# Vulnerabilities published in 2024


- [CVE-2024-41987](https://insights.sbomify.com/CVE-2024-41987/): Cross-Site Request Forgery (CSRF) vulnerability in TEM Opera Plus FM Family Transmitter (high 8.6)
- [CVE-2024-41986](https://insights.sbomify.com/CVE-2024-41986/): Weak cryptography in SOA Audit (medium 6.1)
- [CVE-2024-41985](https://insights.sbomify.com/CVE-2024-41985/): Auth bypass in SOA Audit (low 2.1)
- [CVE-2024-41984](https://insights.sbomify.com/CVE-2024-41984/): Information disclosure in SOA Audit (low 2.1)
- [CVE-2024-41983](https://insights.sbomify.com/CVE-2024-41983/): Information disclosure in SOA Audit (medium 5.1)
- [CVE-2024-41982](https://insights.sbomify.com/CVE-2024-41982/): Information disclosure in SOA Audit (medium 5.9)
- [CVE-2024-41981](https://insights.sbomify.com/CVE-2024-41981/): Memory corruption in Simcenter Femap V2306 (high 7.3)
- [CVE-2024-41980](https://insights.sbomify.com/CVE-2024-41980/): Information disclosure in SOA Audit (low 2.0)
- [CVE-2024-4198](https://insights.sbomify.com/CVE-2024-4198/): Mattermost fails to fully validate role changes (low 2.7)
- [CVE-2024-41979](https://insights.sbomify.com/CVE-2024-41979/): Missing authorization in SOA Audit (high 7.5)
- [CVE-2024-41978](https://insights.sbomify.com/CVE-2024-41978/): Information disclosure in RUGGEDCOM RM1224 LTE(4G) EU (high 7.1)
- [CVE-2024-41977](https://insights.sbomify.com/CVE-2024-41977/): Privilege escalation in RUGGEDCOM RM1224 LTE(4G) EU (high 7.3)
- [CVE-2024-41976](https://insights.sbomify.com/CVE-2024-41976/): Code injection in RUGGEDCOM RM1224 LTE(4G) EU (high 8.6)
- [CVE-2024-41975](https://insights.sbomify.com/CVE-2024-41975/): CODESYS (Edge) Gateway for Windows insecure default (medium 5.3)
- [CVE-2024-41974](https://insights.sbomify.com/CVE-2024-41974/): WAGO: BACNet Service Property Modification Due to Permission Misconfiguration in Multiple Devices (high 7.1)
- [CVE-2024-41973](https://insights.sbomify.com/CVE-2024-41973/): WAGO: Remote Arbitrary File Write with Root Privileges in multiple Devices (high 8.1)
- [CVE-2024-41972](https://insights.sbomify.com/CVE-2024-41972/): WAGO: Arbitrary File Overwrite Leading to Privileged File Read in Multiple Devices (medium 6.5)
- [CVE-2024-41971](https://insights.sbomify.com/CVE-2024-41971/): WAGO: Arbitrary File Overwrite in Multiple Devices (high 8.1)
- [CVE-2024-41970](https://insights.sbomify.com/CVE-2024-41970/): WAGO: Unauthorized Diagnostic Data Exposure in Multiple Devices (medium 5.7)
- [CVE-2024-4197](https://insights.sbomify.com/CVE-2024-4197/): Avaya IP Office One-X Portal File Upload Vulnerability (critical 9.9)
- [CVE-2024-41969](https://insights.sbomify.com/CVE-2024-41969/): WAGO: CODESYS V3 Configuration Authentication Bypass in Multiple Devices (high 8.8)
- [CVE-2024-41968](https://insights.sbomify.com/CVE-2024-41968/): WAGO: Docker Settings Manipulation in Multiple Devices (medium 5.4)
- [CVE-2024-41967](https://insights.sbomify.com/CVE-2024-41967/): WAGO: Boot Mode Manipulation in Multiple Devices (high 8.1)
- [CVE-2024-41965](https://insights.sbomify.com/CVE-2024-41965/): Vim < v9.1.0648 has a double-free in dialog_changed() (medium 4.2)
- [CVE-2024-41964](https://insights.sbomify.com/CVE-2024-41964/): Insufficient permission checks in the language settings in Kirby CMS (high 8.1)
- [CVE-2024-41962](https://insights.sbomify.com/CVE-2024-41962/): Bostr Improper Authorization (medium 4.6)
- [CVE-2024-41961](https://insights.sbomify.com/CVE-2024-41961/): Elektra vulnerable to remote code execution in universal search (critical 9.2)
- [CVE-2024-41960](https://insights.sbomify.com/CVE-2024-41960/): Cross-site Scripting (XSS) via Relay Hosts Configuration in mailcow: dockerized (low 3.8)
- [CVE-2024-4196](https://insights.sbomify.com/CVE-2024-4196/): Avaya IP Office Web Control RCE Vulnerability (critical 10.0)
- [CVE-2024-41959](https://insights.sbomify.com/CVE-2024-41959/): Cross-site Scripting (XSS) via API Logs in mailcow: dockerized (high 7.6)
- [CVE-2024-41958](https://insights.sbomify.com/CVE-2024-41958/): Two-Factor Authentication (2FA) Bypass in mailcow: dockerized (medium 6.6)
- [CVE-2024-41957](https://insights.sbomify.com/CVE-2024-41957/): Vim double free in src/alloc.c:616 (medium 4.5)
- [CVE-2024-41956](https://insights.sbomify.com/CVE-2024-41956/): Soft Serve allows arbitrary code execution by crafting git-lfs requests (high 8.1)
- [CVE-2024-41955](https://insights.sbomify.com/CVE-2024-41955/): Mobile Security Framework (MobSF) has an Open Redirect in Login Redirect (medium 5.2)
- [CVE-2024-41954](https://insights.sbomify.com/CVE-2024-41954/): FOG Weak file permissions (medium 5.3)
- [CVE-2024-41953](https://insights.sbomify.com/CVE-2024-41953/): Zitadel improperly sanitizes HTML in emails and Console UI (medium 4.3)
- [CVE-2024-41952](https://insights.sbomify.com/CVE-2024-41952/): Zitadel has an "Ignoring unknown usernames" vulnerability (medium 5.3)
- [CVE-2024-41951](https://insights.sbomify.com/CVE-2024-41951/): PheonixAppAPI has visible Encoding Maps (medium 4.4)
- [CVE-2024-41950](https://insights.sbomify.com/CVE-2024-41950/): Insecure Jinja2 templates rendered in Haystack Components can lead to RCE (high 7.5)
- [CVE-2024-4195](https://insights.sbomify.com/CVE-2024-4195/): Mattermost allows team admins to promote guests to team admins (low 2.7)
- [CVE-2024-41949](https://insights.sbomify.com/CVE-2024-41949/): biscuit-rust vulnerable to public key confusion in third party block (low 3.0)
- [CVE-2024-41948](https://insights.sbomify.com/CVE-2024-41948/): biscuit-java vulnerable to public key confusion in third party block (low 3.0)
- [CVE-2024-41947](https://insights.sbomify.com/CVE-2024-41947/): XWiki Platform XSS through conflict resolution (critical 9.1)
- [CVE-2024-41946](https://insights.sbomify.com/CVE-2024-41946/): REXML DoS vulnerability (medium 5.3)
- [CVE-2024-41945](https://insights.sbomify.com/CVE-2024-41945/): The fuels-ts typescript SDK has no awareness of to-be-spent transactions (low 3.1)
- [CVE-2024-41944](https://insights.sbomify.com/CVE-2024-41944/): Sensitive Information Disclosure abusing SQL Injection in Xibo CMS proof of play report (medium 6.5)
- [CVE-2024-41943](https://insights.sbomify.com/CVE-2024-41943/): I, Librarian Stored XSS vulnerability in Item Summary (medium 4.6)
- [CVE-2024-41942](https://insights.sbomify.com/CVE-2024-41942/): JupyterHub has a privilege escalation vulnerability with the `admin:users` scope (high 7.2)
- [CVE-2024-41941](https://insights.sbomify.com/CVE-2024-41941/): Missing authorization in SINEC NMS (medium 5.3)
- [CVE-2024-41940](https://insights.sbomify.com/CVE-2024-41940/): Command injection in SINEC NMS (critical 9.4)
- [CVE-2024-4194](https://insights.sbomify.com/CVE-2024-4194/): Album and Image Gallery plus Lightbox <= 2.0 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-41939](https://insights.sbomify.com/CVE-2024-41939/): Missing authorization in SINEC NMS (high 8.7)
- [CVE-2024-41938](https://insights.sbomify.com/CVE-2024-41938/): Path traversal in SINEC NMS (medium 5.1)
- [CVE-2024-41937](https://insights.sbomify.com/CVE-2024-41937/): Apache Airflow: Stored XSS Vulnerability on provider link (medium 6.1)
- [CVE-2024-41936](https://insights.sbomify.com/CVE-2024-41936/): Vonets WiFi Bridges Path Traversal (high 8.7)
- [CVE-2024-41935](https://insights.sbomify.com/CVE-2024-41935/): f2fs: fix to shrink read extent node in batches (high 7.1)
- [CVE-2024-41934](https://insights.sbomify.com/CVE-2024-41934/): Missing authorization in Intel(R) GPA software (medium 4.1)
- [CVE-2024-41932](https://insights.sbomify.com/CVE-2024-41932/): sched: fix warning in sched_setaffinity (medium 5.5)
- [CVE-2024-41931](https://insights.sbomify.com/CVE-2024-41931/): goTenna Pro ATAK Plugin Insertion of Sensitive Information Into Sent Data (medium 5.3)
- [CVE-2024-41930](https://insights.sbomify.com/CVE-2024-41930/): Cross-site scripting in MF Teacher Performance Management System (medium 6.1)
- [CVE-2024-4193](https://insights.sbomify.com/CVE-2024-4193/): Testimonial Slider <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-41929](https://insights.sbomify.com/CVE-2024-41929/): Auth bypass in AHD04T-A (high 8.8)
- [CVE-2024-41928](https://insights.sbomify.com/CVE-2024-41928/): bhyve(8) privileged guest escape via TPM device passthrough (high 8.4)
- [CVE-2024-41927](https://insights.sbomify.com/CVE-2024-41927/): Information disclosure in FC6A Series MICROSmart All-in-One CPU module (medium 4.6)
- [CVE-2024-41926](https://insights.sbomify.com/CVE-2024-41926/): Malicious remote can claim that a user was synced from another remote (low 2.7)
- [CVE-2024-41925](https://insights.sbomify.com/CVE-2024-41925/): Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion (critical 9.3)
- [CVE-2024-41924](https://insights.sbomify.com/CVE-2024-41924/): Security feature bypass in EC-CUBE 4 series (high 7.2)
- [CVE-2024-41922](https://insights.sbomify.com/CVE-2024-41922/): Path traversal in Anka Build (high 7.5)
- [CVE-2024-41921](https://insights.sbomify.com/CVE-2024-41921/): Unsafe use of eval() method in rostopic echo tool (high 7.8)
- [CVE-2024-4192](https://insights.sbomify.com/CVE-2024-4192/): Stack-based Buffer Overflow vulnerability in Delta Electronics CNCSoft-G2 DOPSoft (high 7.8)
- [CVE-2024-41918](https://insights.sbomify.com/CVE-2024-41918/): Open redirect in 'Rakuten Ichiba App' for Android (low 3.1)
- [CVE-2024-41917](https://insights.sbomify.com/CVE-2024-41917/): Race condition in Intel(R) Battery Life Diagnostic Tool software (medium 5.4)
- [CVE-2024-41916](https://insights.sbomify.com/CVE-2024-41916/): Authenticated Sensitive Information Disclosure in ClearPass Policy Manager (medium 6.8)
- [CVE-2024-41915](https://insights.sbomify.com/CVE-2024-41915/): Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface (high 7.2)
- [CVE-2024-41914](https://insights.sbomify.com/CVE-2024-41914/): Cross-site scripting in HPE Aruba Networking EdgeConnect SD-WAN Orchestrator (high 8.1)
- [CVE-2024-41913](https://insights.sbomify.com/CVE-2024-41913/): Clariti Manager – Arbitrary File Upload (high 8.8)
- [CVE-2024-41912](https://insights.sbomify.com/CVE-2024-41912/): Missing authorization in Poly Clariti Manager (critical 9.8)
- [CVE-2024-41911](https://insights.sbomify.com/CVE-2024-41911/): Cross-site scripting in Poly Clariti Manager (medium 5.4)
- [CVE-2024-41910](https://insights.sbomify.com/CVE-2024-41910/): Cross-site scripting in Poly Clariti Manager (medium 6.1)
- [CVE-2024-41909](https://insights.sbomify.com/CVE-2024-41909/): Apache MINA SSHD: integrity check bypass (medium 5.9)
- [CVE-2024-41908](https://insights.sbomify.com/CVE-2024-41908/): Memory corruption in NX (high 7.3)
- [CVE-2024-41907](https://insights.sbomify.com/CVE-2024-41907/): Misconfiguration in SINEC Traffic Analyzer (low 2.1)
- [CVE-2024-41906](https://insights.sbomify.com/CVE-2024-41906/): Information disclosure in SINEC Traffic Analyzer (medium 6.3)
- [CVE-2024-41905](https://insights.sbomify.com/CVE-2024-41905/): Missing authorization in SINEC Traffic Analyzer (high 7.6)
- [CVE-2024-41904](https://insights.sbomify.com/CVE-2024-41904/): Auth bypass in SINEC Traffic Analyzer (high 8.7)
- [CVE-2024-41903](https://insights.sbomify.com/CVE-2024-41903/): Misconfiguration in SINEC Traffic Analyzer (high 7.5)
- [CVE-2024-41902](https://insights.sbomify.com/CVE-2024-41902/): Memory corruption in JT2Go (high 7.3)
- [CVE-2024-4190](https://insights.sbomify.com/CVE-2024-4190/): OpenText ArcSight Logger Stored XSS (high 8.4)
- [CVE-2024-41890](https://insights.sbomify.com/CVE-2024-41890/): Apache Answer: The link to reset the user's password will remain valid after sending a new link (medium 5.3)
- [CVE-2024-4189](https://insights.sbomify.com/CVE-2024-4189/): Multiple XXE sinks in Run LoadRunner script step in OpenText Application Automation Tools (medium 5.9)
- [CVE-2024-41889](https://insights.sbomify.com/CVE-2024-41889/): Code injection in PiTool (high 8.8)
- [CVE-2024-41888](https://insights.sbomify.com/CVE-2024-41888/): Apache Answer: The link for resetting user password is not Single-Use (medium 5.3)
- [CVE-2024-41887](https://insights.sbomify.com/CVE-2024-41887/): Arbitrary File Overwrite (medium 5.1)
- [CVE-2024-41886](https://insights.sbomify.com/CVE-2024-41886/): Improper Input Validation (medium 6.9)
- [CVE-2024-41885](https://insights.sbomify.com/CVE-2024-41885/): Hardcoding sensitive information (medium 5.6)
- [CVE-2024-41884](https://insights.sbomify.com/CVE-2024-41884/): Null Pointer Dereference (medium 6.9)
- [CVE-2024-41883](https://insights.sbomify.com/CVE-2024-41883/): Null Pointer Dereference (medium 6.9)
- [CVE-2024-41882](https://insights.sbomify.com/CVE-2024-41882/): Stack based buffer overflow (medium 6.9)
- [CVE-2024-41881](https://insights.sbomify.com/CVE-2024-41881/): Memory corruption in SDoP (high 8.8)
- [CVE-2024-41880](https://insights.sbomify.com/CVE-2024-41880/): In veilid-core in Veilid before 0.3.4, the protocol's ping function can be misused in a way that decreases the effectiveness of safety and private routes. (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/295/