# Vulnerabilities published in 2024


- [CVE-2024-28813](https://insights.sbomify.com/CVE-2024-28813/): Privilege escalation in nokia:hit 7300 firmware (high 8.4)
- [CVE-2024-28812](https://insights.sbomify.com/CVE-2024-28812/): Hardcoded credentials in nokia:hit 7300 firmware (high 8.8)
- [CVE-2024-28811](https://insights.sbomify.com/CVE-2024-28811/): Code injection in nokia:hit 7300 firmware (low 3.3)
- [CVE-2024-28810](https://insights.sbomify.com/CVE-2024-28810/): Information disclosure in nokia:hit 7300 firmware (medium 6.6)
- [CVE-2024-2881](https://insights.sbomify.com/CVE-2024-2881/): Fault Injection of EdDSA signature in WolfCrypt (medium 6.7)
- [CVE-2024-28809](https://insights.sbomify.com/CVE-2024-28809/): Hardcoded credentials in nokia:hit 7300 firmware (high 8.8)
- [CVE-2024-28808](https://insights.sbomify.com/CVE-2024-28808/): Information disclosure in nokia:hit 7300 firmware (low 2.7)
- [CVE-2024-28807](https://insights.sbomify.com/CVE-2024-28807/): Information disclosure in nokia:hit 7300 firmware (medium 6.5)
- [CVE-2024-28806](https://insights.sbomify.com/CVE-2024-28806/): File upload in italtel:i-mcs nfv (high 7.5)
- [CVE-2024-28805](https://insights.sbomify.com/CVE-2024-28805/): Missing authorization in italtel:i-mcs nfv (critical 9.1)
- [CVE-2024-28804](https://insights.sbomify.com/CVE-2024-28804/): Cross-site scripting in italtel:i-mcs nfv (high 7.1)
- [CVE-2024-28803](https://insights.sbomify.com/CVE-2024-28803/): Cross-site scripting in italtel:i-mcs nfv (medium 6.1)
- [CVE-2024-2880](https://insights.sbomify.com/CVE-2024-2880/): Improper Access Control in GitLab (low 2.7)
- [CVE-2024-28799](https://insights.sbomify.com/CVE-2024-28799/): IBM QRadar Suite Software information disclosure (medium 5.6)
- [CVE-2024-28798](https://insights.sbomify.com/CVE-2024-28798/): IBM InfoSphere Information Server cross-site scripting (high 7.2)
- [CVE-2024-28797](https://insights.sbomify.com/CVE-2024-28797/): IBM InfoSphere Information Server cross-site scripting (medium 6.4)
- [CVE-2024-28796](https://insights.sbomify.com/CVE-2024-28796/): Cross-site scripting in ClearQuest (medium 6.4)
- [CVE-2024-28795](https://insights.sbomify.com/CVE-2024-28795/): IBM InfoSphere Information Server cross-site scripting (medium 5.4)
- [CVE-2024-28794](https://insights.sbomify.com/CVE-2024-28794/): IBM InfoSphere Information Server cross-site scripting (medium 5.4)
- [CVE-2024-28793](https://insights.sbomify.com/CVE-2024-28793/): IBM Engineering Workflow Management cross-site scripting (medium 4.9)
- [CVE-2024-2879](https://insights.sbomify.com/CVE-2024-2879/): SQL injection in LayerSlider (critical 9.8)
- [CVE-2024-28787](https://insights.sbomify.com/CVE-2024-28787/): IBM Security Verify Access information disclosure (high 8.7)
- [CVE-2024-28786](https://insights.sbomify.com/CVE-2024-28786/): IBM QRadar SIEM information disclosure (medium 6.5)
- [CVE-2024-28784](https://insights.sbomify.com/CVE-2024-28784/): IBM QRadar cross-site scripting (medium 5.4)
- [CVE-2024-28782](https://insights.sbomify.com/CVE-2024-28782/): IBM QRadar Suite Software information disclosure (medium 6.3)
- [CVE-2024-28781](https://insights.sbomify.com/CVE-2024-28781/): IBM UrbanCode Deploy cross-site scripting (medium 5.4)
- [CVE-2024-28780](https://insights.sbomify.com/CVE-2024-28780/): IBM Cognos Controller information disclosure (medium 5.9)
- [CVE-2024-2878](https://insights.sbomify.com/CVE-2024-2878/): Allocation of Resources Without Limits or Throttling in GitLab (high 7.5)
- [CVE-2024-28778](https://insights.sbomify.com/CVE-2024-28778/): IBM Cognos Controller information disclosure (medium 6.5)
- [CVE-2024-28777](https://insights.sbomify.com/CVE-2024-28777/): IBM Cognos Controller code execution (high 8.8)
- [CVE-2024-28776](https://insights.sbomify.com/CVE-2024-28776/): IBM Cognos Controller cross-site scripting (medium 5.4)
- [CVE-2024-28775](https://insights.sbomify.com/CVE-2024-28775/): IBM WebSphere Automation cross-site scripting (medium 4.4)
- [CVE-2024-28772](https://insights.sbomify.com/CVE-2024-28772/): IBM Security Directory Integrator cross-site scripting (medium 6.8)
- [CVE-2024-28771](https://insights.sbomify.com/CVE-2024-28771/): IBM Security Directory Integrator information disclosure (medium 4.8)
- [CVE-2024-28770](https://insights.sbomify.com/CVE-2024-28770/): IBM Security Directory Integrator information disclosure (medium 4.8)
- [CVE-2024-2877](https://insights.sbomify.com/CVE-2024-2877/): Vault Enterprise Leaks Sensitive HTTP Request Headers in the Audit Log When Deployed With a Performance Standby Node (medium 5.5)
- [CVE-2024-28767](https://insights.sbomify.com/CVE-2024-28767/): IBM Security Directory Integrator command execution (medium 6.8)
- [CVE-2024-28766](https://insights.sbomify.com/CVE-2024-28766/): IBM Security Directory Integrator information disclosure (low 2.4)
- [CVE-2024-28765](https://insights.sbomify.com/CVE-2024-28765/): Security vulnerability was found in IBM Security Directory Integrator (medium 5.3)
- [CVE-2024-28764](https://insights.sbomify.com/CVE-2024-28764/): IBM WebSphere Automation CSV injection (medium 6.5)
- [CVE-2024-28762](https://insights.sbomify.com/CVE-2024-28762/): IBM Db2 denial of service (medium 5.3)
- [CVE-2024-28761](https://insights.sbomify.com/CVE-2024-28761/): IBM App Connect Enterprise HTML injection (medium 5.4)
- [CVE-2024-28760](https://insights.sbomify.com/CVE-2024-28760/): IBM App Connect Enterprise denial of service (medium 4.3)
- [CVE-2024-2876](https://insights.sbomify.com/CVE-2024-2876/): SQL injection in Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress (critical 9.8)
- [CVE-2024-28759](https://insights.sbomify.com/CVE-2024-28759/): A crafted network packet may cause a buffer overrun in Wind River VxWorks 7 through 23.09. (medium 4.3)
- [CVE-2024-28757](https://insights.sbomify.com/CVE-2024-28757/): XML external entity in fedoraproject:fedora (high 7.5)
- [CVE-2024-28756](https://insights.sbomify.com/CVE-2024-28756/): Security feature bypass in solaredge:mysolaredge (medium 5.9)
- [CVE-2024-28755](https://insights.sbomify.com/CVE-2024-28755/): Denial of service in trustedfirmware:mbed tls (medium 6.5)
- [CVE-2024-28754](https://insights.sbomify.com/CVE-2024-28754/): raspap-webgui vulnerable to denial of service (high 7.5)
- [CVE-2024-28753](https://insights.sbomify.com/CVE-2024-28753/): Path traversal in raspap:raspap (medium 6.5)
- [CVE-2024-28752](https://insights.sbomify.com/CVE-2024-28752/): Apache CXF SSRF Vulnerability using the Aegis databinding (critical 9.3)
- [CVE-2024-28751](https://insights.sbomify.com/CVE-2024-28751/): ifm: Hardcoded telnet credentials in Smart PLC (critical 9.1)
- [CVE-2024-28750](https://insights.sbomify.com/CVE-2024-28750/): ifm: Deleting function in Smart PLC allows command injections (high 7.2)
- [CVE-2024-28749](https://insights.sbomify.com/CVE-2024-28749/): ifm: Writing file function in Smart PLC allows command injections (high 7.2)
- [CVE-2024-28748](https://insights.sbomify.com/CVE-2024-28748/): ifm: Reading function in Smart PLC allows command injections (high 7.2)
- [CVE-2024-28747](https://insights.sbomify.com/CVE-2024-28747/): ifm: Use of Hard-coded Credentials (critical 9.8)
- [CVE-2024-28746](https://insights.sbomify.com/CVE-2024-28746/): Apache Airflow: Ignored Airflow Permissions (high 8.1)
- [CVE-2024-28745](https://insights.sbomify.com/CVE-2024-28745/): Missing authorization in 'ABEMA' App for Android (low 3.3)
- [CVE-2024-28744](https://insights.sbomify.com/CVE-2024-28744/): Hardcoded credentials in ACERA 9010-08 (high 8.8)
- [CVE-2024-28741](https://insights.sbomify.com/CVE-2024-28741/): Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component. (high 8.8)
- [CVE-2024-28740](https://insights.sbomify.com/CVE-2024-28740/): Cross-site scripting in koha:koha (medium 6.1)
- [CVE-2024-2874](https://insights.sbomify.com/CVE-2024-2874/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2024-28739](https://insights.sbomify.com/CVE-2024-28739/): Cross-site scripting in koha:koha (critical 9.6)
- [CVE-2024-28736](https://insights.sbomify.com/CVE-2024-28736/): An issue in Debezium Community debezium-ui v.2.5 allows a local attacker to execute arbitrary code via the refresh page function. (high 7.1)
- [CVE-2024-28735](https://insights.sbomify.com/CVE-2024-28735/): Missing authorization in unit4:financials by coda (high 8.1)
- [CVE-2024-28734](https://insights.sbomify.com/CVE-2024-28734/): Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted (medium 6.1)
- [CVE-2024-28732](https://insights.sbomify.com/CVE-2024-28732/): Ryu Infinite Loop vulnerability (high 7.5)
- [CVE-2024-28731](https://insights.sbomify.com/CVE-2024-28731/): Cross-site request forgery in dlink:dwr-2000m firmware (high 7.3)
- [CVE-2024-28730](https://insights.sbomify.com/CVE-2024-28730/): Cross-site scripting in dlink:dwr-2000m firmware (medium 4.6)
- [CVE-2024-2873](https://insights.sbomify.com/CVE-2024-2873/): User authentication bypass in wolfSSH server (critical 9.1)
- [CVE-2024-28729](https://insights.sbomify.com/CVE-2024-28729/): Command injection in dlink:dwr-2000m firmware (high 7.8)
- [CVE-2024-28728](https://insights.sbomify.com/CVE-2024-28728/): Cross Site Scripting vulnerability in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacke (medium 6.6)
- [CVE-2024-28726](https://insights.sbomify.com/CVE-2024-28726/): An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary cod (high 8.0)
- [CVE-2024-28725](https://insights.sbomify.com/CVE-2024-28725/): Cross-site scripting in yzmcms:yzmcms (high 7.1)
- [CVE-2024-28722](https://insights.sbomify.com/CVE-2024-28722/): Cross Site Scripting vulnerability in Innovaphone myPBX v.14r1, v.13r3, v.12r2 allows a remote attacker to execute arbitrary code via the qu (medium 6.3)
- [CVE-2024-2872](https://insights.sbomify.com/CVE-2024-2872/): Swift Framework < 2024.04.30 - Contributor+ Stored XSS (medium 4.8)
- [CVE-2024-28718](https://insights.sbomify.com/CVE-2024-28718/): OpenStack magnum vulnerable to time-of-check to time-of-use (TOCTOU) attack (critical 9.8)
- [CVE-2024-28717](https://insights.sbomify.com/CVE-2024-28717/): OpenStack Storlets arbitrary code execution vulnerability (medium 4.9)
- [CVE-2024-28716](https://insights.sbomify.com/CVE-2024-28716/): An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component. (high 7.5)
- [CVE-2024-28715](https://insights.sbomify.com/CVE-2024-28715/): Cross-site scripting in html-js:doracms (high 8.8)
- [CVE-2024-28714](https://insights.sbomify.com/CVE-2024-28714/): SQL injection in crmeb:crmeb java (high 8.1)
- [CVE-2024-28713](https://insights.sbomify.com/CVE-2024-28713/): File upload in mtons:mblog (critical 9.8)
- [CVE-2024-28710](https://insights.sbomify.com/CVE-2024-28710/): LimeSurvey Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2024-2871](https://insights.sbomify.com/CVE-2024-2871/): Media Library Assistant <= 3.13 - Authenticated (Contributor+) SQL Injection via Shortcode (medium 6.4)
- [CVE-2024-28709](https://insights.sbomify.com/CVE-2024-28709/): LimeSurvey Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2024-2870](https://insights.sbomify.com/CVE-2024-2870/): Swift Framework < 2024.04.30 - Reflected XSS (medium 6.1)
- [CVE-2024-28699](https://insights.sbomify.com/CVE-2024-28699/): A buffer overflow vulnerability in pdf2json v0.70 allows a local attacker to execute arbitrary code via the GString::copy() and ImgOutputDev (high 7.8)
- [CVE-2024-28698](https://insights.sbomify.com/CVE-2024-28698/): CLSA Directory Traversal vulnerability (critical 9.8)
- [CVE-2024-2869](https://insights.sbomify.com/CVE-2024-2869/): Easy Property Listings <= 3.5.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-28684](https://insights.sbomify.com/CVE-2024-28684/): Cross-site request forgery in dedecms:dedecms (high 8.8)
- [CVE-2024-28683](https://insights.sbomify.com/CVE-2024-28683/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2024-28682](https://insights.sbomify.com/CVE-2024-28682/): Cross-site request forgery in dedecms:dedecms (medium 6.3)
- [CVE-2024-28681](https://insights.sbomify.com/CVE-2024-28681/): Cross-site request forgery in dedecms:dedecms (medium 6.1)
- [CVE-2024-28680](https://insights.sbomify.com/CVE-2024-28680/): Cross-site request forgery in dedecms:dedecms (medium 6.1)
- [CVE-2024-2868](https://insights.sbomify.com/CVE-2024-2868/): Cross-site scripting in ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin (medium 6.4)
- [CVE-2024-28679](https://insights.sbomify.com/CVE-2024-28679/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2024-28678](https://insights.sbomify.com/CVE-2024-28678/): Cross-site request forgery in dedecms:dedecms (medium 6.3)
- [CVE-2024-28677](https://insights.sbomify.com/CVE-2024-28677/): Cross-site request forgery in dedecms:dedecms (medium 6.1)
- [CVE-2024-28676](https://insights.sbomify.com/CVE-2024-28676/): Cross-site scripting in dedecms:dedecms (medium 6.1)
- [CVE-2024-28675](https://insights.sbomify.com/CVE-2024-28675/): Cross-site request forgery in dedecms:dedecms (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/397/