# Vulnerabilities published in 2024


- [CVE-2024-44133](https://insights.sbomify.com/CVE-2024-44133/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-44132](https://insights.sbomify.com/CVE-2024-44132/): Security feature bypass in macOS (high 8.4)
- [CVE-2024-44131](https://insights.sbomify.com/CVE-2024-44131/): Path traversal in iOS and iPadOS (medium 5.5)
- [CVE-2024-44130](https://insights.sbomify.com/CVE-2024-44130/): Information disclosure in macOS (medium 4.4)
- [CVE-2024-4413](https://insights.sbomify.com/CVE-2024-4413/): Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2024-44129](https://insights.sbomify.com/CVE-2024-44129/): Information disclosure in macOS (medium 5.5)
- [CVE-2024-44128](https://insights.sbomify.com/CVE-2024-44128/): Security feature bypass in macOS (medium 5.5)
- [CVE-2024-44127](https://insights.sbomify.com/CVE-2024-44127/): Auth bypass in iOS and iPadOS (medium 5.3)
- [CVE-2024-44126](https://insights.sbomify.com/CVE-2024-44126/): Memory corruption in iOS and iPadOS (high 7.8)
- [CVE-2024-44125](https://insights.sbomify.com/CVE-2024-44125/): Information disclosure in macOS (medium 5.5)
- [CVE-2024-44124](https://insights.sbomify.com/CVE-2024-44124/): Auth bypass in iOS and iPadOS (medium 6.5)
- [CVE-2024-44123](https://insights.sbomify.com/CVE-2024-44123/): Missing authorization in iOS and iPadOS (low 2.3)
- [CVE-2024-44122](https://insights.sbomify.com/CVE-2024-44122/): Security feature bypass in iOS and iPadOS (high 8.8)
- [CVE-2024-44121](https://insights.sbomify.com/CVE-2024-44121/): Information Disclosure in SAP S/4 HANA (Statutory Reports) (medium 4.3)
- [CVE-2024-44120](https://insights.sbomify.com/CVE-2024-44120/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (medium 4.7)
- [CVE-2024-4412](https://insights.sbomify.com/CVE-2024-4412/): Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations (low 2.7)
- [CVE-2024-44117](https://insights.sbomify.com/CVE-2024-44117/): Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (medium 5.4)
- [CVE-2024-44116](https://insights.sbomify.com/CVE-2024-44116/): Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (medium 4.3)
- [CVE-2024-44115](https://insights.sbomify.com/CVE-2024-44115/): Multiple vulnerabilities in SAP NetWeaver Application Server for ABAP and ABAP Platform (medium 4.3)
- [CVE-2024-44114](https://insights.sbomify.com/CVE-2024-44114/): Missing Authorization check in SAP NetWeaver Application Server for ABAP and ABAP Platform (low 2.0)
- [CVE-2024-44113](https://insights.sbomify.com/CVE-2024-44113/): Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer) (medium 4.3)
- [CVE-2024-44112](https://insights.sbomify.com/CVE-2024-44112/): Missing Authorization check in SAP for Oil & Gas (Transportation and Distribution) (medium 4.3)
- [CVE-2024-4411](https://insights.sbomify.com/CVE-2024-4411/): Mihdan: Yandex Turbo Feed <= 1.6.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-44107](https://insights.sbomify.com/CVE-2024-44107/): Privilege escalation in Workspace Control (high 8.8)
- [CVE-2024-44106](https://insights.sbomify.com/CVE-2024-44106/): Privilege escalation in Workspace Control (high 8.8)
- [CVE-2024-44105](https://insights.sbomify.com/CVE-2024-44105/): Information disclosure in Workspace Control (high 8.2)
- [CVE-2024-44104](https://insights.sbomify.com/CVE-2024-44104/): Auth bypass in Workspace Control (high 8.8)
- [CVE-2024-44103](https://insights.sbomify.com/CVE-2024-44103/): Privilege escalation in Workspace Control (high 8.8)
- [CVE-2024-44102](https://insights.sbomify.com/CVE-2024-44102/): Deserialization in PP TeleControl Server Basic 1000 to 5000 V3.1 (critical 10.0)
- [CVE-2024-44101](https://insights.sbomify.com/CVE-2024-44101/): Null dereference in Android (high 7.5)
- [CVE-2024-44100](https://insights.sbomify.com/CVE-2024-44100/): Information disclosure in Android (high 7.5)
- [CVE-2024-4410](https://insights.sbomify.com/CVE-2024-4410/): IgnitionDeck Crowdfunding Platform <= 1.9.8 - Missing Authorization (medium 5.4)
- [CVE-2024-44099](https://insights.sbomify.com/CVE-2024-44099/): Security feature bypass in Android (medium 5.5)
- [CVE-2024-44098](https://insights.sbomify.com/CVE-2024-44098/): Memory corruption in Android (high 7.4)
- [CVE-2024-44097](https://insights.sbomify.com/CVE-2024-44097/): Security feature bypass in Android (critical 9.8)
- [CVE-2024-44096](https://insights.sbomify.com/CVE-2024-44096/): Information disclosure in Android (medium 4.4)
- [CVE-2024-44095](https://insights.sbomify.com/CVE-2024-44095/): Memory corruption in Android (high 7.4)
- [CVE-2024-44094](https://insights.sbomify.com/CVE-2024-44094/): Memory corruption in Android (high 7.4)
- [CVE-2024-44093](https://insights.sbomify.com/CVE-2024-44093/): Memory corruption in Android (high 7.4)
- [CVE-2024-44092](https://insights.sbomify.com/CVE-2024-44092/): Security feature bypass in Android (high 7.8)
- [CVE-2024-4409](https://insights.sbomify.com/CVE-2024-4409/): WP-ViperGB <= 1.6.1 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-44088](https://insights.sbomify.com/CVE-2024-44088/): Apache Geode: Reflected XSS (medium 6.1)
- [CVE-2024-44087](https://insights.sbomify.com/CVE-2024-44087/): Integer overflow in Automation License Manager V5 (critical 9.2)
- [CVE-2024-44085](https://insights.sbomify.com/CVE-2024-44085/): Cross-site scripting in onlyoffice:onlyoffice (medium 6.1)
- [CVE-2024-44083](https://insights.sbomify.com/CVE-2024-44083/): Denial of service in hex-rays:ida pro (high 7.5)
- [CVE-2024-44082](https://insights.sbomify.com/CVE-2024-44082/): In OpenStack Ironic before 26.0.1 and ironic-python-agent before 9.13.1, there is a vulnerability in image processing, in which a crafted im (medium 4.3)
- [CVE-2024-44081](https://insights.sbomify.com/CVE-2024-44081/): Cross-site scripting in 8x8:jitsi meet (critical 9.8)
- [CVE-2024-44080](https://insights.sbomify.com/CVE-2024-44080/): Cross-site scripting in 8x8:jitsi meet (high 7.5)
- [CVE-2024-44076](https://insights.sbomify.com/CVE-2024-44076/): Microcks's POST /api/import and POST /api/export endpoints allow non-administrator access (critical 9.8)
- [CVE-2024-44073](https://insights.sbomify.com/CVE-2024-44073/): Miniscript allows stack consumption (high 7.5)
- [CVE-2024-44072](https://insights.sbomify.com/CVE-2024-44072/): Command injection in WEX-1166DHP (medium 5.7)
- [CVE-2024-44070](https://insights.sbomify.com/CVE-2024-44070/): Memory corruption in frrouting:frrouting (critical 9.8)
- [CVE-2024-44069](https://insights.sbomify.com/CVE-2024-44069/): Missing authorization in pi-hole:pi-hole (high 7.5)
- [CVE-2024-44068](https://insights.sbomify.com/CVE-2024-44068/): Use after free in samsung:exynos 850 firmware (high 8.1)
- [CVE-2024-44067](https://insights.sbomify.com/CVE-2024-44067/): The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have instructions that allow unprivileged (high 8.4)
- [CVE-2024-44065](https://insights.sbomify.com/CVE-2024-44065/): SQL injection in magicbug:cloudlog (critical 9.8)
- [CVE-2024-44064](https://insights.sbomify.com/CVE-2024-44064/): WordPress Like Button Rating LikeBtn plugin <= 2.6.53 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-44063](https://insights.sbomify.com/CVE-2024-44063/): WordPress Happyforms plugin <= 1.26.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44062](https://insights.sbomify.com/CVE-2024-44062/): WordPress Custom Field Template plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44061](https://insights.sbomify.com/CVE-2024-44061/): WordPress EU/UK VAT Manager for WooCommerce plugin <= 2.12.14 - CSRF to Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-44060](https://insights.sbomify.com/CVE-2024-44060/): WordPress filmix theme <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4406](https://insights.sbomify.com/CVE-2024-4406/): Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-44059](https://insights.sbomify.com/CVE-2024-44059/): WordPress Custom Query Blocks plugin <= 5.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44058](https://insights.sbomify.com/CVE-2024-44058/): WordPress Parabola theme <= 2.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44057](https://insights.sbomify.com/CVE-2024-44057/): WordPress Nirvana theme <= 1.6.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44056](https://insights.sbomify.com/CVE-2024-44056/): WordPress Mantra theme <= 3.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44055](https://insights.sbomify.com/CVE-2024-44055/): WordPress Oshine Modules plugin < 3.3.6 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2024-44054](https://insights.sbomify.com/CVE-2024-44054/): WordPress Fluida theme <= 1.8.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44053](https://insights.sbomify.com/CVE-2024-44053/): WordPress Opor Ayam theme <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-44052](https://insights.sbomify.com/CVE-2024-44052/): WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-44051](https://insights.sbomify.com/CVE-2024-44051/): WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44050](https://insights.sbomify.com/CVE-2024-44050/): WordPress Verbosa theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4405](https://insights.sbomify.com/CVE-2024-4405/): Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-44049](https://insights.sbomify.com/CVE-2024-44049/): Cross-site scripting in Gutenberg Blocks (medium 6.5)
- [CVE-2024-44048](https://insights.sbomify.com/CVE-2024-44048/): Path traversal in Product Carousel Slider & Grid Ultimate for WooCommerce (medium 6.5)
- [CVE-2024-44047](https://insights.sbomify.com/CVE-2024-44047/): WordPress IMPress for IDX Broker plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44046](https://insights.sbomify.com/CVE-2024-44046/): WordPress Themify plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-44045](https://insights.sbomify.com/CVE-2024-44045/): WordPress WP Abstracts plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-44044](https://insights.sbomify.com/CVE-2024-44044/): WordPress Oshine Modules plugin < 3.3.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-44043](https://insights.sbomify.com/CVE-2024-44043/): WordPress Photo Gallery by 10Web plugin <= 1.8.27 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-44042](https://insights.sbomify.com/CVE-2024-44042/): WordPress WP Datepicker plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-44041](https://insights.sbomify.com/CVE-2024-44041/): WordPress IdeaPush plugin <= 8.66 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-44040](https://insights.sbomify.com/CVE-2024-44040/): WordPress ShiftController Employee Shift Scheduling plugin <= 4.9.64 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-4404](https://insights.sbomify.com/CVE-2024-4404/): ElementsKit PRO <= 3.6.1 - Authenticated (Contributor+) Server-Side Request Forgery (high 8.5)
- [CVE-2024-44039](https://insights.sbomify.com/CVE-2024-44039/): WordPress WP Travel plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-44038](https://insights.sbomify.com/CVE-2024-44038/): WordPress Sunshine Photo Cart plugin <= 3.2.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-44037](https://insights.sbomify.com/CVE-2024-44037/): WordPress Multipurpose Ticket Booking Manager plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-44036](https://insights.sbomify.com/CVE-2024-44036/): WordPress Kodex Posts likes plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-44035](https://insights.sbomify.com/CVE-2024-44035/): WordPress Gum Elementor Addon plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44034](https://insights.sbomify.com/CVE-2024-44034/): WordPress WPSPX plugin <= 1.0.2 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-44033](https://insights.sbomify.com/CVE-2024-44033/): WordPress Primary Addon for Elementor plugin <= 1.5.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44032](https://insights.sbomify.com/CVE-2024-44032/): WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44031](https://insights.sbomify.com/CVE-2024-44031/): WordPress JoomSport plugin <= 5.6.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-44030](https://insights.sbomify.com/CVE-2024-44030/): WordPress Checkout Mestres WP plugin <= 8.6 - Local File Inclusion vulnerability (high 7.2)
- [CVE-2024-4403](https://insights.sbomify.com/CVE-2024-4403/): CSRF in restart_program in parisneo/lollms-webui (medium 4.4)
- [CVE-2024-44029](https://insights.sbomify.com/CVE-2024-44029/): WordPress Viala theme <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-44028](https://insights.sbomify.com/CVE-2024-44028/): WordPress NiceJob plugin < 3.6.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-44027](https://insights.sbomify.com/CVE-2024-44027/): WordPress Gum Elementor Addon plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44026](https://insights.sbomify.com/CVE-2024-44026/): WordPress Charity Addon for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-44025](https://insights.sbomify.com/CVE-2024-44025/): WordPress NiceJob plugin < 3.6.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/276/