# Vulnerabilities published in 2024


- [CVE-2024-34467](https://insights.sbomify.com/CVE-2024-34467/): ThinkPHP Cross-Site Scripting Vulnerability (medium 6.1)
- [CVE-2024-34463](https://insights.sbomify.com/CVE-2024-34463/): BPL Personal Weighing Scale PWS-01BT IND/09/18/599 devices send sensitive information in unencrypted BLE packets. (medium 5.1)
- [CVE-2024-34462](https://insights.sbomify.com/CVE-2024-34462/): Cross-site scripting in alinto:sogo (medium 6.1)
- [CVE-2024-34461](https://insights.sbomify.com/CVE-2024-34461/): Zenario uses Twig filters insecurely in the Twig Snippet plugin (critical 9.8)
- [CVE-2024-34460](https://insights.sbomify.com/CVE-2024-34460/): Zenario's Tree Explorer tool from Organizer affected by Cross-site Scripting (medium 6.5)
- [CVE-2024-3446](https://insights.sbomify.com/CVE-2024-3446/): Qemu: virtio: dma reentrancy issue leads to double free vulnerability (high 8.2)
- [CVE-2024-34459](https://insights.sbomify.com/CVE-2024-34459/): Memory corruption in xmlsoft:libxml2 (high 7.5)
- [CVE-2024-34458](https://insights.sbomify.com/CVE-2024-34458/): SQL injection in keyfactor:command (high 7.5)
- [CVE-2024-34457](https://insights.sbomify.com/CVE-2024-34457/): Apache StreamPark IDOR Vulnerability (medium 6.5)
- [CVE-2024-34455](https://insights.sbomify.com/CVE-2024-34455/): Buildroot before 0b2967e lacks the sticky bit for the /dev/shm directory. (high 7.5)
- [CVE-2024-34454](https://insights.sbomify.com/CVE-2024-34454/): Nintendo Wii U OS 5.5.5 allows man-in-the-middle attackers to forge SSL certificates as though they came from a Root CA, because there is a (high 7.4)
- [CVE-2024-34453](https://insights.sbomify.com/CVE-2024-34453/): TwoNav 2.1.13 contains an SSRF vulnerability via the url paramater to index.php?c=api&method=read_data&type=connectivity_test (which reaches /system/api.php). (medium 4.3)
- [CVE-2024-34452](https://insights.sbomify.com/CVE-2024-34452/): Cross-site scripting in cmsimple-xh:cmsimple xh (medium 6.1)
- [CVE-2024-34451](https://insights.sbomify.com/CVE-2024-34451/): Security feature bypass in ghost:ghost (critical 9.1)
- [CVE-2024-3445](https://insights.sbomify.com/CVE-2024-3445/): SourceCodester Laundry Management System laporan_filter sql injection (medium 6.3)
- [CVE-2024-34449](https://insights.sbomify.com/CVE-2024-34449/): Vditor allows Cross-site Scripting via an attribute of an `A` element (medium 6.1)
- [CVE-2024-34448](https://insights.sbomify.com/CVE-2024-34448/): Ghost allows CSV Injection during member CSV export (high 8.8)
- [CVE-2024-34447](https://insights.sbomify.com/CVE-2024-34447/): Bouncy Castle Java Cryptography API vulnerable to DNS poisoning (high 7.5)
- [CVE-2024-34446](https://insights.sbomify.com/CVE-2024-34446/): Mullvad VPN through 2024.1 on Android does not set a DNS server in the blocking state (after a hard failure to create a tunnel), and thus DN (high 7.5)
- [CVE-2024-34445](https://insights.sbomify.com/CVE-2024-34445/): WordPress SKT Addons for Elementor plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34444](https://insights.sbomify.com/CVE-2024-34444/): WordPress Slider Revolution plugin < 6.7.0 - Unauthenticated Broken Access Control vulnerability (high 7.1)
- [CVE-2024-34443](https://insights.sbomify.com/CVE-2024-34443/): WordPress Slider Revolution plugin < 6.7.11 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34442](https://insights.sbomify.com/CVE-2024-34442/): WordPress weDocs plugin <= 2.1.4 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34441](https://insights.sbomify.com/CVE-2024-34441/): WordPress Easy Affiliate Links plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34440](https://insights.sbomify.com/CVE-2024-34440/): WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-3444](https://insights.sbomify.com/CVE-2024-3444/): Wangshen SecGate 3600 ?g=net_pro_keyword_import_save unrestricted upload (medium 4.7)
- [CVE-2024-34439](https://insights.sbomify.com/CVE-2024-34439/): WordPress DS Site Message plugin <= 1.14.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34438](https://insights.sbomify.com/CVE-2024-34438/): WordPress Shared Files plugin <= 1.7.19 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34437](https://insights.sbomify.com/CVE-2024-34437/): WordPress Form Maker by 10Web plugin <= 1.15.24 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34436](https://insights.sbomify.com/CVE-2024-34436/): WordPress SKT Addons for Elementor plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34435](https://insights.sbomify.com/CVE-2024-34435/): WordPress Aiomatic plugin <= 1.9.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-34434](https://insights.sbomify.com/CVE-2024-34434/): WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.2 - Arbitrary Shortcode Execution vulnerability (medium 6.5)
- [CVE-2024-34433](https://insights.sbomify.com/CVE-2024-34433/): WordPress One Click Demo Import plugin <=3.2.0 - PHP Object Injection vulnerability (medium 4.4)
- [CVE-2024-34432](https://insights.sbomify.com/CVE-2024-34432/): WordPress Better Elementor Addons plugin <= 1.4.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34431](https://insights.sbomify.com/CVE-2024-34431/): WordPress WP etracker plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-34430](https://insights.sbomify.com/CVE-2024-34430/): WordPress TT Custom Post Type Creator plugin <=1.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3443](https://insights.sbomify.com/CVE-2024-3443/): SourceCodester Prison Management System apply_leave.php cross site scripting (low 3.5)
- [CVE-2024-34429](https://insights.sbomify.com/CVE-2024-34429/): WordPress Simple Website Banner plugin <= 1.8.0.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34428](https://insights.sbomify.com/CVE-2024-34428/): WordPress AWSOM News Announcement plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34427](https://insights.sbomify.com/CVE-2024-34427/): WordPress WP Favorite Posts plugin <= 1.6.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34426](https://insights.sbomify.com/CVE-2024-34426/): WordPress Brozzme Scroll Top plugin <= 1.8.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34425](https://insights.sbomify.com/CVE-2024-34425/): WordPress QuickieBar plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34424](https://insights.sbomify.com/CVE-2024-34424/): WordPress Featured Content Gallery plugin <= 3.2.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34423](https://insights.sbomify.com/CVE-2024-34423/): WordPress Forty Four – 404 Plugin for WordPress plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34422](https://insights.sbomify.com/CVE-2024-34422/): WordPress Viet Affiliate Link plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34421](https://insights.sbomify.com/CVE-2024-34421/): WordPress BlogLentor – Blog Designer Pack for Elementor plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34420](https://insights.sbomify.com/CVE-2024-34420/): WordPress Comments Evolved for WordPress plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3442](https://insights.sbomify.com/CVE-2024-3442/): SourceCodester Prison Management System delete_leave.php sql injection (medium 6.3)
- [CVE-2024-34419](https://insights.sbomify.com/CVE-2024-34419/): WordPress Configure Login Timeout plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34418](https://insights.sbomify.com/CVE-2024-34418/): WordPress WPCS ( WordPress Custom Search ) plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34417](https://insights.sbomify.com/CVE-2024-34417/): WordPress Viet Nam Affiliate plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34416](https://insights.sbomify.com/CVE-2024-34416/): WordPress Pk Favicon Manager plugin <= 2.1 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-34415](https://insights.sbomify.com/CVE-2024-34415/): WordPress Thim Elementor Kit plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34414](https://insights.sbomify.com/CVE-2024-34414/): WordPress Raindrops theme <= 1.600 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34413](https://insights.sbomify.com/CVE-2024-34413/): WordPress SliceWP Affiliates plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34412](https://insights.sbomify.com/CVE-2024-34412/): WordPress ParcelPanel plugin <= 3.8.1 - Auth. SQL Injection vulnerability (high 8.5)
- [CVE-2024-34411](https://insights.sbomify.com/CVE-2024-34411/): WordPress canvasio3D Light plugin <= 2.5.0 - Arbitrary File Upload vulnerability (critical 9.9)
- [CVE-2024-3441](https://insights.sbomify.com/CVE-2024-3441/): SourceCodester Prison Management System edit-profile.php sql injection (medium 6.3)
- [CVE-2024-34408](https://insights.sbomify.com/CVE-2024-34408/): Integer overflow in tencent:libpag (medium 5.3)
- [CVE-2024-34406](https://insights.sbomify.com/CVE-2024-34406/): Improper exception handling in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to cause a denial of service (medium 5.3)
- [CVE-2024-34405](https://insights.sbomify.com/CVE-2024-34405/): Improper deep link validation in McAfee Security: Antivirus VPN for Android before 8.3.0 could allow an attacker to launch an arbitrary URL within the app. (critical 9.1)
- [CVE-2024-34404](https://insights.sbomify.com/CVE-2024-34404/): A vulnerability was discovered in the Alta Recovery Vault feature of Veritas NetBackup before 10.4 and NetBackup Appliance before 5.4. (medium 6.8)
- [CVE-2024-34403](https://insights.sbomify.com/CVE-2024-34403/): Integer overflow in fedoraproject:fedora (medium 5.9)
- [CVE-2024-34402](https://insights.sbomify.com/CVE-2024-34402/): Integer overflow in fedoraproject:fedora (high 8.6)
- [CVE-2024-34401](https://insights.sbomify.com/CVE-2024-34401/): Cross-site scripting in techkshetrainfo:savsoft quiz (medium 6.1)
- [CVE-2024-34400](https://insights.sbomify.com/CVE-2024-34400/): An issue was discovered in VirtoSoftware Virto Kanban Board Web Part before 5.3.5.1 for SharePoint 2019. (medium 6.1)
- [CVE-2024-3440](https://insights.sbomify.com/CVE-2024-3440/): SourceCodester Prison Management System edit_profile.php sql injection (medium 4.7)
- [CVE-2024-34399](https://insights.sbomify.com/CVE-2024-34399/): Auth bypass in bmc:remedy mid-tier (critical 9.8)
- [CVE-2024-34398](https://insights.sbomify.com/CVE-2024-34398/): Cross-site scripting in bmc:remedy mid-tier (medium 4.2)
- [CVE-2024-34397](https://insights.sbomify.com/CVE-2024-34397/): Auth bypass in debian:debian linux (medium 5.2)
- [CVE-2024-34394](https://insights.sbomify.com/CVE-2024-34394/): libxmljs2 namespaces type confusion RCE (high 8.1)
- [CVE-2024-34393](https://insights.sbomify.com/CVE-2024-34393/): libxmljs2 attrs type confusion RCE (high 8.1)
- [CVE-2024-34392](https://insights.sbomify.com/CVE-2024-34392/): libxmljs namespaces type confusion RCE (high 8.1)
- [CVE-2024-34391](https://insights.sbomify.com/CVE-2024-34391/): libxmljs attrs type confusion RCE (high 8.1)
- [CVE-2024-34390](https://insights.sbomify.com/CVE-2024-34390/): WordPress Post Grid Master plugin <= 3.4.8 - Auth. Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3439](https://insights.sbomify.com/CVE-2024-3439/): SourceCodester Prison Management System login.php sql injection (high 7.3)
- [CVE-2024-34389](https://insights.sbomify.com/CVE-2024-34389/): WordPress WP Post Author plugin <= 3.6.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-34388](https://insights.sbomify.com/CVE-2024-34388/): WordPress GDPR Compliance plugin <= 1.2.5 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-34387](https://insights.sbomify.com/CVE-2024-34387/): WordPress WP Post Author plugin <= 3.6.4 - Rating Value Manipulation vulnerability (medium 4.3)
- [CVE-2024-34386](https://insights.sbomify.com/CVE-2024-34386/): WordPress Auto Affiliate Links plugin <= 6.4.3.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-34385](https://insights.sbomify.com/CVE-2024-34385/): WordPress YITH WooCommerce Wishlist plugin <= 3.32.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34384](https://insights.sbomify.com/CVE-2024-34384/): WordPress Sina Extension for Elementor plugin <= 3.5.1 - Local File Inclusion vulnerability (medium 6.5)
- [CVE-2024-34383](https://insights.sbomify.com/CVE-2024-34383/): WordPress SEOPress plugin <= 7.7.1 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-34382](https://insights.sbomify.com/CVE-2024-34382/): WordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.18 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-34381](https://insights.sbomify.com/CVE-2024-34381/): WordPress PropertyHive plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34380](https://insights.sbomify.com/CVE-2024-34380/): WordPress ChatBot Conversational Forms plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3438](https://insights.sbomify.com/CVE-2024-3438/): SourceCodester Prison Management System login.php sql injection (high 7.3)
- [CVE-2024-34379](https://insights.sbomify.com/CVE-2024-34379/): WordPress Restaurant and Cafe theme <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-34378](https://insights.sbomify.com/CVE-2024-34378/): WordPress LeadConnector plugin <= 1.7 - API Broken Access Control vulnerability (high 8.6)
- [CVE-2024-34377](https://insights.sbomify.com/CVE-2024-34377/): Missing authorization in Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery (medium 4.3)
- [CVE-2024-34376](https://insights.sbomify.com/CVE-2024-34376/): WordPress Edge theme <= 2.0.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34375](https://insights.sbomify.com/CVE-2024-34375/): WordPress Sheets to WP Table Live Sync plugin <= 3.7.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-34374](https://insights.sbomify.com/CVE-2024-34374/): WordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34373](https://insights.sbomify.com/CVE-2024-34373/): WordPress The Plus Addons for Elementor plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-34372](https://insights.sbomify.com/CVE-2024-34372/): WordPress Post Grid Master plugin <= 3.4.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-34371](https://insights.sbomify.com/CVE-2024-34371/): WordPress Login with phone number plugin <= 1.7.18 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-34370](https://insights.sbomify.com/CVE-2024-34370/): WordPress EAN for WooCommerce plugin <= 4.8.9 - Arbitrary Option Update to Privilege Escalation vulnerability (high 7.2)
- [CVE-2024-3437](https://insights.sbomify.com/CVE-2024-3437/): SourceCodester Prison Management System Avatar add-admin.php unrestricted upload (medium 6.9)
- [CVE-2024-34369](https://insights.sbomify.com/CVE-2024-34369/): WordPress Web Push Notifications – Webpushr plugin <= 4.35.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-34368](https://insights.sbomify.com/CVE-2024-34368/): WordPress Mooberry Book Manager plugin <= 4.15.12 - Sensitive Data Exposure vulnerability (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/354/