CVE-2024-51472

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

IBM UrbanCode Deploy (UCD) 7.2 through 7.2.3.13, 7.3 through 7.3.2.8, and IBM DevOps Deploy 8.0 through 8.0.1.3 are vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure.

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-80CWE-79

Affected software

VendorProductVersions
IBMDevOps Deploy>= 8.0, <= 8.0.1.3
IBMUrbanCode Deploy>= 7.2, <= 7.2.3.13; >= 7.3, <= 7.3.2.8

References

Timeline

Published
Jan 6, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-514737.5IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5.0.0 through 10.5.0.11, 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9CVE-2024-514756.1IBM Content Navigator 3.0.11, 3.0.15, and 3.1.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which wCVE-2024-514767.5IBM Concert Software 1.0.5 uses an inadequate account lockout setting that could allow a remote attacker to brute force account credentials.CVE-2024-514776.5IBM InfoSphere Information Server 11.7 could allow an authenticated to obtain sensitive username information due to an observable responseCVE-2024-514789.1YesWiki is a wiki system written in PHP. Prior to 4.4.5, the use of a weak cryptographic algorithm and a hard-coded salt to hash the passworCVE-2024-514797.5Next.js is a React framework for building full-stack web applications. In affected versions if a Next.js application is performing authorizaCVE-2024-51487.5A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agentCVE-2024-514807.0RedisTimeSeries is a time-series database (TSDB) module for Redis, by Redis. Executing one of these commands TS.QUERYINDEX, TS.MGET, TS.MRAGCVE-2024-514811.0Nix is a package manager for Linux and other Unix systems. On macOS, built-in builders (such as `builtin:fetchurl`, exposed to users with `iCVE-2024-514829.9ZoneMinder is a free, open source closed-circuit television software application. ZoneMinder v1.37.* <= 1.37.64 is vulnerable to boolean-basCVE-2024-514836.9changedetection.io is free, open source web page change detection software. Prior to version 0.47.5, when a WebDriver is used to fetch filesCVE-2024-514848.1Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly val