# Vulnerabilities published in 2024


- [CVE-2024-41778](https://insights.sbomify.com/CVE-2024-41778/): IBM Controller information disclosure (medium 5.3)
- [CVE-2024-41777](https://insights.sbomify.com/CVE-2024-41777/): IBM Cognos Controller hard coded credentials (high 7.5)
- [CVE-2024-41776](https://insights.sbomify.com/CVE-2024-41776/): IBM Cognos Controller cross-site request forgery (medium 6.5)
- [CVE-2024-41775](https://insights.sbomify.com/CVE-2024-41775/): IBM Cognos Controller information disclosure (medium 5.9)
- [CVE-2024-41774](https://insights.sbomify.com/CVE-2024-41774/): IBM Common Licensing cross-site scripting (medium 4.8)
- [CVE-2024-41773](https://insights.sbomify.com/CVE-2024-41773/): IBM Global Configuration Management incorrect ownership assignment (medium 6.5)
- [CVE-2024-41771](https://insights.sbomify.com/CVE-2024-41771/): IBM Engineering Requirements Management DOORS Next information disclosure (high 7.5)
- [CVE-2024-41770](https://insights.sbomify.com/CVE-2024-41770/): IBM Engineering Requirements Management DOORS Next information disclosure (high 7.5)
- [CVE-2024-4177](https://insights.sbomify.com/CVE-2024-4177/): Host whitelist parser issue in GravityZone Console On-Premise (VA-11554) (high 8.1)
- [CVE-2024-41768](https://insights.sbomify.com/CVE-2024-41768/): IBM Engineering Lifecycle Optimization - Publishing unhandled SLL exception (medium 6.5)
- [CVE-2024-41767](https://insights.sbomify.com/CVE-2024-41767/): IBM Engineering Lifecycle Optimization - Publishing SQL injection (high 7.3)
- [CVE-2024-41766](https://insights.sbomify.com/CVE-2024-41766/): IBM Engineering Lifecycle Optimization - Publishing denial of service (high 7.5)
- [CVE-2024-41765](https://insights.sbomify.com/CVE-2024-41765/): IBM Engineering Lifecycle Optimization - Publishing directory traversal (medium 6.5)
- [CVE-2024-41763](https://insights.sbomify.com/CVE-2024-41763/): IBM Engineering Lifecycle Optimization - Publishing information disclosure (medium 5.9)
- [CVE-2024-41762](https://insights.sbomify.com/CVE-2024-41762/): IBM Db2 denial of service (medium 5.3)
- [CVE-2024-41761](https://insights.sbomify.com/CVE-2024-41761/): IBM Db2 denial of service (medium 5.3)
- [CVE-2024-41760](https://insights.sbomify.com/CVE-2024-41760/): IBM Common Cryptographic Architecture information disclosure (low 3.7)
- [CVE-2024-4176](https://insights.sbomify.com/CVE-2024-4176/): Cross-site scripting in Trellix EDR UI (XConsole) (medium 4.1)
- [CVE-2024-41757](https://insights.sbomify.com/CVE-2024-41757/): IBM Concert Software information disclosure (medium 5.9)
- [CVE-2024-41753](https://insights.sbomify.com/CVE-2024-41753/): IBM Cloud Pak for Business Automation cross-site scripting (medium 6.1)
- [CVE-2024-41752](https://insights.sbomify.com/CVE-2024-41752/): IBM Cognos Analytics HTML injection (medium 5.4)
- [CVE-2024-41751](https://insights.sbomify.com/CVE-2024-41751/): IBM SmartCloud Analytics - Log Analysis security bypass (medium 5.5)
- [CVE-2024-41750](https://insights.sbomify.com/CVE-2024-41750/): IBM SmartCloud Analytics - Log Analysis security bypass (medium 5.5)
- [CVE-2024-4175](https://insights.sbomify.com/CVE-2024-4175/): Improper Input Validation vulnerability in Hyperion Web Server (medium 5.4)
- [CVE-2024-41746](https://insights.sbomify.com/CVE-2024-41746/): IBM CICS TX cross-site scripting (high 7.2)
- [CVE-2024-41745](https://insights.sbomify.com/CVE-2024-41745/): IBM CICS TX Standard cross-site scripting (medium 6.1)
- [CVE-2024-41744](https://insights.sbomify.com/CVE-2024-41744/): IBM CICS TX Standard cross-site request forgery (medium 6.5)
- [CVE-2024-41743](https://insights.sbomify.com/CVE-2024-41743/): IBM TXSeries for Multiplatforms denial of service (high 7.5)
- [CVE-2024-41742](https://insights.sbomify.com/CVE-2024-41742/): IBM TXSeries for Multiplatforms denial of service (high 7.5)
- [CVE-2024-41741](https://insights.sbomify.com/CVE-2024-41741/): IBM TXSeries for Multiplatforms information disclosure (medium 5.3)
- [CVE-2024-4174](https://insights.sbomify.com/CVE-2024-4174/): Cross-Site Scripting (XSS) vulnerability in Hyperion Web Server (medium 5.4)
- [CVE-2024-41739](https://insights.sbomify.com/CVE-2024-41739/): IBM Cognos Dashboards on Cloud Pak for Data privilege escalation (high 8.8)
- [CVE-2024-41738](https://insights.sbomify.com/CVE-2024-41738/): IBM TXSeries for Multiplatforms information disclosure (medium 5.9)
- [CVE-2024-41737](https://insights.sbomify.com/CVE-2024-41737/): Server-Side Request Forgery (SSRF) in SAP CRM ABAP (Insights Management) (medium 5.0)
- [CVE-2024-41736](https://insights.sbomify.com/CVE-2024-41736/): Information Disclosure vulnerability in SAP Permit to Work (medium 4.3)
- [CVE-2024-41735](https://insights.sbomify.com/CVE-2024-41735/): Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice (medium 5.4)
- [CVE-2024-41734](https://insights.sbomify.com/CVE-2024-41734/): Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (medium 4.3)
- [CVE-2024-41733](https://insights.sbomify.com/CVE-2024-41733/): Information Disclosure Vulnerability in SAP Commerce (medium 5.3)
- [CVE-2024-41732](https://insights.sbomify.com/CVE-2024-41732/): Improper Access Control in SAP Netweaver Application Server ABAP (medium 4.7)
- [CVE-2024-41731](https://insights.sbomify.com/CVE-2024-41731/): Multiple Unrestricted File Upload vulnerabilities in SAP BusinessObjects Business Intelligence Platform (low 3.1)
- [CVE-2024-41730](https://insights.sbomify.com/CVE-2024-41730/): Missing Authentication check in SAP BusinessObjects Business Intelligence Platform (critical 9.8)
- [CVE-2024-4173](https://insights.sbomify.com/CVE-2024-4173/): SANnav versions exposes Kafka in the wan interface. (high 7.6)
- [CVE-2024-41729](https://insights.sbomify.com/CVE-2024-41729/): Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer) (medium 4.3)
- [CVE-2024-41728](https://insights.sbomify.com/CVE-2024-41728/): Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform (low 2.7)
- [CVE-2024-41727](https://insights.sbomify.com/CVE-2024-41727/): BIG-IP TMM vulnerability (high 8.7)
- [CVE-2024-41726](https://insights.sbomify.com/CVE-2024-41726/): Path traversal in SKYSEA Client View (high 7.5)
- [CVE-2024-41725](https://insights.sbomify.com/CVE-2024-41725/): Dover Fueling Solutions ProGauge MAGLINK LX CONSOLE Cross-site Scripting (high 8.7)
- [CVE-2024-41724](https://insights.sbomify.com/CVE-2024-41724/): Security feature bypass in Command Centre Server (high 8.7)
- [CVE-2024-41723](https://insights.sbomify.com/CVE-2024-41723/): BIG-IP iControl REST vulnerability (medium 5.3)
- [CVE-2024-41722](https://insights.sbomify.com/CVE-2024-41722/): goTenna Pro ATAK Plugin Weak Authentication (medium 6.0)
- [CVE-2024-41721](https://insights.sbomify.com/CVE-2024-41721/): bhyve(8) out-of-bounds read access via XHCI emulation (high 8.1)
- [CVE-2024-41720](https://insights.sbomify.com/CVE-2024-41720/): Misconfiguration in ZWX-2000CSW2-HN (high 8.0)
- [CVE-2024-4172](https://insights.sbomify.com/CVE-2024-4172/): idcCMS cross-site request forgery (medium 4.3)
- [CVE-2024-41719](https://insights.sbomify.com/CVE-2024-41719/): BIG-IP Next Central Manager vulnerability (medium 5.1)
- [CVE-2024-41717](https://insights.sbomify.com/CVE-2024-41717/): Kieback&Peter DDC4000 Series Path Traversal (critical 9.3)
- [CVE-2024-41716](https://insights.sbomify.com/CVE-2024-41716/): Information disclosure in WindLDR (high 8.1)
- [CVE-2024-41715](https://insights.sbomify.com/CVE-2024-41715/): goTenna Pro ATAK Plugin Observable Response Discrepancy (medium 5.3)
- [CVE-2024-41714](https://insights.sbomify.com/CVE-2024-41714/): Command injection in mitel:micollab (high 8.8)
- [CVE-2024-41713](https://insights.sbomify.com/CVE-2024-41713/): Mitel MiCollab Path Traversal (critical 9.1, exploited in the wild)
- [CVE-2024-41712](https://insights.sbomify.com/CVE-2024-41712/): Command injection in mitel:micollab (medium 6.6)
- [CVE-2024-41711](https://insights.sbomify.com/CVE-2024-41711/): A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 ( (medium 6.8)
- [CVE-2024-41710](https://insights.sbomify.com/CVE-2024-41710/): Mitel SIP Phones Argument Injection (medium 6.8, exploited in the wild)
- [CVE-2024-4171](https://insights.sbomify.com/CVE-2024-4171/): Tenda W30E WizardHandle fromWizardHandle stack-based overflow (high 8.8)
- [CVE-2024-41709](https://insights.sbomify.com/CVE-2024-41709/): Backdrop CMS does not sufficiently sanitize field labels before they are displayed in certain places (medium 6.1)
- [CVE-2024-41708](https://insights.sbomify.com/CVE-2024-41708/): An issue was discovered in AdaCore ada_web_services 20.0 allows an attacker to escalate privileges and steal sessions via the Random_String( (high 7.5)
- [CVE-2024-41707](https://insights.sbomify.com/CVE-2024-41707/): Cross-site scripting in archerirm:archer (medium 4.8)
- [CVE-2024-41706](https://insights.sbomify.com/CVE-2024-41706/): Cross-site scripting in archerirm:archer (high 7.3)
- [CVE-2024-41705](https://insights.sbomify.com/CVE-2024-41705/): Cross-site scripting in archerirm:archer (high 7.1)
- [CVE-2024-41704](https://insights.sbomify.com/CVE-2024-41704/): Path traversal in librechat:librechat (critical 9.1)
- [CVE-2024-41703](https://insights.sbomify.com/CVE-2024-41703/): Missing authorization in librechat:librechat (medium 5.4)
- [CVE-2024-41702](https://insights.sbomify.com/CVE-2024-41702/): SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (critical 9.8)
- [CVE-2024-41701](https://insights.sbomify.com/CVE-2024-41701/): AccuPOS – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (medium 5.3)
- [CVE-2024-41700](https://insights.sbomify.com/CVE-2024-41700/): Barix – CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (high 7.5)
- [CVE-2024-4170](https://insights.sbomify.com/CVE-2024-4170/): Tenda 4G300 sub_429A30 stack-based overflow (high 8.8)
- [CVE-2024-41699](https://insights.sbomify.com/CVE-2024-41699/): Priority – CWE-552: Files or Directories Accessible to External Parties (medium 4.4)
- [CVE-2024-41698](https://insights.sbomify.com/CVE-2024-41698/): Priority – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (medium 4.3)
- [CVE-2024-41697](https://insights.sbomify.com/CVE-2024-41697/): Priority – CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (medium 6.1)
- [CVE-2024-41696](https://insights.sbomify.com/CVE-2024-41696/): Information disclosure in PRI WEB Portal Add-On for Priority ERP on prem (high 7.5)
- [CVE-2024-41695](https://insights.sbomify.com/CVE-2024-41695/): Cybonet - CWE-22: Improper Limitation of a Pathname to a Restricted Directory (high 7.5)
- [CVE-2024-41694](https://insights.sbomify.com/CVE-2024-41694/): Cybonet – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (medium 5.3)
- [CVE-2024-41693](https://insights.sbomify.com/CVE-2024-41693/): Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (medium 6.1)
- [CVE-2024-41692](https://insights.sbomify.com/CVE-2024-41692/): Incorrect Access Control Vulnerability (high 8.6)
- [CVE-2024-41691](https://insights.sbomify.com/CVE-2024-41691/): Insecure Storage of Sensitive Information Vulnerability (high 7.0)
- [CVE-2024-41690](https://insights.sbomify.com/CVE-2024-41690/): Default Credential Storage in Plaintext Vulnerability (high 7.0)
- [CVE-2024-4169](https://insights.sbomify.com/CVE-2024-4169/): Tenda 4G300 sub_4279CC stack-based overflow (high 8.8)
- [CVE-2024-41689](https://insights.sbomify.com/CVE-2024-41689/): Hard-coded Credentials Vulnerability (medium 5.2)
- [CVE-2024-41688](https://insights.sbomify.com/CVE-2024-41688/): Cleartext Storage of Sensitive Information Vulnerability (high 7.0)
- [CVE-2024-41687](https://insights.sbomify.com/CVE-2024-41687/): Cleartext Transmission of Sensitive Information Vulnerability (high 8.6)
- [CVE-2024-41686](https://insights.sbomify.com/CVE-2024-41686/): Password Policy Bypass Vulnerability (high 7.3)
- [CVE-2024-41685](https://insights.sbomify.com/CVE-2024-41685/): Cookie Without HTTPOnly Flag Set Vulnerability (medium 6.9)
- [CVE-2024-41684](https://insights.sbomify.com/CVE-2024-41684/): Cookie Without Secure Flag Set Vulnerability (medium 6.9)
- [CVE-2024-41683](https://insights.sbomify.com/CVE-2024-41683/): Weak cryptography in Location Intelligence family (medium 6.9)
- [CVE-2024-41682](https://insights.sbomify.com/CVE-2024-41682/): Auth bypass in Location Intelligence family (medium 6.9)
- [CVE-2024-41681](https://insights.sbomify.com/CVE-2024-41681/): Weak cryptography in Location Intelligence family (medium 6.0)
- [CVE-2024-4168](https://insights.sbomify.com/CVE-2024-4168/): Tenda 4G300 sub_4260F0 stack-based overflow (high 8.8)
- [CVE-2024-41679](https://insights.sbomify.com/CVE-2024-41679/): Authenticated SQL injection in ticket form (medium 6.5)
- [CVE-2024-41678](https://insights.sbomify.com/CVE-2024-41678/): GLPI has multiple reflected XSS (medium 6.5)
- [CVE-2024-41677](https://insights.sbomify.com/CVE-2024-41677/): Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwik (medium 6.3)
- [CVE-2024-41676](https://insights.sbomify.com/CVE-2024-41676/): Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs (medium 4.1)
- [CVE-2024-41675](https://insights.sbomify.com/CVE-2024-41675/): CKAN has a Cross-site Scripting vector in the Datatables view plugin (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/297/