# Vulnerabilities published in 2024


- [CVE-2024-37643](https://insights.sbomify.com/CVE-2024-37643/): Memory corruption in trendnet:tew-814dap firmware (high 8.8)
- [CVE-2024-37642](https://insights.sbomify.com/CVE-2024-37642/): Command injection in trendnet:tew-814dap firmware (critical 9.1)
- [CVE-2024-37641](https://insights.sbomify.com/CVE-2024-37641/): Memory corruption in trendnet:tew-814dap firmware (high 8.8)
- [CVE-2024-37640](https://insights.sbomify.com/CVE-2024-37640/): Memory corruption in totolink:a3700r firmware (high 8.8)
- [CVE-2024-3764](https://insights.sbomify.com/CVE-2024-3764/): Tuya SDK MQTT Packet denial of service (low 2.7)
- [CVE-2024-37639](https://insights.sbomify.com/CVE-2024-37639/): Memory corruption in totolink:a3700r firmware (high 8.8)
- [CVE-2024-37637](https://insights.sbomify.com/CVE-2024-37637/): Memory corruption in totolink:a3700r firmware (critical 9.8)
- [CVE-2024-37635](https://insights.sbomify.com/CVE-2024-37635/): Memory corruption in totolink:a3700r firmware (critical 9.8)
- [CVE-2024-37634](https://insights.sbomify.com/CVE-2024-37634/): Memory corruption in totolink:a3700r firmware (critical 9.8)
- [CVE-2024-37633](https://insights.sbomify.com/CVE-2024-37633/): Memory corruption in totolink:a3700r firmware (high 8.8)
- [CVE-2024-37632](https://insights.sbomify.com/CVE-2024-37632/): Memory corruption in totolink:a3700r firmware (medium 6.5)
- [CVE-2024-37631](https://insights.sbomify.com/CVE-2024-37631/): Memory corruption in totolink:a3700r firmware (high 8.8)
- [CVE-2024-37630](https://insights.sbomify.com/CVE-2024-37630/): Hardcoded credentials in dlink:dir-605l firmware (high 8.8)
- [CVE-2024-3763](https://insights.sbomify.com/CVE-2024-3763/): Emlog Pro Post Tag tag.php cross site scripting (low 2.4)
- [CVE-2024-37629](https://insights.sbomify.com/CVE-2024-37629/): SummerNote Cross Site Scripting Vulnerability (medium 6.1)
- [CVE-2024-37626](https://insights.sbomify.com/CVE-2024-37626/): Command injection in totolink:a6000r firmware (high 8.8)
- [CVE-2024-37625](https://insights.sbomify.com/CVE-2024-37625/): Cross-site scripting in zhimengzhel:ibarn (medium 6.3)
- [CVE-2024-37624](https://insights.sbomify.com/CVE-2024-37624/): Cross-site scripting in rockoa:xinhu (medium 6.1)
- [CVE-2024-37623](https://insights.sbomify.com/CVE-2024-37623/): Cross-site scripting in rockoa:xinhu (medium 6.1)
- [CVE-2024-37622](https://insights.sbomify.com/CVE-2024-37622/): Cross-site scripting in rockoa:xinhu (medium 6.1)
- [CVE-2024-37621](https://insights.sbomify.com/CVE-2024-37621/): Code injection in strongshop:strongshop (high 7.2)
- [CVE-2024-37620](https://insights.sbomify.com/CVE-2024-37620/): PHPVOD v4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /view/admin/view.php. (medium 6.1)
- [CVE-2024-3762](https://insights.sbomify.com/CVE-2024-3762/): Emlog Pro Whisper Page twitter.php cross site scripting (low 2.4)
- [CVE-2024-37619](https://insights.sbomify.com/CVE-2024-37619/): Cross-site scripting in strongshop:strongshop (high 7.6)
- [CVE-2024-3761](https://insights.sbomify.com/CVE-2024-3761/): Missing Authorization on Delete Datasets in lunary-ai/lunary (critical 9.1)
- [CVE-2024-37607](https://insights.sbomify.com/CVE-2024-37607/): Memory corruption in dlink:dap-2555 firmware (medium 6.5)
- [CVE-2024-37606](https://insights.sbomify.com/CVE-2024-37606/): Memory corruption in dlink:dcs-932l firmware (medium 6.5)
- [CVE-2024-37605](https://insights.sbomify.com/CVE-2024-37605/): Null dereference in dlink:dir-860l firmware (medium 6.5)
- [CVE-2024-37603](https://insights.sbomify.com/CVE-2024-37603/): Memory corruption in mercedes-benz:headunit ntg6 mercedes-benz user experience (medium 4.6)
- [CVE-2024-37602](https://insights.sbomify.com/CVE-2024-37602/): Null dereference in mercedes-benz:headunit ntg6 mercedes-benz user experience (medium 4.6)
- [CVE-2024-37601](https://insights.sbomify.com/CVE-2024-37601/): Memory corruption in mercedes-benz:headunit ntg6 mercedes-benz user experience (medium 4.6)
- [CVE-2024-37600](https://insights.sbomify.com/CVE-2024-37600/): Memory corruption in mercedes-benz:headunit ntg6 mercedes-benz user experience (medium 6.8)
- [CVE-2024-3760](https://insights.sbomify.com/CVE-2024-3760/): Email Bombing Vulnerability in lunary-ai/lunary (high 7.5)
- [CVE-2024-3759](https://insights.sbomify.com/CVE-2024-3759/): Hmdfs has a use after free vulnerability (medium 6.5)
- [CVE-2024-3758](https://insights.sbomify.com/CVE-2024-3758/): Hmdfs has a heap buffer overflow vulnerability (medium 6.5)
- [CVE-2024-37575](https://insights.sbomify.com/CVE-2024-37575/): The Mister org.mistergroup.shouldianswer application 1.4.264 for Android enables any installed application (with no permissions) to place ph (high 7.5)
- [CVE-2024-37574](https://insights.sbomify.com/CVE-2024-37574/): The GriceMobile com.grice.call application 4.5.2 for Android enables any installed application (with no permissions) to place phone calls wi (high 8.2)
- [CVE-2024-37573](https://insights.sbomify.com/CVE-2024-37573/): The Talkatone com.talkatone.android application 8.4.6 for Android enables any installed application (with no permissions) to place phone cal (high 8.4)
- [CVE-2024-37571](https://insights.sbomify.com/CVE-2024-37571/): Buffer Overflow vulnerability in SAS Broker 9.2 build 1495 allows attackers to cause denial of service or obtain sensitive information via c (medium 4.3)
- [CVE-2024-37570](https://insights.sbomify.com/CVE-2024-37570/): Command injection in mitel:6869i sip firmware (high 8.8)
- [CVE-2024-3757](https://insights.sbomify.com/CVE-2024-3757/): Arkcompiler runtime has an integer overflow vulnerability (low 3.3)
- [CVE-2024-37569](https://insights.sbomify.com/CVE-2024-37569/): Command injection in mitel:6869i sip firmware (high 8.3)
- [CVE-2024-37568](https://insights.sbomify.com/CVE-2024-37568/): Authlib has algorithm confusion with asymmetric public keys (high 7.5)
- [CVE-2024-37567](https://insights.sbomify.com/CVE-2024-37567/): Missing authorization in infoblox:nios (critical 9.1)
- [CVE-2024-37566](https://insights.sbomify.com/CVE-2024-37566/): Auth bypass in infoblox:nios (critical 9.8)
- [CVE-2024-37565](https://insights.sbomify.com/CVE-2024-37565/): WordPress Gum Elementor Addon plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37564](https://insights.sbomify.com/CVE-2024-37564/): WordPress PayPlus Payment Gateway plugin <= 7.0.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-37563](https://insights.sbomify.com/CVE-2024-37563/): WordPress TOCHAT.BE plugin <= 1.3.0 - Unauthenticated Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37562](https://insights.sbomify.com/CVE-2024-37562/): WordPress Simple Post Notes plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37561](https://insights.sbomify.com/CVE-2024-37561/): WordPress Plugin Notes Plus plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37560](https://insights.sbomify.com/CVE-2024-37560/): WordPress WP User Switch plugin <= 1.1.0 - Privilege Escalation vulnerability (high 8.0)
- [CVE-2024-3756](https://insights.sbomify.com/CVE-2024-3756/): MF Gig Calendar <= 1.2.1 - Arbitrary Event Deletion via CSRF (high 7.5)
- [CVE-2024-37559](https://insights.sbomify.com/CVE-2024-37559/): WordPress counterpoint theme <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37558](https://insights.sbomify.com/CVE-2024-37558/): WordPress WPFavicon plugin <= 2.1.1 - Cross-Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37557](https://insights.sbomify.com/CVE-2024-37557/): WordPress WP Cookie Law Info plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37556](https://insights.sbomify.com/CVE-2024-37556/): WordPress WordPress Notification Bar plugin <= 1.3.10 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37555](https://insights.sbomify.com/CVE-2024-37555/): WordPress Generate PDF using Contact Form 7 plugin <= 4.1.2 - CSRF to Arbitrary File Upload vulnerability (critical 9.6)
- [CVE-2024-37554](https://insights.sbomify.com/CVE-2024-37554/): WordPress UltraAddons plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37553](https://insights.sbomify.com/CVE-2024-37553/): WordPress Testimonials Widget plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37552](https://insights.sbomify.com/CVE-2024-37552/): WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37551](https://insights.sbomify.com/CVE-2024-37551/): WordPress Simple Social Share plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37550](https://insights.sbomify.com/CVE-2024-37550/): WordPress Template Kit – Export plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3755](https://insights.sbomify.com/CVE-2024-3755/): MF Gig Calendar <= 1.2.1 - Editor+ Stored XSS (medium 5.4)
- [CVE-2024-37549](https://insights.sbomify.com/CVE-2024-37549/): WordPress Save as PDF plugin by Pdfcrowd plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37548](https://insights.sbomify.com/CVE-2024-37548/): WordPress Meks Easy Ads Widget plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37547](https://insights.sbomify.com/CVE-2024-37547/): WordPress Elementor Addons by Livemesh plugin <= 8.4.0 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-37546](https://insights.sbomify.com/CVE-2024-37546/): Cross-site scripting in Image Hover Effects - Caption Hover with Carousel (medium 6.5)
- [CVE-2024-37545](https://insights.sbomify.com/CVE-2024-37545/): WordPress Floating Social Media Links plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37544](https://insights.sbomify.com/CVE-2024-37544/): WordPress Get Better Reviews for WooCommerce plugin <= 4.0.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37543](https://insights.sbomify.com/CVE-2024-37543/): WordPress Ultimate Auction plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37542](https://insights.sbomify.com/CVE-2024-37542/): WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-37541](https://insights.sbomify.com/CVE-2024-37541/): WordPress Elementor Addons, Widgets and Enhancements – Stax plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37540](https://insights.sbomify.com/CVE-2024-37540/): WordPress Leaky Paywall plugin <= 4.21.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3754](https://insights.sbomify.com/CVE-2024-3754/): Alemha Watermarker <= 1.3.1 - Author+ Stored XSS (medium 4.7)
- [CVE-2024-37539](https://insights.sbomify.com/CVE-2024-37539/): WordPress WP To Do plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37538](https://insights.sbomify.com/CVE-2024-37538/): WordPress Link To Bible plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37537](https://insights.sbomify.com/CVE-2024-37537/): WordPress WS Contact Form plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37536](https://insights.sbomify.com/CVE-2024-37536/): WordPress Easy Custom Code (LESS/CSS/JS) Plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37535](https://insights.sbomify.com/CVE-2024-37535/): GNOME VTE before 0.76.3 allows an attacker to cause a denial of service (memory consumption) via a window resize escape sequence, a related (medium 4.4)
- [CVE-2024-37533](https://insights.sbomify.com/CVE-2024-37533/): IBM InfoSphere Information Server information disclosure (low 2.4)
- [CVE-2024-37532](https://insights.sbomify.com/CVE-2024-37532/): IBM WebSphere Application Server identity spoofing (high 8.8)
- [CVE-2024-3753](https://insights.sbomify.com/CVE-2024-3753/): Hostel < 1.1.5.3 - Reflected XSS (medium 5.9)
- [CVE-2024-37529](https://insights.sbomify.com/CVE-2024-37529/): IBM Db2 denial of service (medium 6.5)
- [CVE-2024-37528](https://insights.sbomify.com/CVE-2024-37528/): IBM Cloud Pak for Business Automation cross-site scripting (medium 4.8)
- [CVE-2024-37527](https://insights.sbomify.com/CVE-2024-37527/): IBM OpenPages with Watson cross-site scripting (medium 5.4)
- [CVE-2024-37526](https://insights.sbomify.com/CVE-2024-37526/): IBM Watson Query on Cloud Pak for Data information disclosure (medium 6.5)
- [CVE-2024-37524](https://insights.sbomify.com/CVE-2024-37524/): IBM Analytics Content Hub information disclosure (medium 5.3)
- [CVE-2024-37523](https://insights.sbomify.com/CVE-2024-37523/): WordPress Login Logo Editor plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37522](https://insights.sbomify.com/CVE-2024-37522/): WordPress CC & BCC for Woocommerce Order Emails plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37521](https://insights.sbomify.com/CVE-2024-37521/): WordPress zBench theme <= 1.4.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37520](https://insights.sbomify.com/CVE-2024-37520/): WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 2.1.12 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-3752](https://insights.sbomify.com/CVE-2024-3752/): Crelly Slider <= 1.4.5 - Admin+ Stored XSS (medium 5.4)
- [CVE-2024-37519](https://insights.sbomify.com/CVE-2024-37519/): WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.1.27 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37518](https://insights.sbomify.com/CVE-2024-37518/): WordPress The Events Calendar plugin <= 6.5.1.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37517](https://insights.sbomify.com/CVE-2024-37517/): WordPress Spectra plugin <= 2.13.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37516](https://insights.sbomify.com/CVE-2024-37516/): WordPress Featured Image from URL (FIFU) plugin <= 4.8.2 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-37515](https://insights.sbomify.com/CVE-2024-37515/): Cross-site scripting in XPlainer - WooCommerce Product FAQ (medium 5.8)
- [CVE-2024-37514](https://insights.sbomify.com/CVE-2024-37514/): WordPress CopySafe Web Protection plugin <= 3.14 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37513](https://insights.sbomify.com/CVE-2024-37513/): WordPress WPCafe plugin <= 2.2.27 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-37512](https://insights.sbomify.com/CVE-2024-37512/): WordPress NEX-Forms – Ultimate Form Builder plugin <= 8.5.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/328/