# Vulnerabilities published in 2024


- [CVE-2024-37322](https://insights.sbomify.com/CVE-2024-37322/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37321](https://insights.sbomify.com/CVE-2024-37321/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37320](https://insights.sbomify.com/CVE-2024-37320/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-3732](https://insights.sbomify.com/CVE-2024-3732/): Cross-site scripting in GeoDirectory – WP Business Directory Plugin and Classified Listings Directory (medium 6.4)
- [CVE-2024-37319](https://insights.sbomify.com/CVE-2024-37319/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37318](https://insights.sbomify.com/CVE-2024-37318/): SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-37317](https://insights.sbomify.com/CVE-2024-37317/): Nextcloud Notes app can be tricked into using a received share created before the user logged in (medium 4.6)
- [CVE-2024-37316](https://insights.sbomify.com/CVE-2024-37316/): Nextcloud Calendar's event create can create attachments that link to other websites (medium 4.6)
- [CVE-2024-37315](https://insights.sbomify.com/CVE-2024-37315/): Nextcloud Server's read-only users can restore old versions (low 3.5)
- [CVE-2024-37314](https://insights.sbomify.com/CVE-2024-37314/): Nextcloud Photos' shared albums have no restriction on photo removal (low 3.5)
- [CVE-2024-37313](https://insights.sbomify.com/CVE-2024-37313/): Nextcloud server allows the by-pass the second factor (high 7.3)
- [CVE-2024-37312](https://insights.sbomify.com/CVE-2024-37312/): Nextcloud user_oidc app's ID4me feature is available even when disabled (medium 6.3)
- [CVE-2024-37311](https://insights.sbomify.com/CVE-2024-37311/): Collabora Online's remote host TLS certificates are not fully verified (high 8.2)
- [CVE-2024-37310](https://insights.sbomify.com/CVE-2024-37310/): EVerest has an integer overflow in the "v2g_incoming_v2gtp" function (critical 9.1)
- [CVE-2024-3731](https://insights.sbomify.com/CVE-2024-3731/): Customer Reviews for WooCommerce <= 5.47.0 - Reflected Cross-Site Scripting via 's' (medium 6.1)
- [CVE-2024-37309](https://insights.sbomify.com/CVE-2024-37309/): Client initialized Session-Renegotiation DoS (medium 5.3)
- [CVE-2024-37308](https://insights.sbomify.com/CVE-2024-37308/): WordPress Cooked Plugin - Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability (medium 5.4)
- [CVE-2024-37307](https://insights.sbomify.com/CVE-2024-37307/): Cilium leaks sensitive information in cilium-bugtool (high 7.9)
- [CVE-2024-37306](https://insights.sbomify.com/CVE-2024-37306/): CVAT's export and backup-related API endpoints are susceptible to CSRF (high 7.1)
- [CVE-2024-37305](https://insights.sbomify.com/CVE-2024-37305/): Buffer overflow in deserialization in oqs-provider (high 8.2)
- [CVE-2024-37304](https://insights.sbomify.com/CVE-2024-37304/): NuGetGallery's Markdown Autolinks Processing Vulnerable to Cross-site Scripting (medium 6.1)
- [CVE-2024-37303](https://insights.sbomify.com/CVE-2024-37303/): Synapse unauthenticated writes to the media repository allow planting of problematic content (medium 5.3)
- [CVE-2024-37302](https://insights.sbomify.com/CVE-2024-37302/): Synapse denial of service through media disk space consumption (high 7.5)
- [CVE-2024-37301](https://insights.sbomify.com/CVE-2024-37301/): document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection (high 7.2)
- [CVE-2024-37300](https://insights.sbomify.com/CVE-2024-37300/): Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0 (high 8.1)
- [CVE-2024-3730](https://insights.sbomify.com/CVE-2024-3730/): Simple Membership <= 4.4.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 5.4)
- [CVE-2024-37299](https://insights.sbomify.com/CVE-2024-37299/): Discourse vulnerable to DoS via Tag Group (medium 4.9)
- [CVE-2024-37298](https://insights.sbomify.com/CVE-2024-37298/): Potential memory exhaustion attack due to sparse slice deserialization (high 7.5)
- [CVE-2024-37297](https://insights.sbomify.com/CVE-2024-37297/): WooCommerce has a Cross-Site Scripting Vulnerability in checkout & registration forms (medium 5.4)
- [CVE-2024-37296](https://insights.sbomify.com/CVE-2024-37296/): Aimeos HTML client vulnerable to digital products download without proper payment status check (medium 5.3)
- [CVE-2024-37295](https://insights.sbomify.com/CVE-2024-37295/): Aimeos Core remote code execution in web server context (high 7.2)
- [CVE-2024-37294](https://insights.sbomify.com/CVE-2024-37294/): Aimeos denial of service vulnerability in SaaS and marketplace setups (medium 5.5)
- [CVE-2024-37293](https://insights.sbomify.com/CVE-2024-37293/): aws-deployment-framework's potential risk can lead to privilege escalation (high 7.6)
- [CVE-2024-3729](https://insights.sbomify.com/CVE-2024-3729/): Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation (critical 9.8)
- [CVE-2024-37289](https://insights.sbomify.com/CVE-2024-37289/): Privilege escalation in Trend Micro Apex One (high 7.8)
- [CVE-2024-37288](https://insights.sbomify.com/CVE-2024-37288/): Deserialization in Kibana (critical 9.9)
- [CVE-2024-37287](https://insights.sbomify.com/CVE-2024-37287/): Kibana arbitrary code execution via prototype pollution (critical 9.1)
- [CVE-2024-37286](https://insights.sbomify.com/CVE-2024-37286/): APM Server Insertion of Sensitive Information into Log File (medium 5.7)
- [CVE-2024-37285](https://insights.sbomify.com/CVE-2024-37285/): Kibana arbitrary code execution via YAML deserialization (critical 9.1)
- [CVE-2024-37284](https://insights.sbomify.com/CVE-2024-37284/): Elastic Defend Improper Handling of Alternate Encoding Leads to Crash (medium 5.5)
- [CVE-2024-37283](https://insights.sbomify.com/CVE-2024-37283/): Elastic Agent Insertion of Sensitive Information into Log File (medium 6.5)
- [CVE-2024-37282](https://insights.sbomify.com/CVE-2024-37282/): Privilege escalation in Elastic Cloud Enterprise (high 8.1)
- [CVE-2024-37281](https://insights.sbomify.com/CVE-2024-37281/): Kibana Denial of Service issue (medium 6.5)
- [CVE-2024-37280](https://insights.sbomify.com/CVE-2024-37280/): Elasticsearch StackOverflow vulnerability (medium 4.9)
- [CVE-2024-3728](https://insights.sbomify.com/CVE-2024-3728/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-37279](https://insights.sbomify.com/CVE-2024-37279/): Kibana Broken Access Control issue (medium 4.3)
- [CVE-2024-37278](https://insights.sbomify.com/CVE-2024-37278/): WordPress Cards for Beaver Builder plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37277](https://insights.sbomify.com/CVE-2024-37277/): WordPress Paid Memberships Pro plugin <= 3.0.4 - Insecure Direct Object References (IDOR) vulnerability (high 7.5)
- [CVE-2024-37276](https://insights.sbomify.com/CVE-2024-37276/): WordPress Featured Image from URL (FIFU) plugin <= 4.8.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37275](https://insights.sbomify.com/CVE-2024-37275/): WordPress NextScripts plugin <= 4.4.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37274](https://insights.sbomify.com/CVE-2024-37274/): WordPress WP Mobile Menu plugin <= 2.8.4.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37273](https://insights.sbomify.com/CVE-2024-37273/): Jan path traversal vulnerability (critical 9.8)
- [CVE-2024-37272](https://insights.sbomify.com/CVE-2024-37272/): WordPress Travel Monster theme <= 1.1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37271](https://insights.sbomify.com/CVE-2024-37271/): WordPress Print My Blog plugin <= 3.27.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37270](https://insights.sbomify.com/CVE-2024-37270/): WordPress TrustedLogin Vendor plugin < 1.1.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-3727](https://insights.sbomify.com/CVE-2024-3727/): Containers/image: digest type does not guarantee valid type (high 8.3)
- [CVE-2024-37269](https://insights.sbomify.com/CVE-2024-37269/): WordPress Masterstudy Elementor Widgets plugin <= 1.2.2 - Unauthenticated Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37268](https://insights.sbomify.com/CVE-2024-37268/): WordPress Striking theme <= 2.3.4 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-37267](https://insights.sbomify.com/CVE-2024-37267/): WordPress Striking theme <= 2.3.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37266](https://insights.sbomify.com/CVE-2024-37266/): WordPress Tutor LMS plugin <= 2.7.1 - Path Traversal vulnerability (medium 4.9)
- [CVE-2024-37265](https://insights.sbomify.com/CVE-2024-37265/): WordPress IdeaPush plugin <= 8.60 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37264](https://insights.sbomify.com/CVE-2024-37264/): WordPress Groundhogg plugin <= 3.4.2.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37263](https://insights.sbomify.com/CVE-2024-37263/): Cross-site scripting in Enter Addons (medium 6.5)
- [CVE-2024-37262](https://insights.sbomify.com/CVE-2024-37262/): WordPress Online Booking & Scheduling Calendar plugin <= 4.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37261](https://insights.sbomify.com/CVE-2024-37261/): WordPress WP-Lister Lite for Amazon plugin <= 2.6.16 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37260](https://insights.sbomify.com/CVE-2024-37260/): WordPress Foxiz Theme theme <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability (high 7.2)
- [CVE-2024-3726](https://insights.sbomify.com/CVE-2024-3726/): Cross-site scripting in Login Logout Register Menu (medium 6.4)
- [CVE-2024-37259](https://insights.sbomify.com/CVE-2024-37259/): WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37258](https://insights.sbomify.com/CVE-2024-37258/): WordPress Social Rocket plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37257](https://insights.sbomify.com/CVE-2024-37257/): WordPress Permalink Manager Lite plugin <= 2.4.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37256](https://insights.sbomify.com/CVE-2024-37256/): WordPress Tutor LMS plugin <= 2.7.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-37255](https://insights.sbomify.com/CVE-2024-37255/): WordPress ElementsKit Lite plugin <= 3.1.4 - Unauthenticated Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37254](https://insights.sbomify.com/CVE-2024-37254/): WordPress WP File Manager plugin <= 7.2.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37253](https://insights.sbomify.com/CVE-2024-37253/): WordPress WPDirectoryKit plugin <= 1.3.6 - HTML Injection vulnerability (low 2.7)
- [CVE-2024-37252](https://insights.sbomify.com/CVE-2024-37252/): WordPress Email Subscribers by Icegram Express plugin <= 5.7.25 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-37251](https://insights.sbomify.com/CVE-2024-37251/): WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Cross-Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37250](https://insights.sbomify.com/CVE-2024-37250/): WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Subscriber+ Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-3725](https://insights.sbomify.com/CVE-2024-3725/): Cross-site scripting in Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE (medium 6.4)
- [CVE-2024-37249](https://insights.sbomify.com/CVE-2024-37249/): WordPress Advanced Custom Fields Pro plugin < 6.3.2 - Contributor+ Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37248](https://insights.sbomify.com/CVE-2024-37248/): WordPress Anima theme <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37247](https://insights.sbomify.com/CVE-2024-37247/): WordPress jQuery T(-) Countdown Widget plugin <= 2.3.25 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37246](https://insights.sbomify.com/CVE-2024-37246/): WordPress Gallery Slideshow plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37245](https://insights.sbomify.com/CVE-2024-37245/): WordPress All In One Redirection plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37244](https://insights.sbomify.com/CVE-2024-37244/): WordPress Ninja Beaver Add-ons for Beaver Builder plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37243](https://insights.sbomify.com/CVE-2024-37243/): WordPress Vandana Lite theme <= 1.1.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37242](https://insights.sbomify.com/CVE-2024-37242/): WordPress Newspack Newsletters plugin <= 2.13.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37241](https://insights.sbomify.com/CVE-2024-37241/): WordPress WP Job Manager Resume Manager plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37240](https://insights.sbomify.com/CVE-2024-37240/): WordPress Falang multilanguage for WordPress plugin <= 1.3.51 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3724](https://insights.sbomify.com/CVE-2024-3724/): Cross-site scripting in Happy Addons for Elementor (medium 6.4)
- [CVE-2024-37239](https://insights.sbomify.com/CVE-2024-37239/): WordPress Branda plugin <= 3.4.17 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37238](https://insights.sbomify.com/CVE-2024-37238/): WordPress WPAdverts plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37237](https://insights.sbomify.com/CVE-2024-37237/): WordPress FS Poster plugin <= 6.5.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37236](https://insights.sbomify.com/CVE-2024-37236/): WordPress Loco Translate plugin <= 2.6.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37235](https://insights.sbomify.com/CVE-2024-37235/): WordPress Groundhogg plugin <= 3.4.2.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37234](https://insights.sbomify.com/CVE-2024-37234/): WordPress Academy LMS plugin <= 2.0.4 - Open Redirection vulnerability (low 3.5)
- [CVE-2024-37233](https://insights.sbomify.com/CVE-2024-37233/): WordPress Play.ht plugin <= 3.6.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37232](https://insights.sbomify.com/CVE-2024-37232/): WordPress Hercules Core plugin <= 6.5 - Subscriber+ Arbitrary Settings Change/Access vulnerability (high 8.8)
- [CVE-2024-37231](https://insights.sbomify.com/CVE-2024-37231/): WordPress Salon booking system plugin <= 9.9 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-37230](https://insights.sbomify.com/CVE-2024-37230/): WordPress Book Landing Page theme <= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3723](https://insights.sbomify.com/CVE-2024-3723/): Advanced Contact form 7 DB <= 2.0.2 - Sensitive Information Exposure (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/331/