# Vulnerabilities published in 2024


- [CVE-2024-37125](https://insights.sbomify.com/CVE-2024-37125/): Denial of service in SmartFabric OS10 Software (high 7.5)
- [CVE-2024-37124](https://insights.sbomify.com/CVE-2024-37124/): Code injection in Ricoh Streamline NX PC Client (critical 9.8)
- [CVE-2024-37123](https://insights.sbomify.com/CVE-2024-37123/): WordPress Ibtana – WordPress Website Builder plugin <= 1.2.3.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-37122](https://insights.sbomify.com/CVE-2024-37122/): WordPress Accordions plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37121](https://insights.sbomify.com/CVE-2024-37121/): WordPress Shortcode Addons plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37120](https://insights.sbomify.com/CVE-2024-37120/): WordPress Tabs plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-37119](https://insights.sbomify.com/CVE-2024-37119/): WordPress Uncanny Automator Pro plugin < 5.3.0.1 - Unauthenticated License Settings Reset vulnerability (medium 5.3)
- [CVE-2024-37118](https://insights.sbomify.com/CVE-2024-37118/): Cross-site request forgery in Uncanny Automator Pro (medium 5.4)
- [CVE-2024-37117](https://insights.sbomify.com/CVE-2024-37117/): WordPress Uncanny Automator Pro plugin <= 5.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37116](https://insights.sbomify.com/CVE-2024-37116/): WordPress Sinatra theme <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37115](https://insights.sbomify.com/CVE-2024-37115/): WordPress Newspack Blocks plugin <= 3.0.8 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-37114](https://insights.sbomify.com/CVE-2024-37114/): WordPress My Favorites plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37113](https://insights.sbomify.com/CVE-2024-37113/): WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Database Backup Download vulnerability (critical 9.8)
- [CVE-2024-37112](https://insights.sbomify.com/CVE-2024-37112/): WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Arbitrary SQL Query Execution vulnerability (critical 10.0)
- [CVE-2024-37111](https://insights.sbomify.com/CVE-2024-37111/): WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Denial of Service Attack vulnerability (high 7.5)
- [CVE-2024-37110](https://insights.sbomify.com/CVE-2024-37110/): WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Settings & Users Data Dump vulnerability (high 7.5)
- [CVE-2024-3711](https://insights.sbomify.com/CVE-2024-3711/): Brizy – Page Builder <= 2.4.43 - Missing Authorization (medium 4.3)
- [CVE-2024-37109](https://insights.sbomify.com/CVE-2024-37109/): WordPress WishList Member X plugin < 3.26.7 - Authenticated Arbitrary PHP Code Execution vulnerability (critical 9.9)
- [CVE-2024-37108](https://insights.sbomify.com/CVE-2024-37108/): WordPress WishList Member X plugin < 3.26.7 - Authenticated Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2024-37107](https://insights.sbomify.com/CVE-2024-37107/): WordPress WishList Member X plugin < 3.26.7 - Authenticated Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-37106](https://insights.sbomify.com/CVE-2024-37106/): WordPress WishList Member X plugin < 3.26.7 - Unautenticated Plugin Settings Change Leading to Stored XSS vulnerability (high 8.2)
- [CVE-2024-37104](https://insights.sbomify.com/CVE-2024-37104/): WordPress Chic Lite theme <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37103](https://insights.sbomify.com/CVE-2024-37103/): WordPress Education Zone theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37102](https://insights.sbomify.com/CVE-2024-37102/): WordPress Vilva theme <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37101](https://insights.sbomify.com/CVE-2024-37101/): WordPress WP Post Author plugin <= 3.6.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-37100](https://insights.sbomify.com/CVE-2024-37100/): WordPress Elegant Themes Icons plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3710](https://insights.sbomify.com/CVE-2024-3710/): Image Photo Gallery Final Tiles Grid < 3.6.0 - Contributor+ Stored XSS (medium 6.8)
- [CVE-2024-37099](https://insights.sbomify.com/CVE-2024-37099/): WordPress GiveWP plugin <= 3.14.1 - Unauthenticated PHP Object Injection vulnerability (critical 10.0)
- [CVE-2024-37098](https://insights.sbomify.com/CVE-2024-37098/): WordPress BlossomThemes Email Newsletter plugin <= 2.2.6 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2024-37097](https://insights.sbomify.com/CVE-2024-37097/): WordPress Shortcodes by United Themes plugin < 5.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-37096](https://insights.sbomify.com/CVE-2024-37096/): WordPress Popup box plugin <= 4.5.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-37095](https://insights.sbomify.com/CVE-2024-37095/): WordPress Envira Photo Gallery plugin <= 1.8.7.3 - CSRF leading to notice dismissal vulnerability (medium 4.3)
- [CVE-2024-37094](https://insights.sbomify.com/CVE-2024-37094/): WordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerability (high 8.2)
- [CVE-2024-37093](https://insights.sbomify.com/CVE-2024-37093/): WordPress MasterStudy LMS plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-37092](https://insights.sbomify.com/CVE-2024-37092/): WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Local File Inclusion vulnerability (high 8.5)
- [CVE-2024-37091](https://insights.sbomify.com/CVE-2024-37091/): WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2024-37090](https://insights.sbomify.com/CVE-2024-37090/): SQL Injection vulnerability in multiple StylemixThemes premium themes (high 8.5)
- [CVE-2024-37089](https://insights.sbomify.com/CVE-2024-37089/): WordPress Consulting Elementor Widgets plugin <= 1.3.0 - Unauthenticated Local File Inclusion vulnerability (critical 9.0)
- [CVE-2024-37087](https://insights.sbomify.com/CVE-2024-37087/): Denial of service in VMware Cloud Foundation (medium 5.3)
- [CVE-2024-37086](https://insights.sbomify.com/CVE-2024-37086/): Memory corruption in ESXi (medium 6.8)
- [CVE-2024-37085](https://insights.sbomify.com/CVE-2024-37085/): VMware ESXi Authentication Bypass (medium 6.8, exploited in the wild)
- [CVE-2024-37084](https://insights.sbomify.com/CVE-2024-37084/): CVE-2024-37084: Remote code execution in Spring Cloud Data Flow (critical 9.8)
- [CVE-2024-37082](https://insights.sbomify.com/CVE-2024-37082/): Auth bypass in haproxy-boshrelease (critical 9.1)
- [CVE-2024-37081](https://insights.sbomify.com/CVE-2024-37081/): Privilege escalation in VMware Cloud Foundation (high 7.8)
- [CVE-2024-37080](https://insights.sbomify.com/CVE-2024-37080/): Memory corruption in VMware Cloud Foundation (critical 9.8)
- [CVE-2024-37079](https://insights.sbomify.com/CVE-2024-37079/): Broadcom VMware vCenter Server Out-of-bounds Write (critical 9.8, exploited in the wild)
- [CVE-2024-37078](https://insights.sbomify.com/CVE-2024-37078/): nilfs2: fix potential kernel bug due to lack of writeback flag waiting (high 7.8)
- [CVE-2024-37077](https://insights.sbomify.com/CVE-2024-37077/): Arkcompiler Ets Runtime has an out-of-bounds write vulnerability (high 8.2)
- [CVE-2024-37071](https://insights.sbomify.com/CVE-2024-37071/): IBM Db2 denial of service (medium 5.3)
- [CVE-2024-37070](https://insights.sbomify.com/CVE-2024-37070/): IBM Concert Software information disclosure (medium 4.3)
- [CVE-2024-3707](https://insights.sbomify.com/CVE-2024-3707/): Exposure of Information Through Directory Listing vulnerability in OpenGnsys (medium 5.3)
- [CVE-2024-37068](https://insights.sbomify.com/CVE-2024-37068/): IBM Maximo Application Suite information disclosure (medium 5.9)
- [CVE-2024-37066](https://insights.sbomify.com/CVE-2024-37066/): Command injection in Wyze Cam V4 Pro (medium 6.8)
- [CVE-2024-37065](https://insights.sbomify.com/CVE-2024-37065/): Skops unsafe deserialization (high 7.8)
- [CVE-2024-37064](https://insights.sbomify.com/CVE-2024-37064/): ydata unsafe deserialization (high 7.8)
- [CVE-2024-37063](https://insights.sbomify.com/CVE-2024-37063/): ydata cross-site scripting (high 7.8)
- [CVE-2024-37062](https://insights.sbomify.com/CVE-2024-37062/): ydata unsafe deserialization (high 7.8)
- [CVE-2024-37061](https://insights.sbomify.com/CVE-2024-37061/): MLFlow improper input validation (high 8.8)
- [CVE-2024-37060](https://insights.sbomify.com/CVE-2024-37060/): MLFlow unsafe deserialization (high 8.8)
- [CVE-2024-3706](https://insights.sbomify.com/CVE-2024-3706/): Exposure of Sensitive Information to an Unauthorized Actor vulnerability in OpenGnsys (medium 5.9)
- [CVE-2024-37059](https://insights.sbomify.com/CVE-2024-37059/): MLFlow unsafe deserialization (high 8.8)
- [CVE-2024-37058](https://insights.sbomify.com/CVE-2024-37058/): MLFlow unsafe deserialization (high 8.8)
- [CVE-2024-37057](https://insights.sbomify.com/CVE-2024-37057/): MLFlow unsafe deserialization (high 8.8)
- [CVE-2024-37056](https://insights.sbomify.com/CVE-2024-37056/): MLFlow unsafe deserialization (high 8.8)
- [CVE-2024-37055](https://insights.sbomify.com/CVE-2024-37055/): MLFlow unsafe deserialization (high 8.8)
- [CVE-2024-37054](https://insights.sbomify.com/CVE-2024-37054/): MLFlow unsafe deserialization (high 8.8)
- [CVE-2024-37053](https://insights.sbomify.com/CVE-2024-37053/): MLFlow unsafe deserialization (high 8.8)
- [CVE-2024-37052](https://insights.sbomify.com/CVE-2024-37052/): MLFlow unsafe deserialization (high 8.8)
- [CVE-2024-37051](https://insights.sbomify.com/CVE-2024-37051/): Information disclosure in Aqua (critical 9.3)
- [CVE-2024-37050](https://insights.sbomify.com/CVE-2024-37050/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-3705](https://insights.sbomify.com/CVE-2024-3705/): Unrestricted Upload of File with Dangerous Type vulnerability in OpenGnsys (high 8.8)
- [CVE-2024-37049](https://insights.sbomify.com/CVE-2024-37049/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-37048](https://insights.sbomify.com/CVE-2024-37048/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-37047](https://insights.sbomify.com/CVE-2024-37047/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-37046](https://insights.sbomify.com/CVE-2024-37046/): QTS, QuTS hero (low 2.1)
- [CVE-2024-37045](https://insights.sbomify.com/CVE-2024-37045/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-37044](https://insights.sbomify.com/CVE-2024-37044/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-37043](https://insights.sbomify.com/CVE-2024-37043/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-37042](https://insights.sbomify.com/CVE-2024-37042/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-37041](https://insights.sbomify.com/CVE-2024-37041/): QTS, QuTS hero (medium 5.1)
- [CVE-2024-37040](https://insights.sbomify.com/CVE-2024-37040/): Memory corruption in Sage 1410 (medium 5.4)
- [CVE-2024-3704](https://insights.sbomify.com/CVE-2024-3704/): SQL Injection vulnerability in OpenGnsys (critical 9.8)
- [CVE-2024-37039](https://insights.sbomify.com/CVE-2024-37039/): Denial of service in Sage 1410 (medium 5.9)
- [CVE-2024-37038](https://insights.sbomify.com/CVE-2024-37038/): Misconfiguration in Sage 1410 (high 7.5)
- [CVE-2024-37037](https://insights.sbomify.com/CVE-2024-37037/): Path traversal in Sage 1410 (high 8.1)
- [CVE-2024-37036](https://insights.sbomify.com/CVE-2024-37036/): Memory corruption in Sage 1410 (critical 9.8)
- [CVE-2024-37034](https://insights.sbomify.com/CVE-2024-37034/): Weak cryptography in couchbase:couchbase server (medium 5.9)
- [CVE-2024-37032](https://insights.sbomify.com/CVE-2024-37032/): Ollama does not validate the format of the digest (sha256 with 64 hex digits) (high 8.8)
- [CVE-2024-37031](https://insights.sbomify.com/CVE-2024-37031/): activeadmin vulnerable to stored persistent cross-site scripting (XSS) in dynamic form legends (medium 6.1)
- [CVE-2024-37030](https://insights.sbomify.com/CVE-2024-37030/): Arkcompiler Ets Runtime has a use after free vulnerability (high 8.2)
- [CVE-2024-3703](https://insights.sbomify.com/CVE-2024-3703/): Carousel Slider < 2.2.10 - Editor+ Stored XSS (medium 4.7)
- [CVE-2024-37029](https://insights.sbomify.com/CVE-2024-37029/): Fuji Electric Tellus Lite V-Simulator Stack-based Buffer Overflow (high 8.5)
- [CVE-2024-37028](https://insights.sbomify.com/CVE-2024-37028/): BIG-IP Next Central Manager vulnerability (medium 6.3)
- [CVE-2024-37027](https://insights.sbomify.com/CVE-2024-37027/): Denial of service in Intel(R) VTune(TM) Profiler software (medium 5.2)
- [CVE-2024-37026](https://insights.sbomify.com/CVE-2024-37026/): drm/xe: Only use reserved BCS instances for usm migrate exec queue (medium 5.5)
- [CVE-2024-37025](https://insights.sbomify.com/CVE-2024-37025/): Privilege escalation in Intel(R) Advanced Link Analyzer Standard Edition software installer (medium 5.4)
- [CVE-2024-37024](https://insights.sbomify.com/CVE-2024-37024/): Privilege escalation in ACAT software maintained by Intel(R) for Windows (medium 5.4)
- [CVE-2024-37023](https://insights.sbomify.com/CVE-2024-37023/): Vonets WiFi Bridges Command Injection (critical 9.4)
- [CVE-2024-37022](https://insights.sbomify.com/CVE-2024-37022/): Fuji Electric Tellus Lite V-Simulator Out-of-bounds Write (high 8.5)
- [CVE-2024-37021](https://insights.sbomify.com/CVE-2024-37021/): fpga: manager: add owner module and take its refcount (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/333/