# Vulnerabilities published in 2024


- [CVE-2024-49829](https://insights.sbomify.com/CVE-2024-49829/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Camera (medium 6.7)
- [CVE-2024-49828](https://insights.sbomify.com/CVE-2024-49828/): IBM Db2 for Linux, UNIX and Windows denial of service (medium 6.5)
- [CVE-2024-49827](https://insights.sbomify.com/CVE-2024-49827/): IBM Concert Software information disclosure (low 3.7)
- [CVE-2024-49825](https://insights.sbomify.com/CVE-2024-49825/): IBM Robotic Process Automation session fixation (medium 6.3)
- [CVE-2024-49824](https://insights.sbomify.com/CVE-2024-49824/): IBM Robotic Process Automation security bypass (medium 6.5)
- [CVE-2024-49823](https://insights.sbomify.com/CVE-2024-49823/): IBM Common Cryptographic Architecture denial of service (medium 6.5)
- [CVE-2024-49822](https://insights.sbomify.com/CVE-2024-49822/): IBM QRadar Advisor server-side request forgery (medium 4.1)
- [CVE-2024-49820](https://insights.sbomify.com/CVE-2024-49820/): IBM Security Guardium Key Lifecycle Manager information disclosure (low 3.7)
- [CVE-2024-4982](https://insights.sbomify.com/CVE-2024-4982/): Pagure: path traversal in view_issue_raw_file() (high 7.6)
- [CVE-2024-49819](https://insights.sbomify.com/CVE-2024-49819/): IBM Security Guardium Key Lifecycle Manager information disclosure (medium 4.1)
- [CVE-2024-49818](https://insights.sbomify.com/CVE-2024-49818/): IBM Security Guardium Key Lifecycle Manager information disclosure (medium 4.3)
- [CVE-2024-49817](https://insights.sbomify.com/CVE-2024-49817/): IBM Security Guardium Key Lifecycle Manager information disclosure (medium 4.4)
- [CVE-2024-49816](https://insights.sbomify.com/CVE-2024-49816/): IBM Security Guardium Key Lifecycle Manager information disclosure (medium 4.9)
- [CVE-2024-49814](https://insights.sbomify.com/CVE-2024-49814/): IBM Security Verify Access Appliance Privilege Escalation (high 7.8)
- [CVE-2024-4981](https://insights.sbomify.com/CVE-2024-4981/): Pagure: _update_file_in_git() follows symbolic links in temporary clones (high 7.6)
- [CVE-2024-49808](https://insights.sbomify.com/CVE-2024-49808/): IBM Sterling Connect:Direct Web Services improper authorization (medium 6.3)
- [CVE-2024-49807](https://insights.sbomify.com/CVE-2024-49807/): IBM Sterling B2B Integrator cross-site scripting (medium 6.4)
- [CVE-2024-49806](https://insights.sbomify.com/CVE-2024-49806/): IBM Security Verify Access Appliance hard coded credentials (critical 9.4)
- [CVE-2024-49805](https://insights.sbomify.com/CVE-2024-49805/): IBM Security Verify Access Appliance hard coded credentials (critical 9.4)
- [CVE-2024-49804](https://insights.sbomify.com/CVE-2024-49804/): IBM Security Verify Access Appliance privilege escalation (high 7.8)
- [CVE-2024-49803](https://insights.sbomify.com/CVE-2024-49803/): IBM Security Verify Access Appliance command execution (critical 9.8)
- [CVE-2024-49800](https://insights.sbomify.com/CVE-2024-49800/): IBM ApplinX Information Disclosure (medium 4.3)
- [CVE-2024-4980](https://insights.sbomify.com/CVE-2024-4980/): Cross-site scripting in WPKoi Templates for Elementor (medium 6.4)
- [CVE-2024-49798](https://insights.sbomify.com/CVE-2024-49798/): IBM ApplinX Information Disclosure (medium 4.3)
- [CVE-2024-49797](https://insights.sbomify.com/CVE-2024-49797/): IBM ApplinX Information Disclosure (medium 5.9)
- [CVE-2024-49796](https://insights.sbomify.com/CVE-2024-49796/): IBM ApplinX Clickjacking (medium 5.4)
- [CVE-2024-49795](https://insights.sbomify.com/CVE-2024-49795/): IBM ApplinX Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-49794](https://insights.sbomify.com/CVE-2024-49794/): IBM ApplinX Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-49793](https://insights.sbomify.com/CVE-2024-49793/): IBM ApplinX Cross-Site Scripting (medium 5.4)
- [CVE-2024-49792](https://insights.sbomify.com/CVE-2024-49792/): IBM ApplinX Cross-Site Scripting (medium 5.4)
- [CVE-2024-49791](https://insights.sbomify.com/CVE-2024-49791/): IBM ApplinX Cross-Site Scripting (medium 6.4)
- [CVE-2024-49790](https://insights.sbomify.com/CVE-2024-49790/): IBM Watson Studio on Cloud Pak for Data cross-site scripting (medium 5.4)
- [CVE-2024-49785](https://insights.sbomify.com/CVE-2024-49785/): IBM watsonx.ai cross-site scripting (medium 5.4)
- [CVE-2024-49784](https://insights.sbomify.com/CVE-2024-49784/): IBM OpenPages with Watson information disclosure (medium 5.3)
- [CVE-2024-49783](https://insights.sbomify.com/CVE-2024-49783/): IBM OpenPages with Watson information disclosure (medium 5.3)
- [CVE-2024-49782](https://insights.sbomify.com/CVE-2024-49782/): IBM OpenPages improper certificate validation (medium 6.8)
- [CVE-2024-49781](https://insights.sbomify.com/CVE-2024-49781/): IBM OpenPages XML external entity injection (high 7.1)
- [CVE-2024-49780](https://insights.sbomify.com/CVE-2024-49780/): IBM OpenPages path traversal (medium 5.3)
- [CVE-2024-4978](https://insights.sbomify.com/CVE-2024-4978/): Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code (high 8.7, exploited in the wild)
- [CVE-2024-49779](https://insights.sbomify.com/CVE-2024-49779/): IBM OpenPages cross-site request forgery (medium 4.3)
- [CVE-2024-49778](https://insights.sbomify.com/CVE-2024-49778/): Memory corruption in justdan96:tsmuxer (high 8.8)
- [CVE-2024-49777](https://insights.sbomify.com/CVE-2024-49777/): Memory corruption in justdan96:tsmuxer (high 8.8)
- [CVE-2024-49776](https://insights.sbomify.com/CVE-2024-49776/): Memory corruption in justdan96:tsmuxer (medium 6.5)
- [CVE-2024-49775](https://insights.sbomify.com/CVE-2024-49775/): Memory corruption in Opcenter Execution Foundation (critical 9.3)
- [CVE-2024-49774](https://insights.sbomify.com/CVE-2024-49774/): ModuleScanner flaws in SuiteCRM (high 7.2)
- [CVE-2024-49773](https://insights.sbomify.com/CVE-2024-49773/): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in SuiteCRM (medium 5.3)
- [CVE-2024-49772](https://insights.sbomify.com/CVE-2024-49772/): Authenticated SQL injection in AM_ProjectTemplates controller in SuiteCRM (high 8.8)
- [CVE-2024-49771](https://insights.sbomify.com/CVE-2024-49771/): MPXJ has a Potential Path Traversal Vulnerability (medium 5.3)
- [CVE-2024-49770](https://insights.sbomify.com/CVE-2024-49770/): oak's path traversal allows transfer of hidden files within the served root directory (high 7.7)
- [CVE-2024-4977](https://insights.sbomify.com/CVE-2024-4977/): Index WP MySQL For Speed < 1.4.18 - Admin+ Reflected XSS (medium 6.8)
- [CVE-2024-49769](https://insights.sbomify.com/CVE-2024-49769/): Waitress has a denial of service leading to high CPU usage/resource exhaustion (high 7.5)
- [CVE-2024-49768](https://insights.sbomify.com/CVE-2024-49768/): Waitress has request processing race condition in HTTP pipelining with invalid first request (critical 9.1)
- [CVE-2024-49767](https://insights.sbomify.com/CVE-2024-49767/): Werkzeug possible resource exhaustion when parsing file data in forms (medium 6.9)
- [CVE-2024-49766](https://insights.sbomify.com/CVE-2024-49766/): Werkzeug safe_join not safe on Windows (medium 6.3)
- [CVE-2024-49765](https://insights.sbomify.com/CVE-2024-49765/): Bypass of Discourse Connect using other login paths if enabled in Discourse (medium 5.3)
- [CVE-2024-49764](https://insights.sbomify.com/CVE-2024-49764/): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/device/capture.inc.php (medium 4.8)
- [CVE-2024-49763](https://insights.sbomify.com/CVE-2024-49763/): PlexRipper allows API leak due to open CORS policy (high 8.7)
- [CVE-2024-49762](https://insights.sbomify.com/CVE-2024-49762/): Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled (medium 4.6)
- [CVE-2024-49761](https://insights.sbomify.com/CVE-2024-49761/): REXML ReDoS vulnerability (medium 6.6)
- [CVE-2024-49760](https://insights.sbomify.com/CVE-2024-49760/): OpenRefine has a path traversal in LoadLanguageCommand (high 7.1)
- [CVE-2024-4976](https://insights.sbomify.com/CVE-2024-4976/): Out-of-bounds array write in Xpdf 4.05 due to missing object type check (low 2.1)
- [CVE-2024-49759](https://insights.sbomify.com/CVE-2024-49759/): LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/edituser.inc.php (medium 4.8)
- [CVE-2024-49758](https://insights.sbomify.com/CVE-2024-49758/): LibreNMS has a stored XSS in ExamplePlugin with Device's Notes (medium 4.8)
- [CVE-2024-49757](https://insights.sbomify.com/CVE-2024-49757/): Zitadel User Registration Bypass Vulnerability (high 7.5)
- [CVE-2024-49756](https://insights.sbomify.com/CVE-2024-49756/): AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability. (medium 5.3)
- [CVE-2024-49755](https://insights.sbomify.com/CVE-2024-49755/): Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs (low 3.1)
- [CVE-2024-49754](https://insights.sbomify.com/CVE-2024-49754/): LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php (high 7.5)
- [CVE-2024-49753](https://insights.sbomify.com/CVE-2024-49753/): Denied Host Validation Bypass in Zitadel Actions (medium 5.9)
- [CVE-2024-49751](https://insights.sbomify.com/CVE-2024-49751/): Frappe Press possible HTML injection through SaaS Signup inputs (low 1.2)
- [CVE-2024-49750](https://insights.sbomify.com/CVE-2024-49750/): Snowflake Connector for Python has sensitive data in logs (medium 5.5)
- [CVE-2024-4975](https://insights.sbomify.com/CVE-2024-4975/): code-projects Simple Chat System Message cross site scripting (medium 5.3)
- [CVE-2024-49749](https://insights.sbomify.com/CVE-2024-49749/): Integer overflow in Android (high 8.8)
- [CVE-2024-49748](https://insights.sbomify.com/CVE-2024-49748/): Memory corruption in Android (critical 9.8)
- [CVE-2024-49747](https://insights.sbomify.com/CVE-2024-49747/): Memory corruption in Android (critical 9.8)
- [CVE-2024-49745](https://insights.sbomify.com/CVE-2024-49745/): Memory corruption in Android (high 7.8)
- [CVE-2024-49744](https://insights.sbomify.com/CVE-2024-49744/): Deserialization in Android (high 7.8)
- [CVE-2024-49742](https://insights.sbomify.com/CVE-2024-49742/): Missing authorization in Android (high 7.8)
- [CVE-2024-49740](https://insights.sbomify.com/CVE-2024-49740/): Denial of service in Android (medium 5.5)
- [CVE-2024-4974](https://insights.sbomify.com/CVE-2024-4974/): code-projects Simple Chat System register.php cross site scripting (medium 5.3)
- [CVE-2024-49739](https://insights.sbomify.com/CVE-2024-49739/): Memory corruption in Android (medium 4.0)
- [CVE-2024-49738](https://insights.sbomify.com/CVE-2024-49738/): Memory corruption in Android (high 7.8)
- [CVE-2024-49737](https://insights.sbomify.com/CVE-2024-49737/): Privilege escalation in Android (high 7.8)
- [CVE-2024-49736](https://insights.sbomify.com/CVE-2024-49736/): Business logic in Android (medium 5.5)
- [CVE-2024-49735](https://insights.sbomify.com/CVE-2024-49735/): Privilege escalation in Android (high 7.8)
- [CVE-2024-49734](https://insights.sbomify.com/CVE-2024-49734/): Information disclosure in Android (high 7.5)
- [CVE-2024-49733](https://insights.sbomify.com/CVE-2024-49733/): Information disclosure in Android (medium 5.5)
- [CVE-2024-49732](https://insights.sbomify.com/CVE-2024-49732/): Missing authorization in Android (high 7.8)
- [CVE-2024-49731](https://insights.sbomify.com/CVE-2024-49731/): Business logic in Android (medium 4.0)
- [CVE-2024-49730](https://insights.sbomify.com/CVE-2024-49730/): Memory corruption in Android (high 7.8)
- [CVE-2024-4973](https://insights.sbomify.com/CVE-2024-4973/): code-projects Simple Chat System register.php sql injection (medium 5.3)
- [CVE-2024-49728](https://insights.sbomify.com/CVE-2024-49728/): Information disclosure in Android (medium 5.5)
- [CVE-2024-49724](https://insights.sbomify.com/CVE-2024-49724/): Race condition in Android (high 7.0)
- [CVE-2024-49722](https://insights.sbomify.com/CVE-2024-49722/): Information disclosure in Android (medium 5.5)
- [CVE-2024-49720](https://insights.sbomify.com/CVE-2024-49720/): Business logic in Android (high 7.8)
- [CVE-2024-4972](https://insights.sbomify.com/CVE-2024-4972/): code-projects Simple Chat System login.php sql injection (medium 5.3)
- [CVE-2024-49714](https://insights.sbomify.com/CVE-2024-49714/): Memory corruption in Android (high 7.8)
- [CVE-2024-4971](https://insights.sbomify.com/CVE-2024-4971/): Cross-site scripting in LearnPress – WordPress LMS Plugin for Create and Sell Online Courses (medium 6.4)
- [CVE-2024-49709](https://insights.sbomify.com/CVE-2024-49709/): XSS in iKSORIS (low 2.3)
- [CVE-2024-49708](https://insights.sbomify.com/CVE-2024-49708/): XSS in iKSORIS (medium 5.1)
- [CVE-2024-49707](https://insights.sbomify.com/CVE-2024-49707/): XSS in iKSORIS (medium 5.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/235/