# Vulnerabilities published in 2024


- [CVE-2024-37420](https://insights.sbomify.com/CVE-2024-37420/): WordPress Zita Elementor Site Library plugin <= 1.6.1 - Arbitrary Code Execution vulnerability (critical 9.9)
- [CVE-2024-3742](https://insights.sbomify.com/CVE-2024-3742/): Electrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive Information (high 8.7)
- [CVE-2024-37419](https://insights.sbomify.com/CVE-2024-37419/): WordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-37418](https://insights.sbomify.com/CVE-2024-37418/): WordPress Church Admin plugin <= 4.4.6 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-37417](https://insights.sbomify.com/CVE-2024-37417/): WordPress Coachify theme <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37416](https://insights.sbomify.com/CVE-2024-37416/): WordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37415](https://insights.sbomify.com/CVE-2024-37415/): WordPress E2Pdf plugin <= 1.20.27 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-37414](https://insights.sbomify.com/CVE-2024-37414/): WordPress Depicter Slider plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37413](https://insights.sbomify.com/CVE-2024-37413/): WordPress Preschool and Kindergarten theme <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37412](https://insights.sbomify.com/CVE-2024-37412/): WordPress Blossom Shop theme <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37411](https://insights.sbomify.com/CVE-2024-37411/): WordPress Progress Planner plugin <= 0.9.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37410](https://insights.sbomify.com/CVE-2024-37410/): WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.0.3 - Local File Inclusion vulnerability (medium 4.9)
- [CVE-2024-3741](https://insights.sbomify.com/CVE-2024-3741/): Electrolink FM/DAB/TV Transmitter Authentication Bypass by Assumed-Immutable Data (high 8.7)
- [CVE-2024-37409](https://insights.sbomify.com/CVE-2024-37409/): WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.0.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37408](https://insights.sbomify.com/CVE-2024-37408/): fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pam_fprintd.so" for Sudo. (high 7.3)
- [CVE-2024-37407](https://insights.sbomify.com/CVE-2024-37407/): Memory corruption in libarchive:libarchive (critical 9.1)
- [CVE-2024-37406](https://insights.sbomify.com/CVE-2024-37406/): Other in Android Browser (high 7.5)
- [CVE-2024-37405](https://insights.sbomify.com/CVE-2024-37405/): SQL injection in Rocket.Chat (medium 6.5)
- [CVE-2024-37404](https://insights.sbomify.com/CVE-2024-37404/): Other in Connect Secure (critical 9.1)
- [CVE-2024-37403](https://insights.sbomify.com/CVE-2024-37403/): Path traversal in Docs@Work (medium 5.0)
- [CVE-2024-37401](https://insights.sbomify.com/CVE-2024-37401/): Memory corruption in Connect Secure (high 7.5)
- [CVE-2024-37400](https://insights.sbomify.com/CVE-2024-37400/): Denial of service in Connect Secure (high 7.5)
- [CVE-2024-3740](https://insights.sbomify.com/CVE-2024-3740/): cym1102 nginxWebUI reload exec deserialization (medium 6.3)
- [CVE-2024-37399](https://insights.sbomify.com/CVE-2024-37399/): Null dereference in Avalanche (high 7.5)
- [CVE-2024-37398](https://insights.sbomify.com/CVE-2024-37398/): Privilege escalation in Secure Access Client (high 7.8)
- [CVE-2024-37397](https://insights.sbomify.com/CVE-2024-37397/): XML external entity in EPM (high 8.2)
- [CVE-2024-37396](https://insights.sbomify.com/CVE-2024-37396/): Cross-site scripting in vanderbilt:redcap (medium 5.4)
- [CVE-2024-37395](https://insights.sbomify.com/CVE-2024-37395/): Cross-site scripting in vanderbilt:redcap (medium 5.4)
- [CVE-2024-37394](https://insights.sbomify.com/CVE-2024-37394/): Cross-site scripting in vanderbilt:redcap (medium 5.4)
- [CVE-2024-37393](https://insights.sbomify.com/CVE-2024-37393/): Other in securenvoy:multi-factor authentication solutions (critical 9.8)
- [CVE-2024-37392](https://insights.sbomify.com/CVE-2024-37392/): Cross-site scripting in smseagle:smseagle (medium 6.1)
- [CVE-2024-37391](https://insights.sbomify.com/CVE-2024-37391/): Command injection in proton:protonvpn (high 7.8)
- [CVE-2024-3739](https://insights.sbomify.com/CVE-2024-3739/): cym1102 nginxWebUI upload os command injection (medium 6.3)
- [CVE-2024-37389](https://insights.sbomify.com/CVE-2024-37389/): Apache NiFi: Improper Neutralization of Input in Parameter Context Description (medium 4.6)
- [CVE-2024-37388](https://insights.sbomify.com/CVE-2024-37388/): ebookmeta XML External Entity vulnerability (critical 9.1)
- [CVE-2024-37387](https://insights.sbomify.com/CVE-2024-37387/): Other in Ricoh Streamline NX PC Client (medium 4.0)
- [CVE-2024-37386](https://insights.sbomify.com/CVE-2024-37386/): An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. (medium 4.2)
- [CVE-2024-37385](https://insights.sbomify.com/CVE-2024-37385/): Command injection in roundcube:webmail (critical 9.8)
- [CVE-2024-37384](https://insights.sbomify.com/CVE-2024-37384/): Cross-site scripting in debian:debian linux (medium 6.1)
- [CVE-2024-37383](https://insights.sbomify.com/CVE-2024-37383/): RoundCube Webmail Cross-Site Scripting (XSS) (medium 6.1, exploited in the wild)
- [CVE-2024-37382](https://insights.sbomify.com/CVE-2024-37382/): Code injection in abinitio:authorization gateway (medium 6.3)
- [CVE-2024-37381](https://insights.sbomify.com/CVE-2024-37381/): SQL injection in EPM (high 8.4)
- [CVE-2024-37380](https://insights.sbomify.com/CVE-2024-37380/): Misconfiguration in UniFi U6+ Access Point (medium 5.3)
- [CVE-2024-3738](https://insights.sbomify.com/CVE-2024-3738/): cym1102 nginxWebUI saveCmd handlePath certificate validation (high 7.3)
- [CVE-2024-37377](https://insights.sbomify.com/CVE-2024-37377/): Memory corruption in Connect Secure (high 7.5)
- [CVE-2024-37376](https://insights.sbomify.com/CVE-2024-37376/): SQL injection in EPM (high 7.2)
- [CVE-2024-37373](https://insights.sbomify.com/CVE-2024-37373/): Code injection in Avalanche (high 7.2)
- [CVE-2024-37372](https://insights.sbomify.com/CVE-2024-37372/): Path traversal in Node (low 3.6)
- [CVE-2024-37371](https://insights.sbomify.com/CVE-2024-37371/): Memory corruption in debian:debian linux (critical 9.1)
- [CVE-2024-37370](https://insights.sbomify.com/CVE-2024-37370/): Security feature bypass in mit:kerberos 5 (high 7.5)
- [CVE-2024-3737](https://insights.sbomify.com/CVE-2024-3737/): cym1102 nginxWebUI addOver findCountByQuery path traversal (medium 6.3)
- [CVE-2024-37369](https://insights.sbomify.com/CVE-2024-37369/): Rockwell Automation FactoryTalk® View SE Local Privilege Escalation Vulnerability via Local File Permissions (high 8.5)
- [CVE-2024-37368](https://insights.sbomify.com/CVE-2024-37368/): Rockwell Automation FactoryTalk® View SE v11 Information Leakage Vulnerability via Authentication Restriction (high 8.2)
- [CVE-2024-37367](https://insights.sbomify.com/CVE-2024-37367/): Rockwell Automation FactoryTalk® View SE v12 Information Leakage Vulnerability via Authentication Restriction (high 8.2)
- [CVE-2024-37365](https://insights.sbomify.com/CVE-2024-37365/): FactoryTalk View ME Remote Code Execution Vulnerability via Project Save Path (high 7.0)
- [CVE-2024-37364](https://insights.sbomify.com/CVE-2024-37364/): Ariane Allegro Scenario Player through 2024-03-05, when Ariane Duo kiosk mode is used, allows physically proximate attackers to obtain sensi (medium 6.8)
- [CVE-2024-37363](https://insights.sbomify.com/CVE-2024-37363/): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (medium 6.5)
- [CVE-2024-37362](https://insights.sbomify.com/CVE-2024-37362/): Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials (medium 6.3)
- [CVE-2024-37361](https://insights.sbomify.com/CVE-2024-37361/): Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (critical 9.9)
- [CVE-2024-37360](https://insights.sbomify.com/CVE-2024-37360/): Cross-site scripting in Pentaho Business Analytics Server (medium 4.4)
- [CVE-2024-3736](https://insights.sbomify.com/CVE-2024-3736/): cym1102 nginxWebUI upload unrestricted upload (medium 4.3)
- [CVE-2024-37359](https://insights.sbomify.com/CVE-2024-37359/): Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery (high 8.6)
- [CVE-2024-37358](https://insights.sbomify.com/CVE-2024-37358/): Apache James: denial of service through the use of IMAP literals (high 8.6)
- [CVE-2024-37357](https://insights.sbomify.com/CVE-2024-37357/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-37356](https://insights.sbomify.com/CVE-2024-37356/): tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (medium 5.5)
- [CVE-2024-37355](https://insights.sbomify.com/CVE-2024-37355/): Privilege escalation in Intel(R) Graphics software (high 8.5)
- [CVE-2024-37354](https://insights.sbomify.com/CVE-2024-37354/): btrfs: fix crash on racing fsync and size-extending write into prealloc (high 7.8)
- [CVE-2024-37352](https://insights.sbomify.com/CVE-2024-37352/): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (medium 4.5)
- [CVE-2024-37351](https://insights.sbomify.com/CVE-2024-37351/): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (medium 4.5)
- [CVE-2024-37350](https://insights.sbomify.com/CVE-2024-37350/): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (medium 6.5)
- [CVE-2024-3735](https://insights.sbomify.com/CVE-2024-3735/): Smart Office Main.aspx weak password (medium 6.3)
- [CVE-2024-37349](https://insights.sbomify.com/CVE-2024-37349/): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (medium 4.5)
- [CVE-2024-37348](https://insights.sbomify.com/CVE-2024-37348/): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (medium 4.5)
- [CVE-2024-37347](https://insights.sbomify.com/CVE-2024-37347/): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (medium 4.5)
- [CVE-2024-37346](https://insights.sbomify.com/CVE-2024-37346/): Insufficient input validation vulnerability in the Absolute Secure Access Warehouse prior to 13.06 (medium 4.9)
- [CVE-2024-37345](https://insights.sbomify.com/CVE-2024-37345/): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (medium 5.3)
- [CVE-2024-37344](https://insights.sbomify.com/CVE-2024-37344/): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (medium 4.5)
- [CVE-2024-37343](https://insights.sbomify.com/CVE-2024-37343/): Cross-site scripting vulnerability in the Absolute Secure Access administrative console prior to 13.06 (medium 4.8)
- [CVE-2024-37342](https://insights.sbomify.com/CVE-2024-37342/): Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (high 7.1)
- [CVE-2024-37341](https://insights.sbomify.com/CVE-2024-37341/): Microsoft SQL Server Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2024-37340](https://insights.sbomify.com/CVE-2024-37340/): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-3734](https://insights.sbomify.com/CVE-2024-3734/): FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.8 - Unauthenticated Arbitrary Shortcode Execution (medium 6.5)
- [CVE-2024-37339](https://insights.sbomify.com/CVE-2024-37339/): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37338](https://insights.sbomify.com/CVE-2024-37338/): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37337](https://insights.sbomify.com/CVE-2024-37337/): Microsoft SQL Server Native Scoring Information Disclosure Vulnerability (high 7.1)
- [CVE-2024-37336](https://insights.sbomify.com/CVE-2024-37336/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37335](https://insights.sbomify.com/CVE-2024-37335/): Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37334](https://insights.sbomify.com/CVE-2024-37334/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37333](https://insights.sbomify.com/CVE-2024-37333/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37332](https://insights.sbomify.com/CVE-2024-37332/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37331](https://insights.sbomify.com/CVE-2024-37331/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37330](https://insights.sbomify.com/CVE-2024-37330/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-3733](https://insights.sbomify.com/CVE-2024-3733/): Information disclosure in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 5.3)
- [CVE-2024-37329](https://insights.sbomify.com/CVE-2024-37329/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37328](https://insights.sbomify.com/CVE-2024-37328/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37327](https://insights.sbomify.com/CVE-2024-37327/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37326](https://insights.sbomify.com/CVE-2024-37326/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37325](https://insights.sbomify.com/CVE-2024-37325/): Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability (high 8.1)
- [CVE-2024-37324](https://insights.sbomify.com/CVE-2024-37324/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37323](https://insights.sbomify.com/CVE-2024-37323/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/330/