.5)
- [CVE-2024-21593](https://insights.sbomify.com/CVE-2024-21593/): Junos OS: MX Series with MPC10, MPC11, LC9600, and MX304: A specific MPLS packet will cause a PFE crash (high 7.1)
- [CVE-2024-21591](https://insights.sbomify.com/CVE-2024-21591/): Junos OS: SRX Series and EX Series: Security Vulnerability in J-web allows a preAuth Remote Code Execution (critical 9.8)
- [CVE-2024-21590](https://insights.sbomify.com/CVE-2024-21590/): Junos OS Evolved: Packets which are not destined to the device can reach the RE (high 7.1)
- [CVE-2024-2159](https://insights.sbomify.com/CVE-2024-2159/): Sassy Social Share < 3.3.61 - Contributor+ Stored XSS (medium 4.7)
- [CVE-2024-21589](https://insights.sbomify.com/CVE-2024-21589/): Paragon Active Assurance Control Center: Information disclosure vulnerability (high 7.4)
- [CVE-2024-21587](https://insights.sbomify.com/CVE-2024-21587/): Junos OS: MX Series: Memory leak in bbe-smgd process if BFD liveness detection for DHCP subscribers is enabled (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/450/