# Vulnerabilities published in 2024


- [CVE-2024-37966](https://insights.sbomify.com/CVE-2024-37966/): Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (high 7.1)
- [CVE-2024-37965](https://insights.sbomify.com/CVE-2024-37965/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2024-37962](https://insights.sbomify.com/CVE-2024-37962/): WordPress Fusion Page Builder plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37961](https://insights.sbomify.com/CVE-2024-37961/): WordPress codoc plugin <= 0.9.51.12 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37960](https://insights.sbomify.com/CVE-2024-37960/): WordPress CodePen Embedded Pens Shortcode plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3796](https://insights.sbomify.com/CVE-2024-3796/): Cross-site Scripting vulnerability in WBSAirback (medium 4.8)
- [CVE-2024-37959](https://insights.sbomify.com/CVE-2024-37959/): WordPress Power BI Embedded for WordPress plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37958](https://insights.sbomify.com/CVE-2024-37958/): WordPress Meks Smart Author Widget plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37957](https://insights.sbomify.com/CVE-2024-37957/): WordPress Bradmax Player plugin <= 1.1.27 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37956](https://insights.sbomify.com/CVE-2024-37956/): WordPress VK All in One Expansion Unit plugin <= 9.99.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37955](https://insights.sbomify.com/CVE-2024-37955/): WordPress GutSlider – All in One Block Slider plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37954](https://insights.sbomify.com/CVE-2024-37954/): WordPress Simple Responsive Slider plugin <= 0.2.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37953](https://insights.sbomify.com/CVE-2024-37953/): WordPress MBE eShip plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37952](https://insights.sbomify.com/CVE-2024-37952/): WordPress BookYourTravel theme <= 8.18.17 - Subscriber+ Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-37951](https://insights.sbomify.com/CVE-2024-37951/): WordPress Magical Posts Display plugin <= 1.2.38 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37950](https://insights.sbomify.com/CVE-2024-37950/): WordPress Master Popups plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3795](https://insights.sbomify.com/CVE-2024-3795/): Cross-site Scripting vulnerability in WBSAirback (medium 4.8)
- [CVE-2024-37949](https://insights.sbomify.com/CVE-2024-37949/): WordPress Responsive Mobile theme <= 1.15.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37948](https://insights.sbomify.com/CVE-2024-37948/): WordPress Caxton – Create Pro page layouts in Gutenberg plugin <= 1.30.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37947](https://insights.sbomify.com/CVE-2024-37947/): WordPress Tutor LMS plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37946](https://insights.sbomify.com/CVE-2024-37946/): WordPress ReCaptcha Integration for WordPress plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37945](https://insights.sbomify.com/CVE-2024-37945/): WordPress WPBITS Addons For Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37944](https://insights.sbomify.com/CVE-2024-37944/): Cross-site scripting in WP Travel Engine (medium 6.5)
- [CVE-2024-37943](https://insights.sbomify.com/CVE-2024-37943/): WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability (medium 5.8)
- [CVE-2024-37942](https://insights.sbomify.com/CVE-2024-37942/): WordPress BerqWP plugin <= 1.7.5 - Unauthenticated Non-Blind Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2024-37941](https://insights.sbomify.com/CVE-2024-37941/): Cross-site request forgery in Internal Link Juicer: SEO Auto Linker for WordPress (medium 4.3)
- [CVE-2024-37940](https://insights.sbomify.com/CVE-2024-37940/): Cross-site request forgery in Seraphinite Accelerator (Full, premium) (high 7.4)
- [CVE-2024-3794](https://insights.sbomify.com/CVE-2024-3794/): Cross-site Scripting vulnerability in WBSAirback (medium 4.8)
- [CVE-2024-37939](https://insights.sbomify.com/CVE-2024-37939/): WordPress Patricia Lite theme <= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37938](https://insights.sbomify.com/CVE-2024-37938/): WordPress SociallyViral theme <= 1.0.10 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37937](https://insights.sbomify.com/CVE-2024-37937/): WordPress Rara Business theme <= 1.2.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37936](https://insights.sbomify.com/CVE-2024-37936/): WordPress Tabs For WPBakery Page Builder plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37935](https://insights.sbomify.com/CVE-2024-37935/): WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-37934](https://insights.sbomify.com/CVE-2024-37934/): WordPress Ninja Forms plugin <= 3.8.4 - Subscriber+ Arbitrary Shortcode Execution vulnerability (medium 5.4)
- [CVE-2024-37933](https://insights.sbomify.com/CVE-2024-37933/): WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-37932](https://insights.sbomify.com/CVE-2024-37932/): WordPress Woocommerce OpenPos plugin <= 6.4.4 - Unauthenticated Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-37931](https://insights.sbomify.com/CVE-2024-37931/): WordPress Point theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37930](https://insights.sbomify.com/CVE-2024-37930/): WordPress SmartMag theme < 10.1.0 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-3793](https://insights.sbomify.com/CVE-2024-3793/): Cross-site Scripting vulnerability in WBSAirback (medium 4.8)
- [CVE-2024-37929](https://insights.sbomify.com/CVE-2024-37929/): WordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-37928](https://insights.sbomify.com/CVE-2024-37928/): WordPress Jobmonster theme <= 4.7.0 - Unauthenticated Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-37927](https://insights.sbomify.com/CVE-2024-37927/): WordPress Jobmonster theme <= 4.7.5 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-37926](https://insights.sbomify.com/CVE-2024-37926/): WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37925](https://insights.sbomify.com/CVE-2024-37925/): WordPress BuddyBoss Theme theme <= 2.4.61 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-37924](https://insights.sbomify.com/CVE-2024-37924/): Information disclosure in WP2Speed Faster (medium 5.3)
- [CVE-2024-37923](https://insights.sbomify.com/CVE-2024-37923/): WordPress Cliengo – Chatbot plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-37922](https://insights.sbomify.com/CVE-2024-37922/): WordPress Premium Addons for Elementor plugin <= 4.10.34 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37921](https://insights.sbomify.com/CVE-2024-37921/): WordPress Chained Quiz plugin <= 1.3.2.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37920](https://insights.sbomify.com/CVE-2024-37920/): WordPress ARForms Form Builder plugin <= 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-3792](https://insights.sbomify.com/CVE-2024-3792/): Cross-site Scripting vulnerability in WBSAirback (medium 4.8)
- [CVE-2024-37919](https://insights.sbomify.com/CVE-2024-37919/): WordPress Timeline Module for Beaver Builder plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37918](https://insights.sbomify.com/CVE-2024-37918/): WordPress ConeBlog plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37917](https://insights.sbomify.com/CVE-2024-37917/): Denial of service in pexip:pexip infinity (high 7.5)
- [CVE-2024-3791](https://insights.sbomify.com/CVE-2024-3791/): Cross-site Scripting vulnerability in WBSAirback (medium 4.8)
- [CVE-2024-37906](https://insights.sbomify.com/CVE-2024-37906/): Admidio has Blind SQL Injection in ecard_send.php (critical 10.0)
- [CVE-2024-37905](https://insights.sbomify.com/CVE-2024-37905/): Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik (high 8.8)
- [CVE-2024-37904](https://insights.sbomify.com/CVE-2024-37904/): Denial of service from maliciously configured Git repository in Minder (medium 5.7)
- [CVE-2024-37903](https://insights.sbomify.com/CVE-2024-37903/): Mastodon has improper authorship check on audience extension for existing posts (high 8.2)
- [CVE-2024-37902](https://insights.sbomify.com/CVE-2024-37902/): Path thraversal in DeepJavaLibrary (critical 10.0)
- [CVE-2024-37901](https://insights.sbomify.com/CVE-2024-37901/): XWiki Platform vulnerable to remote code execution from account via SearchSuggestConfigSheet (critical 10.0)
- [CVE-2024-37900](https://insights.sbomify.com/CVE-2024-37900/): XWiki Platform vulnerable to Cross-site Scripting through attachment filename in uploader (medium 6.4)
- [CVE-2024-3790](https://insights.sbomify.com/CVE-2024-3790/): Cross-site Scripting vulnerability in WBSAirback (medium 4.8)
- [CVE-2024-37899](https://insights.sbomify.com/CVE-2024-37899/): Disabling a user account changes its author, allowing RCE from user account in XWiki (critical 9.1)
- [CVE-2024-37898](https://insights.sbomify.com/CVE-2024-37898/): XWiki Platform vulnerable to document deletion and overwrite from edit (medium 4.3)
- [CVE-2024-37897](https://insights.sbomify.com/CVE-2024-37897/): Insufficient access control for password reset in sftpgo (medium 5.4)
- [CVE-2024-37896](https://insights.sbomify.com/CVE-2024-37896/): SQL injection vulnerability in Gin-vue-admin (high 8.8)
- [CVE-2024-37895](https://insights.sbomify.com/CVE-2024-37895/): API Key Leak in lobe-chat (medium 5.7)
- [CVE-2024-37894](https://insights.sbomify.com/CVE-2024-37894/): Squid vulnerable to heap corruption in ESI assign (medium 6.3)
- [CVE-2024-37893](https://insights.sbomify.com/CVE-2024-37893/): MFA bypass in oauth flow in Firefly III (medium 5.9)
- [CVE-2024-37891](https://insights.sbomify.com/CVE-2024-37891/): Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3 (medium 4.4)
- [CVE-2024-37890](https://insights.sbomify.com/CVE-2024-37890/): Denial of service when handling a request with many HTTP headers in ws (high 7.5)
- [CVE-2024-3789](https://insights.sbomify.com/CVE-2024-3789/): Uncontrolled Resource Consumption vulnerability in WBSAirback (medium 6.5)
- [CVE-2024-37889](https://insights.sbomify.com/CVE-2024-37889/): MyFinances Allows Unauthorized Access to Other Customer Data (medium 6.5)
- [CVE-2024-37888](https://insights.sbomify.com/CVE-2024-37888/): The Open Link CKEditor plugin has a cross-site scripting (XSS) vulnerability in open link functionality (medium 6.1)
- [CVE-2024-37887](https://insights.sbomify.com/CVE-2024-37887/): Nextcloud Server's events information leaked with shared calendars on recurrence exceptions (low 3.5)
- [CVE-2024-37886](https://insights.sbomify.com/CVE-2024-37886/): Nextcloud user_oidc's ID4me does not validate signature or expiration (medium 5.4)
- [CVE-2024-37885](https://insights.sbomify.com/CVE-2024-37885/): Code injection in Nextcloud Desktop Client for macOS (low 3.8)
- [CVE-2024-37884](https://insights.sbomify.com/CVE-2024-37884/): Nextcloud Server's users can delete old versions of read-only shared files (low 3.5)
- [CVE-2024-37883](https://insights.sbomify.com/CVE-2024-37883/): Nextcloud Deck can access comments and attachments of deleted cards (medium 4.3)
- [CVE-2024-37882](https://insights.sbomify.com/CVE-2024-37882/): Nextcloud Server can reshare read&share only folder with more permissions (high 8.1)
- [CVE-2024-37881](https://insights.sbomify.com/CVE-2024-37881/): Open redirect in SiteGuard WP Plugin (medium 5.3)
- [CVE-2024-37880](https://insights.sbomify.com/CVE-2024-37880/): Weak cryptography in pq-crystals:kyber (high 7.5)
- [CVE-2024-3788](https://insights.sbomify.com/CVE-2024-3788/): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (medium 6.6)
- [CVE-2024-37879](https://insights.sbomify.com/CVE-2024-37879/): Improper input validation in /admin/config/save in User-friendly SVN (USVN) before v1.0.12 and below allows administrators to execute arbitr (medium 4.8)
- [CVE-2024-37878](https://insights.sbomify.com/CVE-2024-37878/): Cross-site scripting in twcms:twcms (medium 6.1)
- [CVE-2024-37877](https://insights.sbomify.com/CVE-2024-37877/): UERANSIM before 3.2.6 allows out-of-bounds read when a RLS packet is sent to gNodeB with malformed PDU length. (medium 5.5)
- [CVE-2024-37873](https://insights.sbomify.com/CVE-2024-37873/): SQL injection in itsourcecode:payroll management system project in php with source code (critical 9.1)
- [CVE-2024-37872](https://insights.sbomify.com/CVE-2024-37872/): SQL injection in angeljudesuarez:billing system (high 8.1)
- [CVE-2024-37871](https://insights.sbomify.com/CVE-2024-37871/): SQL injection in emiloi:online discussion forum (high 8.2)
- [CVE-2024-37870](https://insights.sbomify.com/CVE-2024-37870/): SQL injection in itsourcecode:learning management system (critical 9.8)
- [CVE-2024-3787](https://insights.sbomify.com/CVE-2024-3787/): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (medium 6.6)
- [CVE-2024-37869](https://insights.sbomify.com/CVE-2024-37869/): File upload in emiloimagtolis:online discussion forum (high 8.8)
- [CVE-2024-37868](https://insights.sbomify.com/CVE-2024-37868/): File upload in emiloimagtolis:online discussion forum (high 8.8)
- [CVE-2024-37865](https://insights.sbomify.com/CVE-2024-37865/): Weak cryptography in s3browser:s3 browser (medium 5.9)
- [CVE-2024-37863](https://insights.sbomify.com/CVE-2024-37863/): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. (critical 9.8)
- [CVE-2024-37862](https://insights.sbomify.com/CVE-2024-37862/): Buffer Overflow vulnerability in Open Robotic Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local a (high 7.3)
- [CVE-2024-37861](https://insights.sbomify.com/CVE-2024-37861/): Open Robotics Robotic Operating System 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_amcl process. (critical 9.8)
- [CVE-2024-37860](https://insights.sbomify.com/CVE-2024-37860/): Buffer Overflow vulnerability in Open Robotic Operating System 2 ROS2 navigation2- ROS2-humble&& navigation2-humble allows a local attacker (high 7.3)
- [CVE-2024-3786](https://insights.sbomify.com/CVE-2024-3786/): Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback (medium 6.6)
- [CVE-2024-37859](https://insights.sbomify.com/CVE-2024-37859/): Cross-site scripting in oretnom23:lost and found information system (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/326/