# Vulnerabilities published in 2024


- [CVE-2024-43420](https://insights.sbomify.com/CVE-2024-43420/): Information disclosure in Intel Atom(R) processors (medium 5.7)
- [CVE-2024-4342](https://insights.sbomify.com/CVE-2024-4342/): Royal Elementor Addons and Templates <= 1.3.975 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-43418](https://insights.sbomify.com/CVE-2024-43418/): GLPI has multiple reflected XSS (medium 6.5)
- [CVE-2024-43417](https://insights.sbomify.com/CVE-2024-43417/): Reflected XSS in Software form (medium 6.5)
- [CVE-2024-43416](https://insights.sbomify.com/CVE-2024-43416/): GLPI vulnerable to enumeration of users' email addresses by unauthenticated user (high 7.5)
- [CVE-2024-43415](https://insights.sbomify.com/CVE-2024-43415/): Decidim-Awesome: SQL injection in AdminAccountability (critical 9.0)
- [CVE-2024-43414](https://insights.sbomify.com/CVE-2024-43414/): Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queries (high 7.5)
- [CVE-2024-43413](https://insights.sbomify.com/CVE-2024-43413/): Xibo CMS XSS vulnerability using DataSet HTML columns (low 3.5)
- [CVE-2024-43412](https://insights.sbomify.com/CVE-2024-43412/): Xibo CMS XSS vulnerability when previewing files uploaded to the library containing HTML/JS (medium 4.6)
- [CVE-2024-43411](https://insights.sbomify.com/CVE-2024-43411/): CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeover (low 3.1)
- [CVE-2024-43410](https://insights.sbomify.com/CVE-2024-43410/): Russh has an OOM Denial of Service due to allocation of untrusted amount (high 7.5)
- [CVE-2024-4341](https://insights.sbomify.com/CVE-2024-4341/): IDOR in ExtremePacs's Extreme XDS (medium 6.5)
- [CVE-2024-43409](https://insights.sbomify.com/CVE-2024-43409/): Ghost's improper authentication allows access to member information and actions (medium 6.5)
- [CVE-2024-43408](https://insights.sbomify.com/CVE-2024-43408/): Discourse Placeholder Forms has a XSS stopped by CSP (medium 6.3)
- [CVE-2024-43407](https://insights.sbomify.com/CVE-2024-43407/): Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerability (medium 6.1)
- [CVE-2024-43406](https://insights.sbomify.com/CVE-2024-43406/): LF Edge eKuiper has a SQL Injection in sqlKvStore (high 8.8)
- [CVE-2024-43405](https://insights.sbomify.com/CVE-2024-43405/): Nuclei Template Signature Verification Bypass (high 7.4)
- [CVE-2024-43404](https://insights.sbomify.com/CVE-2024-43404/): Remote Code Execution Vulnerability in MEGABOT (critical 9.8)
- [CVE-2024-43403](https://insights.sbomify.com/CVE-2024-43403/): Kanister has a potential risk which can be leveraged to make a cluster-level privilege escalation (high 8.8)
- [CVE-2024-43402](https://insights.sbomify.com/CVE-2024-43402/): Rust OS Command Injection/Argument Injection vulnerability (high 8.2)
- [CVE-2024-43401](https://insights.sbomify.com/CVE-2024-43401/): In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them (critical 9.1)
- [CVE-2024-43400](https://insights.sbomify.com/CVE-2024-43400/): XWiki Platform allows XSS through XClass name in string properties (critical 9.1)
- [CVE-2024-4340](https://insights.sbomify.com/CVE-2024-4340/): Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError. (high 7.5)
- [CVE-2024-43399](https://insights.sbomify.com/CVE-2024-43399/): Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library Files (high 8.0)
- [CVE-2024-43398](https://insights.sbomify.com/CVE-2024-43398/): REXML denial of service vulnerability (medium 5.9)
- [CVE-2024-43397](https://insights.sbomify.com/CVE-2024-43397/): Potential unauthorized access issue in apollo-portal (medium 4.3)
- [CVE-2024-43396](https://insights.sbomify.com/CVE-2024-43396/): Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature) (medium 5.4)
- [CVE-2024-43395](https://insights.sbomify.com/CVE-2024-43395/): CraftOS-PC 2's improperly sanitizied paths cause filesystem escape (Windows) (high 8.2)
- [CVE-2024-43394](https://insights.sbomify.com/CVE-2024-43394/): Apache HTTP Server: SSRF on Windows due to UNC paths (high 7.5)
- [CVE-2024-43393](https://insights.sbomify.com/CVE-2024-43393/): Phoenix Contact: Configuration changes of the firewall services can lead to DoS in MGUARD devices (high 8.1)
- [CVE-2024-43392](https://insights.sbomify.com/CVE-2024-43392/): Phoenix Contact: Firewall reconfiguration through the FW_environment variables in MGUARD devices (high 8.1)
- [CVE-2024-43391](https://insights.sbomify.com/CVE-2024-43391/): Phoenix Contact: Firewall reconfiguration through the FW_PORTFORWARDING.SRC_IP in MGUARD devices (high 8.1)
- [CVE-2024-43390](https://insights.sbomify.com/CVE-2024-43390/): Phoenix Contact: Firewall reconfiguration due to improper input validation in MGUARD devices (high 8.1)
- [CVE-2024-4339](https://insights.sbomify.com/CVE-2024-4339/): Cross-site scripting in Prime Slider – Addons for Elementor (medium 6.4)
- [CVE-2024-43389](https://insights.sbomify.com/CVE-2024-43389/): Phoenix Contact: OSPF reconfiguration due to improper input validation in MGUARD devices (high 8.1)
- [CVE-2024-43388](https://insights.sbomify.com/CVE-2024-43388/): Phoenix Contact: SNMP reconfiguration due to improper input validation in MGUARD devices (high 8.8)
- [CVE-2024-43387](https://insights.sbomify.com/CVE-2024-43387/): Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devices (high 8.8)
- [CVE-2024-43386](https://insights.sbomify.com/CVE-2024-43386/): Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices. (high 8.8)
- [CVE-2024-43385](https://insights.sbomify.com/CVE-2024-43385/): Phoenix Contact: OS command execution through PROXY_HTTP_PORT in mGuard devices (high 8.8)
- [CVE-2024-43384](https://insights.sbomify.com/CVE-2024-43384/): Phoenix Contact: Improper removal of sensitive information in MGUARD products (high 8.0)
- [CVE-2024-43383](https://insights.sbomify.com/CVE-2024-43383/): Apache Lucene.Net.Replicator: Remote Code Execution in Lucene.Net.Replicator (high 8.0)
- [CVE-2024-43382](https://insights.sbomify.com/CVE-2024-43382/): Snowflake JDBC Security Advisory (medium 5.9)
- [CVE-2024-43381](https://insights.sbomify.com/CVE-2024-43381/): reNgine vulnerable to Stored Cross-Site Scripting (XSS) via DNS Record Poisoning (medium 5.0)
- [CVE-2024-43380](https://insights.sbomify.com/CVE-2024-43380/): fugit parse and parse_nat stall on lengthy input (medium 5.3)
- [CVE-2024-43379](https://insights.sbomify.com/CVE-2024-43379/): TruffleHog has a Blind SSRF in some Detectors (low 3.4)
- [CVE-2024-43378](https://insights.sbomify.com/CVE-2024-43378/): calamares-nixos-extensions LUKS keyfile exposure regression on legacy BIOS systems (high 7.8)
- [CVE-2024-43377](https://insights.sbomify.com/CVE-2024-43377/): Umbraco CMS Improper Access Control vulnerability (medium 5.4)
- [CVE-2024-43376](https://insights.sbomify.com/CVE-2024-43376/): Umbraco CMS vulnerable to Generation of Error Message Containing Sensitive Information (medium 4.3)
- [CVE-2024-43374](https://insights.sbomify.com/CVE-2024-43374/): Vim heap-use-after-free in src/arglist.c:207 (medium 4.5)
- [CVE-2024-43373](https://insights.sbomify.com/CVE-2024-43373/): webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle (high 7.7)
- [CVE-2024-43371](https://insights.sbomify.com/CVE-2024-43371/): Potential access to sensitive URLs via CKAN extensions (SSRF) (medium 4.5)
- [CVE-2024-43370](https://insights.sbomify.com/CVE-2024-43370/): gettext.js vulnerable to cross-site scripting (XSS) (high 7.2)
- [CVE-2024-4337](https://insights.sbomify.com/CVE-2024-4337/): Múltiple vulnerabilities on Adive Framework (high 7.6)
- [CVE-2024-43369](https://insights.sbomify.com/CVE-2024-43369/): Persistent Cross-site Scripting in Ibexa RichText Field Type (high 7.2)
- [CVE-2024-43368](https://insights.sbomify.com/CVE-2024-43368/): Trix has a Cross-Site Scripting (XSS) vulnerability on copy & paste (medium 6.5)
- [CVE-2024-43367](https://insights.sbomify.com/CVE-2024-43367/): Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects (high 7.5)
- [CVE-2024-43366](https://insights.sbomify.com/CVE-2024-43366/): zkvyper ignored loop range bounds (high 7.5)
- [CVE-2024-43365](https://insights.sbomify.com/CVE-2024-43365/): Stored Cross-site Scripting (XSS) when creating external links in Cacti (medium 5.7)
- [CVE-2024-43364](https://insights.sbomify.com/CVE-2024-43364/): Stored Cross-site Scripting (XSS) when creating external links in Cacti (medium 5.7)
- [CVE-2024-43363](https://insights.sbomify.com/CVE-2024-43363/): Remote code execution via Log Poisoning in Cacti (high 7.2)
- [CVE-2024-43362](https://insights.sbomify.com/CVE-2024-43362/): Stored Cross-site Scripting (XSS) when creating external links in Cacti (high 7.3)
- [CVE-2024-43360](https://insights.sbomify.com/CVE-2024-43360/): ZoneMinder Time-based SQL Injection (critical 9.8)
- [CVE-2024-4336](https://insights.sbomify.com/CVE-2024-4336/): Múltiple vulnerabilities on Adive Framework (high 7.6)
- [CVE-2024-43359](https://insights.sbomify.com/CVE-2024-43359/): XSS vulnerabilities in montagereview (not scored)
- [CVE-2024-43358](https://insights.sbomify.com/CVE-2024-43358/): XSS vulnerability in filter view (medium 6.1)
- [CVE-2024-43357](https://insights.sbomify.com/CVE-2024-43357/): JavaScript specification issue may lead to type confusion and pointer dereference in implementations (high 8.6)
- [CVE-2024-43356](https://insights.sbomify.com/CVE-2024-43356/): WordPress oik plugin <= 4.12.0 - Arbitrary File Deletion vulnerability (medium 4.3)
- [CVE-2024-43355](https://insights.sbomify.com/CVE-2024-43355/): WordPress JoomSport plugin <= 5.3.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43354](https://insights.sbomify.com/CVE-2024-43354/): WordPress myCred plugin <= 2.7.2 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-43353](https://insights.sbomify.com/CVE-2024-43353/): WordPress myCred plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43352](https://insights.sbomify.com/CVE-2024-43352/): WordPress GivingPress Lite theme <= 1.8.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43351](https://insights.sbomify.com/CVE-2024-43351/): WordPress Bravada theme <= 1.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43350](https://insights.sbomify.com/CVE-2024-43350/): WordPress Propovoice CRM plugin <= 1.7.6.4 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2024-4335](https://insights.sbomify.com/CVE-2024-4335/): Rank Math SEO with AI Best SEO Tools <= 1.0.217 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-43349](https://insights.sbomify.com/CVE-2024-43349/): WordPress All Bootstrap Blocks plugin <= 1.3.19 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43348](https://insights.sbomify.com/CVE-2024-43348/): WordPress Purity Of Soul theme <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43347](https://insights.sbomify.com/CVE-2024-43347/): WordPress Button contact VR plugin <= 4.7.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-43346](https://insights.sbomify.com/CVE-2024-43346/): WordPress Modal Window – create popup modal window plugin <= 6.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43345](https://insights.sbomify.com/CVE-2024-43345/): WordPress Landing Page Builder plugin <= 1.5.2.0 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-43344](https://insights.sbomify.com/CVE-2024-43344/): Cross-site scripting in Icegram (medium 6.5)
- [CVE-2024-43343](https://insights.sbomify.com/CVE-2024-43343/): WordPress Order Tracking – WordPress Status Tracking Plugin plugin < 3.3.13 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43342](https://insights.sbomify.com/CVE-2024-43342/): Cross-site scripting in Ultimate Store Kit Elementor Addons (medium 6.5)
- [CVE-2024-43341](https://insights.sbomify.com/CVE-2024-43341/): WordPress Hello Agency theme <= 1.0.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-43340](https://insights.sbomify.com/CVE-2024-43340/): WordPress AFI – The Easiest Integration Plugin plugin <= 1.89.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-4334](https://insights.sbomify.com/CVE-2024-4334/): Cross-site scripting in Supreme Modules Lite – Divi Theme, Extra Theme and Divi Builder (medium 6.4)
- [CVE-2024-43339](https://insights.sbomify.com/CVE-2024-43339/): WordPress WordPress Webinar Plugin – WebinarPress plugin <= 1.33.20 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-43338](https://insights.sbomify.com/CVE-2024-43338/): WordPress Crowdsignal Polls & Ratings plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-43337](https://insights.sbomify.com/CVE-2024-43337/): WordPress Brave plugin <= 0.7.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-43336](https://insights.sbomify.com/CVE-2024-43336/): Cross-site request forgery in WP User Manager (medium 4.3)
- [CVE-2024-43335](https://insights.sbomify.com/CVE-2024-43335/): WordPress Responsive Blocks – WordPress Gutenberg Blocks plugin <= 1.8.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43334](https://insights.sbomify.com/CVE-2024-43334/): WordPress Zilom theme < 1.4.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43333](https://insights.sbomify.com/CVE-2024-43333/): WordPress Admin and Site Enhancements (ASE) Pro Plugin <= 7.6.2.1 - Privilege Escalation vulnerability (high 7.5)
- [CVE-2024-43332](https://insights.sbomify.com/CVE-2024-43332/): WordPress Photo Engine plugin <= 6.4.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43331](https://insights.sbomify.com/CVE-2024-43331/): WordPress WP SMS plugin <= 6.9.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-43330](https://insights.sbomify.com/CVE-2024-43330/): WordPress PowerPack for Beaver Builder plugin < 2.37.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-4333](https://insights.sbomify.com/CVE-2024-4333/): Cross-site scripting in Sina Extension for Elementor (medium 6.4)
- [CVE-2024-43329](https://insights.sbomify.com/CVE-2024-43329/): WordPress Allegiant theme <= 1.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43328](https://insights.sbomify.com/CVE-2024-43328/): WordPress EmbedPress plugin <= 4.0.9 - Local File Inclusion vulnerability (high 8.3)
- [CVE-2024-43327](https://insights.sbomify.com/CVE-2024-43327/): WordPress Invite Anyone plugin <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-43326](https://insights.sbomify.com/CVE-2024-43326/): WordPress Plugin Notes Plus plugin <= 1.2.7 - Arbitrary Content Deletion vulnerability (medium 5.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/283/