# Vulnerabilities published in 2024


- [CVE-2024-20492](https://insights.sbomify.com/CVE-2024-20492/): Cisco Expressway Series Privilege Escalation Vulnerability (medium 6.0)
- [CVE-2024-20491](https://insights.sbomify.com/CVE-2024-20491/): Cisco Nexus Dashboard Insights Information Disclosure Vulnerability (medium 6.3)
- [CVE-2024-20490](https://insights.sbomify.com/CVE-2024-20490/): Cisco Nexus Dashboard Fabric Controller and Nexus Dashboard Orchestrator Information Disclosure Vulnerability (medium 6.3)
- [CVE-2024-2049](https://insights.sbomify.com/CVE-2024-2049/): Server-Side Request Forgery (SSRF) (medium 6.5)
- [CVE-2024-20489](https://insights.sbomify.com/CVE-2024-20489/): Cisco Routed Passive Optical Network Cleartext Password Vulnerability (high 8.4)
- [CVE-2024-20488](https://insights.sbomify.com/CVE-2024-20488/): Cisco Unified Communications Manager Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2024-20487](https://insights.sbomify.com/CVE-2024-20487/): Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabiliy (medium 4.3)
- [CVE-2024-20486](https://insights.sbomify.com/CVE-2024-20486/): Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability (medium 6.5)
- [CVE-2024-20485](https://insights.sbomify.com/CVE-2024-20485/): Code injection in Cisco Adaptive Security Appliance (ASA) Software (medium 6.0)
- [CVE-2024-20484](https://insights.sbomify.com/CVE-2024-20484/): Cisco Enterprise Chat and Email Denial of Service Vulnerability (high 7.5)
- [CVE-2024-20483](https://insights.sbomify.com/CVE-2024-20483/): Cisco IOS XR PON Controller Command Injection Vulnerabilities (high 7.2)
- [CVE-2024-20482](https://insights.sbomify.com/CVE-2024-20482/): Privilege escalation in Cisco Firepower Management Center (medium 6.5)
- [CVE-2024-20481](https://insights.sbomify.com/CVE-2024-20481/): Cisco ASA and FTD Denial-of-Service (medium 5.8, exploited in the wild)
- [CVE-2024-20480](https://insights.sbomify.com/CVE-2024-20480/): Denial of service in Cisco IOS XE Software (high 8.6)
- [CVE-2024-2048](https://insights.sbomify.com/CVE-2024-2048/): Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates (high 8.1)
- [CVE-2024-20479](https://insights.sbomify.com/CVE-2024-20479/): Cross-site scripting in Cisco Identity Services Engine Software (medium 4.8)
- [CVE-2024-20478](https://insights.sbomify.com/CVE-2024-20478/): Cisco Application Policy Infrastructure Controller App Privilege Escalation Vulnerability (medium 6.5)
- [CVE-2024-20477](https://insights.sbomify.com/CVE-2024-20477/): Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Endpoint Vulnerability (medium 5.4)
- [CVE-2024-20476](https://insights.sbomify.com/CVE-2024-20476/): Cisco Identity Services Engine Authorization Bypass Vulnerability (medium 4.3)
- [CVE-2024-20475](https://insights.sbomify.com/CVE-2024-20475/): Cisco SD-WAN vManage Cross-Site Scripting Vulnerability (medium 6.4)
- [CVE-2024-20474](https://insights.sbomify.com/CVE-2024-20474/): Integer overflow in Cisco Secure Client (medium 4.3)
- [CVE-2024-20473](https://insights.sbomify.com/CVE-2024-20473/): SQL injection in Cisco Firepower Management Center (medium 6.5)
- [CVE-2024-20472](https://insights.sbomify.com/CVE-2024-20472/): SQL injection in Cisco Firepower Management Center (medium 6.5)
- [CVE-2024-20471](https://insights.sbomify.com/CVE-2024-20471/): SQL injection in Cisco Firepower Management Center (medium 6.5)
- [CVE-2024-20470](https://insights.sbomify.com/CVE-2024-20470/): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Remote Code Execution Vulnerability (medium 6.5)
- [CVE-2024-2047](https://insights.sbomify.com/CVE-2024-2047/): ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw (high 8.8)
- [CVE-2024-20469](https://insights.sbomify.com/CVE-2024-20469/): Cisco Identity Services Engine Command Injection Vulnerability (medium 6.0)
- [CVE-2024-20467](https://insights.sbomify.com/CVE-2024-20467/): Denial of service in Cisco IOS XE Software (high 8.6)
- [CVE-2024-20466](https://insights.sbomify.com/CVE-2024-20466/): Cisco Identity Services Engine Sensitive Information Disclosure Vulnerability (medium 6.5)
- [CVE-2024-20465](https://insights.sbomify.com/CVE-2024-20465/): Security feature bypass in IOS (medium 5.8)
- [CVE-2024-20464](https://insights.sbomify.com/CVE-2024-20464/): Denial of service in Cisco IOS XE Software (high 8.6)
- [CVE-2024-20463](https://insights.sbomify.com/CVE-2024-20463/): Cisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection and Denial of Service Vulnerability (medium 5.4)
- [CVE-2024-20462](https://insights.sbomify.com/CVE-2024-20462/): Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-20461](https://insights.sbomify.com/CVE-2024-20461/): Cisco ATA 190 Series Analog Telephone Adapter Firmware Command Injection Vulnerability (medium 6.0)
- [CVE-2024-20460](https://insights.sbomify.com/CVE-2024-20460/): Cisco ATA 190 Series Analog Telephone Adapter Firmware Reflected Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2024-20459](https://insights.sbomify.com/CVE-2024-20459/): Cisco ATA 190 Series Analog Telephone Adapter Muliplatform Firmware Command Injection Vulnerability (medium 6.5)
- [CVE-2024-20458](https://insights.sbomify.com/CVE-2024-20458/): Cisco ATA 190 Series Analog Telephone Adapter Software Vulnerabilities (high 8.2)
- [CVE-2024-20457](https://insights.sbomify.com/CVE-2024-20457/): Cisco Unified Communications Manager IM & Presence Service Information Disclosure Vulnerability (medium 6.5)
- [CVE-2024-20456](https://insights.sbomify.com/CVE-2024-20456/): Security feature bypass in Cisco IOS XR Software (medium 6.7)
- [CVE-2024-20455](https://insights.sbomify.com/CVE-2024-20455/): Denial of service in Cisco IOS XE Catalyst SD-WAN (high 8.6)
- [CVE-2024-20454](https://insights.sbomify.com/CVE-2024-20454/): Memory corruption in Cisco Small Business IP Phones (critical 9.8)
- [CVE-2024-20451](https://insights.sbomify.com/CVE-2024-20451/): Denial of service in Cisco Small Business IP Phones (high 7.5)
- [CVE-2024-20450](https://insights.sbomify.com/CVE-2024-20450/): Memory corruption in Cisco Small Business IP Phones (critical 9.8)
- [CVE-2024-2045](https://insights.sbomify.com/CVE-2024-2045/): Session 1.17.5 - LFR via chat attachment (medium 5.5)
- [CVE-2024-20449](https://insights.sbomify.com/CVE-2024-20449/): Cisco Nexus Dashboard Fabric Controller Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-20448](https://insights.sbomify.com/CVE-2024-20448/): Cisco Nexus Dashboard Fabric Controller Credential Information Disclosure Vulnerability (medium 6.3)
- [CVE-2024-20446](https://insights.sbomify.com/CVE-2024-20446/): Cisco NX-OS Software DHCPv6 Relay Agent Denial of Service Vulnerability (high 8.6)
- [CVE-2024-20445](https://insights.sbomify.com/CVE-2024-20445/): Cisco IP Phone 7800, 8800, and 9800 Series Information Disclosure Vulnerability (medium 5.3)
- [CVE-2024-20444](https://insights.sbomify.com/CVE-2024-20444/): Cisco Nexus Dashboard Fabric Controller REST API Command Injection Vulnerability (medium 5.5)
- [CVE-2024-20443](https://insights.sbomify.com/CVE-2024-20443/): Cross-site scripting in Cisco Adaptive Security Appliance (ASA) Software (medium 5.4)
- [CVE-2024-20442](https://insights.sbomify.com/CVE-2024-20442/): Cisco Nexus Dashboard Unauthorized API Endpoints Vulnerability (medium 5.4)
- [CVE-2024-20441](https://insights.sbomify.com/CVE-2024-20441/): Cisco Nexus Dashboard Fabric Controller Unauthorized API Endpoint Vulnerability (medium 5.7)
- [CVE-2024-20440](https://insights.sbomify.com/CVE-2024-20440/): Information disclosure in Cisco Smart License Utility (high 7.5)
- [CVE-2024-2044](https://insights.sbomify.com/CVE-2024-2044/): Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 (critical 9.9)
- [CVE-2024-20439](https://insights.sbomify.com/CVE-2024-20439/): Cisco Smart Licensing Utility Static Credential (critical 9.8, exploited in the wild)
- [CVE-2024-20438](https://insights.sbomify.com/CVE-2024-20438/): Cisco Nexus Dashboard Fabric Controller Unauthorized REST API Vulnerability (medium 6.3)
- [CVE-2024-20437](https://insights.sbomify.com/CVE-2024-20437/): Cross-site request forgery in Cisco IOS XE Software (high 8.1)
- [CVE-2024-20436](https://insights.sbomify.com/CVE-2024-20436/): Null dereference in Cisco IOS XE Software (high 8.6)
- [CVE-2024-20435](https://insights.sbomify.com/CVE-2024-20435/): Command injection in Cisco Secure Web Appliance (high 8.8)
- [CVE-2024-20434](https://insights.sbomify.com/CVE-2024-20434/): Integer overflow in Cisco IOS XE Software (medium 4.3)
- [CVE-2024-20433](https://insights.sbomify.com/CVE-2024-20433/): Memory corruption in Cisco IOS XE Software (high 8.6)
- [CVE-2024-20432](https://insights.sbomify.com/CVE-2024-20432/): Cisco Nexus Dashboard Fabric Controller Web UI Command Injection Vulnerability (critical 9.9)
- [CVE-2024-20431](https://insights.sbomify.com/CVE-2024-20431/): Security feature bypass in Cisco Firepower Threat Defense Software (medium 5.8)
- [CVE-2024-20430](https://insights.sbomify.com/CVE-2024-20430/): Cisco Meraki Systems Manager Agent for Windows Privilege Escalation Vulnerability (high 7.3)
- [CVE-2024-2043](https://insights.sbomify.com/CVE-2024-2043/): Missing authorization in EleForms – All In One Form Integration including DB for Elementor (medium 5.3)
- [CVE-2024-20429](https://insights.sbomify.com/CVE-2024-20429/): Command injection in Cisco Secure Email (medium 6.5)
- [CVE-2024-20426](https://insights.sbomify.com/CVE-2024-20426/): Null dereference in Cisco Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2024-20424](https://insights.sbomify.com/CVE-2024-20424/): Command injection in Cisco Firepower Management Center (critical 9.9)
- [CVE-2024-20421](https://insights.sbomify.com/CVE-2024-20421/): Cisco ATA 190 Series Analog Telephone Adapter Firmware Cross-Site Request Forgery Vulnerability (high 7.1)
- [CVE-2024-20420](https://insights.sbomify.com/CVE-2024-20420/): Cisco ATA 190 Series Analog Telephone Adapter Firmware Privilege Escalation Vulnerability (medium 5.4)
- [CVE-2024-2042](https://insights.sbomify.com/CVE-2024-2042/): Cross-site scripting in ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (medium 6.4)
- [CVE-2024-20419](https://insights.sbomify.com/CVE-2024-20419/): Auth bypass in Cisco Smart Software Manager On-Prem (critical 10.0)
- [CVE-2024-20418](https://insights.sbomify.com/CVE-2024-20418/): Cisco Ultra-Reliable Wireless Backhaul Software Command Injection Vulnerability (critical 10.0)
- [CVE-2024-20417](https://insights.sbomify.com/CVE-2024-20417/): Cisco Identity Services Engine REST API Blind SQL Injection Vulnerabities (medium 6.5)
- [CVE-2024-20416](https://insights.sbomify.com/CVE-2024-20416/): Memory corruption in Cisco Small Business RV Series Router Firmware (medium 6.5)
- [CVE-2024-20415](https://insights.sbomify.com/CVE-2024-20415/): Cross-site scripting in Cisco Firepower Management Center (medium 4.8)
- [CVE-2024-20414](https://insights.sbomify.com/CVE-2024-20414/): Cross-site request forgery in Cisco IOS XE Software (medium 6.5)
- [CVE-2024-20413](https://insights.sbomify.com/CVE-2024-20413/): Cisco NX-OS Bash Privilege Escalation Vulnerability (medium 6.7)
- [CVE-2024-20412](https://insights.sbomify.com/CVE-2024-20412/): Hardcoded credentials in Cisco Firepower Threat Defense Software (critical 9.3)
- [CVE-2024-20411](https://insights.sbomify.com/CVE-2024-20411/): Cisco NX-OS Bash Arbitrary Code Execution Vulnerability (medium 6.7)
- [CVE-2024-20410](https://insights.sbomify.com/CVE-2024-20410/): Cross-site scripting in Cisco Firepower Management Center (medium 5.4)
- [CVE-2024-20409](https://insights.sbomify.com/CVE-2024-20409/): Cross-site scripting in Cisco Firepower Management Center (medium 4.8)
- [CVE-2024-20408](https://insights.sbomify.com/CVE-2024-20408/): Denial of service in Cisco Adaptive Security Appliance (ASA) Software (high 7.7)
- [CVE-2024-20407](https://insights.sbomify.com/CVE-2024-20407/): Security feature bypass in Cisco Firepower Threat Defense Software (medium 5.8)
- [CVE-2024-20406](https://insights.sbomify.com/CVE-2024-20406/): Cisco IOS XR Software Intermediate System-to-Intermediate System Denial of Service Vulnerability (high 7.4)
- [CVE-2024-20405](https://insights.sbomify.com/CVE-2024-20405/): Cross-site scripting in Cisco Finesse (medium 4.8)
- [CVE-2024-20404](https://insights.sbomify.com/CVE-2024-20404/): Server-side request forgery in Cisco Finesse (high 7.2)
- [CVE-2024-20403](https://insights.sbomify.com/CVE-2024-20403/): Cross-site scripting in Cisco Firepower Management Center (medium 4.8)
- [CVE-2024-20402](https://insights.sbomify.com/CVE-2024-20402/): Denial of service in Cisco Adaptive Security Appliance (ASA) Software (high 8.6)
- [CVE-2024-20401](https://insights.sbomify.com/CVE-2024-20401/): Path traversal in Cisco Secure Email (critical 9.8)
- [CVE-2024-20400](https://insights.sbomify.com/CVE-2024-20400/): Open redirect in Cisco TelePresence Video Communication Server (VCS) Expressway (medium 4.7)
- [CVE-2024-2040](https://insights.sbomify.com/CVE-2024-2040/): Himer - Social Questions and Answers < 2.1.1 - Arbitrary Group Joining via CSRF (medium 6.3)
- [CVE-2024-20399](https://insights.sbomify.com/CVE-2024-20399/): Cisco NX-OS Command Injection (medium 6.0, exploited in the wild)
- [CVE-2024-20398](https://insights.sbomify.com/CVE-2024-20398/): Cisco IOS XR Software Local Privilege Escalation Vulnerability (high 8.8)
- [CVE-2024-20397](https://insights.sbomify.com/CVE-2024-20397/): Cisco NX-OS Software Image Verification Bypass Vulnerability (medium 5.2)
- [CVE-2024-20396](https://insights.sbomify.com/CVE-2024-20396/): Information disclosure in Cisco Webex Teams (medium 5.3)
- [CVE-2024-20395](https://insights.sbomify.com/CVE-2024-20395/): Information disclosure in Cisco Webex Teams (medium 6.4)
- [CVE-2024-20394](https://insights.sbomify.com/CVE-2024-20394/): Denial of service in Cisco AppDynamics (medium 5.5)
- [CVE-2024-20393](https://insights.sbomify.com/CVE-2024-20393/): Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Privilege Escalation Vulnerability (high 8.8)
- [CVE-2024-20392](https://insights.sbomify.com/CVE-2024-20392/): Cross-site scripting in Cisco Secure Email (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/461/