# Vulnerabilities published in 2024


- [CVE-2024-51506](https://insights.sbomify.com/CVE-2024-51506/): Cross-site scripting in tiki:tiki (medium 4.8)
- [CVE-2024-51505](https://insights.sbomify.com/CVE-2024-51505/): An issue was discovered in Atos Eviden IDRA before 2.7.1. (high 8.0)
- [CVE-2024-51504](https://insights.sbomify.com/CVE-2024-51504/): Apache ZooKeeper: Authentication bypass with IP-based authentication in Admin Server (critical 9.1)
- [CVE-2024-51503](https://insights.sbomify.com/CVE-2024-51503/): Command injection in Trend Micro Deep Security (high 8.0)
- [CVE-2024-51502](https://insights.sbomify.com/CVE-2024-51502/): Panic Vulnerability in loona-hpack (medium 5.1)
- [CVE-2024-51501](https://insights.sbomify.com/CVE-2024-51501/): CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes (critical 10.0)
- [CVE-2024-51500](https://insights.sbomify.com/CVE-2024-51500/): Denial of service in firmware (medium 5.3)
- [CVE-2024-5150](https://insights.sbomify.com/CVE-2024-5150/): Login with phone number <= 1.7.26 - Authentication Bypass due to Missing Empty Value Check (critical 9.8)
- [CVE-2024-51499](https://insights.sbomify.com/CVE-2024-51499/): MarkUs Arbitrary File Write leading up to remote code execution (student accounts) (high 7.1)
- [CVE-2024-51498](https://insights.sbomify.com/CVE-2024-51498/): [@imput/cobalt-web] Cross-site Scripting when downloading picker image from malicious instance (medium 6.0)
- [CVE-2024-51497](https://insights.sbomify.com/CVE-2024-51497/): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/print-customoid.php (medium 4.8)
- [CVE-2024-51496](https://insights.sbomify.com/CVE-2024-51496/): LibreNMS has a Reflected XSS ('Cross-site Scripting') in librenms/includes/html/pages/wireless.inc.php (medium 4.8)
- [CVE-2024-51495](https://insights.sbomify.com/CVE-2024-51495/): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php (medium 4.8)
- [CVE-2024-51494](https://insights.sbomify.com/CVE-2024-51494/): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/app/Http/Controllers/Table/EditPortsController.php (medium 4.8)
- [CVE-2024-51493](https://insights.sbomify.com/CVE-2024-51493/): API key access in settings without reauthentication in OctoPrint (medium 5.3)
- [CVE-2024-51492](https://insights.sbomify.com/CVE-2024-51492/): Zusam vulnerable to stored XSS, allowing token theft via crafted SVG (high 8.8)
- [CVE-2024-51491](https://insights.sbomify.com/CVE-2024-51491/): Process crash during CRL-based revocation check on OS using separate mount point for temp Directory in notation-go (low 3.3)
- [CVE-2024-51490](https://insights.sbomify.com/CVE-2024-51490/): Stored Cross-Site Scripting in Ampache (medium 5.5)
- [CVE-2024-5149](https://insights.sbomify.com/CVE-2024-5149/): BuddyForms <= 2.8.9 - Email Verification Bypass due to Insufficient Randomness (medium 6.5)
- [CVE-2024-51489](https://insights.sbomify.com/CVE-2024-51489/): Insufficient Message Token Validation in Ampache (medium 5.3)
- [CVE-2024-51488](https://insights.sbomify.com/CVE-2024-51488/): Insufficient Validation in Delete Message in Ampache (medium 5.3)
- [CVE-2024-51487](https://insights.sbomify.com/CVE-2024-51487/): Insufficient Validation in Catalog (Activation/Deactivation) in Ampache (medium 5.3)
- [CVE-2024-51486](https://insights.sbomify.com/CVE-2024-51486/): Stored Cross-Site Scripting in Ampache (medium 5.5)
- [CVE-2024-51485](https://insights.sbomify.com/CVE-2024-51485/): Insufficient Validation in Plugins (Activation/Deactivation) in Ampache (medium 5.3)
- [CVE-2024-51484](https://insights.sbomify.com/CVE-2024-51484/): Insufficient Validation in Controllers (Activation/Deactivation) in Ampache (medium 5.3)
- [CVE-2024-51483](https://insights.sbomify.com/CVE-2024-51483/): changedetection.io Path Traversal vulnerability (medium 6.9)
- [CVE-2024-51482](https://insights.sbomify.com/CVE-2024-51482/): Boolean-based SQL Injection in ZoneMinder v1.37.* <= 1.37.64 (critical 10.0)
- [CVE-2024-51481](https://insights.sbomify.com/CVE-2024-51481/): Nix allows macOS sandbox escape via built-in builders (low 1.0)
- [CVE-2024-51480](https://insights.sbomify.com/CVE-2024-51480/): RedisTimeSeries Integer Overflow Remote Code Execution Vulnerability (high 7.0)
- [CVE-2024-5148](https://insights.sbomify.com/CVE-2024-5148/): Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate (high 7.5)
- [CVE-2024-51479](https://insights.sbomify.com/CVE-2024-51479/): Authorization bypass in Next.js (high 7.5)
- [CVE-2024-51478](https://insights.sbomify.com/CVE-2024-51478/): Use of a Broken or Risky Cryptographic Algorithm in YesWiki (critical 9.9)
- [CVE-2024-51477](https://insights.sbomify.com/CVE-2024-51477/): IBM InfoSphere Information Server information disclosure (medium 4.3)
- [CVE-2024-51476](https://insights.sbomify.com/CVE-2024-51476/): IBM Concert Software information disclosure (high 7.5)
- [CVE-2024-51475](https://insights.sbomify.com/CVE-2024-51475/): IBM Content Navigator HTML injection (medium 5.4)
- [CVE-2024-51473](https://insights.sbomify.com/CVE-2024-51473/): IBM Db2 for Linux, UNIX and Windows denial of service (medium 6.5)
- [CVE-2024-51472](https://insights.sbomify.com/CVE-2024-51472/): IBM DevOps Deploy / IBM UrbanCode Deploy HTML injection (low 3.1)
- [CVE-2024-51471](https://insights.sbomify.com/CVE-2024-51471/): IBM MQ Appliance denial of service (medium 5.3)
- [CVE-2024-51470](https://insights.sbomify.com/CVE-2024-51470/): IBM MQ denial of service (medium 6.5)
- [CVE-2024-5147](https://insights.sbomify.com/CVE-2024-5147/): WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2024-51466](https://insights.sbomify.com/CVE-2024-51466/): IBM Cognos Analytics expression language injection (critical 9.0)
- [CVE-2024-51465](https://insights.sbomify.com/CVE-2024-51465/): IBM App Connect Enterprise Certified Container command execution (high 8.8)
- [CVE-2024-51464](https://insights.sbomify.com/CVE-2024-51464/): IBM i authentication bypass (medium 4.3)
- [CVE-2024-51463](https://insights.sbomify.com/CVE-2024-51463/): IBM i server-side request forgery (medium 5.4)
- [CVE-2024-51462](https://insights.sbomify.com/CVE-2024-51462/): IBM QRadar WinCollect Agent data manipulation (medium 4.0)
- [CVE-2024-51461](https://insights.sbomify.com/CVE-2024-51461/): IBM QRadar WinCollect Agent denial of service (medium 4.3)
- [CVE-2024-51460](https://insights.sbomify.com/CVE-2024-51460/): IBM InfoSphere Information Server information disclosure (medium 4.3)
- [CVE-2024-51459](https://insights.sbomify.com/CVE-2024-51459/): IBM InfoSphere Server Information command execution (high 8.4)
- [CVE-2024-51457](https://insights.sbomify.com/CVE-2024-51457/): IBM Robotic Process Automation for Cloud Pak cross-site scripting (medium 4.4)
- [CVE-2024-51456](https://insights.sbomify.com/CVE-2024-51456/): IBM Robotic Process Automation information disclosure (medium 5.9)
- [CVE-2024-51454](https://insights.sbomify.com/CVE-2024-51454/): Other in Engineering Workflow Management (medium 6.5)
- [CVE-2024-51453](https://insights.sbomify.com/CVE-2024-51453/): IBM Sterling Secure Proxy directory traversal (medium 4.3)
- [CVE-2024-51451](https://insights.sbomify.com/CVE-2024-51451/): Multiple Vulnerabilities in IBM Concert Software (medium 6.5)
- [CVE-2024-51450](https://insights.sbomify.com/CVE-2024-51450/): IBM Security Verify Directory Command Execution (critical 9.1)
- [CVE-2024-5145](https://insights.sbomify.com/CVE-2024-5145/): SourceCodester Vehicle Management System HTTP POST Request newdriver.php unrestricted upload (medium 5.3)
- [CVE-2024-51448](https://insights.sbomify.com/CVE-2024-51448/): IBM Robotic Process Automation privilege escalation (medium 6.7)
- [CVE-2024-51447](https://insights.sbomify.com/CVE-2024-51447/): Information disclosure in Polarion V2310 (medium 6.9)
- [CVE-2024-51446](https://insights.sbomify.com/CVE-2024-51446/): Cross-site scripting in Polarion V2310 (medium 5.1)
- [CVE-2024-51445](https://insights.sbomify.com/CVE-2024-51445/): XML external entity in Polarion V2310 (high 7.1)
- [CVE-2024-51444](https://insights.sbomify.com/CVE-2024-51444/): SQL injection in Polarion V2310 (high 7.1)
- [CVE-2024-51442](https://insights.sbomify.com/CVE-2024-51442/): Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a specially crafted minidlna (high 8.8)
- [CVE-2024-51440](https://insights.sbomify.com/CVE-2024-51440/): An issue in Nothing Tech Nothing OS v.2.6 allows a local attacker to escalate privileges via the NtBpfService component. (high 7.8)
- [CVE-2024-51434](https://insights.sbomify.com/CVE-2024-51434/): Froala WYSIWYG editor allows cross-site scripting (XSS) (medium 6.1)
- [CVE-2024-51432](https://insights.sbomify.com/CVE-2024-51432/): Cross Site Scripting vulnerability in FiberHome HG6544C RP2743 allows an attacker to execute arbitrary code via the SSID field in the WIFI C (medium 4.8)
- [CVE-2024-51431](https://insights.sbomify.com/CVE-2024-51431/): Hardcoded credentials in lb-link:bl-wr1300h firmware (high 8.1)
- [CVE-2024-51430](https://insights.sbomify.com/CVE-2024-51430/): Cross Site Scripting vulnerability in online diagnostic lab management system using php v.1.0 allows a remote attacker to execute arbitrary (medium 6.4)
- [CVE-2024-5143](https://insights.sbomify.com/CVE-2024-5143/): Missing authorization in Certain HP LaserJet Pro Printers (medium 6.8)
- [CVE-2024-51428](https://insights.sbomify.com/CVE-2024-51428/): Denial of service in espressif:esp-idf (high 7.5)
- [CVE-2024-51427](https://insights.sbomify.com/CVE-2024-51427/): An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact (critical 9.8)
- [CVE-2024-51426](https://insights.sbomify.com/CVE-2024-51426/): An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact (high 8.8)
- [CVE-2024-51425](https://insights.sbomify.com/CVE-2024-51425/): An issue in the WaterToken smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact. (high 8.8)
- [CVE-2024-51424](https://insights.sbomify.com/CVE-2024-51424/): An issue in the PepeGxng smart contract (which can be run on the Ethereum blockchain) allows remote attackers to have an unspecified impact (critical 9.8)
- [CVE-2024-51423](https://insights.sbomify.com/CVE-2024-51423/): Cross-site scripting in infor:global human resources (medium 6.1)
- [CVE-2024-5142](https://insights.sbomify.com/CVE-2024-5142/): XSS in Hubshare's social module (high 7.0)
- [CVE-2024-51419](https://insights.sbomify.com/CVE-2024-51419/): Cross Site Scripting vulnerability in Shenzhen Interconnection Harbor Network Technology Co., Ltd Ofweek Online Exhibition v.1.0.0 allows a (medium 6.1)
- [CVE-2024-51417](https://insights.sbomify.com/CVE-2024-51417/): Property reflection in System.Linq.Dynamic.Core (medium 6.4)
- [CVE-2024-5141](https://insights.sbomify.com/CVE-2024-5141/): Cross-site scripting in Rotating Tweets (Twitter widget and shortcode) (medium 6.4)
- [CVE-2024-51409](https://insights.sbomify.com/CVE-2024-51409/): Memory corruption in tenda:o3 firmware (medium 6.5)
- [CVE-2024-51408](https://insights.sbomify.com/CVE-2024-51408/): Server-side request forgery in appsmith:appsmith (high 8.5)
- [CVE-2024-51407](https://insights.sbomify.com/CVE-2024-51407/): Other in projectfloodlight:floodlight (medium 6.2)
- [CVE-2024-51406](https://insights.sbomify.com/CVE-2024-51406/): Security feature bypass in projectfloodlight:open sdn controller (medium 6.2)
- [CVE-2024-51399](https://insights.sbomify.com/CVE-2024-51399/): Altai Technologies Ltd Altai IX500 Indoor 22 802.11ac Wave 2 AP After login, there are file reads in the background, and attackers can obtai (medium 5.7)
- [CVE-2024-51398](https://insights.sbomify.com/CVE-2024-51398/): Altai Technologies Ltd Altai X500 Indoor 22 802.11ac Wave 2 AP web Management Weak password leakage in the background may lead to unauthoriz (medium 6.5)
- [CVE-2024-51395](https://insights.sbomify.com/CVE-2024-51395/): Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a d (medium 6.2)
- [CVE-2024-51394](https://insights.sbomify.com/CVE-2024-51394/): Buffer Overflow vulnerability in Ardupiot Copter Latest commit 92693e023793133e49a035daf37c14433e484778 allows a local attacker to cause a d (medium 5.5)
- [CVE-2024-51392](https://insights.sbomify.com/CVE-2024-51392/): An issue in OpenKnowledgeMaps Headstart v7 allows a remote attacker to escalate privileges via the url parameter of the getPDF.php component (high 8.8)
- [CVE-2024-5139](https://insights.sbomify.com/CVE-2024-5139/): Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection (medium 6.1)
- [CVE-2024-51382](https://insights.sbomify.com/CVE-2024-51382/): Cross-site request forgery in jatos:jatos (high 8.4)
- [CVE-2024-51381](https://insights.sbomify.com/CVE-2024-51381/): Cross-site request forgery in jatos:jatos (high 8.4)
- [CVE-2024-51380](https://insights.sbomify.com/CVE-2024-51380/): Cross-site scripting in jatos:jatos (high 8.4)
- [CVE-2024-5138](https://insights.sbomify.com/CVE-2024-5138/): CVE-2024-5138: snapd snapctl auth bypass (high 8.1)
- [CVE-2024-51379](https://insights.sbomify.com/CVE-2024-51379/): Cross-site scripting in jatos:jatos (high 8.4)
- [CVE-2024-51378](https://insights.sbomify.com/CVE-2024-51378/): CyberPanel Incorrect Default Permissions (critical 10.0, exploited in the wild)
- [CVE-2024-51377](https://insights.sbomify.com/CVE-2024-51377/): Cross-site scripting in ladybirdweb:faveo helpdesk (high 8.8)
- [CVE-2024-51376](https://insights.sbomify.com/CVE-2024-51376/): Directory Traversal vulnerability in yeqifu carRental v.1.0 allows a remote attacker to obtain sensitive information via the file/downloadFi (high 7.5)
- [CVE-2024-5137](https://insights.sbomify.com/CVE-2024-5137/): PHPGurukul Directory Management System Searchbar admin-profile.php cross site scripting (medium 5.1)
- [CVE-2024-51367](https://insights.sbomify.com/CVE-2024-51367/): An arbitrary file upload vulnerability in the component \Users\username.BlackBoard of BlackBoard v2.0.0.2 allows attackers to execute arbitr (critical 9.8)
- [CVE-2024-51366](https://insights.sbomify.com/CVE-2024-51366/): An arbitrary file upload vulnerability in the component \Roaming\Omega of OmegaT v6.0.1 allows attackers to execute arbitrary code via uploa (critical 9.8)
- [CVE-2024-51364](https://insights.sbomify.com/CVE-2024-51364/): An arbitrary file upload vulnerability in ModbusMechanic v3.0 allows attackers to execute arbitrary code via uploading a crafted .xml file. (high 8.8)
- [CVE-2024-51363](https://insights.sbomify.com/CVE-2024-51363/): Insecure deserialization in Hodoku v2.3.0 to v2.3.2 allows attackers to execute arbitrary code. (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/222/