# Vulnerabilities published in 2024


- [CVE-2024-43126](https://insights.sbomify.com/CVE-2024-43126/): Cross-site scripting in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce (high 7.1)
- [CVE-2024-43125](https://insights.sbomify.com/CVE-2024-43125/): WordPress WP Table Builder plugin <= 1.4.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43124](https://insights.sbomify.com/CVE-2024-43124/): WordPress Graphina plugin <= 1.8.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43123](https://insights.sbomify.com/CVE-2024-43123/): WordPress Card Elements for Elementor plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-43122](https://insights.sbomify.com/CVE-2024-43122/): WordPress Robin image optimizer plugin <= 1.6.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-43121](https://insights.sbomify.com/CVE-2024-43121/): WordPress HUSKY plugin <= 1.3.6.1 - Privilege Escalation vulnerability (critical 9.1)
- [CVE-2024-43120](https://insights.sbomify.com/CVE-2024-43120/): WordPress TypeSquare Webfonts plugin <= 2.0.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-4312](https://insights.sbomify.com/CVE-2024-4312/): Soccer Engine – Soccer Plugin for WordPress <= 1.12 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-43119](https://insights.sbomify.com/CVE-2024-43119/): WordPress Aruba HiSpeed Cache plugin <= 2.0.12 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43118](https://insights.sbomify.com/CVE-2024-43118/): WordPress Hummingbird plugin <= 3.9.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-43117](https://insights.sbomify.com/CVE-2024-43117/): WordPress Hummingbird plugin <= 3.9.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-43116](https://insights.sbomify.com/CVE-2024-43116/): WordPress Simple Local Avatars plugin <= 2.7.10 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-43115](https://insights.sbomify.com/CVE-2024-43115/): Apache DolphinScheduler: Alert Script Attack (high 8.8)
- [CVE-2024-43114](https://insights.sbomify.com/CVE-2024-43114/): Privilege escalation in TeamCity (high 7.5)
- [CVE-2024-43113](https://insights.sbomify.com/CVE-2024-43113/): Cross-site scripting in Firefox for iOS (medium 6.1)
- [CVE-2024-43112](https://insights.sbomify.com/CVE-2024-43112/): Cross-site scripting in Firefox for iOS (medium 6.1)
- [CVE-2024-43111](https://insights.sbomify.com/CVE-2024-43111/): Cross-site scripting in Firefox for iOS (critical 9.8)
- [CVE-2024-43110](https://insights.sbomify.com/CVE-2024-43110/): Multiple issues in ctl(4) CAM Target Layer (high 8.4)
- [CVE-2024-4311](https://insights.sbomify.com/CVE-2024-4311/): Lack of login attempt rate-limiting in zenml-io/zenml (medium 5.4)
- [CVE-2024-43108](https://insights.sbomify.com/CVE-2024-43108/): goTenna Pro ATAK Plugin Missing Support for Integrity Check (medium 6.0)
- [CVE-2024-43107](https://insights.sbomify.com/CVE-2024-43107/): Security feature bypass in Milestone Integration Plugin (high 7.2)
- [CVE-2024-43106](https://insights.sbomify.com/CVE-2024-43106/): Security feature bypass in Excel (high 7.1)
- [CVE-2024-43105](https://insights.sbomify.com/CVE-2024-43105/): Excessive Resource Consumption via `/export` (medium 4.3)
- [CVE-2024-43102](https://insights.sbomify.com/CVE-2024-43102/): umtx Kernel panic or Use-After-Free (critical 9.8)
- [CVE-2024-43101](https://insights.sbomify.com/CVE-2024-43101/): Missing authorization in Intel(R) Data Center GPU Flex Series for Windows driver software (medium 5.8)
- [CVE-2024-4310](https://insights.sbomify.com/CVE-2024-4310/): Cross-site Scripting (XSS) vulnerability in HubBank (medium 6.3)
- [CVE-2024-43099](https://insights.sbomify.com/CVE-2024-43099/): AutomationDirect DirectLogic H2-DM1E Authentication Bypass by Capture-replay (high 8.7)
- [CVE-2024-43098](https://insights.sbomify.com/CVE-2024-43098/): i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock (medium 5.5)
- [CVE-2024-43097](https://insights.sbomify.com/CVE-2024-43097/): Integer overflow in Android (high 7.8)
- [CVE-2024-43096](https://insights.sbomify.com/CVE-2024-43096/): Memory corruption in Android (high 8.8)
- [CVE-2024-43095](https://insights.sbomify.com/CVE-2024-43095/): Privilege escalation in Android (high 7.8)
- [CVE-2024-43093](https://insights.sbomify.com/CVE-2024-43093/): Android Framework Privilege Escalation (high 7.3, exploited in the wild)
- [CVE-2024-43091](https://insights.sbomify.com/CVE-2024-43091/): Integer overflow in Android (critical 9.8)
- [CVE-2024-43090](https://insights.sbomify.com/CVE-2024-43090/): Missing authorization in Android (medium 5.0)
- [CVE-2024-4309](https://insights.sbomify.com/CVE-2024-4309/): SQL injection vulnerability in HubBank (high 8.1)
- [CVE-2024-43089](https://insights.sbomify.com/CVE-2024-43089/): Missing authorization in Android (high 7.8)
- [CVE-2024-43088](https://insights.sbomify.com/CVE-2024-43088/): Missing authorization in Android (high 8.4)
- [CVE-2024-43087](https://insights.sbomify.com/CVE-2024-43087/): Business logic in Android (high 8.4)
- [CVE-2024-43086](https://insights.sbomify.com/CVE-2024-43086/): Information disclosure in Android (medium 5.5)
- [CVE-2024-43085](https://insights.sbomify.com/CVE-2024-43085/): Security feature bypass in Android (high 7.8)
- [CVE-2024-43084](https://insights.sbomify.com/CVE-2024-43084/): Information disclosure in Android (medium 6.2)
- [CVE-2024-43083](https://insights.sbomify.com/CVE-2024-43083/): Denial of service in Android (medium 6.2)
- [CVE-2024-43082](https://insights.sbomify.com/CVE-2024-43082/): Information disclosure in Android (medium 5.5)
- [CVE-2024-43081](https://insights.sbomify.com/CVE-2024-43081/): Privilege escalation in Android (high 7.8)
- [CVE-2024-43080](https://insights.sbomify.com/CVE-2024-43080/): Deserialization in Android (high 7.8)
- [CVE-2024-4308](https://insights.sbomify.com/CVE-2024-4308/): SQL injection vulnerability in HubBank (high 8.1)
- [CVE-2024-43077](https://insights.sbomify.com/CVE-2024-43077/): Memory corruption in Android (high 7.8)
- [CVE-2024-4307](https://insights.sbomify.com/CVE-2024-4307/): SQL injection vulnerability in HubBank (high 8.1)
- [CVE-2024-43067](https://insights.sbomify.com/CVE-2024-43067/): Time-of-check Time-of-use (TOCTOU) Race Condition in Camera (high 7.8)
- [CVE-2024-43066](https://insights.sbomify.com/CVE-2024-43066/): Use After Free in HLOS (high 7.8)
- [CVE-2024-43065](https://insights.sbomify.com/CVE-2024-43065/): Exposed Dangerous Method or Function in HLOS (high 7.1)
- [CVE-2024-43064](https://insights.sbomify.com/CVE-2024-43064/): Permissions, Privileges, and Access Controls issue in Automotive OS Platform (high 7.5)
- [CVE-2024-43063](https://insights.sbomify.com/CVE-2024-43063/): Buffer Over-read in Automotive Autonomy (medium 6.1)
- [CVE-2024-43062](https://insights.sbomify.com/CVE-2024-43062/): Use After Free in Camera Linux (high 7.8)
- [CVE-2024-43061](https://insights.sbomify.com/CVE-2024-43061/): Use After Free in Audio (high 7.8)
- [CVE-2024-43060](https://insights.sbomify.com/CVE-2024-43060/): Use of Out-of-range Pointer Offset in Automotive Audio (high 7.8)
- [CVE-2024-4306](https://insights.sbomify.com/CVE-2024-4306/): Unrestricted Upload of File with Dangerous Type vulnerability in HubBank (critical 9.9)
- [CVE-2024-43059](https://insights.sbomify.com/CVE-2024-43059/): Use After Free in Automotive Multimedia (high 7.8)
- [CVE-2024-43058](https://insights.sbomify.com/CVE-2024-43058/): Incorrect Type Conversion or Cast in Multimedia Frameworks (high 7.8)
- [CVE-2024-43057](https://insights.sbomify.com/CVE-2024-43057/): Use After Free in MProc (high 7.8)
- [CVE-2024-43056](https://insights.sbomify.com/CVE-2024-43056/): Buffer Over-read in Hypervisor (medium 5.5)
- [CVE-2024-43055](https://insights.sbomify.com/CVE-2024-43055/): Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Camera_Linux (high 7.8)
- [CVE-2024-43053](https://insights.sbomify.com/CVE-2024-43053/): Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host (high 7.8)
- [CVE-2024-43052](https://insights.sbomify.com/CVE-2024-43052/): Improper Input Validation in Video Analytics and Processing (high 7.8)
- [CVE-2024-43051](https://insights.sbomify.com/CVE-2024-43051/): Improper Authorization in SPS-HLOS (medium 5.5)
- [CVE-2024-43050](https://insights.sbomify.com/CVE-2024-43050/): Stack-based Buffer Overflow in WLAN Windows Host (high 7.8)
- [CVE-2024-4305](https://insights.sbomify.com/CVE-2024-4305/): PostX < 4.1.0 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2024-43049](https://insights.sbomify.com/CVE-2024-43049/): Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host (high 7.8)
- [CVE-2024-43048](https://insights.sbomify.com/CVE-2024-43048/): Stack-based Buffer Overflow in Performance (high 7.8)
- [CVE-2024-43047](https://insights.sbomify.com/CVE-2024-43047/): Qualcomm Multiple Chipsets Use-After-Free (high 7.8, exploited in the wild)
- [CVE-2024-43046](https://insights.sbomify.com/CVE-2024-43046/): Information Exposure in TZ Secure OS (medium 5.5)
- [CVE-2024-43045](https://insights.sbomify.com/CVE-2024-43045/): Jenkins does not perform a permission check in an HTTP endpoint (medium 6.3)
- [CVE-2024-43044](https://insights.sbomify.com/CVE-2024-43044/): Jenkins Remoting library arbitrary file read vulnerability (high 8.8)
- [CVE-2024-43042](https://insights.sbomify.com/CVE-2024-43042/): Auth bypass in pluck-cms:pluck (critical 9.8)
- [CVE-2024-43040](https://insights.sbomify.com/CVE-2024-43040/): Renwoxing Enterprise Intelligent Management System before v3.0 was discovered to contain a SQL injection vulnerability via the parid paramet (critical 9.1)
- [CVE-2024-4304](https://insights.sbomify.com/CVE-2024-4304/): Vulnerability on SWAL platform from GT3 Soluciones (medium 5.4)
- [CVE-2024-43035](https://insights.sbomify.com/CVE-2024-43035/): Fonoster is vulnerable to directory traversal (medium 5.8)
- [CVE-2024-43033](https://insights.sbomify.com/CVE-2024-43033/): File upload in jpress:jpress (high 8.8)
- [CVE-2024-43032](https://insights.sbomify.com/CVE-2024-43032/): Auth bypass in autman:autman (medium 4.3)
- [CVE-2024-43031](https://insights.sbomify.com/CVE-2024-43031/): Missing authorization in autman:autman (medium 4.3)
- [CVE-2024-4303](https://insights.sbomify.com/CVE-2024-4303/): ArmorX Android APP - MFA Bypass (high 8.8)
- [CVE-2024-43028](https://insights.sbomify.com/CVE-2024-43028/): Command injection in jeecg:jeecg boot (critical 9.8)
- [CVE-2024-43027](https://insights.sbomify.com/CVE-2024-43027/): Command injection in draytek:vigor2960 firmware (high 8.0)
- [CVE-2024-43025](https://insights.sbomify.com/CVE-2024-43025/): Cross-site scripting in rws:multitrans (medium 6.1)
- [CVE-2024-43024](https://insights.sbomify.com/CVE-2024-43024/): Cross-site scripting in rws:multitrans (medium 6.1)
- [CVE-2024-43022](https://insights.sbomify.com/CVE-2024-43022/): An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a directory traversal. (high 7.5)
- [CVE-2024-4302](https://insights.sbomify.com/CVE-2024-4302/): Super 8 livechat SDK - Cross-site Scripting (medium 6.1)
- [CVE-2024-43018](https://insights.sbomify.com/CVE-2024-43018/): SQL injection in piwigo:piwigo (medium 6.4)
- [CVE-2024-43011](https://insights.sbomify.com/CVE-2024-43011/): Path traversal in zzcms:zzcms (medium 4.9)
- [CVE-2024-4301](https://insights.sbomify.com/CVE-2024-4301/): N-Reporter and N-Cloud from N-Partner - Os Command Injection (high 8.8)
- [CVE-2024-43009](https://insights.sbomify.com/CVE-2024-43009/): Cross-site scripting in zzcms:zzcms (medium 4.7)
- [CVE-2024-43006](https://insights.sbomify.com/CVE-2024-43006/): Cross-site scripting in zzcms:zzcms (medium 5.4)
- [CVE-2024-43005](https://insights.sbomify.com/CVE-2024-43005/): Cross-site scripting in zzcms:zzcms (medium 4.7)
- [CVE-2024-4300](https://insights.sbomify.com/CVE-2024-4300/): E-WEBInformationCo. FS-EZViewer(Web) - Sensitive Data Exposure (critical 9.8)
- [CVE-2024-42995](https://insights.sbomify.com/CVE-2024-42995/): Missing authorization in vtiger:vtiger crm (high 8.3)
- [CVE-2024-42994](https://insights.sbomify.com/CVE-2024-42994/): SQL injection in vtiger:vtiger crm (high 7.2)
- [CVE-2024-42991](https://insights.sbomify.com/CVE-2024-42991/): File upload in mingsoft:mcms (high 8.1)
- [CVE-2024-4299](https://insights.sbomify.com/CVE-2024-4299/): HGiga iSherlock - Command Injection (high 7.2)
- [CVE-2024-42988](https://insights.sbomify.com/CVE-2024-42988/): Lack of access control in ChallengeSolves (/api/v1/challenges/<challenge id>/solves) of CTFd v2.0.0 - v3.7.2 allows authenticated users to r (medium 4.3)
- [CVE-2024-42987](https://insights.sbomify.com/CVE-2024-42987/): Memory corruption in tenda:fh1206 firmware (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/286/