# Vulnerabilities published in 2024


- [CVE-2024-34783](https://insights.sbomify.com/CVE-2024-34783/): SQL injection in EPM (critical 9.1)
- [CVE-2024-34782](https://insights.sbomify.com/CVE-2024-34782/): SQL injection in EPM (high 7.2)
- [CVE-2024-34781](https://insights.sbomify.com/CVE-2024-34781/): SQL injection in EPM (high 7.2)
- [CVE-2024-34780](https://insights.sbomify.com/CVE-2024-34780/): SQL injection in EPM (high 7.2)
- [CVE-2024-3478](https://insights.sbomify.com/CVE-2024-3478/): Herd Effects < 5.2.7 - Effect Deletion via CSRF (medium 6.1)
- [CVE-2024-34779](https://insights.sbomify.com/CVE-2024-34779/): SQL injection in EPM (critical 9.1)
- [CVE-2024-34777](https://insights.sbomify.com/CVE-2024-34777/): dma-mapping: benchmark: fix node id validation (high 7.1)
- [CVE-2024-34776](https://insights.sbomify.com/CVE-2024-34776/): Memory corruption in Intel(R) SGX SDK software (low 2.0)
- [CVE-2024-34773](https://insights.sbomify.com/CVE-2024-34773/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2024-34772](https://insights.sbomify.com/CVE-2024-34772/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2024-34771](https://insights.sbomify.com/CVE-2024-34771/): Memory corruption in Solid Edge (high 7.8)
- [CVE-2024-34770](https://insights.sbomify.com/CVE-2024-34770/): WordPress Popup Maker WP plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3477](https://insights.sbomify.com/CVE-2024-3477/): Popup Box < 2.2.7 - Popup Deletion via CSRF (medium 4.3)
- [CVE-2024-34769](https://insights.sbomify.com/CVE-2024-34769/): WordPress Elegant Blocks – Amazing Gutenberg Blocks plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34768](https://insights.sbomify.com/CVE-2024-34768/): WordPress Fastly plugin <= 1.2.25 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34767](https://insights.sbomify.com/CVE-2024-34767/): WordPress ShopLentor plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34766](https://insights.sbomify.com/CVE-2024-34766/): WordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34765](https://insights.sbomify.com/CVE-2024-34765/): WordPress Sensei Pro (WC Paid Courses) plugin <= 4.23.1.1.23.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34763](https://insights.sbomify.com/CVE-2024-34763/): Missing authorization in Builder for WooCommerce reviews shortcodes – ReviewShort (medium 5.3)
- [CVE-2024-34762](https://insights.sbomify.com/CVE-2024-34762/): Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Local File Inclusion vulnerability (critical 9.9)
- [CVE-2024-34761](https://insights.sbomify.com/CVE-2024-34761/): Wordpress Advanced Custom Fields Pro plugin < 6.2.10 - Contributor+ Arbitrary Function Execution vulnerability (high 8.5)
- [CVE-2024-34760](https://insights.sbomify.com/CVE-2024-34760/): WordPress Magazine Blocks plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3476](https://insights.sbomify.com/CVE-2024-3476/): Side Menu Lite < 4.2.1 - Menu Deletion via CSRF (high 8.8)
- [CVE-2024-34759](https://insights.sbomify.com/CVE-2024-34759/): WordPress Picture Gallery plugin <= 1.5.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34758](https://insights.sbomify.com/CVE-2024-34758/): WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.6.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34757](https://insights.sbomify.com/CVE-2024-34757/): WordPress Borderless plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34756](https://insights.sbomify.com/CVE-2024-34756/): WordPress Integration for HubSpot and Contact Form 7 plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34755](https://insights.sbomify.com/CVE-2024-34755/): Cross-site request forgery in Integration for Contact Form 7 and Salesforce (medium 4.3)
- [CVE-2024-34754](https://insights.sbomify.com/CVE-2024-34754/): WordPress Contact Form Widget plugin <= 1.3.9 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-34753](https://insights.sbomify.com/CVE-2024-34753/): WordPress Radio Player plugin <= 2.0.73 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34752](https://insights.sbomify.com/CVE-2024-34752/): WordPress Landing Page Builder <= 1.5.1.8 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-34751](https://insights.sbomify.com/CVE-2024-34751/): WordPress Order Export & Order Import for WooCommerce plugin <= 2.4.9 - PHP Object Injection vulnerability (medium 4.4)
- [CVE-2024-34750](https://insights.sbomify.com/CVE-2024-34750/): Apache Tomcat: HTTP/2 excess header handling DoS (high 7.5)
- [CVE-2024-3475](https://insights.sbomify.com/CVE-2024-3475/): Sticky Buttons < 3.2.4 - Button Deletion via CSRF (high 7.5)
- [CVE-2024-34749](https://insights.sbomify.com/CVE-2024-34749/): Cross-site scripting in Phormer (medium 6.1)
- [CVE-2024-34748](https://insights.sbomify.com/CVE-2024-34748/): Use after free in Android (high 8.4)
- [CVE-2024-34747](https://insights.sbomify.com/CVE-2024-34747/): Use after free in Android (high 8.4)
- [CVE-2024-34743](https://insights.sbomify.com/CVE-2024-34743/): Business logic in Android (high 7.8)
- [CVE-2024-34742](https://insights.sbomify.com/CVE-2024-34742/): Business logic in Android (medium 5.5)
- [CVE-2024-34741](https://insights.sbomify.com/CVE-2024-34741/): Security feature bypass in Android (high 7.8)
- [CVE-2024-34740](https://insights.sbomify.com/CVE-2024-34740/): Integer overflow in Android (high 7.7)
- [CVE-2024-3474](https://insights.sbomify.com/CVE-2024-3474/): Wow Skype Buttons < 4.0.4 - Button Deletion via CSRF (high 8.8)
- [CVE-2024-34739](https://insights.sbomify.com/CVE-2024-34739/): Privilege escalation in Android (high 7.8)
- [CVE-2024-34738](https://insights.sbomify.com/CVE-2024-34738/): Privilege escalation in Android (high 7.7)
- [CVE-2024-34737](https://insights.sbomify.com/CVE-2024-34737/): Business logic in Android (high 7.7)
- [CVE-2024-34736](https://insights.sbomify.com/CVE-2024-34736/): Privilege escalation in Android (medium 6.2)
- [CVE-2024-34734](https://insights.sbomify.com/CVE-2024-34734/): Misconfiguration in Android (high 7.7)
- [CVE-2024-34733](https://insights.sbomify.com/CVE-2024-34733/): Integer overflow in Android (high 8.4)
- [CVE-2024-34732](https://insights.sbomify.com/CVE-2024-34732/): Race condition in Android (high 8.4)
- [CVE-2024-34731](https://insights.sbomify.com/CVE-2024-34731/): Race condition in Android (high 7.7)
- [CVE-2024-34730](https://insights.sbomify.com/CVE-2024-34730/): Security feature bypass in Android (high 7.8)
- [CVE-2024-3473](https://insights.sbomify.com/CVE-2024-3473/): Header Footer Code Manager Pro <= 1.0.16 - Reflected Cross-Site Scripting via message (medium 6.1)
- [CVE-2024-34729](https://insights.sbomify.com/CVE-2024-34729/): Business logic in Android (high 8.4)
- [CVE-2024-34727](https://insights.sbomify.com/CVE-2024-34727/): Memory corruption in Android (high 7.5)
- [CVE-2024-34726](https://insights.sbomify.com/CVE-2024-34726/): Privilege escalation in Android (high 7.8)
- [CVE-2024-34725](https://insights.sbomify.com/CVE-2024-34725/): Race condition in Android (high 7.4)
- [CVE-2024-34724](https://insights.sbomify.com/CVE-2024-34724/): Race condition in Android (high 7.0)
- [CVE-2024-34723](https://insights.sbomify.com/CVE-2024-34723/): Business logic in Android (medium 5.3)
- [CVE-2024-34722](https://insights.sbomify.com/CVE-2024-34722/): Auth bypass in Android (high 7.4)
- [CVE-2024-34721](https://insights.sbomify.com/CVE-2024-34721/): Information disclosure in Android (medium 6.2)
- [CVE-2024-34720](https://insights.sbomify.com/CVE-2024-34720/): Privilege escalation in Android (high 7.4)
- [CVE-2024-3472](https://insights.sbomify.com/CVE-2024-3472/): Modal Window < 5.3.10 - Modal Deletion via CSRF (medium 5.9)
- [CVE-2024-34719](https://insights.sbomify.com/CVE-2024-34719/): Null dereference in Android (high 8.4)
- [CVE-2024-34717](https://insights.sbomify.com/CVE-2024-34717/): Anonymous PrestaShop customer can download other customers' invoices (medium 5.3)
- [CVE-2024-34716](https://insights.sbomify.com/CVE-2024-34716/): PrestaShop vulnerable to XSS via customer contact form in FO, through file upload (critical 9.7)
- [CVE-2024-34715](https://insights.sbomify.com/CVE-2024-34715/): Partial Password Exposure Vulnerability in Fides Webserver Logs (low 2.3)
- [CVE-2024-34714](https://insights.sbomify.com/CVE-2024-34714/): Hoppscotch Extension responds to calls made by origins not in the domain list (high 7.6)
- [CVE-2024-34713](https://insights.sbomify.com/CVE-2024-34713/): sshproxy vulnerable to SSH option injection (low 3.5)
- [CVE-2024-34712](https://insights.sbomify.com/CVE-2024-34712/): Oceanic allows unsanitized user input to lead to path traversal in URLs (medium 6.5)
- [CVE-2024-34711](https://insights.sbomify.com/CVE-2024-34711/): GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) (critical 9.3)
- [CVE-2024-34710](https://insights.sbomify.com/CVE-2024-34710/): Wiki.js Stored XSS through Client Side Template Injection (high 7.1)
- [CVE-2024-3471](https://insights.sbomify.com/CVE-2024-3471/): Button Generator < 3.0 - Button Deletion via CSRF (low 3.4)
- [CVE-2024-34709](https://insights.sbomify.com/CVE-2024-34709/): Directus Lacks Session Tokens Invalidation (medium 5.4)
- [CVE-2024-34708](https://insights.sbomify.com/CVE-2024-34708/): Directus allows redacted data extraction on the API through "alias" (medium 4.9)
- [CVE-2024-34707](https://insights.sbomify.com/CVE-2024-34707/): Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pages (high 7.5)
- [CVE-2024-34706](https://insights.sbomify.com/CVE-2024-34706/): @valtimo/components exposes access token to form.io (critical 9.8)
- [CVE-2024-34704](https://insights.sbomify.com/CVE-2024-34704/): era-compiler-solidity contains a `xor(zext(cmp), -1)` misoptimization (medium 5.9)
- [CVE-2024-34703](https://insights.sbomify.com/CVE-2024-34703/): Botan Vulnerable to Denial of Service Due to Overly Large Elliptic Curve Parameters (high 7.5)
- [CVE-2024-34702](https://insights.sbomify.com/CVE-2024-34702/): Botan has a Denial of Service Due to Excessive Name Constraints (medium 5.3)
- [CVE-2024-34701](https://insights.sbomify.com/CVE-2024-34701/): CreateWiki vulnerable to impersonation of wiki requester (medium 5.9)
- [CVE-2024-3470](https://insights.sbomify.com/CVE-2024-3470/): Repository administrator can bypass organization's ruleset using deploy keys (medium 5.9)
- [CVE-2024-34699](https://insights.sbomify.com/CVE-2024-34699/): GZ::CTF allows unprivileged user can perform XSS attacks by constructing malicious team names. (medium 6.5)
- [CVE-2024-34698](https://insights.sbomify.com/CVE-2024-34698/): Prototype Pollution in getQueryParam Function (URL Query Parser) (medium 4.6)
- [CVE-2024-34697](https://insights.sbomify.com/CVE-2024-34697/): Freescout vulnerable to Stored HTML Injection in Editing Received Emails (high 7.6)
- [CVE-2024-34696](https://insights.sbomify.com/CVE-2024-34696/): GeoServer's Server Status shows sensitive environmental variables and Java properties (medium 4.5)
- [CVE-2024-34695](https://insights.sbomify.com/CVE-2024-34695/): WOWS Karma vulnerable to a post submission bounce/timing attack (medium 6.3)
- [CVE-2024-34694](https://insights.sbomify.com/CVE-2024-34694/): LNbits improperly handles potential network and payment failures when using Eclair backend (high 8.1)
- [CVE-2024-34693](https://insights.sbomify.com/CVE-2024-34693/): Apache Superset: Server arbitrary file read (medium 6.8)
- [CVE-2024-34692](https://insights.sbomify.com/CVE-2024-34692/): [CVE-2024-34692] Unrestricted File upload vulnerability in SAP Enable Now (low 3.3)
- [CVE-2024-34691](https://insights.sbomify.com/CVE-2024-34691/): Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files) (medium 6.5)
- [CVE-2024-34690](https://insights.sbomify.com/CVE-2024-34690/): Missing Authorization check in SAP Student Life Cycle Management (SLcM) (medium 5.4)
- [CVE-2024-3469](https://insights.sbomify.com/CVE-2024-3469/): GP Premium <= 2.4.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-34689](https://insights.sbomify.com/CVE-2024-34689/): [CVE-2024-34689] Server-Side Request Forgery in SAP Business Workflow (WebFlow Services) (medium 5.0)
- [CVE-2024-34688](https://insights.sbomify.com/CVE-2024-34688/): Denial of service (DOS) in SAP NetWeaver AS Java (Meta Model Repository) (high 7.5)
- [CVE-2024-34687](https://insights.sbomify.com/CVE-2024-34687/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform (medium 6.5)
- [CVE-2024-34686](https://insights.sbomify.com/CVE-2024-34686/): Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) (medium 6.1)
- [CVE-2024-34685](https://insights.sbomify.com/CVE-2024-34685/): [CVE-2024-34685] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Knowledge Management XMLEditor (medium 6.1)
- [CVE-2024-34684](https://insights.sbomify.com/CVE-2024-34684/): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Scheduling) (low 3.7)
- [CVE-2024-34683](https://insights.sbomify.com/CVE-2024-34683/): Unrestricted file upload in SAP Document Builder (HTTP service) (medium 6.5)
- [CVE-2024-34682](https://insights.sbomify.com/CVE-2024-34682/): Missing authorization in Samsung Mobile Devices (low 2.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/351/