# Vulnerabilities published in 2024


- [CVE-2024-33686](https://insights.sbomify.com/CVE-2024-33686/): Broken Access Control vulnerability affecting multiple WordPress themes by Extend Themes (medium 4.3)
- [CVE-2024-33685](https://insights.sbomify.com/CVE-2024-33685/): WordPress Startupzy theme <= 1.1.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33684](https://insights.sbomify.com/CVE-2024-33684/): WordPress Save as PDF plugin by Pdfcrowd plugin <= 3.2.0 - Broken Access Control to Stored XSS vulnerability (medium 6.5)
- [CVE-2024-33683](https://insights.sbomify.com/CVE-2024-33683/): WordPress Hide Dashboard Notifications plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-33682](https://insights.sbomify.com/CVE-2024-33682/): WordPress WP GDPR Compliance plugin <= 2.0.23 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-33681](https://insights.sbomify.com/CVE-2024-33681/): WordPress Regenerate post permalink plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) leading to XSS vulnerability (high 7.1)
- [CVE-2024-33680](https://insights.sbomify.com/CVE-2024-33680/): WordPress MainWP Child Reports plugin <= 2.1.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-3368](https://insights.sbomify.com/CVE-2024-3368/): All in One SEO < 4.6.1.1 - Contributor+ Stored XSS (medium 6.1)
- [CVE-2024-33679](https://insights.sbomify.com/CVE-2024-33679/): WordPress FameTheme Demo Importer plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-33678](https://insights.sbomify.com/CVE-2024-33678/): WordPress ClickCease Click Fraud Protection plugin <= 3.2.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-33677](https://insights.sbomify.com/CVE-2024-33677/): WordPress Contact Form 7 Extension For Mailchimp plugin <= 0.5.70 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-33673](https://insights.sbomify.com/CVE-2024-33673/): Privilege escalation in veritas:backup exec (high 7.8)
- [CVE-2024-33672](https://insights.sbomify.com/CVE-2024-33672/): Other in veritas:netbackup (high 7.7)
- [CVE-2024-33671](https://insights.sbomify.com/CVE-2024-33671/): Path traversal in veritas:backup exec (high 7.7)
- [CVE-2024-33670](https://insights.sbomify.com/CVE-2024-33670/): Passbolt API allows HTML injection (medium 4.3)
- [CVE-2024-3367](https://insights.sbomify.com/CVE-2024-3367/): Argument injection to runmqsc (medium 6.5)
- [CVE-2024-33669](https://insights.sbomify.com/CVE-2024-33669/): Passbolt Browser Extension leaks password information (medium 6.1)
- [CVE-2024-33668](https://insights.sbomify.com/CVE-2024-33668/): Missing authorization in zammad:zammad (critical 9.1)
- [CVE-2024-33667](https://insights.sbomify.com/CVE-2024-33667/): Missing authorization in zammad:zammad (medium 6.5)
- [CVE-2024-33666](https://insights.sbomify.com/CVE-2024-33666/): Missing authorization in zammad:zammad (high 8.6)
- [CVE-2024-33665](https://insights.sbomify.com/CVE-2024-33665/): angular-translate through 2.19.1 allows XSS via a crafted key that is used by the translate directive. (medium 6.1)
- [CVE-2024-33664](https://insights.sbomify.com/CVE-2024-33664/): python-jose denial of service via compressed JWE content (medium 5.3)
- [CVE-2024-33663](https://insights.sbomify.com/CVE-2024-33663/): Weak cryptography in python-jose project:python-jose (medium 6.5)
- [CVE-2024-33662](https://insights.sbomify.com/CVE-2024-33662/): Portainer improperly uses an encryption algorithm in the AesEncrypt function (high 7.5)
- [CVE-2024-33661](https://insights.sbomify.com/CVE-2024-33661/): Open redirect in portainer:portainer (critical 9.1)
- [CVE-2024-33660](https://insights.sbomify.com/CVE-2024-33660/): Potential Firmware update without integrity check (medium 5.2)
- [CVE-2024-3366](https://insights.sbomify.com/CVE-2024-3366/): Xuxueli xxl-job Template JdkSerializeTool.java deserialize injection (low 3.5)
- [CVE-2024-33659](https://insights.sbomify.com/CVE-2024-33659/): BiosGuard Buffer Overflow and TOCTOU Vulnerability (medium 5.7)
- [CVE-2024-33658](https://insights.sbomify.com/CVE-2024-33658/): Buffer Overflow Vulnerability In OFBD (medium 4.4)
- [CVE-2024-33657](https://insights.sbomify.com/CVE-2024-33657/): Smm Callout in SmmComputrace Module (high 7.8)
- [CVE-2024-33656](https://insights.sbomify.com/CVE-2024-33656/): Memory Leak in SmmComuptrace Module (high 7.8)
- [CVE-2024-33655](https://insights.sbomify.com/CVE-2024-33655/): The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS qu (high 7.5)
- [CVE-2024-33654](https://insights.sbomify.com/CVE-2024-33654/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-33653](https://insights.sbomify.com/CVE-2024-33653/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-33652](https://insights.sbomify.com/CVE-2024-33652/): WordPress Client Dash plugin <= 2.2.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33651](https://insights.sbomify.com/CVE-2024-33651/): WordPress MF Gig Calendar plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-33650](https://insights.sbomify.com/CVE-2024-33650/): WordPress Serious Slider plugin <= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3365](https://insights.sbomify.com/CVE-2024-3365/): SourceCodester Online Library System controller.php cross site scripting (low 3.5)
- [CVE-2024-33649](https://insights.sbomify.com/CVE-2024-33649/): WordPress Opal Widgets For Elementor plugin <= 1.6.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33648](https://insights.sbomify.com/CVE-2024-33648/): WordPress Recencio Book Reviews plugin <= 1.66.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-33647](https://insights.sbomify.com/CVE-2024-33647/): Missing authorization in Polarion ALM (medium 6.5)
- [CVE-2024-33646](https://insights.sbomify.com/CVE-2024-33646/): WordPress Sticky Anything plugin <= 2.1.5 - Broken Access Control to XSS vulnerability (high 7.1)
- [CVE-2024-33645](https://insights.sbomify.com/CVE-2024-33645/): WordPress Easy Set Favicon plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-33644](https://insights.sbomify.com/CVE-2024-33644/): WordPress Customify Site Library plugin <= 0.0.9 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2024-33643](https://insights.sbomify.com/CVE-2024-33643/): WordPress Advanced Most Recent Posts Mod plugin <= 1.6.5.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33642](https://insights.sbomify.com/CVE-2024-33642/): WordPress Advanced Post List plugin <= 0.5.6.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33641](https://insights.sbomify.com/CVE-2024-33641/): WordPress Custom field finder plugin <= 0.3 - PHP Object Injection vulnerability (medium 5.4)
- [CVE-2024-33640](https://insights.sbomify.com/CVE-2024-33640/): WordPress Pretty Google Calendar plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3364](https://insights.sbomify.com/CVE-2024-3364/): SourceCodester Online Library System index.php cross site scripting (low 3.5)
- [CVE-2024-33639](https://insights.sbomify.com/CVE-2024-33639/): WordPress PopupAlly plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33638](https://insights.sbomify.com/CVE-2024-33638/): WordPress Smart Maintenance Mode plugin <= 1.4.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-33637](https://insights.sbomify.com/CVE-2024-33637/): WordPress Solid Affiliate plugin <= 1.9.1 - Sensitive Data Exposure via Log File vulnerability (high 7.5)
- [CVE-2024-33636](https://insights.sbomify.com/CVE-2024-33636/): WordPress WP Page Post Widget Clone plugin <= 1.0.1 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-33635](https://insights.sbomify.com/CVE-2024-33635/): Missing authorization in Piotnet Addons For Elementor Pro (high 7.5)
- [CVE-2024-33634](https://insights.sbomify.com/CVE-2024-33634/): Server-side request forgery in Piotnet Addons For Elementor Pro (medium 5.4)
- [CVE-2024-33633](https://insights.sbomify.com/CVE-2024-33633/): WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-33632](https://insights.sbomify.com/CVE-2024-33632/): WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-33631](https://insights.sbomify.com/CVE-2024-33631/): Cross-site scripting in Piotnet Addons For Elementor Pro (medium 6.5)
- [CVE-2024-33630](https://insights.sbomify.com/CVE-2024-33630/): WordPress Piotnet Addons For Elementor plugin <= 2.4.26 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3363](https://insights.sbomify.com/CVE-2024-3363/): SourceCodester Online Library System index.php sql injection (high 7.3)
- [CVE-2024-33629](https://insights.sbomify.com/CVE-2024-33629/): WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 4.0.0 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2024-33628](https://insights.sbomify.com/CVE-2024-33628/): WordPress XforWooCommerce plugin <= 2.0.2 - Authenticated Local File Inclusion vulnerability (high 8.8)
- [CVE-2024-33627](https://insights.sbomify.com/CVE-2024-33627/): WordPress AGCA – Custom Dashboard & Login Page plugin <= 7.2.2 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2024-33626](https://insights.sbomify.com/CVE-2024-33626/): Information disclosure in WBR-6012 (medium 5.3)
- [CVE-2024-33625](https://insights.sbomify.com/CVE-2024-33625/): CyberPower PowerPanel business Use of Hard-coded Password (critical 9.8)
- [CVE-2024-33624](https://insights.sbomify.com/CVE-2024-33624/): Denial of service in Intel(R) PROSet/Wireless WiFi software for Windows (medium 5.3)
- [CVE-2024-33623](https://insights.sbomify.com/CVE-2024-33623/): Denial of service in WBR-6012 (low 3.7)
- [CVE-2024-33622](https://insights.sbomify.com/CVE-2024-33622/): Missing authorization in FUJITSU Business Application ID Link Manager II (medium 6.5)
- [CVE-2024-33621](https://insights.sbomify.com/CVE-2024-33621/): ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (medium 5.5)
- [CVE-2024-33620](https://insights.sbomify.com/CVE-2024-33620/): Path traversal in FUJITSU Business Application ID Link Manager II (high 8.6)
- [CVE-2024-3362](https://insights.sbomify.com/CVE-2024-3362/): SourceCodester Online Library System controller.php sql injection (high 7.3)
- [CVE-2024-33619](https://insights.sbomify.com/CVE-2024-33619/): efi: libstub: only free priv.runtime_map when allocated (high 7.8)
- [CVE-2024-33618](https://insights.sbomify.com/CVE-2024-33618/): Denial of service in BVMS (high 7.5)
- [CVE-2024-33617](https://insights.sbomify.com/CVE-2024-33617/): Information disclosure in Intel(R) QAT Engine for OpenSSL software (high 8.2)
- [CVE-2024-33616](https://insights.sbomify.com/CVE-2024-33616/): Auth bypass in Multiple MFPs (multifunction printers) (medium 5.3)
- [CVE-2024-33615](https://insights.sbomify.com/CVE-2024-33615/): CyberPower PowerPanel business Relative Path Traversal (high 8.8)
- [CVE-2024-33612](https://insights.sbomify.com/CVE-2024-33612/): BIG-IP Next Central Manager vulnerability (medium 6.8)
- [CVE-2024-33611](https://insights.sbomify.com/CVE-2024-33611/): Denial of service in Intel(R) PROSet/Wireless WiFi software for Windows (medium 4.6)
- [CVE-2024-33610](https://insights.sbomify.com/CVE-2024-33610/): Missing authorization in Multiple MFPs (multifunction printers) (critical 9.1)
- [CVE-2024-3361](https://insights.sbomify.com/CVE-2024-3361/): SourceCodester Online Library System deweydecimal.php sql injection (high 7.3)
- [CVE-2024-33608](https://insights.sbomify.com/CVE-2024-33608/): BIG-IP IPsec vulnerability (high 7.5)
- [CVE-2024-33607](https://insights.sbomify.com/CVE-2024-33607/): Memory corruption in Intel(R) TDX module software (medium 5.7)
- [CVE-2024-33606](https://insights.sbomify.com/CVE-2024-33606/): MicroDicom DICOM Viewer Improper Authorization in Handler for Custom URL Scheme (high 8.6)
- [CVE-2024-33605](https://insights.sbomify.com/CVE-2024-33605/): Path traversal in Multiple MFPs (multifunction printers) (high 7.5)
- [CVE-2024-33604](https://insights.sbomify.com/CVE-2024-33604/): BIG-IP Configuration utility XSS vulnerability (medium 6.1)
- [CVE-2024-33603](https://insights.sbomify.com/CVE-2024-33603/): Information disclosure in WBR-6012 (medium 5.3)
- [CVE-2024-33602](https://insights.sbomify.com/CVE-2024-33602/): nscd: netgroup cache assumes NSS callback uses in-buffer strings (high 7.4)
- [CVE-2024-33601](https://insights.sbomify.com/CVE-2024-33601/): nscd: netgroup cache may terminate daemon on memory allocation failure (high 7.3)
- [CVE-2024-33600](https://insights.sbomify.com/CVE-2024-33600/): nscd: Null pointer crashes after notfound response (medium 5.9)
- [CVE-2024-3360](https://insights.sbomify.com/CVE-2024-3360/): SourceCodester Online Library System index.php sql injection (high 7.3)
- [CVE-2024-33599](https://insights.sbomify.com/CVE-2024-33599/): nscd: Stack-based buffer overflow in netgroup cache (high 8.1)
- [CVE-2024-33598](https://insights.sbomify.com/CVE-2024-33598/): WordPress Annual Archive plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-33597](https://insights.sbomify.com/CVE-2024-33597/): WordPress SSU plugin <= 1.5.0 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-33596](https://insights.sbomify.com/CVE-2024-33596/): WordPress Five Star Restaurant Reservations plugin <= 2.6.16 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-33595](https://insights.sbomify.com/CVE-2024-33595/): WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on Duplicate Post vulnerability (medium 4.3)
- [CVE-2024-33594](https://insights.sbomify.com/CVE-2024-33594/): WordPress Leaky Paywall plugin <= 4.20.8 - Price Manipulation vulnerability (high 7.5)
- [CVE-2024-33593](https://insights.sbomify.com/CVE-2024-33593/): WordPress Smart Forms plugin <= 2.6.91 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-33592](https://insights.sbomify.com/CVE-2024-33592/): WordPress Radio Player plugin <= 2.0.73 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2024-33591](https://insights.sbomify.com/CVE-2024-33591/): WordPress Easy Accept Payments for PayPal plugin <= 4.9.10 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-33590](https://insights.sbomify.com/CVE-2024-33590/): WordPress basepress plugin <= 2.16.1 - Server Side Request Forgery (SSRF) vulnerability (medium 5.0)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/360/