# Vulnerabilities published in 2024


- [CVE-2024-32771](https://insights.sbomify.com/CVE-2024-32771/): QTS, QuTS hero (low 2.6)
- [CVE-2024-32770](https://insights.sbomify.com/CVE-2024-32770/): Photo Station (medium 6.3)
- [CVE-2024-3277](https://insights.sbomify.com/CVE-2024-3277/): Yumpu ePaper publishing <= 2.0.24 - Missing Authorization to PDF Upload, Publishing, and API Key Modification (medium 5.0)
- [CVE-2024-32769](https://insights.sbomify.com/CVE-2024-32769/): Photo Station (medium 6.3)
- [CVE-2024-32768](https://insights.sbomify.com/CVE-2024-32768/): Photo Station (medium 6.3)
- [CVE-2024-32767](https://insights.sbomify.com/CVE-2024-32767/): Photo Station (medium 6.3)
- [CVE-2024-32766](https://insights.sbomify.com/CVE-2024-32766/): QTS, QuTS hero, QuTScloud (critical 10.0)
- [CVE-2024-32765](https://insights.sbomify.com/CVE-2024-32765/): QTS, QuTS hero (medium 4.2)
- [CVE-2024-32764](https://insights.sbomify.com/CVE-2024-32764/): myQNAPcloud Link (critical 9.9)
- [CVE-2024-32763](https://insights.sbomify.com/CVE-2024-32763/): QTS, QuTS hero (medium 5.3)
- [CVE-2024-32762](https://insights.sbomify.com/CVE-2024-32762/): QuLog Center (high 8.2)
- [CVE-2024-32761](https://insights.sbomify.com/CVE-2024-32761/): BIG-IP TMM tenants on VELOS and rSeries vulnerability (medium 6.5)
- [CVE-2024-32760](https://insights.sbomify.com/CVE-2024-32760/): NGINX HTTP/3 QUIC vulnerability (medium 6.5)
- [CVE-2024-3276](https://insights.sbomify.com/CVE-2024-3276/): FooBox (Free and Premium) < 2.7.28 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-32759](https://insights.sbomify.com/CVE-2024-32759/): Johnson Controls Software House C●CURE 9000 installer password strength (high 7.7)
- [CVE-2024-32758](https://insights.sbomify.com/CVE-2024-32758/): exacqVision - Key exchanges (critical 9.0)
- [CVE-2024-32757](https://insights.sbomify.com/CVE-2024-32757/): American Dynamics Illustra Essentials Gen 4 - Linux Credential Leak (medium 6.8)
- [CVE-2024-32756](https://insights.sbomify.com/CVE-2024-32756/): American Dynamics Illustra Essentials Gen 4 - Reversible User Credential - Linux (medium 6.8)
- [CVE-2024-32755](https://insights.sbomify.com/CVE-2024-32755/): American Dynamics Illustra Essentials Gen 4 - Log Filter Input Validation (critical 9.1)
- [CVE-2024-32754](https://insights.sbomify.com/CVE-2024-32754/): Johnson Controls Kantech KT1, KT2, and KT400 Door Controllers - Exposure of Sensitive Information (low 3.1)
- [CVE-2024-32753](https://insights.sbomify.com/CVE-2024-32753/): TYCO Illustra Pro Gen 4 - JQuery version (high 7.0)
- [CVE-2024-32752](https://insights.sbomify.com/CVE-2024-32752/): Johnson Controls Software House iSTAR Configuration Utility (ICU) Tool (high 8.8)
- [CVE-2024-3275](https://insights.sbomify.com/CVE-2024-3275/): eRoom – Zoom Meetings & Webinar <= 1.4.18 - Missing Authorization to Information Exposure (medium 4.3)
- [CVE-2024-32746](https://insights.sbomify.com/CVE-2024-32746/): Cross-site scripting in wondercms:wondercms (medium 4.6)
- [CVE-2024-32745](https://insights.sbomify.com/CVE-2024-32745/): Cross-site scripting in wondercms:wondercms (medium 5.9)
- [CVE-2024-32744](https://insights.sbomify.com/CVE-2024-32744/): Cross-site scripting in wondercms:wondercms (medium 4.6)
- [CVE-2024-32743](https://insights.sbomify.com/CVE-2024-32743/): Cross-site scripting in wondercms:wondercms (medium 5.5)
- [CVE-2024-32742](https://insights.sbomify.com/CVE-2024-32742/): Misconfiguration in SIMATIC CN 4100 (high 7.6)
- [CVE-2024-32741](https://insights.sbomify.com/CVE-2024-32741/): Hardcoded credentials in SIMATIC CN 4100 (critical 10.0)
- [CVE-2024-32740](https://insights.sbomify.com/CVE-2024-32740/): Hardcoded credentials in SIMATIC CN 4100 (critical 9.8)
- [CVE-2024-3274](https://insights.sbomify.com/CVE-2024-3274/): D-Link DNS-320L/DNS-320LW/DNS-327L HTTP GET Request info.cgi information disclosure (medium 5.3)
- [CVE-2024-32739](https://insights.sbomify.com/CVE-2024-32739/): CyberPower PowerPanel Enterprise SQL Injection (high 7.5)
- [CVE-2024-32738](https://insights.sbomify.com/CVE-2024-32738/): CyberPower PowerPanel Enterprise SQL Injection (high 7.5)
- [CVE-2024-32737](https://insights.sbomify.com/CVE-2024-32737/): CyberPower PowerPanel Enterprise SQL Injection (high 7.5)
- [CVE-2024-32736](https://insights.sbomify.com/CVE-2024-32736/): CyberPower PowerPanel Enterprise SQL Injection (high 7.5)
- [CVE-2024-32735](https://insights.sbomify.com/CVE-2024-32735/): CyberPower PowerPanel Enterprise Missing Authentication (critical 9.8)
- [CVE-2024-32733](https://insights.sbomify.com/CVE-2024-32733/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (medium 6.1)
- [CVE-2024-32732](https://insights.sbomify.com/CVE-2024-32732/): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence platform (medium 5.3)
- [CVE-2024-32731](https://insights.sbomify.com/CVE-2024-32731/): Missing Authorization check in SAP My Travel Requests (medium 5.5)
- [CVE-2024-32730](https://insights.sbomify.com/CVE-2024-32730/): Missing authorization check in SAP Enable Now Manager (medium 6.5)
- [CVE-2024-3273](https://insights.sbomify.com/CVE-2024-3273/): D-Link Multiple NAS Devices Command Injection (high 7.3, exploited in the wild)
- [CVE-2024-32729](https://insights.sbomify.com/CVE-2024-32729/): WordPress ChatBot Conversational Forms plugin <= 1.1.8 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2024-32728](https://insights.sbomify.com/CVE-2024-32728/): WordPress Paid Membership Subscriptions plugin <= 2.11.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32727](https://insights.sbomify.com/CVE-2024-32727/): WordPress RomethemeForm For Elementor plugin <= 1.1.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32726](https://insights.sbomify.com/CVE-2024-32726/): WordPress Frontend Dashboard plugin <= 2.2.2 - Sensitive Data Exposure on PII vulnerability (high 7.5)
- [CVE-2024-32725](https://insights.sbomify.com/CVE-2024-32725/): WordPress 5 Stars Rating Funnel plugin 1.2.67 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32724](https://insights.sbomify.com/CVE-2024-32724/): Missing authorization in Sharkdropship dropshipping for Aliexpress, eBay, Amazon, etsy (high 7.5)
- [CVE-2024-32723](https://insights.sbomify.com/CVE-2024-32723/): WordPress Advanced Floating Content plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32722](https://insights.sbomify.com/CVE-2024-32722/): WordPress Coupon & Discount Code Reveal Button plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32721](https://insights.sbomify.com/CVE-2024-32721/): WordPress Jeg Elementor Kit plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32720](https://insights.sbomify.com/CVE-2024-32720/): WordPress Appointment Hour Booking plugin <= 1.4.56 - Captcha Bypass vulnerability (medium 5.3)
- [CVE-2024-3272](https://insights.sbomify.com/CVE-2024-3272/): D-Link Multiple NAS Devices Use of Hard-Coded Credentials (critical 9.8, exploited in the wild)
- [CVE-2024-32719](https://insights.sbomify.com/CVE-2024-32719/): WordPress WP Club Manager plugin <= 2.2.11 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32718](https://insights.sbomify.com/CVE-2024-32718/): WordPress The Pack Elementor addons plugin <= 2.0.8.2 - Server Side Request Forgery (SSRF) vulnerability (medium 4.9)
- [CVE-2024-32717](https://insights.sbomify.com/CVE-2024-32717/): WordPress SchedulePress plugin <= 5.0.8 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-32716](https://insights.sbomify.com/CVE-2024-32716/): WordPress StreamWeasels Twitch Integration plugin <= 1.7.8 - API Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-32715](https://insights.sbomify.com/CVE-2024-32715/): WordPress Olive One Click Demo Import plugin <= 1.1.1 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2024-32714](https://insights.sbomify.com/CVE-2024-32714/): WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32713](https://insights.sbomify.com/CVE-2024-32713/): WordPress AI Post Generator | AutoWriter plugin <= 3.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-32712](https://insights.sbomify.com/CVE-2024-32712/): WordPress Podlove Podcast Publisher plugin <= 4.0.14 - Broken Access Control vulnerability (high 7.5)
- [CVE-2024-32711](https://insights.sbomify.com/CVE-2024-32711/): WordPress myCred plugin <= 2.6.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32710](https://insights.sbomify.com/CVE-2024-32710/): WordPress WP-Recall plugin <= 16.26.5 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-3271](https://insights.sbomify.com/CVE-2024-3271/): Command Injection in run-llama/llama_index (critical 9.8)
- [CVE-2024-32709](https://insights.sbomify.com/CVE-2024-32709/): WordPress WP-Recall plugin <= 16.26.5 - SQL Injection vulnerability (critical 9.3)
- [CVE-2024-32708](https://insights.sbomify.com/CVE-2024-32708/): WordPress Maintenance Mode plugin <= 3.0.1 - IP Bypass vulnerability (low 3.7)
- [CVE-2024-32707](https://insights.sbomify.com/CVE-2024-32707/): WordPress Image Slider plugin <= 1.1.125 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32706](https://insights.sbomify.com/CVE-2024-32706/): WordPress ARForms plugin <= 6.4 - Subscriber+ SQL Injection vulnerability (high 8.5)
- [CVE-2024-32705](https://insights.sbomify.com/CVE-2024-32705/): WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary Plugin Activation/Deactivation Vulnerability (high 7.1)
- [CVE-2024-32704](https://insights.sbomify.com/CVE-2024-32704/): WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary WordPress Options Removal vulnerability (high 7.1)
- [CVE-2024-32703](https://insights.sbomify.com/CVE-2024-32703/): WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary File Deletion vulnerability (high 7.7)
- [CVE-2024-32702](https://insights.sbomify.com/CVE-2024-32702/): WordPress ARForms plugin <= 6.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32701](https://insights.sbomify.com/CVE-2024-32701/): WordPress InstaWP Connect plugin <= 0.1.0.24 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32700](https://insights.sbomify.com/CVE-2024-32700/): WordPress Kognetiks Chatbot for WordPress plugin <= 2.0.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-3270](https://insights.sbomify.com/CVE-2024-3270/): ThingsBoard AdvancedFeature access control (low 3.8)
- [CVE-2024-32699](https://insights.sbomify.com/CVE-2024-32699/): WordPress YITH WooCommerce Compare plugin <= 2.37.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32698](https://insights.sbomify.com/CVE-2024-32698/): WordPress Happy Addons for Elementor plugin <= 3.10.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32697](https://insights.sbomify.com/CVE-2024-32697/): WordPress HelloAsso plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32696](https://insights.sbomify.com/CVE-2024-32696/): WordPress AI Infographic Maker OpenAI plugin <= 4.6.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32695](https://insights.sbomify.com/CVE-2024-32695/): WordPress Language Switcher for Transposh plugin <= 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32694](https://insights.sbomify.com/CVE-2024-32694/): WordPress 3D FlipBook, PDF Viewer, PDF Embedder plugin <= 3.62 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32693](https://insights.sbomify.com/CVE-2024-32693/): WordPress Automatic plugin < 3.93.0 - Multiple Cross Site Request Forgery (CSRF) vulnerability (high 7.6)
- [CVE-2024-32692](https://insights.sbomify.com/CVE-2024-32692/): WordPress Chauffeur Taxi Booking System for WordPress plugin <= 6.9 - Broken Authentication vulnerability (high 8.2)
- [CVE-2024-32691](https://insights.sbomify.com/CVE-2024-32691/): WordPress Active Products Tables for WooCommerce plugin <= 1.0.6.2 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32690](https://insights.sbomify.com/CVE-2024-32690/): WordPress RSS Feed Widget plugin <= 2.9.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3269](https://insights.sbomify.com/CVE-2024-3269/): Download Monitor <= 4.9.13 - Missing Authorization (medium 5.4)
- [CVE-2024-32689](https://insights.sbomify.com/CVE-2024-32689/): WordPress WP Social Comments plugin <= 1.7.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32688](https://insights.sbomify.com/CVE-2024-32688/): WordPress MyRewards plugin <= 5.3.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-32687](https://insights.sbomify.com/CVE-2024-32687/): WordPress WPC Frequently Bought Together for WooCommerce plugin <= 7.0.3 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32686](https://insights.sbomify.com/CVE-2024-32686/): WordPress Backup Migration plugin <= 1.4.3 - Sensitive Data Exposure via Log vulnerability (medium 5.3)
- [CVE-2024-32685](https://insights.sbomify.com/CVE-2024-32685/): WordPress WP Ultimate Review plugin <= 2.2.5 - Review Score Manipulation vulnerability (medium 5.3)
- [CVE-2024-32684](https://insights.sbomify.com/CVE-2024-32684/): WordPress WP Ultimate Review plugin <= 2.2.5 - Broken Access Control on Review vulnerability (medium 5.3)
- [CVE-2024-32683](https://insights.sbomify.com/CVE-2024-32683/): WordPress WP Ultimate Review plugin <= 2.2.5 - Insecure Direct Object References (IDOR) vulnerability (medium 5.3)
- [CVE-2024-32682](https://insights.sbomify.com/CVE-2024-32682/): WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability (high 7.1)
- [CVE-2024-32681](https://insights.sbomify.com/CVE-2024-32681/): WordPress Prime Slider plugin <= 3.13.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32680](https://insights.sbomify.com/CVE-2024-32680/): WordPress HUSKY plugin <= 1.3.5.2 - Remote Code Execution (RCE) vulnerability (high 8.8)
- [CVE-2024-3268](https://insights.sbomify.com/CVE-2024-3268/): Missing authorization in Video Gallery – YouTube Gallery & Responsive Video Playlist (medium 5.3)
- [CVE-2024-32679](https://insights.sbomify.com/CVE-2024-32679/): WordPress Shared Files plugin <= 1.7.16 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32678](https://insights.sbomify.com/CVE-2024-32678/): WordPress TrackShip for WooCommerce plugin <= 1.7.5 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32677](https://insights.sbomify.com/CVE-2024-32677/): WordPress LoginPress Pro plugin < 3.0.0 - Unauth. License Activation/Deactivation vulnerability (medium 6.5)
- [CVE-2024-32676](https://insights.sbomify.com/CVE-2024-32676/): WordPress LoginPress Pro plugin < 3.0.0 - Captcha Bypass vulnerability (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/367/