# Vulnerabilities published in 2024


- [CVE-2024-38879](https://insights.sbomify.com/CVE-2024-38879/): Auth bypass in Omnivise T3000 Application Server R9.2 (high 8.7)
- [CVE-2024-38878](https://insights.sbomify.com/CVE-2024-38878/): Path traversal in Omnivise T3000 Application Server R9.2 (medium 6.9)
- [CVE-2024-38877](https://insights.sbomify.com/CVE-2024-38877/): Information disclosure in Omnivise T3000 Application Server R9.2 (high 8.3)
- [CVE-2024-38876](https://insights.sbomify.com/CVE-2024-38876/): Privilege escalation in Omnivise T3000 Application Server R9.2 (high 8.5)
- [CVE-2024-38875](https://insights.sbomify.com/CVE-2024-38875/): Django vulnerable to Denial of Service (high 7.5)
- [CVE-2024-38874](https://insights.sbomify.com/CVE-2024-38874/): events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability (medium 5.4)
- [CVE-2024-38873](https://insights.sbomify.com/CVE-2024-38873/): FriendlyCaptcha Plugin for TYPO3 Captcha Check Bypass (medium 5.3)
- [CVE-2024-38872](https://insights.sbomify.com/CVE-2024-38872/): SQL Injection (high 8.3)
- [CVE-2024-38871](https://insights.sbomify.com/CVE-2024-38871/): SQL Injection (high 8.3)
- [CVE-2024-38870](https://insights.sbomify.com/CVE-2024-38870/): Stored XSS (low 3.5)
- [CVE-2024-3887](https://insights.sbomify.com/CVE-2024-3887/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 5.4)
- [CVE-2024-38869](https://insights.sbomify.com/CVE-2024-38869/): Incorrect Authorization (high 8.3)
- [CVE-2024-38868](https://insights.sbomify.com/CVE-2024-38868/): Incorrect Authorization (high 7.6)
- [CVE-2024-38867](https://insights.sbomify.com/CVE-2024-38867/): Weak cryptography in SIPROTEC 5 6MD84 (CP300) (high 8.2)
- [CVE-2024-38866](https://insights.sbomify.com/CVE-2024-38866/): Livestatus Injection in dynmaps (medium 5.3)
- [CVE-2024-38865](https://insights.sbomify.com/CVE-2024-38865/): Livestatus command injection in RestAPI (medium 6.0)
- [CVE-2024-38864](https://insights.sbomify.com/CVE-2024-38864/): User-Readable Private Key in Windows Agent (medium 4.8)
- [CVE-2024-38863](https://insights.sbomify.com/CVE-2024-38863/): CSRF token leaked in URL parameters (low 2.0)
- [CVE-2024-38862](https://insights.sbomify.com/CVE-2024-38862/): SNMP and IMPI secrets written to audit log (medium 5.1)
- [CVE-2024-38861](https://insights.sbomify.com/CVE-2024-38861/): Lack of TLS validation in plugin MikroTik on Checkmk Exchange (medium 4.9)
- [CVE-2024-38860](https://insights.sbomify.com/CVE-2024-38860/): Reflected links in error message facilitate phishing attacks (medium 5.1)
- [CVE-2024-3886](https://insights.sbomify.com/CVE-2024-3886/): tagDiv Composer <= 5.0 - Reflected Cross-Site Scripting via envato_code[] (medium 6.1)
- [CVE-2024-38859](https://insights.sbomify.com/CVE-2024-38859/): XSS in view page with SLA column (medium 4.8)
- [CVE-2024-38858](https://insights.sbomify.com/CVE-2024-38858/): Cross-site scripting in Robotmk logs view (low 2.3)
- [CVE-2024-38857](https://insights.sbomify.com/CVE-2024-38857/): Reflected links in visuals facilitate phishing attacks (medium 4.3)
- [CVE-2024-38856](https://insights.sbomify.com/CVE-2024-38856/): Apache OFBiz Incorrect Authorization (high 8.1, exploited in the wild)
- [CVE-2024-3885](https://insights.sbomify.com/CVE-2024-3885/): Premium Addons for Elementor <= 4.10.28 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-3884](https://insights.sbomify.com/CVE-2024-3884/): Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded (high 7.5)
- [CVE-2024-38834](https://insights.sbomify.com/CVE-2024-38834/): Stored cross-site scripting vulnerability (CVE-2024-38834) (medium 6.5)
- [CVE-2024-38833](https://insights.sbomify.com/CVE-2024-38833/): Stored cross-site scripting vulnerability (CVE-2024-38833) (medium 6.8)
- [CVE-2024-38832](https://insights.sbomify.com/CVE-2024-38832/): Stored cross-site scripting vulnerability (CVE-2024-38832) (high 7.1)
- [CVE-2024-38831](https://insights.sbomify.com/CVE-2024-38831/): Local privilege escalation vulnerability (CVE-2024-38831) (high 7.8)
- [CVE-2024-38830](https://insights.sbomify.com/CVE-2024-38830/): Local privilege escalation vulnerability (high 7.8)
- [CVE-2024-3883](https://insights.sbomify.com/CVE-2024-3883/): 3D FlipBook <= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL (medium 6.4)
- [CVE-2024-38829](https://insights.sbomify.com/CVE-2024-38829/): Spring LDAP sensitive data exposure for case-sensitive comparisons (low 3.7)
- [CVE-2024-38828](https://insights.sbomify.com/CVE-2024-38828/): CVE-2024-38828: DoS via Spring MVC controller method with byte[] parameter (medium 5.3)
- [CVE-2024-38827](https://insights.sbomify.com/CVE-2024-38827/): Spring Security Authorization Bypass for Case Sensitive Comparisons (medium 4.8)
- [CVE-2024-38826](https://insights.sbomify.com/CVE-2024-38826/): CVE-2024-38826 Cloud Controller Denial of Service Attack (medium 5.3)
- [CVE-2024-38825](https://insights.sbomify.com/CVE-2024-38825/): CVE-2024-38825 Salt Advisory (medium 6.4)
- [CVE-2024-38824](https://insights.sbomify.com/CVE-2024-38824/): CVE-2024-38824 salt advisory (critical 9.6)
- [CVE-2024-38823](https://insights.sbomify.com/CVE-2024-38823/): CVE-2024-38823 Salt Advisory (low 2.7)
- [CVE-2024-38822](https://insights.sbomify.com/CVE-2024-38822/): CVE-2024-38822 Salt Advisory (low 2.7)
- [CVE-2024-38821](https://insights.sbomify.com/CVE-2024-38821/): Authorization Bypass of Static Resources in WebFlux Applications (critical 9.1)
- [CVE-2024-38820](https://insights.sbomify.com/CVE-2024-38820/): CVE-2024-38820: Spring Framework DataBinder Case Sensitive Match Exception (low 3.1)
- [CVE-2024-3882](https://insights.sbomify.com/CVE-2024-3882/): Tenda W30E fromRouteStatic stack-based overflow (high 8.8)
- [CVE-2024-38819](https://insights.sbomify.com/CVE-2024-38819/): Spring Framework Path Traversal vulnerability (high 7.5)
- [CVE-2024-38818](https://insights.sbomify.com/CVE-2024-38818/): Privilege escalation in VMware NSX, VMware Cloud Foundation (medium 6.7)
- [CVE-2024-38817](https://insights.sbomify.com/CVE-2024-38817/): Command injection in VMware NSX, VMware Cloud Foundation (medium 6.7)
- [CVE-2024-38816](https://insights.sbomify.com/CVE-2024-38816/): CVE-2024-38816: Path traversal vulnerability in functional web frameworks (high 7.5)
- [CVE-2024-38815](https://insights.sbomify.com/CVE-2024-38815/): Open redirect in VMware NSX, VMware Cloud Foundation (medium 4.3)
- [CVE-2024-38814](https://insights.sbomify.com/CVE-2024-38814/): SQL injection in VMware HCX (high 8.8)
- [CVE-2024-38813](https://insights.sbomify.com/CVE-2024-38813/): VMware vCenter Server Privilege Escalation (high 7.5, exploited in the wild)
- [CVE-2024-38812](https://insights.sbomify.com/CVE-2024-38812/): VMware vCenter Server Heap-Based Buffer Overflow (critical 9.8, exploited in the wild)
- [CVE-2024-38811](https://insights.sbomify.com/CVE-2024-38811/): Code-execution vulnerability (high 8.8)
- [CVE-2024-38810](https://insights.sbomify.com/CVE-2024-38810/): Missing Authorization When Using @AuthorizeReturnObject (medium 6.5)
- [CVE-2024-3881](https://insights.sbomify.com/CVE-2024-3881/): Tenda W30E frmL7ProtForm frmL7PlotForm stack-based overflow (high 8.8)
- [CVE-2024-38809](https://insights.sbomify.com/CVE-2024-38809/): Spring Framework DoS via conditional HTTP request (medium 5.3)
- [CVE-2024-38808](https://insights.sbomify.com/CVE-2024-38808/): CVE-2024-38808: Spring Expression DoS Vulnerability (medium 4.3)
- [CVE-2024-38807](https://insights.sbomify.com/CVE-2024-38807/): CVE-2024-38807: Signature Forgery Vulnerability in Spring Boot's Loader (medium 6.3)
- [CVE-2024-38806](https://insights.sbomify.com/CVE-2024-38806/): UAA Failure to Remove Shadow User’s Access (low 3.9)
- [CVE-2024-38805](https://insights.sbomify.com/CVE-2024-38805/): iSCSI Remote Memory Corruption and Denial of Service (medium 6.3)
- [CVE-2024-3880](https://insights.sbomify.com/CVE-2024-3880/): Tenda W30E WriteFacMac formWriteFacMac os command injection (medium 6.3)
- [CVE-2024-38798](https://insights.sbomify.com/CVE-2024-38798/): Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege (medium 5.8)
- [CVE-2024-38797](https://insights.sbomify.com/CVE-2024-38797/): Out-of-bounds Read in HashPeImageByType() (medium 4.6)
- [CVE-2024-38796](https://insights.sbomify.com/CVE-2024-38796/): Integer overflow in PeCoffLoaderRelocateImage (medium 5.9)
- [CVE-2024-38795](https://insights.sbomify.com/CVE-2024-38795/): WordPress ListingPro plugin <= 2.9.4 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-38794](https://insights.sbomify.com/CVE-2024-38794/): WordPress Custom Query Blocks plugin <= 5.2.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-38793](https://insights.sbomify.com/CVE-2024-38793/): WordPress Best Restaurant Menu by Pricelisto plugin <= 1.4.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-38792](https://insights.sbomify.com/CVE-2024-38792/): WordPress ConveyThis Translate plugin <= 234 - Non-arbitrary Options Update vulnerability (medium 5.3)
- [CVE-2024-38791](https://insights.sbomify.com/CVE-2024-38791/): WordPress AI ENGINE plugin <= 2.4.7 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-38790](https://insights.sbomify.com/CVE-2024-38790/): WordPress Smartsupp plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2024-3879](https://insights.sbomify.com/CVE-2024-3879/): Tenda W30E setcfm formSetCfm stack-based overflow (high 8.8)
- [CVE-2024-38789](https://insights.sbomify.com/CVE-2024-38789/): WordPress Telegram Bot & Channel plugin <= 3.8.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.3)
- [CVE-2024-38788](https://insights.sbomify.com/CVE-2024-38788/): WordPress UiPress lite plugin <= 3.4.06 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-38787](https://insights.sbomify.com/CVE-2024-38787/): Information disclosure in Import and export users and customers (high 7.5)
- [CVE-2024-38786](https://insights.sbomify.com/CVE-2024-38786/): WordPress CoziPress theme <= 1.0.30 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38785](https://insights.sbomify.com/CVE-2024-38785/): WordPress Gutenverse plugin <= 1.9.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38784](https://insights.sbomify.com/CVE-2024-38784/): WordPress Livemesh Addons for Beaver Builder plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-38783](https://insights.sbomify.com/CVE-2024-38783/): WordPress Arconix FAQ plugin <= 1.9.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-38782](https://insights.sbomify.com/CVE-2024-38782/): WordPress Leaflet Maps Marker plugin <= 3.12.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38781](https://insights.sbomify.com/CVE-2024-38781/): WordPress CopySafe Web Protection plugin <= 3.15 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-38780](https://insights.sbomify.com/CVE-2024-38780/): dma-buf/sw-sync: don't enable IRQ from sync_print_obj() (medium 5.5)
- [CVE-2024-3878](https://insights.sbomify.com/CVE-2024-3878/): Tenda F1202 webExcptypemanFilter fromwebExcptypemanFilter stack-based overflow (high 8.8)
- [CVE-2024-38778](https://insights.sbomify.com/CVE-2024-38778/): WordPress WP Fast Total Search <= 1.69.234 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38777](https://insights.sbomify.com/CVE-2024-38777/): WordPress Titan Anti-spam & Security plugin <= 7.3.6 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-38776](https://insights.sbomify.com/CVE-2024-38776/): WordPress WP GoToWebinar plugin <= 15.7 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-38775](https://insights.sbomify.com/CVE-2024-38775/): WordPress CTX Feed plugin <= 6.5.6 - Arbitrary Options Update vulnerability (high 7.2)
- [CVE-2024-38774](https://insights.sbomify.com/CVE-2024-38774/): WordPress Security Optimizer plugin <= 1.5.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-38773](https://insights.sbomify.com/CVE-2024-38773/): WordPress formlift plugin <= 7.5.17 - Unauthenticated Blind SQL Injection vulnerability (critical 9.3)
- [CVE-2024-38772](https://insights.sbomify.com/CVE-2024-38772/): Path traversal in JetWidgets for Elementor and WooCommerce (medium 6.5)
- [CVE-2024-38771](https://insights.sbomify.com/CVE-2024-38771/): WordPress Atarim plugin <= 4.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-38770](https://insights.sbomify.com/CVE-2024-38770/): Privilege escalation in Backup and Staging by WP Time Capsule (critical 9.8)
- [CVE-2024-3877](https://insights.sbomify.com/CVE-2024-3877/): Tenda F1202 fromqossetting stack-based overflow (high 8.8)
- [CVE-2024-38769](https://insights.sbomify.com/CVE-2024-38769/): WordPress Arconix Shortcodes plugin <= 2.1.11 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-38768](https://insights.sbomify.com/CVE-2024-38768/): WordPress The Pack Elementor addons plugin <= 2.0.8.6 - Local File Inclusion vulnerability (medium 4.3)
- [CVE-2024-38767](https://insights.sbomify.com/CVE-2024-38767/): WordPress BSK PDF Manager plugin <= 3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-38766](https://insights.sbomify.com/CVE-2024-38766/): Cross-site request forgery in Matomo Analytics (medium 4.3)
- [CVE-2024-38765](https://insights.sbomify.com/CVE-2024-38765/): WordPress Oceanic theme <= 1.0.48 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38764](https://insights.sbomify.com/CVE-2024-38764/): WordPress i-transform theme <= 3.0.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-38763](https://insights.sbomify.com/CVE-2024-38763/): WordPress Popularis Verse theme <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/317/