# Vulnerabilities published in 2024


- [CVE-2024-41285](https://insights.sbomify.com/CVE-2024-41285/): Memory corruption in fastcom:fw300r firmware (critical 9.8)
- [CVE-2024-41281](https://insights.sbomify.com/CVE-2024-41281/): Memory corruption in linksys:wrt54g firmware (high 8.8)
- [CVE-2024-4128](https://insights.sbomify.com/CVE-2024-4128/): CSRF in firebase-tools emulator suite (low 2.6)
- [CVE-2024-41276](https://insights.sbomify.com/CVE-2024-41276/): A vulnerability in Kaiten version 57.131.12 and earlier allows attackers to bypass the PIN code authentication mechanism. (critical 9.8)
- [CVE-2024-41270](https://insights.sbomify.com/CVE-2024-41270/): Gorush uses deprecated TLS versions (critical 9.1)
- [CVE-2024-4127](https://insights.sbomify.com/CVE-2024-4127/): Tenda W15E guestWifiRuleRefresh stack-based overflow (high 8.8)
- [CVE-2024-41265](https://insights.sbomify.com/CVE-2024-41265/): cortex establishes TLS connections with `InsecureSkipVerify` set to `true` (high 7.5)
- [CVE-2024-41264](https://insights.sbomify.com/CVE-2024-41264/): casdoor's use of`ssh.InsecureIgnoreHostKey()` disables host key verification (high 7.5)
- [CVE-2024-41262](https://insights.sbomify.com/CVE-2024-41262/): Information disclosure in codenotary:immudb (high 7.4)
- [CVE-2024-41260](https://insights.sbomify.com/CVE-2024-41260/): NetBird uses a static initialization vector (IV) (high 7.5)
- [CVE-2024-4126](https://insights.sbomify.com/CVE-2024-4126/): Tenda W15E SetSysTimeCfg formSetSysTime stack-based overflow (high 8.8)
- [CVE-2024-41259](https://insights.sbomify.com/CVE-2024-41259/): Navidrome uses MD5 hashing algorithm (critical 9.1)
- [CVE-2024-41258](https://insights.sbomify.com/CVE-2024-41258/): Security feature bypass in filestash:filestash (medium 5.3)
- [CVE-2024-41256](https://insights.sbomify.com/CVE-2024-41256/): Filestash skips TLS certificate verification process when sending out email verification codes (medium 5.9)
- [CVE-2024-41255](https://insights.sbomify.com/CVE-2024-41255/): Filestash configured to skip TLS certificate verification when using the FTPS protocol (high 7.5)
- [CVE-2024-41254](https://insights.sbomify.com/CVE-2024-41254/): Security feature bypass in litestream:litestream (medium 5.3)
- [CVE-2024-41253](https://insights.sbomify.com/CVE-2024-41253/): goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component. (high 7.1)
- [CVE-2024-41252](https://insights.sbomify.com/CVE-2024-41252/): Missing authorization in lopalopa:responsive school management system (medium 5.3)
- [CVE-2024-41251](https://insights.sbomify.com/CVE-2024-41251/): Missing authorization in lopalopa:responsive school management system (medium 6.5)
- [CVE-2024-41250](https://insights.sbomify.com/CVE-2024-41250/): Missing authorization in lopalopa:responsive school management system (medium 5.3)
- [CVE-2024-4125](https://insights.sbomify.com/CVE-2024-4125/): Tenda W15E setStaticRoute formSetStaticRoute stack-based overflow (high 8.8)
- [CVE-2024-41249](https://insights.sbomify.com/CVE-2024-41249/): Missing authorization in lopalopa:responsive school management system (high 7.5)
- [CVE-2024-41248](https://insights.sbomify.com/CVE-2024-41248/): Missing authorization in lopalopa:responsive school management system (high 7.5)
- [CVE-2024-41247](https://insights.sbomify.com/CVE-2024-41247/): Missing authorization in lopalopa:responsive school management system (critical 9.1)
- [CVE-2024-41246](https://insights.sbomify.com/CVE-2024-41246/): Missing authorization in lopalopa:responsive school management system (medium 5.3)
- [CVE-2024-41245](https://insights.sbomify.com/CVE-2024-41245/): Missing authorization in lopalopa:responsive school management system (high 7.5)
- [CVE-2024-41244](https://insights.sbomify.com/CVE-2024-41244/): Missing authorization in lopalopa:responsive school management system (high 7.5)
- [CVE-2024-41243](https://insights.sbomify.com/CVE-2024-41243/): Missing authorization in lopalopa:responsive school management system (medium 5.3)
- [CVE-2024-41242](https://insights.sbomify.com/CVE-2024-41242/): Cross-site scripting in lopalopa:responsive school management system (medium 5.5)
- [CVE-2024-41241](https://insights.sbomify.com/CVE-2024-41241/): Cross-site scripting in lopalopa:responsive school management system (medium 4.8)
- [CVE-2024-41240](https://insights.sbomify.com/CVE-2024-41240/): Cross-site scripting in lopalopa:responsive school management system (medium 6.3)
- [CVE-2024-4124](https://insights.sbomify.com/CVE-2024-4124/): Tenda W15E SetRemoteWebManage formSetRemoteWebManage stack-based overflow (high 8.8)
- [CVE-2024-41239](https://insights.sbomify.com/CVE-2024-41239/): Cross-site scripting in lopalopa:responsive school management system (medium 5.9)
- [CVE-2024-41238](https://insights.sbomify.com/CVE-2024-41238/): SQL injection in lopalopa:responsive school management system (medium 4.3)
- [CVE-2024-41237](https://insights.sbomify.com/CVE-2024-41237/): SQL injection in lopalopa:responsive school management system (critical 9.8)
- [CVE-2024-41236](https://insights.sbomify.com/CVE-2024-41236/): SQL injection in lopalopa:responsive school management system (medium 5.4)
- [CVE-2024-4123](https://insights.sbomify.com/CVE-2024-4123/): Tenda W15E SetPortMapping formSetPortMapping stack-based overflow (high 8.8)
- [CVE-2024-41228](https://insights.sbomify.com/CVE-2024-41228/): A symlink following vulnerability in the pouch cp function of AliyunContainerService pouch v1.3.1 allows attackers to escalate privileges an (high 7.6)
- [CVE-2024-41226](https://insights.sbomify.com/CVE-2024-41226/): Code injection in automationanywhere:automation 360 (high 8.8)
- [CVE-2024-4122](https://insights.sbomify.com/CVE-2024-4122/): Tenda W15E setDebugCfg formSetDebugCfg stack-based overflow (high 8.8)
- [CVE-2024-41217](https://insights.sbomify.com/CVE-2024-41217/): Memory corruption in justdan96:tsmuxer (medium 6.5)
- [CVE-2024-4121](https://insights.sbomify.com/CVE-2024-4121/): Tenda W15E formQOSRuleDel stack-based overflow (high 8.8)
- [CVE-2024-41209](https://insights.sbomify.com/CVE-2024-41209/): Memory corruption in justdan96:tsmuxer (high 8.8)
- [CVE-2024-41206](https://insights.sbomify.com/CVE-2024-41206/): Memory corruption in justdan96:tsmuxer (medium 6.5)
- [CVE-2024-41200](https://insights.sbomify.com/CVE-2024-41200/): Memory corruption in pandora:kmplayer (medium 5.5)
- [CVE-2024-4120](https://insights.sbomify.com/CVE-2024-4120/): Tenda W15E modifyIpMacBind formIPMacBindModify stack-based overflow (high 8.8)
- [CVE-2024-41199](https://insights.sbomify.com/CVE-2024-41199/): Auth bypass in ocuco:innovation (high 7.2)
- [CVE-2024-41198](https://insights.sbomify.com/CVE-2024-41198/): Auth bypass in ocuco:innovation (critical 9.8)
- [CVE-2024-41197](https://insights.sbomify.com/CVE-2024-41197/): Auth bypass in ocuco:innovation (critical 9.8)
- [CVE-2024-41196](https://insights.sbomify.com/CVE-2024-41196/): Auth bypass in ocuco:innovation (critical 9.8)
- [CVE-2024-41195](https://insights.sbomify.com/CVE-2024-41195/): Auth bypass in ocuco:innovation (critical 9.8)
- [CVE-2024-4119](https://insights.sbomify.com/CVE-2024-4119/): Tenda W15E delIpMacBind formIPMacBindDel stack-based overflow (high 8.8)
- [CVE-2024-41184](https://insights.sbomify.com/CVE-2024-41184/): In the vrrp_ipsets_handler handler (fglobal_parser.c) of keepalived through 2.3.1, an integer overflow can occur. (critical 9.8)
- [CVE-2024-41183](https://insights.sbomify.com/CVE-2024-41183/): Path traversal in Trend Micro VPN (consumer) (high 7.8)
- [CVE-2024-4118](https://insights.sbomify.com/CVE-2024-4118/): Tenda W15E addIpMacBind formIPMacBindAdd stack-based overflow (high 8.8)
- [CVE-2024-41178](https://insights.sbomify.com/CVE-2024-41178/): Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files (high 7.5)
- [CVE-2024-41177](https://insights.sbomify.com/CVE-2024-41177/): Apache Zeppelin: XSS in the Helium module (medium 6.1)
- [CVE-2024-41176](https://insights.sbomify.com/CVE-2024-41176/): Beckhoff: Local Denial of Service issue in package MDP included in TwinCAT/BSD (high 7.3)
- [CVE-2024-41175](https://insights.sbomify.com/CVE-2024-41175/): Beckhoff: Local Denial-of-Service vulnerability in TwinCAT/BSD and the IPC-Diagnostics package (medium 5.5)
- [CVE-2024-41174](https://insights.sbomify.com/CVE-2024-41174/): Beckhoff: Improper input neutralization vulnerability in the IPC-Diagnostics package in TwinCAT/BSD (high 7.3)
- [CVE-2024-41173](https://insights.sbomify.com/CVE-2024-41173/): Beckhoff: Local authentication bypass in the IPC-Diagnostics package included in TwinCAT/BSD (high 7.8)
- [CVE-2024-41172](https://insights.sbomify.com/CVE-2024-41172/): Apache CXF: Unrestricted memory consumption in CXF HTTP clients (medium 5.3)
- [CVE-2024-41171](https://insights.sbomify.com/CVE-2024-41171/): Privilege escalation in SINUMERIK 828D V4 (critical 9.3)
- [CVE-2024-41170](https://insights.sbomify.com/CVE-2024-41170/): Memory corruption in Tecnomatix Plant Simulation V2302 (high 7.3)
- [CVE-2024-4117](https://insights.sbomify.com/CVE-2024-4117/): Tenda W15E DelPortMapping formDelPortMapping stack-based overflow (high 8.8)
- [CVE-2024-41169](https://insights.sbomify.com/CVE-2024-41169/): Apache Zeppelin: raft directory listing and file read (high 7.5)
- [CVE-2024-41168](https://insights.sbomify.com/CVE-2024-41168/): Use after free in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows (high 7.1)
- [CVE-2024-41167](https://insights.sbomify.com/CVE-2024-41167/): Privilege escalation in Intel(R) Server Board M10JNP2SB Family (high 8.7)
- [CVE-2024-41166](https://insights.sbomify.com/CVE-2024-41166/): Memory corruption in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows (medium 6.0)
- [CVE-2024-41165](https://insights.sbomify.com/CVE-2024-41165/): Security feature bypass in Word (high 7.1)
- [CVE-2024-41164](https://insights.sbomify.com/CVE-2024-41164/): BIG-IP MPTCP vulnerability (high 8.2)
- [CVE-2024-41163](https://insights.sbomify.com/CVE-2024-41163/): Path traversal in Anka Build (high 7.5)
- [CVE-2024-41162](https://insights.sbomify.com/CVE-2024-41162/): Malicious remote can make an arbitrary local channel read-only (medium 4.1)
- [CVE-2024-41161](https://insights.sbomify.com/CVE-2024-41161/): Vonets WiFi Bridges Use of Hard-coded Credentials (high 8.7)
- [CVE-2024-41160](https://insights.sbomify.com/CVE-2024-41160/): Liteos-A has an use after free vulnerability (high 8.8)
- [CVE-2024-4116](https://insights.sbomify.com/CVE-2024-4116/): Tenda W15E DelDhcpRule formDelDhcpRule stack-based overflow (high 8.8)
- [CVE-2024-41159](https://insights.sbomify.com/CVE-2024-41159/): Security feature bypass in OneNote (high 7.1)
- [CVE-2024-41157](https://insights.sbomify.com/CVE-2024-41157/): Liteos-A has an use after free vulnerability (high 8.8)
- [CVE-2024-41156](https://insights.sbomify.com/CVE-2024-41156/): Information disclosure in TRO600 (low 2.7)
- [CVE-2024-41153](https://insights.sbomify.com/CVE-2024-41153/): Command injection in TRO600 (high 7.2)
- [CVE-2024-41151](https://insights.sbomify.com/CVE-2024-41151/): Apache HertzBeat: RCE by notice template injection vulnerability (high 8.8)
- [CVE-2024-41150](https://insights.sbomify.com/CVE-2024-41150/): Stored XSS (medium 6.3)
- [CVE-2024-4115](https://insights.sbomify.com/CVE-2024-4115/): Tenda W15E AddDnsForward formAddDnsForward stack-based overflow (high 8.8)
- [CVE-2024-41149](https://insights.sbomify.com/CVE-2024-41149/): block: avoid to reuse `hctx` not removed from cpuhp callback list (high 7.8)
- [CVE-2024-41148](https://insights.sbomify.com/CVE-2024-41148/): Unsafe use of eval() method in rostopic hz tool (high 7.8)
- [CVE-2024-41147](https://insights.sbomify.com/CVE-2024-41147/): Memory corruption in Miniaudio (high 7.7)
- [CVE-2024-41146](https://insights.sbomify.com/CVE-2024-41146/): Denial of service in Controller 6000 and Controller 7000 (medium 4.6)
- [CVE-2024-41145](https://insights.sbomify.com/CVE-2024-41145/): Security feature bypass in Teams (work or school) (high 7.1)
- [CVE-2024-41144](https://insights.sbomify.com/CVE-2024-41144/): Malicious remote can create/update/delete arbitrary posts in arbitrary channels (medium 5.5)
- [CVE-2024-41143](https://insights.sbomify.com/CVE-2024-41143/): Privilege escalation in SKYSEA Client View (high 7.8)
- [CVE-2024-41141](https://insights.sbomify.com/CVE-2024-41141/): Cross-site scripting in EC-CUBE Web API Plugin (medium 6.1)
- [CVE-2024-41140](https://insights.sbomify.com/CVE-2024-41140/): Improper Authorization (high 8.1)
- [CVE-2024-4114](https://insights.sbomify.com/CVE-2024-4114/): Tenda TX9 PowerSaveSet sub_42C014 stack-based overflow (high 8.8)
- [CVE-2024-41139](https://insights.sbomify.com/CVE-2024-41139/): Privilege escalation in SKYSEA Client View (high 7.8)
- [CVE-2024-41138](https://insights.sbomify.com/CVE-2024-41138/): Security feature bypass in Teams (work or school) (high 7.1)
- [CVE-2024-41136](https://insights.sbomify.com/CVE-2024-41136/): Authenticated Command Injection in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface (medium 6.8)
- [CVE-2024-41135](https://insights.sbomify.com/CVE-2024-41135/): Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface (high 7.2)
- [CVE-2024-41134](https://insights.sbomify.com/CVE-2024-41134/): Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface (high 7.2)
- [CVE-2024-41133](https://insights.sbomify.com/CVE-2024-41133/): Authenticated Remote Code Execution in HPE Aruba Networking EdgeConnect SD-WAN Command Line Interface (high 7.2)
- [CVE-2024-41132](https://insights.sbomify.com/CVE-2024-41132/): SixLabors ImageSharp Allows Excessive Memory Allocation in Gif Decoder (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/300/