# Vulnerabilities published in 2024


- [CVE-2024-37229](https://insights.sbomify.com/CVE-2024-37229/): WordPress Blogmentor – Blog Layouts for Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37228](https://insights.sbomify.com/CVE-2024-37228/): WordPress InstaWP Connect plugin <= 0.1.0.38 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-37227](https://insights.sbomify.com/CVE-2024-37227/): WordPress Newsletters plugin <= 4.9.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37226](https://insights.sbomify.com/CVE-2024-37226/): WordPress Kanban Boards for WordPress plugin <= 2.5.21 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37225](https://insights.sbomify.com/CVE-2024-37225/): WordPress Zoho Marketing Automation plugin <= 1.2.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-37224](https://insights.sbomify.com/CVE-2024-37224/): WordPress SP Project & Document Manager plugin <= 4.71 - Directory Traversal vulnerability (high 7.5)
- [CVE-2024-37223](https://insights.sbomify.com/CVE-2024-37223/): WordPress Restaurant Reservations plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37222](https://insights.sbomify.com/CVE-2024-37222/): WordPress Master Slider plugin <= 3.10.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37221](https://insights.sbomify.com/CVE-2024-37221/): WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37220](https://insights.sbomify.com/CVE-2024-37220/): WordPress Optinly plugin <= 1.0.18 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-3722](https://insights.sbomify.com/CVE-2024-3722/): Swift Performance Lite <= 2.3.6.18 - Incorrect Authorization to Authenticated (Subscriber+) Settings Modification (medium 5.4)
- [CVE-2024-37219](https://insights.sbomify.com/CVE-2024-37219/): WordPress Page Builder Sandwich plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37218](https://insights.sbomify.com/CVE-2024-37218/): WordPress Page Builder Sandwich <= 5.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37217](https://insights.sbomify.com/CVE-2024-37217/): WordPress Empty Cart Button for WooCommerce plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37216](https://insights.sbomify.com/CVE-2024-37216/): WordPress Sketchfab Embed plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37215](https://insights.sbomify.com/CVE-2024-37215/): Cross-site scripting in Transition Slider – Responsive Image Slider and Gallery (medium 5.9)
- [CVE-2024-37214](https://insights.sbomify.com/CVE-2024-37214/): WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control to XSS vulnerability (medium 6.5)
- [CVE-2024-37213](https://insights.sbomify.com/CVE-2024-37213/): WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.4.6 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-37212](https://insights.sbomify.com/CVE-2024-37212/): WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - CSRF to PHP Object Injection vulnerability (high 8.3)
- [CVE-2024-37211](https://insights.sbomify.com/CVE-2024-37211/): Cross-site scripting in Ali2Woo Lite (high 7.1)
- [CVE-2024-37210](https://insights.sbomify.com/CVE-2024-37210/): WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-3721](https://insights.sbomify.com/CVE-2024-3721/): TBK DVR-4104/DVR-4216 os command injection (medium 6.3)
- [CVE-2024-37209](https://insights.sbomify.com/CVE-2024-37209/): WordPress User Rights Access Manager plugin <= 1.1.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-37208](https://insights.sbomify.com/CVE-2024-37208/): WordPress WP Scraper plugin <= 5.7 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-37207](https://insights.sbomify.com/CVE-2024-37207/): WordPress Demo Awesome plugin <= 1.0.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-37206](https://insights.sbomify.com/CVE-2024-37206/): WordPress Demo Awesome plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37205](https://insights.sbomify.com/CVE-2024-37205/): WordPress affiliate-toolkit plugin <= 3.4.4 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-37204](https://insights.sbomify.com/CVE-2024-37204/): WordPress PropertyHive plugin <= 2.0.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37203](https://insights.sbomify.com/CVE-2024-37203/): WordPress Laybuy Payment Extension for WooCommerce plugin <= 5.3.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37202](https://insights.sbomify.com/CVE-2024-37202/): Missing authorization in Ultimate Custom Add To Cart Button (Ajax) For WooCommerce by Binary Carpenter (medium 6.5)
- [CVE-2024-37201](https://insights.sbomify.com/CVE-2024-37201/): WordPress Woocommerce Customers Order History plugin <= 5.2.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-3720](https://insights.sbomify.com/CVE-2024-3720/): Tianwell Fire Intelligent Command Platform API Interface page sql injection (medium 6.3)
- [CVE-2024-37199](https://insights.sbomify.com/CVE-2024-37199/): WordPress Enfold theme <= 5.6.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37198](https://insights.sbomify.com/CVE-2024-37198/): WordPress Digital Newspaper theme <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3719](https://insights.sbomify.com/CVE-2024-3719/): Campcodes House Rental Management System ajax.php sql injection (medium 6.3)
- [CVE-2024-37187](https://insights.sbomify.com/CVE-2024-37187/): Advantech ADAM-5550 Weak Encoding for Password (medium 6.8)
- [CVE-2024-37186](https://insights.sbomify.com/CVE-2024-37186/): Command injection in Wavlink AC3000 (critical 9.1)
- [CVE-2024-37185](https://insights.sbomify.com/CVE-2024-37185/): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (high 8.2)
- [CVE-2024-37184](https://insights.sbomify.com/CVE-2024-37184/): Memory corruption in Wavlink AC3000 (critical 9.1)
- [CVE-2024-37183](https://insights.sbomify.com/CVE-2024-37183/): Westermo L210-F2G Lynx Cleartext Transmission of Sensitive Information (medium 6.9)
- [CVE-2024-37182](https://insights.sbomify.com/CVE-2024-37182/): Lack of permissions prompting when opening external URLs (medium 4.7)
- [CVE-2024-37181](https://insights.sbomify.com/CVE-2024-37181/): Race condition in Intel(R) Neural Compressor software (low 2.1)
- [CVE-2024-37180](https://insights.sbomify.com/CVE-2024-37180/): [CVE-2024-37180] Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform (medium 4.1)
- [CVE-2024-3718](https://insights.sbomify.com/CVE-2024-3718/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2024-37179](https://insights.sbomify.com/CVE-2024-37179/): Insecure File Operations vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) (high 7.7)
- [CVE-2024-37178](https://insights.sbomify.com/CVE-2024-37178/): Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation (medium 5.0)
- [CVE-2024-37177](https://insights.sbomify.com/CVE-2024-37177/): Cross-Site Scripting (XSS) vulnerabilities in SAP Financial Consolidation (high 8.1)
- [CVE-2024-37176](https://insights.sbomify.com/CVE-2024-37176/): Missing Authorization check in SAP BW/4HANA Transformation and DTP (medium 5.5)
- [CVE-2024-37175](https://insights.sbomify.com/CVE-2024-37175/): [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI) (medium 4.3)
- [CVE-2024-37174](https://insights.sbomify.com/CVE-2024-37174/): [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI) (medium 6.1)
- [CVE-2024-37173](https://insights.sbomify.com/CVE-2024-37173/): [Multiple CVEs] Multiple vulnerabilities in SAP CRM (WebClient UI) (medium 6.1)
- [CVE-2024-37172](https://insights.sbomify.com/CVE-2024-37172/): [CVE-2024-37172] Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management) (medium 5.4)
- [CVE-2024-37171](https://insights.sbomify.com/CVE-2024-37171/): [CVE-2024-37171] Server-Side Request Forgery (SSRF) in SAP Transportation Management (Collaboration Portal) (medium 5.0)
- [CVE-2024-3717](https://insights.sbomify.com/CVE-2024-3717/): Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure (medium 5.3)
- [CVE-2024-37169](https://insights.sbomify.com/CVE-2024-37169/): @jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper (medium 5.3)
- [CVE-2024-37168](https://insights.sbomify.com/CVE-2024-37168/): @grpc/grpc-js can allocate memory for incoming messages well above configured limits (medium 5.3)
- [CVE-2024-37167](https://insights.sbomify.com/CVE-2024-37167/): Tuleap has improper permissions of the backlog items (medium 4.3)
- [CVE-2024-37166](https://insights.sbomify.com/CVE-2024-37166/): ghtml Cross-Site Scripting (XSS) vulnerability (high 8.9)
- [CVE-2024-37165](https://insights.sbomify.com/CVE-2024-37165/): Discourse has an XSS via Onebox system (medium 6.3)
- [CVE-2024-37164](https://insights.sbomify.com/CVE-2024-37164/): CVAT SSRF via custom cloud storage endpoints (high 7.1)
- [CVE-2024-37163](https://insights.sbomify.com/CVE-2024-37163/): SkyScrape Secure API Requests (medium 6.4)
- [CVE-2024-37162](https://insights.sbomify.com/CVE-2024-37162/): zsa Generates Error Messages Containing Sensitive Information (medium 4.0)
- [CVE-2024-37161](https://insights.sbomify.com/CVE-2024-37161/): MeterSphere front-end editor stores XSS vulnerability (medium 4.0)
- [CVE-2024-37160](https://insights.sbomify.com/CVE-2024-37160/): Formwork has a Cross-site scripting (XSS) vulnerability in Description metadata (medium 4.8)
- [CVE-2024-3716](https://insights.sbomify.com/CVE-2024-3716/): Foreman-installer: candlepin database password being leaked to local users via the process list (medium 6.2)
- [CVE-2024-37159](https://insights.sbomify.com/CVE-2024-37159/): Evmos is missing create validator check (low 3.5)
- [CVE-2024-37158](https://insights.sbomify.com/CVE-2024-37158/): Evmos is missing precompile checks (low 3.5)
- [CVE-2024-37157](https://insights.sbomify.com/CVE-2024-37157/): Discourse vulnerable to Server-Side Request Forgery via FastImage (medium 6.4)
- [CVE-2024-37156](https://insights.sbomify.com/CVE-2024-37156/): TokenController formName not sanitized in hidden input (medium 6.1)
- [CVE-2024-37155](https://insights.sbomify.com/CVE-2024-37155/): OpenCTI May Bypass Introspection Restriction (medium 6.5)
- [CVE-2024-37154](https://insights.sbomify.com/CVE-2024-37154/): Evmos allows unvested token delegations (medium 5.3)
- [CVE-2024-37153](https://insights.sbomify.com/CVE-2024-37153/): Evmos's contract balance not updating correctly after interchain transaction (high 7.5)
- [CVE-2024-37152](https://insights.sbomify.com/CVE-2024-37152/): Unauthenticated Access to sensitive settings in Argo CD (medium 5.3)
- [CVE-2024-37151](https://insights.sbomify.com/CVE-2024-37151/): Suricata defrag: IP ID reuse can lead to policy bypass (medium 5.3)
- [CVE-2024-37150](https://insights.sbomify.com/CVE-2024-37150/): Private npm registry support used scope auth token for downloading tarballs (high 7.6)
- [CVE-2024-3715](https://insights.sbomify.com/CVE-2024-3715/): Database for Contact Form 7, WPforms, Elementor forms <= 1.3.8 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-37149](https://insights.sbomify.com/CVE-2024-37149/): GLPI allows remote code execution through the plugin loader (high 7.2)
- [CVE-2024-37148](https://insights.sbomify.com/CVE-2024-37148/): GLPI allows account takeover via SQL Injection in AJAX scripts (high 8.1)
- [CVE-2024-37147](https://insights.sbomify.com/CVE-2024-37147/): GLPI allows Authenticated File Upload to Restricted Tickets (medium 4.3)
- [CVE-2024-37146](https://insights.sbomify.com/CVE-2024-37146/): GHSL-2023-248: Flowise xss in /api/v1/credentials/id (medium 6.1)
- [CVE-2024-37145](https://insights.sbomify.com/CVE-2024-37145/): GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id (medium 6.1)
- [CVE-2024-37144](https://insights.sbomify.com/CVE-2024-37144/): Information disclosure in Dell Data Lakehouse (high 8.2)
- [CVE-2024-37143](https://insights.sbomify.com/CVE-2024-37143/): Path traversal in Dell Data Lakehouse (critical 10.0)
- [CVE-2024-37142](https://insights.sbomify.com/CVE-2024-37142/): Privilege escalation in Dell Peripheral Manager (high 7.3)
- [CVE-2024-37141](https://insights.sbomify.com/CVE-2024-37141/): Open redirect in PowerProtect DD (low 3.5)
- [CVE-2024-37140](https://insights.sbomify.com/CVE-2024-37140/): Command injection in PowerProtect DD (high 8.8)
- [CVE-2024-3714](https://insights.sbomify.com/CVE-2024-3714/): GiveWP – Donation Plugin and Fundraising Platform <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-37139](https://insights.sbomify.com/CVE-2024-37139/): Denial of service in PowerProtect DD (medium 6.5)
- [CVE-2024-37138](https://insights.sbomify.com/CVE-2024-37138/): Path traversal in PowerProtect DD (medium 4.1)
- [CVE-2024-37137](https://insights.sbomify.com/CVE-2024-37137/): Weak cryptography in CloudLink (low 3.8)
- [CVE-2024-37136](https://insights.sbomify.com/CVE-2024-37136/): Information disclosure in Path to Power (medium 6.8)
- [CVE-2024-37135](https://insights.sbomify.com/CVE-2024-37135/): Information disclosure in Data Manager Appliance Software (DMAS) (low 3.3)
- [CVE-2024-37134](https://insights.sbomify.com/CVE-2024-37134/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2024-37133](https://insights.sbomify.com/CVE-2024-37133/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2024-37132](https://insights.sbomify.com/CVE-2024-37132/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2024-37131](https://insights.sbomify.com/CVE-2024-37131/): Misconfiguration in Secure Connect Gateway (SCG) Policy Manager (high 7.5)
- [CVE-2024-37130](https://insights.sbomify.com/CVE-2024-37130/): Privilege escalation in Dell OpenManage Server Administrator (high 7.3)
- [CVE-2024-37129](https://insights.sbomify.com/CVE-2024-37129/): Path traversal in Dell Inventory Collector (medium 6.7)
- [CVE-2024-37127](https://insights.sbomify.com/CVE-2024-37127/): Privilege escalation in Dell Peripheral Manager (high 7.8)
- [CVE-2024-37126](https://insights.sbomify.com/CVE-2024-37126/): Privilege escalation in PowerScale OneFS (medium 6.7)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/332/