# Vulnerabilities published in 2024


- [CVE-2024-56219](https://insights.sbomify.com/CVE-2024-56219/): WordPress Widget Options plugin <= 4.0.6.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-56218](https://insights.sbomify.com/CVE-2024-56218/): WordPress Contact Form 7 - Dynamic Text Extension plugin <= 5.0.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-56217](https://insights.sbomify.com/CVE-2024-56217/): WordPress Download Manager plugin <= 3.3.03 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-56216](https://insights.sbomify.com/CVE-2024-56216/): WordPress Themify Builder plugin <= 7.6.3 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-56215](https://insights.sbomify.com/CVE-2024-56215/): WordPress Member Directory and Contact Form plugin <= 1.7.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-56214](https://insights.sbomify.com/CVE-2024-56214/): WordPress UserPro plugin <= 5.1.9 - Local File Inclusion vulnerability (high 8.3)
- [CVE-2024-56213](https://insights.sbomify.com/CVE-2024-56213/): WordPress Eventin plugin <= 4.0.7 - Contributor+ Limited Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-56212](https://insights.sbomify.com/CVE-2024-56212/): WordPress UserPro plugin <= 5.1.9 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-56211](https://insights.sbomify.com/CVE-2024-56211/): WordPress UserPro plugin <= 5.1.9 - Authenticated Arbitrary User Meta Update vulnerability (high 8.8)
- [CVE-2024-56210](https://insights.sbomify.com/CVE-2024-56210/): WordPress UserPro plugin <= 5.1.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56209](https://insights.sbomify.com/CVE-2024-56209/): WordPress Kleo theme < 5.4.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56208](https://insights.sbomify.com/CVE-2024-56208/): WordPress NewsMash theme <= 1.0.71 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-56207](https://insights.sbomify.com/CVE-2024-56207/): Cross-site request forgery in EditionGuard for WooCommerce – eBook Sales with DRM (high 8.8)
- [CVE-2024-56206](https://insights.sbomify.com/CVE-2024-56206/): WordPress gap-hub-user-role. plugin <= 3.4.1 - CSRF to Broken Authentication vulnerability (high 8.8)
- [CVE-2024-56205](https://insights.sbomify.com/CVE-2024-56205/): WordPress AI Magic – SEO Content Generator & Article Writer plugin <= 1.0.4 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-56204](https://insights.sbomify.com/CVE-2024-56204/): WordPress Sinking Dropdowns plugin <= 1.25 - CSRF to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-56203](https://insights.sbomify.com/CVE-2024-56203/): WordPress Wayne Audio Player plugin <= 1.0 - CSRF to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-56202](https://insights.sbomify.com/CVE-2024-56202/): Apache Traffic Server: Expect header field can unreasonably retain resource (medium 4.3)
- [CVE-2024-56201](https://insights.sbomify.com/CVE-2024-56201/): Jinja has a sandbox breakout through malicious filenames (medium 5.4)
- [CVE-2024-56200](https://insights.sbomify.com/CVE-2024-56200/): Uncontrolled Recursion and Asymmetric Resource Consumption in Altair media/file proxy (high 8.6)
- [CVE-2024-5620](https://insights.sbomify.com/CVE-2024-5620/): Authentication Bypass in PruvaSoft Informatics' Apinizer Management Console (medium 6.5)
- [CVE-2024-56199](https://insights.sbomify.com/CVE-2024-56199/): phpMyFAQ Vulnerable to Stored HTML Injection at FAQ (medium 5.2)
- [CVE-2024-56198](https://insights.sbomify.com/CVE-2024-56198/): path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability (critical 9.3)
- [CVE-2024-56197](https://insights.sbomify.com/CVE-2024-56197/): Users can see other user's tagged PMs in Discourse (low 2.2)
- [CVE-2024-56196](https://insights.sbomify.com/CVE-2024-56196/): Apache Traffic Server: ACL is not fully compatible with older versions (medium 6.3)
- [CVE-2024-56195](https://insights.sbomify.com/CVE-2024-56195/): Apache Traffic Server: Intercept plugins are not access controlled (medium 6.3)
- [CVE-2024-56193](https://insights.sbomify.com/CVE-2024-56193/): Information disclosure in Android (medium 5.1)
- [CVE-2024-56192](https://insights.sbomify.com/CVE-2024-56192/): Memory corruption in Android (high 7.8)
- [CVE-2024-56191](https://insights.sbomify.com/CVE-2024-56191/): Integer overflow in Android (high 8.4)
- [CVE-2024-56190](https://insights.sbomify.com/CVE-2024-56190/): Memory corruption in Android (high 7.8)
- [CVE-2024-5619](https://insights.sbomify.com/CVE-2024-5619/): IDOR in PruvaSoft Informatics' Apinizer Management Console (critical 9.6)
- [CVE-2024-56189](https://insights.sbomify.com/CVE-2024-56189/): Memory corruption in Android (medium 6.5)
- [CVE-2024-56188](https://insights.sbomify.com/CVE-2024-56188/): Null dereference in Android (medium 5.1)
- [CVE-2024-56187](https://insights.sbomify.com/CVE-2024-56187/): Information disclosure in Android (medium 6.6)
- [CVE-2024-56186](https://insights.sbomify.com/CVE-2024-56186/): Memory corruption in Android (medium 5.1)
- [CVE-2024-56185](https://insights.sbomify.com/CVE-2024-56185/): Memory corruption in Android (medium 5.1)
- [CVE-2024-56184](https://insights.sbomify.com/CVE-2024-56184/): Memory corruption in Android (medium 5.1)
- [CVE-2024-56182](https://insights.sbomify.com/CVE-2024-56182/): Security feature bypass in SIMATIC Field PG M5 (high 8.4)
- [CVE-2024-56181](https://insights.sbomify.com/CVE-2024-56181/): Security feature bypass in SIMATIC Field PG M5 (high 8.4)
- [CVE-2024-56180](https://insights.sbomify.com/CVE-2024-56180/): Apache EventMesh: raft Hessian Deserialization Vulnerability allowing remote code execution (critical 9.8)
- [CVE-2024-5618](https://insights.sbomify.com/CVE-2024-5618/): Broken Access Control in PruvaSoft Informatics' Apinizer Management Console (critical 9.9)
- [CVE-2024-56179](https://insights.sbomify.com/CVE-2024-56179/): In MindManager Windows versions prior to 24.1.150, attackers could potentially write to unexpected directories in victims' machines via dire (high 7.8)
- [CVE-2024-56178](https://insights.sbomify.com/CVE-2024-56178/): Privilege escalation in couchbase:couchbase server (medium 6.5)
- [CVE-2024-56175](https://insights.sbomify.com/CVE-2024-56175/): Cross-site scripting in optimizely:configured commerce (medium 6.1)
- [CVE-2024-56174](https://insights.sbomify.com/CVE-2024-56174/): Cross-site scripting in optimizely:configured commerce (high 8.1)
- [CVE-2024-56173](https://insights.sbomify.com/CVE-2024-56173/): Cross-site scripting in optimizely:configured commerce (medium 4.7)
- [CVE-2024-56171](https://insights.sbomify.com/CVE-2024-56171/): Use after free in libxml2 (high 7.8)
- [CVE-2024-56170](https://insights.sbomify.com/CVE-2024-56170/): Security feature bypass in nicmx:fort-validator (medium 5.3)
- [CVE-2024-56169](https://insights.sbomify.com/CVE-2024-56169/): Security feature bypass in nicmx:fort validator (medium 5.3)
- [CVE-2024-56161](https://insights.sbomify.com/CVE-2024-56161/): Security feature bypass in AMD EPYC™ 7001 Series (high 7.2)
- [CVE-2024-5616](https://insights.sbomify.com/CVE-2024-5616/): CSRF Vulnerability in mudler/LocalAI (medium 4.3)
- [CVE-2024-56159](https://insights.sbomify.com/CVE-2024-56159/): Server source code is exposed to the public if sourcemaps are enabled (high 7.8)
- [CVE-2024-56158](https://insights.sbomify.com/CVE-2024-56158/): XWiki allows SQL injection in query endpoint of REST API with Oracle (critical 9.3)
- [CVE-2024-56157](https://insights.sbomify.com/CVE-2024-56157/): iTop vulnerable to Self XSS in CSV Import (medium 6.3)
- [CVE-2024-56156](https://insights.sbomify.com/CVE-2024-56156/): Halo Vulnerable to Stored XSS and RCE via File Upload Bypass (medium 5.5)
- [CVE-2024-5615](https://insights.sbomify.com/CVE-2024-5615/): Open Graph <= 1.11.2 - Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2024-56145](https://insights.sbomify.com/CVE-2024-56145/): Craft CMS Code Injection (critical 9.3, exploited in the wild)
- [CVE-2024-56144](https://insights.sbomify.com/CVE-2024-56144/): Stored XSS-LibreNMS-Display Name 2 in librenms (medium 4.6)
- [CVE-2024-56143](https://insights.sbomify.com/CVE-2024-56143/): Strapi Allows Unauthorized Access to Private Fields via parms.lookup (high 8.2)
- [CVE-2024-56142](https://insights.sbomify.com/CVE-2024-56142/): Path Traversal in pghoard (medium 4.8)
- [CVE-2024-56141](https://insights.sbomify.com/CVE-2024-56141/): Minosoft has IV equal to key (medium 5.0)
- [CVE-2024-56140](https://insights.sbomify.com/CVE-2024-56140/): Bypass of CSRF Middleware in Astro (medium 5.9)
- [CVE-2024-5614](https://insights.sbomify.com/CVE-2024-5614/): Piotnet Addons For Elementor <= 2.4.29 - Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2024-56139](https://insights.sbomify.com/CVE-2024-56139/): A stack overflow Segmentation Fault (SEGV) and Memory Leak in pdftools (medium 6.9)
- [CVE-2024-56138](https://insights.sbomify.com/CVE-2024-56138/): Timestamp signature generation lacks certificate revocation check in notion-go (medium 4.0)
- [CVE-2024-56137](https://insights.sbomify.com/CVE-2024-56137/): MaxKB RCE vulnerability in function library (medium 6.8)
- [CVE-2024-56136](https://insights.sbomify.com/CVE-2024-56136/): /api/v1/jwt/fetch_api_key endpoint can leak if an email address has an account in Zulip server (medium 6.9)
- [CVE-2024-56135](https://insights.sbomify.com/CVE-2024-56135/): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (high 8.4)
- [CVE-2024-56134](https://insights.sbomify.com/CVE-2024-56134/): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (high 8.4)
- [CVE-2024-56133](https://insights.sbomify.com/CVE-2024-56133/): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (high 8.4)
- [CVE-2024-56132](https://insights.sbomify.com/CVE-2024-56132/): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (high 8.4)
- [CVE-2024-56131](https://insights.sbomify.com/CVE-2024-56131/): Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. (high 8.4)
- [CVE-2024-5613](https://insights.sbomify.com/CVE-2024-5613/): Formula <= 0.5.1 - Reflected Cross-Site Scripting via quality_customizer_notify_dismiss_action (medium 6.1)
- [CVE-2024-56128](https://insights.sbomify.com/CVE-2024-56128/): Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption (medium 5.3)
- [CVE-2024-5612](https://insights.sbomify.com/CVE-2024-5612/): Cross-site scripting in Essential Addons for Elementor Pro (medium 6.4)
- [CVE-2024-56116](https://insights.sbomify.com/CVE-2024-56116/): Cross-site request forgery in amiro:amiro.cms (high 8.8)
- [CVE-2024-56115](https://insights.sbomify.com/CVE-2024-56115/): Cross-site scripting in amiro:amiro.cms (medium 6.1)
- [CVE-2024-56114](https://insights.sbomify.com/CVE-2024-56114/): Missing authorization in henkel:canlineapp (medium 6.5)
- [CVE-2024-56113](https://insights.sbomify.com/CVE-2024-56113/): Smart Toilet Lab - Motius 1.3.11 is running with debug mode turned on (DEBUG = True) and exposing sensitive information defined in Django se (high 7.5)
- [CVE-2024-56112](https://insights.sbomify.com/CVE-2024-56112/): Cross-site scripting in cyberpanel:cyberpanel (medium 6.1)
- [CVE-2024-5611](https://insights.sbomify.com/CVE-2024-5611/): Stratum – Elementor Widgets <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget (medium 6.4)
- [CVE-2024-56089](https://insights.sbomify.com/CVE-2024-56089/): Weak cryptography in technitium:dnsserver (high 7.5)
- [CVE-2024-56087](https://insights.sbomify.com/CVE-2024-56087/): Code injection in logpoint:siem (medium 5.9)
- [CVE-2024-56086](https://insights.sbomify.com/CVE-2024-56086/): Command injection in logpoint:siem (high 7.1)
- [CVE-2024-56085](https://insights.sbomify.com/CVE-2024-56085/): Code injection in logpoint:siem (medium 5.9)
- [CVE-2024-56084](https://insights.sbomify.com/CVE-2024-56084/): Command injection in logpoint:universal normalizer (high 7.1)
- [CVE-2024-56083](https://insights.sbomify.com/CVE-2024-56083/): Cognition Devin before 2024-12-12 provides write access to code by an attacker who discovers the https://vscode-randomly_generated_string.de (high 8.1)
- [CVE-2024-56082](https://insights.sbomify.com/CVE-2024-56082/): ChatBar.tsx in Lumos before 1.0.17 parses raw HTML in Markdown because the markdown-to-jsx package is used without disableParsingRawHTML set to true. (low 3.5)
- [CVE-2024-5608](https://insights.sbomify.com/CVE-2024-5608/): SQL Injection (high 8.3)
- [CVE-2024-56074](https://insights.sbomify.com/CVE-2024-56074/): gitingest before 9996a06 mishandles symbolic links that point outside of the base directory. (medium 5.5)
- [CVE-2024-56073](https://insights.sbomify.com/CVE-2024-56073/): Denial of service in pavel-odintsov:fastnetmon (high 7.5)
- [CVE-2024-56072](https://insights.sbomify.com/CVE-2024-56072/): Denial of service in pavel-odintsov:fastnetmon (high 7.5)
- [CVE-2024-56071](https://insights.sbomify.com/CVE-2024-56071/): WordPress Simple Dashboard plugin <= 2.0 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-56070](https://insights.sbomify.com/CVE-2024-56070/): WordPress WP SuperBackup plugin <= 2.3.3 - Multiple Subscriber+ Broken Access Control vulnerabilities (high 7.4)
- [CVE-2024-5607](https://insights.sbomify.com/CVE-2024-5607/): Missing authorization in GDPR CCPA Compliance & Cookie Consent Banner (medium 5.4)
- [CVE-2024-56069](https://insights.sbomify.com/CVE-2024-56069/): WordPress WP SuperBackup plugin <= 2.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-56068](https://insights.sbomify.com/CVE-2024-56068/): WordPress WP SuperBackup plugin <= 2.3.3 - Subscriber+ PHP Object Injection vulnerability (high 7.5)
- [CVE-2024-56067](https://insights.sbomify.com/CVE-2024-56067/): WordPress WP SuperBackup plugin <= 2.3.3 - Unauthenticated Backup File Download Vulnerability (high 7.5)
- [CVE-2024-56066](https://insights.sbomify.com/CVE-2024-56066/): WordPress Agency Toolkit plugin <= 1.0.23 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-56065](https://insights.sbomify.com/CVE-2024-56065/): WordPress WP2LEADS Plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/190/