# Vulnerabilities published in 2024


- [CVE-2024-39686](https://insights.sbomify.com/CVE-2024-39686/): fishaudio/Bert-VITS2 Command Injection in webui_preprocess.py bert_gen function (critical 9.8)
- [CVE-2024-39685](https://insights.sbomify.com/CVE-2024-39685/): fishaudio/Bert-VITS2 Command Injection in webui_preprocess.py resample function (critical 9.8)
- [CVE-2024-39684](https://insights.sbomify.com/CVE-2024-39684/): Integer overflow in RapidJSON (medium 6.8)
- [CVE-2024-39683](https://insights.sbomify.com/CVE-2024-39683/): ZITADEL Vulnerable to Session Information Leakage (medium 5.7)
- [CVE-2024-39682](https://insights.sbomify.com/CVE-2024-39682/): WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt (medium 6.4)
- [CVE-2024-39681](https://insights.sbomify.com/CVE-2024-39681/): WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All Recipes (medium 5.4)
- [CVE-2024-39680](https://insights.sbomify.com/CVE-2024-39680/): WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save (medium 5.4)
- [CVE-2024-3968](https://insights.sbomify.com/CVE-2024-3968/): Remote Code Execution vulnerability in the iManager (high 7.8)
- [CVE-2024-39679](https://insights.sbomify.com/CVE-2024-39679/): WordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template Reset (medium 4.3)
- [CVE-2024-39678](https://insights.sbomify.com/CVE-2024-39678/): WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDs (medium 4.3)
- [CVE-2024-39677](https://insights.sbomify.com/CVE-2024-39677/): NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities (medium 5.9)
- [CVE-2024-39676](https://insights.sbomify.com/CVE-2024-39676/): Apache Pinot: Unauthorized endpoint exposed sensitive information (high 7.5)
- [CVE-2024-39675](https://insights.sbomify.com/CVE-2024-39675/): Misconfiguration in RUGGEDCOM RMC30 (high 8.7)
- [CVE-2024-39674](https://insights.sbomify.com/CVE-2024-39674/): Information disclosure in EMUI (medium 6.2)
- [CVE-2024-39673](https://insights.sbomify.com/CVE-2024-39673/): Deserialization in EMUI (medium 6.8)
- [CVE-2024-39672](https://insights.sbomify.com/CVE-2024-39672/): Use after free in EMUI (high 8.4)
- [CVE-2024-39671](https://insights.sbomify.com/CVE-2024-39671/): Missing authorization in EMUI (critical 9.3)
- [CVE-2024-39670](https://insights.sbomify.com/CVE-2024-39670/): Privilege escalation in EMUI (medium 6.2)
- [CVE-2024-3967](https://insights.sbomify.com/CVE-2024-3967/): Remote Code Execution vulnerability in the iManager (high 7.6)
- [CVE-2024-39669](https://insights.sbomify.com/CVE-2024-39669/): In the Console in Soffid IAM before 3.5.39, necessary checks were not applied to some Java objects. (critical 9.8)
- [CVE-2024-39668](https://insights.sbomify.com/CVE-2024-39668/): WordPress Extensions for Elementor plugin <= 2.0.31 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-39667](https://insights.sbomify.com/CVE-2024-39667/): WordPress Element Pack Elementor Addons plugin <= 5.6.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-39666](https://insights.sbomify.com/CVE-2024-39666/): WordPress WooCommerce plugin <= 9.1.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-39665](https://insights.sbomify.com/CVE-2024-39665/): WordPress Filter & Grids plugin <= 2.9.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-39664](https://insights.sbomify.com/CVE-2024-39664/): WordPress Filter & Grids plugin <= 2.8.32 - Broken Authentication vulnerability (high 7.3)
- [CVE-2024-39663](https://insights.sbomify.com/CVE-2024-39663/): WordPress WP Fast Total Search plugin <= 1.68.232 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-39662](https://insights.sbomify.com/CVE-2024-39662/): WordPress Black Widgets For Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-39661](https://insights.sbomify.com/CVE-2024-39661/): WordPress Kubio AI Page Builder plugin <= 2.2.4 - Authenticated Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-39660](https://insights.sbomify.com/CVE-2024-39660/): WordPress Photo Engine (Media Organizer & Lightroom) plugin <= 6.3.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3966](https://insights.sbomify.com/CVE-2024-3966/): Pray For Me <= 1.0.4 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-39659](https://insights.sbomify.com/CVE-2024-39659/): WordPress WP-PostRatings plugin <= 1.91.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-39658](https://insights.sbomify.com/CVE-2024-39658/): WordPress Salon Booking System plugin <= 10.7 - Authenticated SQL Injection vulnerability (high 7.6)
- [CVE-2024-39657](https://insights.sbomify.com/CVE-2024-39657/): WordPress Sender plugin <= 2.6.18 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-39656](https://insights.sbomify.com/CVE-2024-39656/): WordPress Tin Canny Reporting for LearnDash plugin <= 4.3.0.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-39655](https://insights.sbomify.com/CVE-2024-39655/): WordPress LiquidPoll plugin <= 3.3.77 - Unauthenticated Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-39654](https://insights.sbomify.com/CVE-2024-39654/): WordPress Sign-up Sheets plugin <= 2.2.12 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-39653](https://insights.sbomify.com/CVE-2024-39653/): WordPress VikRentCar Car Rental Management System plugin <= 1.4.0 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-39652](https://insights.sbomify.com/CVE-2024-39652/): WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-39651](https://insights.sbomify.com/CVE-2024-39651/): WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-39650](https://insights.sbomify.com/CVE-2024-39650/): WordPress WooCommerce PDF Vouchers plugin < 4.9.5 - Unauthenticated Multiple Vulnerabilities (high 7.3)
- [CVE-2024-3965](https://insights.sbomify.com/CVE-2024-3965/): Pray For Me <= 1.0.4 - Settings Update via CSRF (medium 5.4)
- [CVE-2024-39649](https://insights.sbomify.com/CVE-2024-39649/): WordPress Essential Addons for Elementor plugin <= 5.9.26 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-39648](https://insights.sbomify.com/CVE-2024-39648/): WordPress Eventin plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-39647](https://insights.sbomify.com/CVE-2024-39647/): WordPress Message Filter for Contact Form 7 plugin <= 1.6.1.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-39646](https://insights.sbomify.com/CVE-2024-39646/): WordPress Custom 404 Pro plugin <= 3.11.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-39645](https://insights.sbomify.com/CVE-2024-39645/): WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-39644](https://insights.sbomify.com/CVE-2024-39644/): WordPress Black Widgets For Elementor plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-39643](https://insights.sbomify.com/CVE-2024-39643/): WordPress RegistrationMagic plugin <= 6.0.0.1 - Cross Site Scripting (XSS) vulnerability (medium 5.8)
- [CVE-2024-39642](https://insights.sbomify.com/CVE-2024-39642/): WordPress LearnPress plugin <= 4.2.6.8.2 - Insecure Direct Object References (IDOR) vulnerability (medium 6.5)
- [CVE-2024-39641](https://insights.sbomify.com/CVE-2024-39641/): WordPress LearnPress plugin <= 4.2.6.8.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-39640](https://insights.sbomify.com/CVE-2024-39640/): WordPress Social Feed Gallery plugin <= 4.3.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-3964](https://insights.sbomify.com/CVE-2024-3964/): Product Enquiry for WooCommerce < 3.1.8 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-39639](https://insights.sbomify.com/CVE-2024-39639/): WordPress File Upload plugin <= 4.24.7 - Broken Access Control + CSRF vulnerability (medium 4.3)
- [CVE-2024-39638](https://insights.sbomify.com/CVE-2024-39638/): WordPress Registrations for the Events Calendar plugin <= 2.12.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-39637](https://insights.sbomify.com/CVE-2024-39637/): WordPress Edubin theme <= 9.2.0 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2024-39636](https://insights.sbomify.com/CVE-2024-39636/): WordPress Better Find and Replace plugin <= 1.6.1 - PHP Object Injection vulnerability (high 8.3)
- [CVE-2024-39635](https://insights.sbomify.com/CVE-2024-39635/): WordPress Youzify plugin <= 1.2.6 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-39634](https://insights.sbomify.com/CVE-2024-39634/): WordPress PowerPack Pro for Elementor plugin <= 2.10.14 - Contributor+ Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-39633](https://insights.sbomify.com/CVE-2024-39633/): WordPress PowerPack for Beaver Builder plugin <= 2.33.0 - Contributor+ Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-39631](https://insights.sbomify.com/CVE-2024-39631/): WordPress Contest Gallery plugin <= 23.1.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-39630](https://insights.sbomify.com/CVE-2024-39630/): WordPress Timetable and Event Schedule by MotoPress plugin <= 2.4.13 - PHP Object Injection vulnerability (medium 5.5)
- [CVE-2024-3963](https://insights.sbomify.com/CVE-2024-3963/): RafflePress Lite < 1.12.14 - Editor+ Stored XSS (medium 6.5)
- [CVE-2024-39629](https://insights.sbomify.com/CVE-2024-39629/): WordPress Himalayas theme <= 1.3.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-39628](https://insights.sbomify.com/CVE-2024-39628/): WordPress Ninja Forms plugin <= 3.8.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-39627](https://insights.sbomify.com/CVE-2024-39627/): Cross-site scripting in NextGEN Gallery (medium 5.9)
- [CVE-2024-39626](https://insights.sbomify.com/CVE-2024-39626/): WordPress Pretty Simple Popup Builder plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-39625](https://insights.sbomify.com/CVE-2024-39625/): WordPress Icegram Engage plugin <= 3.1.24 - Unauthenticated Message Duplication Vulnerability (medium 5.3)
- [CVE-2024-39624](https://insights.sbomify.com/CVE-2024-39624/): WordPress ListingPro theme <= 2.9.4 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-39623](https://insights.sbomify.com/CVE-2024-39623/): WordPress ListingPro theme <= 2.9.4 - Cross Site Request Forgery (CSRF) to Account Takeover vulnerability (high 8.8)
- [CVE-2024-39622](https://insights.sbomify.com/CVE-2024-39622/): WordPress ListingPro theme <= 2.9.4 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-39621](https://insights.sbomify.com/CVE-2024-39621/): WordPress ListingPro plugin <= 2.9.4 - Local File Inclusion vulnerability (high 8.0)
- [CVE-2024-39620](https://insights.sbomify.com/CVE-2024-39620/): WordPress ListingPro plugin <= 2.9.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-3962](https://insights.sbomify.com/CVE-2024-3962/): Product Addons & Fields for WooCommerce <= 32.0.18 - Unauthenticated Arbitrary File Upload via ppom_upload_file (critical 9.8)
- [CVE-2024-39619](https://insights.sbomify.com/CVE-2024-39619/): WordPress ListingPro plugin <= 2.9.4 - Unauthenticated Local File Inclusion vulnerability (critical 9.0)
- [CVE-2024-39614](https://insights.sbomify.com/CVE-2024-39614/): Django vulnerable to Denial of Service (high 7.5)
- [CVE-2024-39613](https://insights.sbomify.com/CVE-2024-39613/): RCE in desktop app in Windows by local attacker (medium 5.3)
- [CVE-2024-39612](https://insights.sbomify.com/CVE-2024-39612/): Background Task Manager has an out-of-bounds read permission bypass vulnerability (medium 5.5)
- [CVE-2024-39610](https://insights.sbomify.com/CVE-2024-39610/): FitNesse Cross-site scripting (medium 6.1)
- [CVE-2024-3961](https://insights.sbomify.com/CVE-2024-3961/): ConvertKit <= 2.4.9 - Missing Authorization (medium 5.3)
- [CVE-2024-39609](https://insights.sbomify.com/CVE-2024-39609/): Privilege escalation in Intel(R) Server Board M70KLP (high 8.7)
- [CVE-2024-39608](https://insights.sbomify.com/CVE-2024-39608/): Missing authorization in Wavlink AC3000 (critical 10.0)
- [CVE-2024-39607](https://insights.sbomify.com/CVE-2024-39607/): Command injection in WRC-X1500GS-B (medium 6.8)
- [CVE-2024-39606](https://insights.sbomify.com/CVE-2024-39606/): Denial of service in Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software for Windows (medium 6.0)
- [CVE-2024-39605](https://insights.sbomify.com/CVE-2024-39605/): Delta Electronics DIAScreen Stack-based Buffer Overflow (high 8.4)
- [CVE-2024-39604](https://insights.sbomify.com/CVE-2024-39604/): Command injection in Wavlink AC3000 (critical 9.0)
- [CVE-2024-39603](https://insights.sbomify.com/CVE-2024-39603/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39602](https://insights.sbomify.com/CVE-2024-39602/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-39601](https://insights.sbomify.com/CVE-2024-39601/): Missing authorization in CPCI85 Central Processing/Communication (high 7.1)
- [CVE-2024-39600](https://insights.sbomify.com/CVE-2024-39600/): [CVE-2024-39600] Information Disclosure vulnerability in SAP GUI for Windows (medium 5.0)
- [CVE-2024-39599](https://insights.sbomify.com/CVE-2024-39599/): [CVE-2024-39599] Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform (medium 4.7)
- [CVE-2024-39598](https://insights.sbomify.com/CVE-2024-39598/): [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI) (medium 5.0)
- [CVE-2024-39597](https://insights.sbomify.com/CVE-2024-39597/): [CVE-2024-39597] Improper Authorization Checks on Early Login Composable Storefront B2B sites of SAP Commerce (high 7.2)
- [CVE-2024-39596](https://insights.sbomify.com/CVE-2024-39596/): [CVE-2024-39596] Missing Authorization check vulnerability in SAP Enable Now (medium 4.3)
- [CVE-2024-39595](https://insights.sbomify.com/CVE-2024-39595/): Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation (medium 5.4)
- [CVE-2024-39594](https://insights.sbomify.com/CVE-2024-39594/): Cross-site scripting in SAP Business Warehouse - Business Planning and Simulation (medium 6.1)
- [CVE-2024-39593](https://insights.sbomify.com/CVE-2024-39593/): [CVE-2024-39593] Information Disclosure vulnerability in SAP Landscape Management (medium 6.9)
- [CVE-2024-39592](https://insights.sbomify.com/CVE-2024-39592/): [CVE-2024-39592] Missing Authorization check in SAP PDCE (high 7.7)
- [CVE-2024-39591](https://insights.sbomify.com/CVE-2024-39591/): Missing Authorization check in SAP Document Builder (medium 4.3)
- [CVE-2024-39590](https://insights.sbomify.com/CVE-2024-39590/): Null dereference in OpenPLC v3 (high 7.5)
- [CVE-2024-3959](https://insights.sbomify.com/CVE-2024-3959/): Improper Authorization in GitLab (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/311/