# Vulnerabilities published in 2024


- [CVE-2024-35809](https://insights.sbomify.com/CVE-2024-35809/): PCI/PM: Drain runtime-idle callbacks before driver removal (medium 5.5)
- [CVE-2024-35808](https://insights.sbomify.com/CVE-2024-35808/): md/dm-raid: don't call md_reap_sync_thread() directly (high 7.8)
- [CVE-2024-35807](https://insights.sbomify.com/CVE-2024-35807/): ext4: fix corruption during on-line resize (medium 5.5)
- [CVE-2024-35806](https://insights.sbomify.com/CVE-2024-35806/): soc: fsl: qbman: Always disable interrupts when taking cgr_lock (medium 5.5)
- [CVE-2024-35805](https://insights.sbomify.com/CVE-2024-35805/): dm snapshot: fix lockup in dm_exception_table_exit (medium 5.5)
- [CVE-2024-35804](https://insights.sbomify.com/CVE-2024-35804/): KVM: x86: Mark target gfn of emulated atomic instruction as dirty (high 8.8)
- [CVE-2024-35803](https://insights.sbomify.com/CVE-2024-35803/): x86/efistub: Call mixed mode boot services on the firmware's stack (medium 5.5)
- [CVE-2024-35801](https://insights.sbomify.com/CVE-2024-35801/): x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (high 7.8)
- [CVE-2024-35800](https://insights.sbomify.com/CVE-2024-35800/): efi: fix panic in kdump kernel (medium 5.5)
- [CVE-2024-3580](https://insights.sbomify.com/CVE-2024-3580/): Popup4Phone <= 1.3.2 - Editor+ Stored XSS (medium 6.1)
- [CVE-2024-35799](https://insights.sbomify.com/CVE-2024-35799/): drm/amd/display: Prevent crash when disable stream (medium 6.2)
- [CVE-2024-35798](https://insights.sbomify.com/CVE-2024-35798/): btrfs: fix race in read_extent_buffer_pages() (high 7.8)
- [CVE-2024-35797](https://insights.sbomify.com/CVE-2024-35797/): mm: cachestat: fix two shmem bugs (high 7.1)
- [CVE-2024-35796](https://insights.sbomify.com/CVE-2024-35796/): net: ll_temac: platform_get_resource replaced by wrong function (medium 5.5)
- [CVE-2024-35795](https://insights.sbomify.com/CVE-2024-35795/): drm/amdgpu: fix deadlock while reading mqd from debugfs (medium 5.5)
- [CVE-2024-35794](https://insights.sbomify.com/CVE-2024-35794/): dm-raid: really frozen sync_thread during suspend (medium 5.5)
- [CVE-2024-35793](https://insights.sbomify.com/CVE-2024-35793/): debugfs: fix wait/cancellation handling during remove (high 7.8)
- [CVE-2024-35792](https://insights.sbomify.com/CVE-2024-35792/): crypto: rk3288 - Fix use after free in unprepare (high 7.8)
- [CVE-2024-35791](https://insights.sbomify.com/CVE-2024-35791/): KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() (high 7.8)
- [CVE-2024-35790](https://insights.sbomify.com/CVE-2024-35790/): usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (medium 5.5)
- [CVE-2024-3579](https://insights.sbomify.com/CVE-2024-3579/): XSS in Online Shopping System Advanced (medium 6.1)
- [CVE-2024-35789](https://insights.sbomify.com/CVE-2024-35789/): wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (high 8.0)
- [CVE-2024-35787](https://insights.sbomify.com/CVE-2024-35787/): md/md-bitmap: fix incorrect usage for sb_index (high 7.8)
- [CVE-2024-35786](https://insights.sbomify.com/CVE-2024-35786/): drm/nouveau: fix stale locked mutex in nouveau_gem_ioctl_pushbuf (medium 5.5)
- [CVE-2024-35785](https://insights.sbomify.com/CVE-2024-35785/): tee: optee: Fix kernel panic caused by incorrect error handling (high 7.8)
- [CVE-2024-35784](https://insights.sbomify.com/CVE-2024-35784/): btrfs: fix deadlock with fiemap and extent locking (medium 5.5)
- [CVE-2024-35783](https://insights.sbomify.com/CVE-2024-35783/): Privilege escalation in SIMATIC BATCH V9.1 (critical 9.4)
- [CVE-2024-35782](https://insights.sbomify.com/CVE-2024-35782/): WordPress Cowidgets – Elementor Addons plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35781](https://insights.sbomify.com/CVE-2024-35781/): WordPress Word Balloon plugin <= 4.21.1 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-35780](https://insights.sbomify.com/CVE-2024-35780/): WordPress Page Builder: Live Composer plugin <= 1.5.42 - Contributor+ PHP Object Injection vulnerability (high 8.5)
- [CVE-2024-35779](https://insights.sbomify.com/CVE-2024-35779/): Cross-site scripting in Page Builder: Live Composer (medium 6.5)
- [CVE-2024-35778](https://insights.sbomify.com/CVE-2024-35778/): WordPress Slideshow SE plugin <= 2.5.17 - Auth. Limited Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-35777](https://insights.sbomify.com/CVE-2024-35777/): WordPress WooCommerce plugin <= 8.9.2 - Content Injection vulnerability (low 3.5)
- [CVE-2024-35776](https://insights.sbomify.com/CVE-2024-35776/): WordPress phpinfo() WP plugin <= 5.0 - Unauthenticated Data Exposure vulnerability (medium 5.3)
- [CVE-2024-35775](https://insights.sbomify.com/CVE-2024-35775/): WordPress Slider by Soliloquy plugin <= 2.7.6 - Broken Access Control to XSS vulnerability (medium 5.9)
- [CVE-2024-35774](https://insights.sbomify.com/CVE-2024-35774/): WordPress DImage 360 plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35773](https://insights.sbomify.com/CVE-2024-35773/): WordPress Comment Reply Email plugin <= 1.3 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-35772](https://insights.sbomify.com/CVE-2024-35772/): WordPress Hueman theme <= 3.7.24 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-35771](https://insights.sbomify.com/CVE-2024-35771/): WordPress Customizr theme <= 4.4.21 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-35770](https://insights.sbomify.com/CVE-2024-35770/): WordPress Vimeography plugin <= 2.4.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-35769](https://insights.sbomify.com/CVE-2024-35769/): WordPress Slideshow SE plugin <= 2.5.17 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35768](https://insights.sbomify.com/CVE-2024-35768/): WordPress Page Builder: Live Composer plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35767](https://insights.sbomify.com/CVE-2024-35767/): WordPress Squeeze plugin <= 1.4 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-35766](https://insights.sbomify.com/CVE-2024-35766/): WordPress WPPizza – A Restaurant Plugin plugin <= 3.18.13 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35765](https://insights.sbomify.com/CVE-2024-35765/): WordPress Greenshift – animation and page builder blocks plugin <= 8.8.9.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35764](https://insights.sbomify.com/CVE-2024-35764/): WordPress Church Admin plugin <= 4.4.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35763](https://insights.sbomify.com/CVE-2024-35763/): WordPress Excellent theme <= 1.2.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35762](https://insights.sbomify.com/CVE-2024-35762/): WordPress Serious Slider plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35761](https://insights.sbomify.com/CVE-2024-35761/): Cross-site scripting in Online Booking & Scheduling Calendar for WordPress by vcita (medium 6.5)
- [CVE-2024-35760](https://insights.sbomify.com/CVE-2024-35760/): WordPress WP Job Portal plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3576](https://insights.sbomify.com/CVE-2024-3576/): NPort 5100A Series Store XSS Vulnerability (high 8.3)
- [CVE-2024-35759](https://insights.sbomify.com/CVE-2024-35759/): WordPress WP Job Portal plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35758](https://insights.sbomify.com/CVE-2024-35758/): WordPress Interface theme <= 3.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35757](https://insights.sbomify.com/CVE-2024-35757/): WordPress Easy Age Verify plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35756](https://insights.sbomify.com/CVE-2024-35756/): WordPress Tooltip CK plugin <= 2.2.15 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35755](https://insights.sbomify.com/CVE-2024-35755/): WordPress Weather Widget Pro plugin <= 1.1.40 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35754](https://insights.sbomify.com/CVE-2024-35754/): WordPress Ovic Importer plugin <= 1.6.3 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2024-35753](https://insights.sbomify.com/CVE-2024-35753/): WordPress TemplatesNext OnePager plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35752](https://insights.sbomify.com/CVE-2024-35752/): WordPress Stellissimo Text Box plugin 1.1.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35751](https://insights.sbomify.com/CVE-2024-35751/): WordPress Woody code snippets plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35750](https://insights.sbomify.com/CVE-2024-35750/): WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-3575](https://insights.sbomify.com/CVE-2024-3575/): Cross-site Scripting (XSS) - Stored in mindsdb/mindsdb (medium 5.8)
- [CVE-2024-35749](https://insights.sbomify.com/CVE-2024-35749/): WordPress Under Construction / Maintenance Mode from Acurax plugin <= 2.6 - IP Bypass vulnerability (low 3.7)
- [CVE-2024-35748](https://insights.sbomify.com/CVE-2024-35748/): WordPress WooCommerce Dropshipping plugin <= 5.0.4 - Unauthenticated Arbitrary Email Sending vulnerability (medium 5.3)
- [CVE-2024-35747](https://insights.sbomify.com/CVE-2024-35747/): WordPress Contact Form Builder, Contact Widget plugin <= 2.1.7 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2024-35746](https://insights.sbomify.com/CVE-2024-35746/): WordPress BuddyPress Cover plugin <= 2.1.4.2 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-35745](https://insights.sbomify.com/CVE-2024-35745/): WordPress Strategery Migrations plugin <= 1.0 - Arbitrary File Deletion vulnerability (high 7.5)
- [CVE-2024-35744](https://insights.sbomify.com/CVE-2024-35744/): WordPress Upunzipper plugin <= 1.0.0 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-35743](https://insights.sbomify.com/CVE-2024-35743/): WordPress SC filechecker plugin <= 0.6 - Arbitrary File Deletion vulnerability (high 8.6)
- [CVE-2024-35742](https://insights.sbomify.com/CVE-2024-35742/): WordPress Easy Forms for Mailchimp plugin <= 6.9.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35741](https://insights.sbomify.com/CVE-2024-35741/): WordPress Awesome Support plugin <= 6.1.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35740](https://insights.sbomify.com/CVE-2024-35740/): WordPress Pixgraphy theme <= 1.3.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3574](https://insights.sbomify.com/CVE-2024-3574/): Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapy (high 7.5)
- [CVE-2024-35739](https://insights.sbomify.com/CVE-2024-35739/): WordPress The Post Grid plugin <= 7.7.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35738](https://insights.sbomify.com/CVE-2024-35738/): WordPress Kognetiks Chatbot for WordPress plugin <= 1.9.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35737](https://insights.sbomify.com/CVE-2024-35737/): WordPress WP Visitors Tracker plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35736](https://insights.sbomify.com/CVE-2024-35736/): WordPress Visualizer plugin <= 3.11.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-35735](https://insights.sbomify.com/CVE-2024-35735/): WordPress WP Time Slots Booking Form plugin <= 1.2.11 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35734](https://insights.sbomify.com/CVE-2024-35734/): WordPress WP Time Slots Booking Form plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35733](https://insights.sbomify.com/CVE-2024-35733/): WordPress Auto Coupons for WooCommerce plugin <= 3.0.14 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35732](https://insights.sbomify.com/CVE-2024-35732/): WordPress YITH Custom Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-35731](https://insights.sbomify.com/CVE-2024-35731/): WordPress Kenta Gutenberg Blocks plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35730](https://insights.sbomify.com/CVE-2024-35730/): Cross-site scripting in Active Products Tables for WooCommerce (high 7.1)
- [CVE-2024-3573](https://insights.sbomify.com/CVE-2024-3573/): Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflow (critical 9.3)
- [CVE-2024-35729](https://insights.sbomify.com/CVE-2024-35729/): WordPress Tickera plugin <= 3.5.2.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-35728](https://insights.sbomify.com/CVE-2024-35728/): WordPress Product Addons & Fields for WooCommerce plugin <= 32.0.20 - Content Injection vulnerability (medium 5.3)
- [CVE-2024-35727](https://insights.sbomify.com/CVE-2024-35727/): WordPress Extra Product Options for WooCommerce plugin <= 3.0.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35726](https://insights.sbomify.com/CVE-2024-35726/): WordPress WooBuddy plugin <= 3.4.19 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35725](https://insights.sbomify.com/CVE-2024-35725/): WordPress LA-Studio Element Kit for Elementor plugin <= 1.3.6 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35724](https://insights.sbomify.com/CVE-2024-35724/): WordPress Bosa Elementor Addons and Templates for WooCommerce plugin <= 1.0.12 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35723](https://insights.sbomify.com/CVE-2024-35723/): WordPress Dashboard To-Do List plugin <= 1.2.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35722](https://insights.sbomify.com/CVE-2024-35722/): Missing authorization in Slider Responsive Slideshow – Image slider, Gallery slideshow (medium 4.3)
- [CVE-2024-35721](https://insights.sbomify.com/CVE-2024-35721/): WordPress Image Gallery plugin <= 1.4.5 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35720](https://insights.sbomify.com/CVE-2024-35720/): WordPress Album Gallery – WordPress Gallery plugin <= 1.5.7 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-3572](https://insights.sbomify.com/CVE-2024-3572/): XML External Entity (XXE) Vulnerability in scrapy/scrapy (high 7.5)
- [CVE-2024-35719](https://insights.sbomify.com/CVE-2024-35719/): WordPress RestroPress plugin <= 3.1.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-35718](https://insights.sbomify.com/CVE-2024-35718/): WordPress Newsletters plugin <= 4.9.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-35717](https://insights.sbomify.com/CVE-2024-35717/): WordPress Media Slider plugin <= 1.3.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-35716](https://insights.sbomify.com/CVE-2024-35716/): WordPress Copymatic plugin <= 1.9 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-35715](https://insights.sbomify.com/CVE-2024-35715/): WordPress Bloglo and Blogvi themes affected by Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/344/