# Vulnerabilities published in 2024


- [CVE-2024-40725](https://insights.sbomify.com/CVE-2024-40725/): Apache HTTP Server: source code disclosure with handlers configured via AddType (medium 5.3)
- [CVE-2024-40724](https://insights.sbomify.com/CVE-2024-40724/): Memory corruption in Assimp (high 8.4)
- [CVE-2024-40723](https://insights.sbomify.com/CVE-2024-40723/): CHANGING Information Technology HWATAIServiSign Windows Version - Stack-based Buffer Overflow (medium 4.3)
- [CVE-2024-40722](https://insights.sbomify.com/CVE-2024-40722/): CHANGING Information Technology TCBServiSign Windows Version - Stack-based Buffer Overflow (medium 4.3)
- [CVE-2024-40721](https://insights.sbomify.com/CVE-2024-40721/): CHANGING Information Technology TCBServiSign Windows Version - Improper Input Validation (high 8.8)
- [CVE-2024-40720](https://insights.sbomify.com/CVE-2024-40720/): CHANGING Information Technology TCBServiSign Windows Version - Improper Input Validation (high 8.8)
- [CVE-2024-4072](https://insights.sbomify.com/CVE-2024-4072/): Kashipara Online Furniture Shopping Ecommerce Website search.php cross site scripting (low 3.5)
- [CVE-2024-40719](https://insights.sbomify.com/CVE-2024-40719/): CHANGING Information Technology TCBServiSign Windows Version - Inadequate Encryption Strength (medium 6.5)
- [CVE-2024-40718](https://insights.sbomify.com/CVE-2024-40718/): Server-side request forgery in Nutanix AHV (high 8.8)
- [CVE-2024-40717](https://insights.sbomify.com/CVE-2024-40717/): Missing authorization in Backup & Replication (high 8.8)
- [CVE-2024-40715](https://insights.sbomify.com/CVE-2024-40715/): Auth bypass in Enterprise Manager (high 7.7)
- [CVE-2024-40714](https://insights.sbomify.com/CVE-2024-40714/): Security feature bypass in Backup and Recovery (high 8.3)
- [CVE-2024-40713](https://insights.sbomify.com/CVE-2024-40713/): Auth bypass in Backup and Recovery (high 7.8)
- [CVE-2024-40712](https://insights.sbomify.com/CVE-2024-40712/): Path traversal in Backup and Recovery (high 7.8)
- [CVE-2024-40711](https://insights.sbomify.com/CVE-2024-40711/): Veeam Backup and Replication Deserialization (critical 9.8, exploited in the wild)
- [CVE-2024-40710](https://insights.sbomify.com/CVE-2024-40710/): Information disclosure in Backup and Recovery (high 8.8)
- [CVE-2024-4071](https://insights.sbomify.com/CVE-2024-4071/): Kashipara Online Furniture Shopping Ecommerce Website prodInfo.php sql injection (medium 6.3)
- [CVE-2024-40709](https://insights.sbomify.com/CVE-2024-40709/): Missing authorization in Backup and Recovery (high 7.8)
- [CVE-2024-40706](https://insights.sbomify.com/CVE-2024-40706/): IBM InfoSphere Information Server information disclosure (medium 5.3)
- [CVE-2024-40705](https://insights.sbomify.com/CVE-2024-40705/): IBM InfoSphere Information Server denial of service (medium 6.5)
- [CVE-2024-40704](https://insights.sbomify.com/CVE-2024-40704/): IBM InfoSphere Information Server information disclosure (medium 4.9)
- [CVE-2024-40703](https://insights.sbomify.com/CVE-2024-40703/): IBM Cognos Analytics information disclosure (medium 5.5)
- [CVE-2024-40702](https://insights.sbomify.com/CVE-2024-40702/): IBM Cognos Controller improper certificate validation (high 8.2)
- [CVE-2024-40700](https://insights.sbomify.com/CVE-2024-40700/): IBM Security Verify Access cross-site scripting (medium 6.1)
- [CVE-2024-4070](https://insights.sbomify.com/CVE-2024-4070/): Kashipara Online Furniture Shopping Ecommerce Website prodList.php sql injection (medium 6.3)
- [CVE-2024-40697](https://insights.sbomify.com/CVE-2024-40697/): IBM Common Licensing information disclosure (high 7.5)
- [CVE-2024-40696](https://insights.sbomify.com/CVE-2024-40696/): IBM Sterling B2B Integrator cross-site scripting (medium 4.8)
- [CVE-2024-40695](https://insights.sbomify.com/CVE-2024-40695/): IBM Cognos Analytics file upload (high 8.0)
- [CVE-2024-40693](https://insights.sbomify.com/CVE-2024-40693/): IBM Planning Analytics file upload (high 8.0)
- [CVE-2024-40691](https://insights.sbomify.com/CVE-2024-40691/): IBM Cognos Controller file upload (high 8.0)
- [CVE-2024-40690](https://insights.sbomify.com/CVE-2024-40690/): IBM InfoSphere Server cross-site scripting (medium 5.4)
- [CVE-2024-4069](https://insights.sbomify.com/CVE-2024-4069/): Kashipara Online Furniture Shopping Ecommerce Website search.php sql injection (medium 6.3)
- [CVE-2024-40689](https://insights.sbomify.com/CVE-2024-40689/): IBM InfoSphere Information Server SQL injection (medium 6.0)
- [CVE-2024-40686](https://insights.sbomify.com/CVE-2024-40686/): IBM SmartCloud Analytics - Log Analysis HOST header injection (medium 5.4)
- [CVE-2024-40685](https://insights.sbomify.com/CVE-2024-40685/): IBM Operations Analytics - Log Analysis is affected by CSRF Token Replay Attack (medium 4.3)
- [CVE-2024-40684](https://insights.sbomify.com/CVE-2024-40684/): IBM Operations Analytics - Log Analysis is affected by Weak Password Policy and Inadequate Account Lockout Mechanism (medium 5.9)
- [CVE-2024-40683](https://insights.sbomify.com/CVE-2024-40683/): Auth bypass in Operations Analytics - Log Analysis (medium 6.3)
- [CVE-2024-40682](https://insights.sbomify.com/CVE-2024-40682/): IBM SmartCloud Analytics - Log Analysis denial of service (medium 6.2)
- [CVE-2024-40681](https://insights.sbomify.com/CVE-2024-40681/): IBM MQ security bypass (high 7.5)
- [CVE-2024-40680](https://insights.sbomify.com/CVE-2024-40680/): IBM MQ denial of service (medium 5.5)
- [CVE-2024-4068](https://insights.sbomify.com/CVE-2024-4068/): Memory Exhaustion in braces (high 7.5)
- [CVE-2024-40679](https://insights.sbomify.com/CVE-2024-40679/): IBM Db2 information disclosure (medium 5.5)
- [CVE-2024-40677](https://insights.sbomify.com/CVE-2024-40677/): Missing authorization in Android (high 8.4)
- [CVE-2024-40676](https://insights.sbomify.com/CVE-2024-40676/): Security feature bypass in Android (high 7.7)
- [CVE-2024-40675](https://insights.sbomify.com/CVE-2024-40675/): Denial of service in Android (high 7.5)
- [CVE-2024-40674](https://insights.sbomify.com/CVE-2024-40674/): Memory corruption in Android (medium 5.3)
- [CVE-2024-40673](https://insights.sbomify.com/CVE-2024-40673/): Code injection in Android (medium 6.5)
- [CVE-2024-40672](https://insights.sbomify.com/CVE-2024-40672/): Missing authorization in Android (high 8.4)
- [CVE-2024-40671](https://insights.sbomify.com/CVE-2024-40671/): Missing authorization in Android (high 7.8)
- [CVE-2024-40670](https://insights.sbomify.com/CVE-2024-40670/): Use after free in Android (high 8.4)
- [CVE-2024-4067](https://insights.sbomify.com/CVE-2024-4067/): Regular Expression Denial of Service in micromatch (medium 5.3)
- [CVE-2024-40669](https://insights.sbomify.com/CVE-2024-40669/): Use after free in Android (high 8.4)
- [CVE-2024-40664](https://insights.sbomify.com/CVE-2024-40664/): Business logic in Android (medium 6.2)
- [CVE-2024-40662](https://insights.sbomify.com/CVE-2024-40662/): Privilege escalation in Android (high 7.8)
- [CVE-2024-40661](https://insights.sbomify.com/CVE-2024-40661/): Missing authorization in Android (high 7.8)
- [CVE-2024-40660](https://insights.sbomify.com/CVE-2024-40660/): Privilege escalation in Android (high 7.8)
- [CVE-2024-4066](https://insights.sbomify.com/CVE-2024-4066/): Tenda AC8 AdvSetMacMtuWan fromAdvSetMacMtuWan stack-based overflow (high 8.8)
- [CVE-2024-40659](https://insights.sbomify.com/CVE-2024-40659/): Denial of service in Android (medium 5.5)
- [CVE-2024-40658](https://insights.sbomify.com/CVE-2024-40658/): Memory corruption in Android (high 7.8)
- [CVE-2024-40657](https://insights.sbomify.com/CVE-2024-40657/): Privilege escalation in Android (high 7.8)
- [CVE-2024-40656](https://insights.sbomify.com/CVE-2024-40656/): Information disclosure in Android (medium 5.5)
- [CVE-2024-40655](https://insights.sbomify.com/CVE-2024-40655/): Privilege escalation in Android (high 7.8)
- [CVE-2024-40654](https://insights.sbomify.com/CVE-2024-40654/): Privilege escalation in Android (high 7.8)
- [CVE-2024-40653](https://insights.sbomify.com/CVE-2024-40653/): Privilege escalation in Android (high 7.3)
- [CVE-2024-40652](https://insights.sbomify.com/CVE-2024-40652/): Missing authorization in Android (high 7.3)
- [CVE-2024-40651](https://insights.sbomify.com/CVE-2024-40651/): Use after free in Android (high 8.4)
- [CVE-2024-40650](https://insights.sbomify.com/CVE-2024-40650/): Security feature bypass in Android (high 7.8)
- [CVE-2024-4065](https://insights.sbomify.com/CVE-2024-4065/): Tenda AC8 SetRebootTimer formSetRebootTimer stack-based overflow (high 8.8)
- [CVE-2024-40649](https://insights.sbomify.com/CVE-2024-40649/): Use after free in Android (high 8.4)
- [CVE-2024-40648](https://insights.sbomify.com/CVE-2024-40648/): matrix-sdk-crypto's `UserIdentity::is_verified` not checking verification status of own user identity while performing the check (medium 5.4)
- [CVE-2024-40647](https://insights.sbomify.com/CVE-2024-40647/): Unintentional exposure of environment variables to subprocesses in sentry-sdk (medium 5.3)
- [CVE-2024-40646](https://insights.sbomify.com/CVE-2024-40646/): Vertex Vulnerable to Path Traversal (high 8.6)
- [CVE-2024-40645](https://insights.sbomify.com/CVE-2024-40645/): FOG Authenticated File Upload RCE (high 8.8)
- [CVE-2024-40644](https://insights.sbomify.com/CVE-2024-40644/): gitoxide's gix-path can use a fake program files location (medium 6.8)
- [CVE-2024-40643](https://insights.sbomify.com/CVE-2024-40643/): Joplin has a parsing error leading to Cross-site Scripting (XSS) (critical 9.7)
- [CVE-2024-40642](https://insights.sbomify.com/CVE-2024-40642/): Absent Input Validation in BinaryHttpParser in the netty incubator codec.bhttp (high 8.1)
- [CVE-2024-40641](https://insights.sbomify.com/CVE-2024-40641/): Unsigned code template execution through workflows in projectdiscovery/nuclei (high 7.4)
- [CVE-2024-40640](https://insights.sbomify.com/CVE-2024-40640/): Usage of non-constant time base64 decoder could lead to leakage of secret key material in vodozemac (low 2.9)
- [CVE-2024-4064](https://insights.sbomify.com/CVE-2024-4064/): Tenda AC8 execCommand R7WebsSecurityHandler stack-based overflow (high 8.8)
- [CVE-2024-40638](https://insights.sbomify.com/CVE-2024-40638/): GLPI allows account takeover via SQL Injection in AJAX scripts (high 8.1)
- [CVE-2024-40637](https://insights.sbomify.com/CVE-2024-40637/): Implicit override for built-in materializations from installed packages in dbt-core (medium 4.2)
- [CVE-2024-40636](https://insights.sbomify.com/CVE-2024-40636/): Basic Auth Credential Leakage to Logs After Fetch Registry Error in Steeltoe.Discovery.Eureka with Peer Awareness (medium 5.3)
- [CVE-2024-40635](https://insights.sbomify.com/CVE-2024-40635/): containerd has an integer overflow in User ID handling (medium 4.6)
- [CVE-2024-40634](https://insights.sbomify.com/CVE-2024-40634/): Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint (high 7.5)
- [CVE-2024-40633](https://insights.sbomify.com/CVE-2024-40633/): Customer data leak via adjustments API endpoint in Sylius (medium 5.3)
- [CVE-2024-40632](https://insights.sbomify.com/CVE-2024-40632/): Linkerd potential access to the shutdown endpoint (low 3.7)
- [CVE-2024-40631](https://insights.sbomify.com/CVE-2024-40631/): Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate media (high 8.1)
- [CVE-2024-40630](https://insights.sbomify.com/CVE-2024-40630/): HEIF Heap OOB Read in OpenImageIO (medium 4.3)
- [CVE-2024-4063](https://insights.sbomify.com/CVE-2024-4063/): EZVIZ CS-C6-21WFR-8 Davinci Application certificate validation (low 3.7)
- [CVE-2024-40629](https://insights.sbomify.com/CVE-2024-40629/): Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver (critical 10.0)
- [CVE-2024-40628](https://insights.sbomify.com/CVE-2024-40628/): Arbitrary File Read in Ansible Playbooks in Jumpserver (critical 10.0)
- [CVE-2024-40627](https://insights.sbomify.com/CVE-2024-40627/): OpaMiddleware does not filter HTTP OPTIONS requests (medium 5.8)
- [CVE-2024-40626](https://insights.sbomify.com/CVE-2024-40626/): Stored Cross-site Scripting (XSS) vulnerability in Outline editor (high 7.3)
- [CVE-2024-40625](https://insights.sbomify.com/CVE-2024-40625/): GeoServer Coverage REST API Allows Server Side Request Forgery (medium 5.5)
- [CVE-2024-40624](https://insights.sbomify.com/CVE-2024-40624/): Deserialization of untrusted data in torrentpier/torrentpier (critical 9.8)
- [CVE-2024-40620](https://insights.sbomify.com/CVE-2024-40620/): Rockwell Automation Pavilion8® Unencrypted Data Vulnerability via HTTP protocol (medium 5.3)
- [CVE-2024-4062](https://insights.sbomify.com/CVE-2024-4062/): Hualai Xiaofang iSC5 certificate validation (low 3.7)
- [CVE-2024-40619](https://insights.sbomify.com/CVE-2024-40619/): Denial of service in ControlLogix® 5580 (high 8.7)
- [CVE-2024-40618](https://insights.sbomify.com/CVE-2024-40618/): Cross-site scripting in NAVER Whale browser (critical 9.6)
- [CVE-2024-40617](https://insights.sbomify.com/CVE-2024-40617/): Path traversal in FUJITSU Network Edgiot GW1500 (M2M-GW for FENICS) (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/305/