# Vulnerabilities published in 2024


- [CVE-2024-32866](https://insights.sbomify.com/CVE-2024-32866/): Conform contains Prototype Pollution Vulnerability in `parseWith...` function (high 8.6)
- [CVE-2024-32865](https://insights.sbomify.com/CVE-2024-32865/): exacqVison - TLS certificate validation (medium 6.4)
- [CVE-2024-32864](https://insights.sbomify.com/CVE-2024-32864/): exacqVison - HTTPS Session Establishment (medium 6.4)
- [CVE-2024-32863](https://insights.sbomify.com/CVE-2024-32863/): exacqVison - CSRF issues with Web Service (medium 6.8)
- [CVE-2024-32862](https://insights.sbomify.com/CVE-2024-32862/): exacqVision CORS (medium 6.8)
- [CVE-2024-32861](https://insights.sbomify.com/CVE-2024-32861/): Software House C•CURE - CouchDB executable protection (high 7.8)
- [CVE-2024-32860](https://insights.sbomify.com/CVE-2024-32860/): Other in CPG BIOS (high 7.5)
- [CVE-2024-3286](https://insights.sbomify.com/CVE-2024-3286/): Memory corruption in Printers (high 7.5)
- [CVE-2024-32859](https://insights.sbomify.com/CVE-2024-32859/): Other in CPG BIOS (high 7.5)
- [CVE-2024-32858](https://insights.sbomify.com/CVE-2024-32858/): Other in CPG BIOS (high 7.5)
- [CVE-2024-32857](https://insights.sbomify.com/CVE-2024-32857/): Other in Dell Peripheral Manager (high 7.3)
- [CVE-2024-32856](https://insights.sbomify.com/CVE-2024-32856/): Information disclosure in CPG BIOS (medium 5.1)
- [CVE-2024-32855](https://insights.sbomify.com/CVE-2024-32855/): Memory corruption in CPG BIOS (low 3.8)
- [CVE-2024-32854](https://insights.sbomify.com/CVE-2024-32854/): Privilege escalation in PowerScale OneFS (medium 6.7)
- [CVE-2024-32853](https://insights.sbomify.com/CVE-2024-32853/): Privilege escalation in PowerScale OneFS (medium 4.4)
- [CVE-2024-32852](https://insights.sbomify.com/CVE-2024-32852/): Weak cryptography in PowerScale OneFS (medium 5.9)
- [CVE-2024-32850](https://insights.sbomify.com/CVE-2024-32850/): Command injection in SkyBridge BASIC MB-A130 (critical 9.8)
- [CVE-2024-3285](https://insights.sbomify.com/CVE-2024-3285/): Cross-site scripting in Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider (medium 6.4)
- [CVE-2024-32849](https://insights.sbomify.com/CVE-2024-32849/): Privilege escalation in Trend Micro Maximum Security (Consumer) (high 7.8)
- [CVE-2024-32848](https://insights.sbomify.com/CVE-2024-32848/): SQL injection in EPM (critical 9.1)
- [CVE-2024-32847](https://insights.sbomify.com/CVE-2024-32847/): SQL injection in EPM (high 7.2)
- [CVE-2024-32846](https://insights.sbomify.com/CVE-2024-32846/): SQL injection in EPM (critical 9.1)
- [CVE-2024-32845](https://insights.sbomify.com/CVE-2024-32845/): SQL injection in EPM (critical 9.1)
- [CVE-2024-32844](https://insights.sbomify.com/CVE-2024-32844/): SQL injection in EPM (high 7.2)
- [CVE-2024-32843](https://insights.sbomify.com/CVE-2024-32843/): SQL injection in EPM (critical 9.1)
- [CVE-2024-32842](https://insights.sbomify.com/CVE-2024-32842/): SQL injection in EPM (critical 9.1)
- [CVE-2024-32841](https://insights.sbomify.com/CVE-2024-32841/): SQL injection in EPM (high 7.2)
- [CVE-2024-32840](https://insights.sbomify.com/CVE-2024-32840/): SQL injection in EPM (critical 9.1)
- [CVE-2024-32839](https://insights.sbomify.com/CVE-2024-32839/): SQL injection in EPM (high 7.2)
- [CVE-2024-32838](https://insights.sbomify.com/CVE-2024-32838/): Apache Fineract: SQL injection vulnerabilities in offices API endpoint (critical 9.4)
- [CVE-2024-32836](https://insights.sbomify.com/CVE-2024-32836/): WordPress WP-Lister Lite for eBay plugin <= 3.5.11 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-32835](https://insights.sbomify.com/CVE-2024-32835/): WordPress Export and Import Users and Customers plugin <= 2.5.3 - Deserialization of untrusted data vulnerability (medium 5.4)
- [CVE-2024-32834](https://insights.sbomify.com/CVE-2024-32834/): WordPress WooCommerce Shipping Label plugin <= 2.3.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32833](https://insights.sbomify.com/CVE-2024-32833/): WordPress List Custom Taxonomy Widget plugin <= 4.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32832](https://insights.sbomify.com/CVE-2024-32832/): WordPress Login with Phone Number plugin <= 1.6.93 - Broken Access Control vulnerability (critical 9.8)
- [CVE-2024-32831](https://insights.sbomify.com/CVE-2024-32831/): WordPress Accessibility Widget plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32830](https://insights.sbomify.com/CVE-2024-32830/): WordPress buddyforms plugin <= 2.8.8- Arbitrary File Read and SSRF vulnerability (high 8.6)
- [CVE-2024-3283](https://insights.sbomify.com/CVE-2024-3283/): Privilege Escalation via Mass Assignment in mintplex-labs/anything-llm (high 7.2)
- [CVE-2024-32829](https://insights.sbomify.com/CVE-2024-32829/): WordPress Data Tables Generator by Supsystic plugin <= 1.10.31 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32828](https://insights.sbomify.com/CVE-2024-32828/): Missing authorization in Flexible Shipping (medium 4.3)
- [CVE-2024-32827](https://insights.sbomify.com/CVE-2024-32827/): WordPress Giveaways and Contests by RafflePress plugin <= 1.12.7 - IP Restriction Bypass vulnerability (medium 5.3)
- [CVE-2024-32826](https://insights.sbomify.com/CVE-2024-32826/): WordPress VK Block Patterns plugin <= 1.31.0 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32825](https://insights.sbomify.com/CVE-2024-32825/): WordPress Simply Static plugin <= 3.1.3 - Sensitive Data Exposure via Log File vulnerability (high 7.5)
- [CVE-2024-32824](https://insights.sbomify.com/CVE-2024-32824/): WordPress Evergreen Content Poster plugin <= 1.4.2 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-32823](https://insights.sbomify.com/CVE-2024-32823/): WordPress Rate My Post plugin <= 3.4.4 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2024-32822](https://insights.sbomify.com/CVE-2024-32822/): WordPress Reviews Plus plugin <= 1.3.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32821](https://insights.sbomify.com/CVE-2024-32821/): WordPress Total Poll Lite plugin <= 4.9.9 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32820](https://insights.sbomify.com/CVE-2024-32820/): Missing authorization in Social Share Icons & Social Share Buttons (medium 5.3)
- [CVE-2024-3282](https://insights.sbomify.com/CVE-2024-3282/): WP Table Builder <= 1.5.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-32819](https://insights.sbomify.com/CVE-2024-32819/): WordPress Culqi plugin <= 3.0.14 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-32818](https://insights.sbomify.com/CVE-2024-32818/): WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32817](https://insights.sbomify.com/CVE-2024-32817/): WordPress Import and export users and customers plugin <= 1.26.2 - PHP Object Injection vulnerability (medium 4.4)
- [CVE-2024-32816](https://insights.sbomify.com/CVE-2024-32816/): WordPress Combo Blocks plugin <= 2.2.78 - Sensitive Data Exposure via API vulnerability (high 7.5)
- [CVE-2024-32815](https://insights.sbomify.com/CVE-2024-32815/): WordPress All-in-one Like Widget plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32814](https://insights.sbomify.com/CVE-2024-32814/): WordPress Advanced Local Pickup for WooCommerce plugin <= 1.6.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32813](https://insights.sbomify.com/CVE-2024-32813/): WordPress Integrate Google Drive plugin <= 1.3.9 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32812](https://insights.sbomify.com/CVE-2024-32812/): WordPress Podlove Podcast Publisher plugin <= 4.0.11 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2024-32811](https://insights.sbomify.com/CVE-2024-32811/): Information disclosure in USPS Shipping for WooCommerce – Live Rates (medium 5.3)
- [CVE-2024-32810](https://insights.sbomify.com/CVE-2024-32810/): WordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerability (high 7.6)
- [CVE-2024-3281](https://insights.sbomify.com/CVE-2024-3281/): Missing authorization in Poly CCX devices (high 8.8)
- [CVE-2024-32809](https://insights.sbomify.com/CVE-2024-32809/): WordPress ActiveDEMAND plugin <= 0.2.41 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-32808](https://insights.sbomify.com/CVE-2024-32808/): WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object Reference (IDOR) vulnerability (medium 5.4)
- [CVE-2024-32807](https://insights.sbomify.com/CVE-2024-32807/): WordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerability (high 8.5)
- [CVE-2024-32806](https://insights.sbomify.com/CVE-2024-32806/): WordPress Headline Analyzer plugin <= 1.3.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32805](https://insights.sbomify.com/CVE-2024-32805/): WordPress Social Snap plugin <= 1.3.5 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-32804](https://insights.sbomify.com/CVE-2024-32804/): WordPress WP GoToWebinar plugin <= 14.46 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32803](https://insights.sbomify.com/CVE-2024-32803/): WordPress SuperFaktura WooCommerce plugin <= 1.40.3 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2024-32802](https://insights.sbomify.com/CVE-2024-32802/): WordPress Better Messages plugin <= 2.4.32 - Broken Authentication vulnerability (medium 5.3)
- [CVE-2024-32801](https://insights.sbomify.com/CVE-2024-32801/): WordPress Widget Post Slider plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32800](https://insights.sbomify.com/CVE-2024-32800/): WordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3280](https://insights.sbomify.com/CVE-2024-3280/): Cross-site scripting in Follow Us Badges (medium 6.4)
- [CVE-2024-32799](https://insights.sbomify.com/CVE-2024-32799/): WordPress Easy Property Listings plugin <= 3.5.3 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32798](https://insights.sbomify.com/CVE-2024-32798/): WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability (high 7.5)
- [CVE-2024-32797](https://insights.sbomify.com/CVE-2024-32797/): WordPress WP LinkedIn Auto Publish plugin <= 8.11 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-32796](https://insights.sbomify.com/CVE-2024-32796/): WordPress WP Fusion Lite plugin <= 3.42.10 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2024-32795](https://insights.sbomify.com/CVE-2024-32795/): WordPress WPCal.io <= 0.9.5.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32794](https://insights.sbomify.com/CVE-2024-32794/): WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32793](https://insights.sbomify.com/CVE-2024-32793/): WordPress Paid Memberships Pro plugin <= 2.12.10 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-32792](https://insights.sbomify.com/CVE-2024-32792/): WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32791](https://insights.sbomify.com/CVE-2024-32791/): WordPress Premium Addons for Elementor plugin <= 4.10.25 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32790](https://insights.sbomify.com/CVE-2024-32790/): WordPress Pricing Table by Supsystic plugin <= 1.9.12 - Content Injection vulnerability (medium 4.3)
- [CVE-2024-3279](https://insights.sbomify.com/CVE-2024-3279/): Improper Access Control in mintplex-labs/anything-llm (critical 9.1)
- [CVE-2024-32789](https://insights.sbomify.com/CVE-2024-32789/): WordPress Seers plugin <= 8.0.6 - Cross Site Request Forgery (CSRF) to XSS vulnerability (high 7.1)
- [CVE-2024-32788](https://insights.sbomify.com/CVE-2024-32788/): WordPress FG Joomla to Wordpress plugin <= 4.20.2 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-32787](https://insights.sbomify.com/CVE-2024-32787/): WordPress Secure Copy Content Protection and Content Locking plugin <= 3.7.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32786](https://insights.sbomify.com/CVE-2024-32786/): WordPress Royal Elementor Addons and Templates plugin <= 1.3.93 - IP Bypass vulnerability (medium 5.3)
- [CVE-2024-32785](https://insights.sbomify.com/CVE-2024-32785/): WordPress The Pack Elementor addons plugin <= 2.0.8.3 - Cross Site Request Forgery (CSRF) to XSS vulnerability (high 7.1)
- [CVE-2024-32784](https://insights.sbomify.com/CVE-2024-32784/): WordPress CookieHub plugin <= 1.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32783](https://insights.sbomify.com/CVE-2024-32783/): WordPress Advanced Testimonial Carousel for Elementor plugin <= 3.0.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32782](https://insights.sbomify.com/CVE-2024-32782/): WordPress HT Mega plugin <= 2.4.7 - Sensitive Data Exposure vulnerability (medium 4.3)
- [CVE-2024-32781](https://insights.sbomify.com/CVE-2024-32781/): WordPress Email Customizer for WooCommerce plugin <= 2.6.0 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-32780](https://insights.sbomify.com/CVE-2024-32780/): WordPress VikRentCar Car Rental Management System plugin <= 1.3.2 - Sensitive Data Exposure via Invoices vulnerability (medium 5.9)
- [CVE-2024-32779](https://insights.sbomify.com/CVE-2024-32779/): WordPress Vision – Image Map Builder plugin <= 1.7.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32778](https://insights.sbomify.com/CVE-2024-32778/): WordPress Contest Gallery plugin <= 21.3.4 - Arbitrary File Deletion vulnerability (high 8.5)
- [CVE-2024-32777](https://insights.sbomify.com/CVE-2024-32777/): WordPress BizPrint plugin <= 4.3.39 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-32776](https://insights.sbomify.com/CVE-2024-32776/): WordPress AppPresser plugin <= 4.3.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-32775](https://insights.sbomify.com/CVE-2024-32775/): WordPress Embed Google Photos album plugin <= 2.1.9 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-32774](https://insights.sbomify.com/CVE-2024-32774/): WordPress ProfileGrid plugin <= 5.8.2 - Group Members Limit Bypass vulnerability (medium 4.3)
- [CVE-2024-32773](https://insights.sbomify.com/CVE-2024-32773/): WordPress Royal Elementor Kit theme <= 1.0.116 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32772](https://insights.sbomify.com/CVE-2024-32772/): WordPress ProfileGrid plugin <= 5.7.9 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/366/