# Vulnerabilities published in 2024


- [CVE-2024-33978](https://insights.sbomify.com/CVE-2024-33978/): Cross-site Scripting in Janobe E-Negosyo System (high 7.1)
- [CVE-2024-33977](https://insights.sbomify.com/CVE-2024-33977/): Cross-site Scripting in Janobe E-Negosyo System (high 7.1)
- [CVE-2024-33976](https://insights.sbomify.com/CVE-2024-33976/): Cross-site Scripting in Janobe E-Negosyo System (high 7.1)
- [CVE-2024-33975](https://insights.sbomify.com/CVE-2024-33975/): Cross-site Scripting in Janobe E-Negosyo System (high 7.1)
- [CVE-2024-33974](https://insights.sbomify.com/CVE-2024-33974/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33973](https://insights.sbomify.com/CVE-2024-33973/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33972](https://insights.sbomify.com/CVE-2024-33972/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33971](https://insights.sbomify.com/CVE-2024-33971/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33970](https://insights.sbomify.com/CVE-2024-33970/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33969](https://insights.sbomify.com/CVE-2024-33969/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33968](https://insights.sbomify.com/CVE-2024-33968/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33967](https://insights.sbomify.com/CVE-2024-33967/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33966](https://insights.sbomify.com/CVE-2024-33966/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33965](https://insights.sbomify.com/CVE-2024-33965/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33964](https://insights.sbomify.com/CVE-2024-33964/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33963](https://insights.sbomify.com/CVE-2024-33963/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33962](https://insights.sbomify.com/CVE-2024-33962/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33961](https://insights.sbomify.com/CVE-2024-33961/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33960](https://insights.sbomify.com/CVE-2024-33960/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33959](https://insights.sbomify.com/CVE-2024-33959/): SQL injection in Janobe products (critical 9.8)
- [CVE-2024-33958](https://insights.sbomify.com/CVE-2024-33958/): SQL injection in Janobe E-Negosyo System (critical 9.8)
- [CVE-2024-33957](https://insights.sbomify.com/CVE-2024-33957/): SQL injection in Janobe E-Negosyo System (critical 9.8)
- [CVE-2024-33956](https://insights.sbomify.com/CVE-2024-33956/): WordPress Custom WooCommerce Checkout Fields Editor plugin <= 1.3.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33955](https://insights.sbomify.com/CVE-2024-33955/): WordPress Freesia Empire theme <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33954](https://insights.sbomify.com/CVE-2024-33954/): WordPress Pliska theme <= 0.3.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33953](https://insights.sbomify.com/CVE-2024-33953/): WordPress Adventure Journal theme <= 1.7.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33952](https://insights.sbomify.com/CVE-2024-33952/): WordPress Unique theme <= 0.3.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33951](https://insights.sbomify.com/CVE-2024-33951/): WordPress Perfect Pullquotes plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33950](https://insights.sbomify.com/CVE-2024-33950/): WordPress Archives Calendar Widget plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33949](https://insights.sbomify.com/CVE-2024-33949/): WordPress Min and Max Purchase for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33948](https://insights.sbomify.com/CVE-2024-33948/): WordPress TweetScroll Widget plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability (medium 5.5)
- [CVE-2024-33947](https://insights.sbomify.com/CVE-2024-33947/): WordPress RegistrationMagic plugin <= 5.3.2.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-33946](https://insights.sbomify.com/CVE-2024-33946/): WordPress WPify Woo Czech plugin <= 4.0.10 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-33945](https://insights.sbomify.com/CVE-2024-33945/): WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33944](https://insights.sbomify.com/CVE-2024-33944/): Missing authorization in WooCommerce AWeber Newsletter Subscription (medium 6.5)
- [CVE-2024-33943](https://insights.sbomify.com/CVE-2024-33943/): WordPress Ultimate Under Construction plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33942](https://insights.sbomify.com/CVE-2024-33942/): WordPress Google Typography plugin <= 1.1.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33941](https://insights.sbomify.com/CVE-2024-33941/): WordPress iPanorama 360 plugin <= 1.8.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33940](https://insights.sbomify.com/CVE-2024-33940/): WordPress EventON plugin <= 2.2.14 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33939](https://insights.sbomify.com/CVE-2024-33939/): WordPress LMS by Masteriyo plugin <= 1.7.3 - Broken Authentication vulnerability (medium 5.3)
- [CVE-2024-33938](https://insights.sbomify.com/CVE-2024-33938/): WordPress Sliding Widgets plugin <= 1.5.0 - Broken Access Control to XSS vulnerability (medium 6.5)
- [CVE-2024-33937](https://insights.sbomify.com/CVE-2024-33937/): WordPress Progressive WordPress (PWA) plugin <= 2.1.13 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33936](https://insights.sbomify.com/CVE-2024-33936/): WordPress Print-O-Matic plugin <= 2.1.10 - Auth. Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33935](https://insights.sbomify.com/CVE-2024-33935/): WordPress PB MailCrypt plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33934](https://insights.sbomify.com/CVE-2024-33934/): WordPress Mini Loops plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33933](https://insights.sbomify.com/CVE-2024-33933/): Cross-site scripting in Elementor – Header, Footer & Blocks Template (medium 6.5)
- [CVE-2024-33932](https://insights.sbomify.com/CVE-2024-33932/): WordPress Login Logout Register Menu plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33931](https://insights.sbomify.com/CVE-2024-33931/): WordPress JW Player for WordPress plugin <= 2.3.3 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-33930](https://insights.sbomify.com/CVE-2024-33930/): WordPress Share This Image plugin <= 1.97 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-3393](https://insights.sbomify.com/CVE-2024-3393/): Palo Alto Networks PAN-OS Malicious DNS Packet (high 8.7, exploited in the wild)
- [CVE-2024-33929](https://insights.sbomify.com/CVE-2024-33929/): WordPress Directorist plugin <= 7.8.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33928](https://insights.sbomify.com/CVE-2024-33928/): Cross-site scripting in CodeBard's Patron Button and Widgets for Patreon (high 7.1)
- [CVE-2024-33927](https://insights.sbomify.com/CVE-2024-33927/): WordPress Giphypress plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33926](https://insights.sbomify.com/CVE-2024-33926/): WordPress GWP-Histats plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33925](https://insights.sbomify.com/CVE-2024-33925/): WordPress Embed Google Fonts plugin <= 3.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33924](https://insights.sbomify.com/CVE-2024-33924/): WordPress Realtyna Organic IDX plugin + WPL Real Estate plugin <= 4.14.4 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-33923](https://insights.sbomify.com/CVE-2024-33923/): WordPress SP Project & Document Manager plugin <= 4.69 - Broken Access Control vulnerability (medium 6.3)
- [CVE-2024-33922](https://insights.sbomify.com/CVE-2024-33922/): WordPress WP Media Cleaner plugin <= 6.7.2 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-33921](https://insights.sbomify.com/CVE-2024-33921/): WordPress ReviewX plugin <= 1.6.21 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33920](https://insights.sbomify.com/CVE-2024-33920/): WordPress Democracy Poll plugin <= 6.0.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33919](https://insights.sbomify.com/CVE-2024-33919/): WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-33918](https://insights.sbomify.com/CVE-2024-33918/): Cross-site scripting in AJAX Login and Registration modal popup + inline form (medium 5.9)
- [CVE-2024-33917](https://insights.sbomify.com/CVE-2024-33917/): WordPress WTI Like Post plugin <= 1.4.6 - IP Restriction Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2024-33916](https://insights.sbomify.com/CVE-2024-33916/): WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33915](https://insights.sbomify.com/CVE-2024-33915/): WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33914](https://insights.sbomify.com/CVE-2024-33914/): WordPress Exclusive Addons for Elementor plugin <= 2.6.9.1 - Broken Access Control on Post Duplication vulnerability (medium 4.3)
- [CVE-2024-33913](https://insights.sbomify.com/CVE-2024-33913/): WordPress Xserver Migrator plugin <= 1.6.1 - CSRF to Arbitrary File Upload vulnerability (critical 9.6)
- [CVE-2024-33912](https://insights.sbomify.com/CVE-2024-33912/): WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control on Paid Courses vulnerability (high 7.1)
- [CVE-2024-33911](https://insights.sbomify.com/CVE-2024-33911/): WordPress The School Management Pro plugin <= 10.3.4 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-33910](https://insights.sbomify.com/CVE-2024-33910/): WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33909](https://insights.sbomify.com/CVE-2024-33909/): WordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33908](https://insights.sbomify.com/CVE-2024-33908/): WordPress WidgetKit plugin <= 2.5.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33907](https://insights.sbomify.com/CVE-2024-33907/): WordPress Print My Blog plugin <= 3.26.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33905](https://insights.sbomify.com/CVE-2024-33905/): In Telegram WebK before 2.0.0 (488), a crafted Mini Web App allows XSS via the postMessage web_app_open_link event type. (medium 4.6)
- [CVE-2024-33904](https://insights.sbomify.com/CVE-2024-33904/): In plugins/HookSystem.cpp in Hyprland through 0.39.1 (before 28c8561), through a race condition, a local attacker can cause execution of arb (high 7.0)
- [CVE-2024-33903](https://insights.sbomify.com/CVE-2024-33903/): In CARLA through 0.9.15.2, the collision sensor mishandles some situations involving pedestrians or bicycles, in part because the collision (medium 5.9)
- [CVE-2024-33901](https://insights.sbomify.com/CVE-2024-33901/): Information disclosure in keepassxc:keepassxc (medium 6.5)
- [CVE-2024-33900](https://insights.sbomify.com/CVE-2024-33900/): Information disclosure in keepassxc:keepassxc (medium 6.5)
- [CVE-2024-33899](https://insights.sbomify.com/CVE-2024-33899/): Other in rarlab:winrar (high 7.1)
- [CVE-2024-33898](https://insights.sbomify.com/CVE-2024-33898/): Axiros AXESS Auto Configuration Server (ACS) 4.x and 5.0.0 is affected by an Incorrect Access Control vulnerability. (critical 9.8)
- [CVE-2024-33897](https://insights.sbomify.com/CVE-2024-33897/): Missing authorization in hms-networks:ewon cosy\+ firmware (critical 9.1)
- [CVE-2024-33896](https://insights.sbomify.com/CVE-2024-33896/): Command injection in hms-networks:ewon cosy\+ firmware (high 7.2)
- [CVE-2024-33895](https://insights.sbomify.com/CVE-2024-33895/): Hardcoded credentials in hms-networks:ewon cosy\+ firmware (medium 6.6)
- [CVE-2024-33894](https://insights.sbomify.com/CVE-2024-33894/): Privilege escalation in hms-networks:ewon cosy\+ firmware (high 8.8)
- [CVE-2024-33893](https://insights.sbomify.com/CVE-2024-33893/): Cross-site scripting in hms-networks:ewon cosy\+ firmware (medium 6.1)
- [CVE-2024-33892](https://insights.sbomify.com/CVE-2024-33892/): Information disclosure in hms-networks:ewon cosy\+ firmware (medium 5.3)
- [CVE-2024-33891](https://insights.sbomify.com/CVE-2024-33891/): Hardcoded credentials in delinea:secret server (high 8.8)
- [CVE-2024-33883](https://insights.sbomify.com/CVE-2024-33883/): ejs lacks certain pollution protection (medium 4.0)
- [CVE-2024-33881](https://insights.sbomify.com/CVE-2024-33881/): Information disclosure in virtosoftware:sharepoint bulk file download (high 7.5)
- [CVE-2024-33880](https://insights.sbomify.com/CVE-2024-33880/): Information disclosure in virtosoftware:sharepoint bulk file download (medium 5.3)
- [CVE-2024-3388](https://insights.sbomify.com/CVE-2024-3388/): PAN-OS: User Impersonation in GlobalProtect SSL VPN (medium 4.1)
- [CVE-2024-33879](https://insights.sbomify.com/CVE-2024-33879/): Path traversal in virtosoftware:sharepoint bulk file download (critical 9.8)
- [CVE-2024-33877](https://insights.sbomify.com/CVE-2024-33877/): Memory corruption in hdfgroup:hdf5 (high 8.8)
- [CVE-2024-33876](https://insights.sbomify.com/CVE-2024-33876/): Memory corruption in hdfgroup:hdf5 (medium 5.7)
- [CVE-2024-33875](https://insights.sbomify.com/CVE-2024-33875/): Memory corruption in hdfgroup:hdf5 (medium 5.7)
- [CVE-2024-33874](https://insights.sbomify.com/CVE-2024-33874/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2024-33873](https://insights.sbomify.com/CVE-2024-33873/): Memory corruption in hdfgroup:hdf5 (high 8.8)
- [CVE-2024-33872](https://insights.sbomify.com/CVE-2024-33872/): Keyfactor Command 10.5.x before 10.5.1 and 11.5.x before 11.5.1 allows SQL Injection which could result in code execution and escalation of privileges. (critical 9.8)
- [CVE-2024-33871](https://insights.sbomify.com/CVE-2024-33871/): Code injection in artifex:ghostscript (high 8.8)
- [CVE-2024-33870](https://insights.sbomify.com/CVE-2024-33870/): Path traversal in artifex:ghostscript (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/358/