# Vulnerabilities published in 2024


- [CVE-2024-32962](https://insights.sbomify.com/CVE-2024-32962/): XML signature verification bypass due improper verification of signature / signature spoofing (critical 10.0)
- [CVE-2024-32961](https://insights.sbomify.com/CVE-2024-32961/): WordPress Blocksy theme <= 2.0.33 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32960](https://insights.sbomify.com/CVE-2024-32960/): WordPress Booking Ultra Pro plugin 1.1.12 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-3296](https://insights.sbomify.com/CVE-2024-3296/): Rust-openssl: timing based side-channel can lead to a bleichenbacher style attack (medium 5.9)
- [CVE-2024-32959](https://insights.sbomify.com/CVE-2024-32959/): WordPress Sirv plugin <= 7.2.2 - Arbitrary Option Update to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-32958](https://insights.sbomify.com/CVE-2024-32958/): WordPress Slash Admin plugin <= 3.8.1 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-32957](https://insights.sbomify.com/CVE-2024-32957/): WordPress Page Builder: Live Composer plugin <= 1.5.38 - Broken Access Control vulnerability (medium 4.7)
- [CVE-2024-32956](https://insights.sbomify.com/CVE-2024-32956/): WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32955](https://insights.sbomify.com/CVE-2024-32955/): WordPress FV Flowplayer Video Player plugin <= 7.5.43.7212 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-32954](https://insights.sbomify.com/CVE-2024-32954/): WordPress Newsletters plugin <= 4.9.5 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-32953](https://insights.sbomify.com/CVE-2024-32953/): WordPress Newsletters plugin <= 4.9.5 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-32952](https://insights.sbomify.com/CVE-2024-32952/): WordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32951](https://insights.sbomify.com/CVE-2024-32951/): WordPress Max Addons Pro for Bricks plugin <= 1.6.1 - Unauthenticated Plugin Settings Reset vulnerability (medium 6.5)
- [CVE-2024-32950](https://insights.sbomify.com/CVE-2024-32950/): WordPress WP Media Category Management plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-3295](https://insights.sbomify.com/CVE-2024-3295/): Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (medium 6.5)
- [CVE-2024-32949](https://insights.sbomify.com/CVE-2024-32949/): WordPress Integrate Google Drive plugin <= 1.3.8 - Broken Access Control vulnerability (high 8.3)
- [CVE-2024-32948](https://insights.sbomify.com/CVE-2024-32948/): WordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerability (critical 9.1)
- [CVE-2024-32947](https://insights.sbomify.com/CVE-2024-32947/): WordPress WP ADA Compliance Check Basic plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32946](https://insights.sbomify.com/CVE-2024-32946/): Information disclosure in WBR-6012 (medium 5.9)
- [CVE-2024-32945](https://insights.sbomify.com/CVE-2024-32945/): LaTeX post content manipulation via renderer state leak across contexts (low 2.6)
- [CVE-2024-32944](https://insights.sbomify.com/CVE-2024-32944/): Path traversal in UTAU (low 3.3)
- [CVE-2024-32943](https://insights.sbomify.com/CVE-2024-32943/): Westermo L210-F2G Lynx Improper Control of Interaction Frequency (high 8.7)
- [CVE-2024-32942](https://insights.sbomify.com/CVE-2024-32942/): Misconfiguration in Intel(R) DSA installer for Windows (medium 5.4)
- [CVE-2024-32941](https://insights.sbomify.com/CVE-2024-32941/): Null dereference in Intel(R) MLC software (medium 6.9)
- [CVE-2024-32940](https://insights.sbomify.com/CVE-2024-32940/): Missing authorization in Intel(R) RAID Web Console software (medium 6.5)
- [CVE-2024-32939](https://insights.sbomify.com/CVE-2024-32939/): Email addresses of remote users visible in props regardless of server settings (medium 4.3)
- [CVE-2024-32938](https://insights.sbomify.com/CVE-2024-32938/): Privilege escalation in Intel(R) MPI Library for Windows software (medium 5.4)
- [CVE-2024-32937](https://insights.sbomify.com/CVE-2024-32937/): Command injection in GXP2135 (high 8.1)
- [CVE-2024-32936](https://insights.sbomify.com/CVE-2024-32936/): media: ti: j721e-csi2rx: Fix races while restarting DMA (high 7.8)
- [CVE-2024-32932](https://insights.sbomify.com/CVE-2024-32932/): American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - stored web interface (medium 6.8)
- [CVE-2024-32931](https://insights.sbomify.com/CVE-2024-32931/): exacqVison - Token Disclosed in URL (medium 5.7)
- [CVE-2024-32930](https://insights.sbomify.com/CVE-2024-32930/): Information disclosure in Android (medium 5.5)
- [CVE-2024-3293](https://insights.sbomify.com/CVE-2024-3293/): SQL injection in rtMedia for WordPress, BuddyPress and bbPress (high 8.8)
- [CVE-2024-32929](https://insights.sbomify.com/CVE-2024-32929/): Use after free in Android (high 8.1)
- [CVE-2024-32928](https://insights.sbomify.com/CVE-2024-32928/): Security feature bypass in Nest Speakers (medium 5.9)
- [CVE-2024-32927](https://insights.sbomify.com/CVE-2024-32927/): Use after free in Android (high 7.8)
- [CVE-2024-32926](https://insights.sbomify.com/CVE-2024-32926/): Information disclosure in Android (medium 5.5)
- [CVE-2024-32925](https://insights.sbomify.com/CVE-2024-32925/): Memory corruption in Android (high 8.8)
- [CVE-2024-32924](https://insights.sbomify.com/CVE-2024-32924/): Denial of service in Android (high 7.5)
- [CVE-2024-32923](https://insights.sbomify.com/CVE-2024-32923/): Denial of service in Android (medium 4.0)
- [CVE-2024-32922](https://insights.sbomify.com/CVE-2024-32922/): Privilege escalation in Android (high 7.4)
- [CVE-2024-32921](https://insights.sbomify.com/CVE-2024-32921/): Memory corruption in Android (high 7.4)
- [CVE-2024-32920](https://insights.sbomify.com/CVE-2024-32920/): Memory corruption in Android (high 7.1)
- [CVE-2024-3292](https://insights.sbomify.com/CVE-2024-3292/): Race Condition (high 8.2)
- [CVE-2024-32919](https://insights.sbomify.com/CVE-2024-32919/): Memory corruption in Android (high 7.8)
- [CVE-2024-32918](https://insights.sbomify.com/CVE-2024-32918/): Security feature bypass in Android (medium 6.1)
- [CVE-2024-32917](https://insights.sbomify.com/CVE-2024-32917/): Memory corruption in Android (high 7.1)
- [CVE-2024-32916](https://insights.sbomify.com/CVE-2024-32916/): Information disclosure in Android (medium 5.9)
- [CVE-2024-32915](https://insights.sbomify.com/CVE-2024-32915/): Memory corruption in Android (medium 4.3)
- [CVE-2024-32914](https://insights.sbomify.com/CVE-2024-32914/): Information disclosure in Android (medium 5.5)
- [CVE-2024-32913](https://insights.sbomify.com/CVE-2024-32913/): Integer overflow in Android (critical 9.8)
- [CVE-2024-32912](https://insights.sbomify.com/CVE-2024-32912/): Denial of service in Android (medium 5.5)
- [CVE-2024-32911](https://insights.sbomify.com/CVE-2024-32911/): Weak cryptography in Android (high 7.5)
- [CVE-2024-32910](https://insights.sbomify.com/CVE-2024-32910/): Information disclosure in Android (medium 5.5)
- [CVE-2024-3291](https://insights.sbomify.com/CVE-2024-3291/): Privilege Escalation (high 7.8)
- [CVE-2024-32909](https://insights.sbomify.com/CVE-2024-32909/): Memory corruption in Android (high 8.1)
- [CVE-2024-32908](https://insights.sbomify.com/CVE-2024-32908/): Race condition in Android (high 8.4)
- [CVE-2024-32907](https://insights.sbomify.com/CVE-2024-32907/): Memory corruption in Android (high 8.4)
- [CVE-2024-32906](https://insights.sbomify.com/CVE-2024-32906/): Privilege escalation in Android (high 7.8)
- [CVE-2024-32905](https://insights.sbomify.com/CVE-2024-32905/): Memory corruption in Android (critical 9.8)
- [CVE-2024-32904](https://insights.sbomify.com/CVE-2024-32904/): Memory corruption in Android (medium 4.7)
- [CVE-2024-32903](https://insights.sbomify.com/CVE-2024-32903/): Memory corruption in Android (high 7.4)
- [CVE-2024-32902](https://insights.sbomify.com/CVE-2024-32902/): Denial of service in Android (high 7.5)
- [CVE-2024-32901](https://insights.sbomify.com/CVE-2024-32901/): Memory corruption in Android (high 7.8)
- [CVE-2024-32900](https://insights.sbomify.com/CVE-2024-32900/): Use after free in Android (critical 9.8)
- [CVE-2024-3290](https://insights.sbomify.com/CVE-2024-3290/): Race Condition (high 8.2)
- [CVE-2024-32899](https://insights.sbomify.com/CVE-2024-32899/): Race condition in Android (high 7.0)
- [CVE-2024-32898](https://insights.sbomify.com/CVE-2024-32898/): Memory corruption in Android (medium 4.7)
- [CVE-2024-32897](https://insights.sbomify.com/CVE-2024-32897/): Memory corruption in Android (medium 5.9)
- [CVE-2024-32896](https://insights.sbomify.com/CVE-2024-32896/): Android Pixel Privilege Escalation (high 8.1, exploited in the wild)
- [CVE-2024-32895](https://insights.sbomify.com/CVE-2024-32895/): Memory corruption in Android (critical 9.8)
- [CVE-2024-32894](https://insights.sbomify.com/CVE-2024-32894/): Memory corruption in Android (high 7.5)
- [CVE-2024-32893](https://insights.sbomify.com/CVE-2024-32893/): Memory corruption in Android (high 8.1)
- [CVE-2024-32892](https://insights.sbomify.com/CVE-2024-32892/): Memory corruption in Android (high 7.8)
- [CVE-2024-32891](https://insights.sbomify.com/CVE-2024-32891/): Race condition in Android (high 7.0)
- [CVE-2024-32890](https://insights.sbomify.com/CVE-2024-32890/): Stored Cross-site Scripting in results JSON API in librespeed/speedtest (medium 6.1)
- [CVE-2024-3289](https://insights.sbomify.com/CVE-2024-3289/): Misconfiguration in Nessus (high 7.8)
- [CVE-2024-32888](https://insights.sbomify.com/CVE-2024-32888/): Amazon JDBC Driver for Redshift SQL Injection via line comment generation (critical 10.0)
- [CVE-2024-32887](https://insights.sbomify.com/CVE-2024-32887/): Reflected XSS in sidekiq (medium 5.5)
- [CVE-2024-32886](https://insights.sbomify.com/CVE-2024-32886/): Vitess vulnerable to infinite memory consumption and vtgate crash (medium 4.9)
- [CVE-2024-32884](https://insights.sbomify.com/CVE-2024-32884/): gix-transport indirect code execution via malicious username (medium 6.4)
- [CVE-2024-32883](https://insights.sbomify.com/CVE-2024-32883/): MCUboot Injection attack of unprotected TLV values (high 7.7)
- [CVE-2024-32882](https://insights.sbomify.com/CVE-2024-32882/): Permission check bypass when editing a model with per-field restrictions in wagtail (low 2.7)
- [CVE-2024-32881](https://insights.sbomify.com/CVE-2024-32881/): Unauthorized access to GET/SET of Slack Bot Tokens in Danswer (critical 9.8)
- [CVE-2024-32880](https://insights.sbomify.com/CVE-2024-32880/): pyLoad allows upload to arbitrary folder lead to RCE (critical 9.1)
- [CVE-2024-3288](https://insights.sbomify.com/CVE-2024-3288/): Logo Slider < 4.0.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-32879](https://insights.sbomify.com/CVE-2024-32879/): social-auth-app-django Improper Handling of Case Sensitivity vulnerability (medium 4.9)
- [CVE-2024-32878](https://insights.sbomify.com/CVE-2024-32878/): Use of Uninitialized Variable Vulnerability in llama.cpp (high 7.1)
- [CVE-2024-32877](https://insights.sbomify.com/CVE-2024-32877/): Reflected Cross-site Scripting in yiisoft/yii2 Debug mode (medium 4.2)
- [CVE-2024-32876](https://insights.sbomify.com/CVE-2024-32876/): NewPipe has potential security vulnerability when importing settings (high 8.5)
- [CVE-2024-32875](https://insights.sbomify.com/CVE-2024-32875/): Hugo doesn't escape markdown title in internal render hooks (medium 6.1)
- [CVE-2024-32874](https://insights.sbomify.com/CVE-2024-32874/): In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of Service (medium 6.8)
- [CVE-2024-32873](https://insights.sbomify.com/CVE-2024-32873/): evmos allows transferring unvested tokens after delegations (low 3.5)
- [CVE-2024-32872](https://insights.sbomify.com/CVE-2024-32872/): Umbraco Workflow's Backoffice users can execute arbitrary SQL (medium 5.5)
- [CVE-2024-32871](https://insights.sbomify.com/CVE-2024-32871/): Pimcore Vulnerable to Flooding Server with Thumbnail files (high 7.5)
- [CVE-2024-32870](https://insights.sbomify.com/CVE-2024-32870/): iTop hub connector Information disclosure (medium 5.8)
- [CVE-2024-3287](https://insights.sbomify.com/CVE-2024-3287/): SmartCrawl WordPress SEO checker, SEO analyzer, SEO optimizer <= 3.10.2 - Missing Authorization (medium 5.3)
- [CVE-2024-32869](https://insights.sbomify.com/CVE-2024-32869/): Hono vulnerable to Restricted Directory Traversal in serveStatic with deno (medium 5.3)
- [CVE-2024-32868](https://insights.sbomify.com/CVE-2024-32868/): ZITADEL's Improper Lockout Mechanism Leads to MFA Bypass (medium 6.5)
- [CVE-2024-32867](https://insights.sbomify.com/CVE-2024-32867/): Suricata's defrag contains various issues leading to policy bypass (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/365/