# Vulnerabilities published in 2024


- [CVE-2024-25729](https://insights.sbomify.com/CVE-2024-25729/): Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access. (high 8.8)
- [CVE-2024-25728](https://insights.sbomify.com/CVE-2024-25728/): Information disclosure in expressvpn:expressvpn (high 7.5)
- [CVE-2024-25724](https://insights.sbomify.com/CVE-2024-25724/): Memory corruption in rti:connext professional (high 7.3)
- [CVE-2024-25723](https://insights.sbomify.com/CVE-2024-25723/): ZenML Server Remote Privilege Escalation Vulnerability (high 8.8)
- [CVE-2024-25722](https://insights.sbomify.com/CVE-2024-25722/): SQL injection in qanything:qanything (critical 9.8)
- [CVE-2024-2572](https://insights.sbomify.com/CVE-2024-2572/): SourceCodester Employee Task Management System task-details.php redirect (high 7.3)
- [CVE-2024-25718](https://insights.sbomify.com/CVE-2024-25718/): Samly access control vulnerability (critical 9.1)
- [CVE-2024-25715](https://insights.sbomify.com/CVE-2024-25715/): Open redirect in glewlwyd sso server project:glewlwyd sso server (medium 6.1)
- [CVE-2024-25714](https://insights.sbomify.com/CVE-2024-25714/): Weak cryptography in debian:debian linux (critical 9.1)
- [CVE-2024-25713](https://insights.sbomify.com/CVE-2024-25713/): yyjson has a Double Free vulnerability (high 8.6)
- [CVE-2024-25712](https://insights.sbomify.com/CVE-2024-25712/): Cross-site scripting in http-swagger project:http-swagger (medium 6.1)
- [CVE-2024-25711](https://insights.sbomify.com/CVE-2024-25711/): diffoscope Path Traversal vulnerability (high 7.1)
- [CVE-2024-25710](https://insights.sbomify.com/CVE-2024-25710/): Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file (high 8.1)
- [CVE-2024-2571](https://insights.sbomify.com/CVE-2024-2571/): SourceCodester Employee Task Management System manage-admin.php redirect (high 7.3)
- [CVE-2024-25709](https://insights.sbomify.com/CVE-2024-25709/): Self-XSS style in move item dialog (medium 6.1)
- [CVE-2024-25708](https://insights.sbomify.com/CVE-2024-25708/): Persistent XSS when creating new application using Web App Builder (medium 4.8)
- [CVE-2024-25707](https://insights.sbomify.com/CVE-2024-25707/): BUG-000160241 - Reflected XSS in Portal for ArcGIS (medium 4.8)
- [CVE-2024-25706](https://insights.sbomify.com/CVE-2024-25706/): HTMLi at createFolder Content Injection (medium 6.1)
- [CVE-2024-25705](https://insights.sbomify.com/CVE-2024-25705/): Cross site scripting issue in embed widget (medium 5.4)
- [CVE-2024-25702](https://insights.sbomify.com/CVE-2024-25702/): BUG-000160599 - Stored XSS in Portal for ArcGIS Web App Builder (medium 4.8)
- [CVE-2024-25701](https://insights.sbomify.com/CVE-2024-25701/): BUG-000160765 - Stored XSS in ArcGIS Experience Builder (medium 4.8)
- [CVE-2024-25700](https://insights.sbomify.com/CVE-2024-25700/): Persistent XSS in URL added to a shared map (medium 4.8)
- [CVE-2024-2570](https://insights.sbomify.com/CVE-2024-2570/): SourceCodester Employee Task Management System edit-task.php redirect (high 7.3)
- [CVE-2024-25699](https://insights.sbomify.com/CVE-2024-25699/): Portal for ArcGIS has an invalid authentication vulnerability (high 8.5)
- [CVE-2024-25698](https://insights.sbomify.com/CVE-2024-25698/): Reflected XSS in Portal for ArcGIS (medium 6.1)
- [CVE-2024-25697](https://insights.sbomify.com/CVE-2024-25697/): Stored XSS in Portal for ArcGIS (medium 5.4)
- [CVE-2024-25696](https://insights.sbomify.com/CVE-2024-25696/): Stored XSS in Portal for ArcGIS (medium 4.8)
- [CVE-2024-25695](https://insights.sbomify.com/CVE-2024-25695/): concatenated errors resulting in cross site scripting and frame injection issues. (high 7.2)
- [CVE-2024-25694](https://insights.sbomify.com/CVE-2024-25694/): BUG-000163019 - Stored XSS in Portal for ArcGIS (medium 4.8)
- [CVE-2024-25693](https://insights.sbomify.com/CVE-2024-25693/): Portal for ArcGIS has a directory traversal vulnerability. (critical 9.9)
- [CVE-2024-25692](https://insights.sbomify.com/CVE-2024-25692/): BUG-000154722 - Cross-site request forgery (CSRF) issue in Portal for ArcGIS (medium 5.4)
- [CVE-2024-25691](https://insights.sbomify.com/CVE-2024-25691/): BUG-000165286 - Reflected XSS in Portal for ArcGIS (medium 6.1)
- [CVE-2024-25690](https://insights.sbomify.com/CVE-2024-25690/): HTML injection in ArcGIS Web AppBuilder (medium 4.7)
- [CVE-2024-2569](https://insights.sbomify.com/CVE-2024-2569/): SourceCodester Employee Task Management System admin-manage-user.php redirect (high 7.3)
- [CVE-2024-2568](https://insights.sbomify.com/CVE-2024-2568/): heyewei JFinalCMS Custom Data Page sql injection (medium 4.7)
- [CVE-2024-25679](https://insights.sbomify.com/CVE-2024-25679/): Weak cryptography in pquic:pquic (medium 6.5)
- [CVE-2024-25678](https://insights.sbomify.com/CVE-2024-25678/): Security feature bypass in litespeedtech:lsquic (medium 5.9)
- [CVE-2024-25677](https://insights.sbomify.com/CVE-2024-25677/): Security feature bypass in minbrowser:min (high 8.8)
- [CVE-2024-25676](https://insights.sbomify.com/CVE-2024-25676/): An issue was discovered in ViewerJS 0.5.8. (medium 4.7)
- [CVE-2024-25675](https://insights.sbomify.com/CVE-2024-25675/): Other in misp-project:misp (critical 9.8)
- [CVE-2024-25674](https://insights.sbomify.com/CVE-2024-25674/): File upload in misp-project:misp (critical 9.8)
- [CVE-2024-25673](https://insights.sbomify.com/CVE-2024-25673/): Other in couchbase:couchbase server (medium 6.1)
- [CVE-2024-2567](https://insights.sbomify.com/CVE-2024-2567/): jurecapuder AndroidWeatherApp Backup File androidmanifest.xml backup (low 1.8)
- [CVE-2024-25662](https://insights.sbomify.com/CVE-2024-25662/): Oxygen XML Web Author v26.0.0 and older and Oxygen Content Fusion v6.1 and older are vulnerable to Cross-Site Scripting (XSS) for malicious URLs. (medium 6.1)
- [CVE-2024-25661](https://insights.sbomify.com/CVE-2024-25661/): Information disclosure in nokia:transcend network management system (high 7.7)
- [CVE-2024-25660](https://insights.sbomify.com/CVE-2024-25660/): Privilege escalation in nokia:transcend network management system (critical 9.0)
- [CVE-2024-2566](https://insights.sbomify.com/CVE-2024-2566/): Fujian Kelixin Communication Command and Dispatch Platform get_extension_yl.php sql injection (high 7.3)
- [CVE-2024-25659](https://insights.sbomify.com/CVE-2024-25659/): Misconfiguration in nokia:transcend network management system (high 7.2)
- [CVE-2024-25658](https://insights.sbomify.com/CVE-2024-25658/): Information disclosure in nokia:transcend network management system (medium 6.5)
- [CVE-2024-25657](https://insights.sbomify.com/CVE-2024-25657/): An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could a (medium 5.4)
- [CVE-2024-25656](https://insights.sbomify.com/CVE-2024-25656/): Improper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer Premis (medium 5.9)
- [CVE-2024-25655](https://insights.sbomify.com/CVE-2024-25655/): Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow (medium 6.5)
- [CVE-2024-25654](https://insights.sbomify.com/CVE-2024-25654/): Information disclosure in avsystem:unified management platform (medium 5.5)
- [CVE-2024-25653](https://insights.sbomify.com/CVE-2024-25653/): Missing authorization in delinea:secret server (medium 4.3)
- [CVE-2024-25652](https://insights.sbomify.com/CVE-2024-25652/): Missing authorization in Secret Server (high 7.6)
- [CVE-2024-25651](https://insights.sbomify.com/CVE-2024-25651/): Information disclosure in delinea:secret server (medium 5.3)
- [CVE-2024-25650](https://insights.sbomify.com/CVE-2024-25650/): Weak cryptography in delinea:distributed engine (medium 5.9)
- [CVE-2024-2565](https://insights.sbomify.com/CVE-2024-2565/): PandaXGO PandaX File Extension upload.go unrestricted upload (medium 6.3)
- [CVE-2024-25649](https://insights.sbomify.com/CVE-2024-25649/): Information disclosure in delinea:secret server (medium 6.7)
- [CVE-2024-25648](https://insights.sbomify.com/CVE-2024-25648/): Use after free in Foxit Reader (high 8.8)
- [CVE-2024-25647](https://insights.sbomify.com/CVE-2024-25647/): Misconfiguration in Intel(R) Binary Configuration Tool software for Windows (medium 5.4)
- [CVE-2024-25646](https://insights.sbomify.com/CVE-2024-25646/): Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence (high 7.7)
- [CVE-2024-25645](https://insights.sbomify.com/CVE-2024-25645/): Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal) (medium 5.3)
- [CVE-2024-25644](https://insights.sbomify.com/CVE-2024-25644/): Information Disclosure vulnerability in NetWeaver (WSRM) (medium 5.3)
- [CVE-2024-25643](https://insights.sbomify.com/CVE-2024-25643/): Missing authorization check in SAP Fiori app (My Overtime Requests) (medium 4.3)
- [CVE-2024-25642](https://insights.sbomify.com/CVE-2024-25642/): Improper Certificate Validation in SAP Cloud Connector (high 7.4)
- [CVE-2024-25641](https://insights.sbomify.com/CVE-2024-25641/): Cacti RCE vulnerability when importing packages (critical 9.1)
- [CVE-2024-25640](https://insights.sbomify.com/CVE-2024-25640/): Improper Neutralization of Alternate XSS Syntax in iris-web (medium 4.6)
- [CVE-2024-2564](https://insights.sbomify.com/CVE-2024-2564/): PandaXGO PandaX user.go ExportUser path traversal (medium 6.3)
- [CVE-2024-25639](https://insights.sbomify.com/CVE-2024-25639/): Prompt Injection triggered XSS vulnerability in Khoj Obsidian, Desktop and Web clients (medium 5.9)
- [CVE-2024-25638](https://insights.sbomify.com/CVE-2024-25638/): DNSJava DNSSEC Bypass (high 8.9)
- [CVE-2024-25637](https://insights.sbomify.com/CVE-2024-25637/): Reflected XSS via X-October-Request-Handler Header (low 3.1)
- [CVE-2024-25636](https://insights.sbomify.com/CVE-2024-25636/): Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts (high 7.1)
- [CVE-2024-25635](https://insights.sbomify.com/CVE-2024-25635/): IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS (high 8.8)
- [CVE-2024-25634](https://insights.sbomify.com/CVE-2024-25634/): IDOR make user can read e-mail log sent by other events (high 7.2)
- [CVE-2024-25633](https://insights.sbomify.com/CVE-2024-25633/): In eLabFTW, if administrators can create users, users can too (medium 5.4)
- [CVE-2024-25632](https://insights.sbomify.com/CVE-2024-25632/): Unauthorised granting of administrator privileges over arbitrary teams under certain circumstances (high 8.6)
- [CVE-2024-25631](https://insights.sbomify.com/CVE-2024-25631/): Unencrypted traffic between pods when using Wireguard and an external kvstore (medium 6.1)
- [CVE-2024-25630](https://insights.sbomify.com/CVE-2024-25630/): Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryption (medium 6.1)
- [CVE-2024-2563](https://insights.sbomify.com/CVE-2024-2563/): PandaXGO PandaX upload.go DeleteImage path traversal (medium 5.4)
- [CVE-2024-25629](https://insights.sbomify.com/CVE-2024-25629/): c-ares out of bounds read in ares__read_line() (medium 4.4)
- [CVE-2024-25628](https://insights.sbomify.com/CVE-2024-25628/): Insufficient Session Expiration in alf.io (high 7.6)
- [CVE-2024-25627](https://insights.sbomify.com/CVE-2024-25627/): Cross-Site Scripting (XSS) via File Upload in Alf.io (low 3.5)
- [CVE-2024-25626](https://insights.sbomify.com/CVE-2024-25626/): Yocto Project Security Advisory - BitBake/Toaster (high 8.8)
- [CVE-2024-25625](https://insights.sbomify.com/CVE-2024-25625/): Pimcore Host Header Injection in user invitation link (high 8.1)
- [CVE-2024-25624](https://insights.sbomify.com/CVE-2024-25624/): iris-web vulnerable to Server Side Template Injection in reports (medium 6.8)
- [CVE-2024-25623](https://insights.sbomify.com/CVE-2024-25623/): Lack of media type verification of Activity Streams objects allows impersonation of remote accounts (high 8.5)
- [CVE-2024-25622](https://insights.sbomify.com/CVE-2024-25622/): H2O ignores headers configuration directives (low 3.1)
- [CVE-2024-25621](https://insights.sbomify.com/CVE-2024-25621/): containerd affected by a local privilege escalation via wide permissions on CRI directory (high 7.3)
- [CVE-2024-25620](https://insights.sbomify.com/CVE-2024-25620/): Dependency management path traversal in helm (medium 6.4)
- [CVE-2024-2562](https://insights.sbomify.com/CVE-2024-2562/): PandaXGO PandaX role_menu.go InsertRole sql injection (medium 6.3)
- [CVE-2024-25619](https://insights.sbomify.com/CVE-2024-25619/): Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon (low 3.1)
- [CVE-2024-25618](https://insights.sbomify.com/CVE-2024-25618/): External OpenID Connect Account Takeover by E-Mail Change in mastodon (medium 4.2)
- [CVE-2024-25617](https://insights.sbomify.com/CVE-2024-25617/): Denial of Service in HTTP Header parser in squid proxy (medium 5.3)
- [CVE-2024-25616](https://insights.sbomify.com/CVE-2024-25616/): Information disclosure in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points (low 3.7)
- [CVE-2024-25615](https://insights.sbomify.com/CVE-2024-25615/): Denial of service in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points (medium 5.3)
- [CVE-2024-25614](https://insights.sbomify.com/CVE-2024-25614/): Path traversal in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points (medium 5.5)
- [CVE-2024-25613](https://insights.sbomify.com/CVE-2024-25613/): Command injection in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points (high 7.2)
- [CVE-2024-25612](https://insights.sbomify.com/CVE-2024-25612/): Command injection in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points (high 7.2)
- [CVE-2024-25611](https://insights.sbomify.com/CVE-2024-25611/): Command injection in ArubaOS Wi-Fi Controllers and Campus/Remote Access Points (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/421/