# Vulnerabilities published in 2024


- [CVE-2024-32675](https://insights.sbomify.com/CVE-2024-32675/): WordPress Order Limit for WooCommerce plugin <= 2.0.0 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-32674](https://insights.sbomify.com/CVE-2024-32674/): Cross-site scripting in Heateor Social Login WordPress (medium 5.4)
- [CVE-2024-32673](https://insights.sbomify.com/CVE-2024-32673/): Memory corruption in Walrus (medium 6.7)
- [CVE-2024-32672](https://insights.sbomify.com/CVE-2024-32672/): Memory corruption in Escargot (medium 5.3)
- [CVE-2024-32671](https://insights.sbomify.com/CVE-2024-32671/): Memory corruption in Escargot (medium 6.9)
- [CVE-2024-32670](https://insights.sbomify.com/CVE-2024-32670/): Information disclosure in Galaxy SmartTag2 (high 7.0)
- [CVE-2024-3267](https://insights.sbomify.com/CVE-2024-3267/): Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_price_list Shortcode (medium 6.4)
- [CVE-2024-32669](https://insights.sbomify.com/CVE-2024-32669/): Possible stack overflow due to a string encoding processing error (medium 5.3)
- [CVE-2024-32668](https://insights.sbomify.com/CVE-2024-32668/): bhyve(8) privileged guest escape via USB controller (high 8.2)
- [CVE-2024-32667](https://insights.sbomify.com/CVE-2024-32667/): Memory corruption in OpenCL(TM) software (low 2.4)
- [CVE-2024-32666](https://insights.sbomify.com/CVE-2024-32666/): Null dereference in Intel(R) RAID Web Console software (medium 4.7)
- [CVE-2024-32664](https://insights.sbomify.com/CVE-2024-32664/): Suricata's base64 contains an out of bounds write (medium 5.3)
- [CVE-2024-32663](https://insights.sbomify.com/CVE-2024-32663/): Suricata 's http2 parser contains an improper compressed header handling can lead to resource starvation (high 7.5)
- [CVE-2024-32662](https://insights.sbomify.com/CVE-2024-32662/): FreeRDP rdp_redirection_read_base64_wchar out of bound read (high 7.5)
- [CVE-2024-32661](https://insights.sbomify.com/CVE-2024-32661/): FreeRDP rdp_write_logon_info_v1 NULL access (high 7.5)
- [CVE-2024-32660](https://insights.sbomify.com/CVE-2024-32660/): FreeRDP zgfx_decompress out of memory vulnerability (high 7.5)
- [CVE-2024-3266](https://insights.sbomify.com/CVE-2024-3266/): Bold Page Builder <= 4.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget URL Attribute (medium 6.4)
- [CVE-2024-32659](https://insights.sbomify.com/CVE-2024-32659/): freerdp_image_copy out of bound read (critical 9.8)
- [CVE-2024-32658](https://insights.sbomify.com/CVE-2024-32658/): FreeRDP ExtractRunLengthRegular* out of bound read (critical 9.8)
- [CVE-2024-32657](https://insights.sbomify.com/CVE-2024-32657/): Hydra has persistent XSS vulnerability serving HTML build outputs (medium 4.6)
- [CVE-2024-32656](https://insights.sbomify.com/CVE-2024-32656/): Ant Media Server vulnerable to local privilege escalation (high 7.8)
- [CVE-2024-32655](https://insights.sbomify.com/CVE-2024-32655/): Npgsql Vulnerable to SQL Injection via Protocol Message Size Overflow (high 8.1)
- [CVE-2024-32653](https://insights.sbomify.com/CVE-2024-32653/): Insufficient input filtering of "package name" allows command execution in the device with shell privileges (medium 6.1)
- [CVE-2024-32652](https://insights.sbomify.com/CVE-2024-32652/): @hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsed (high 7.5)
- [CVE-2024-32651](https://insights.sbomify.com/CVE-2024-32651/): Server Side Template Injection in Jinja2 allows Remote Command Execution (critical 10.0)
- [CVE-2024-32650](https://insights.sbomify.com/CVE-2024-32650/): Rustls vulnerable to an infinite loop in rustls::conn::ConnectionCommon::complete_io() with proper client input (high 7.5)
- [CVE-2024-3265](https://insights.sbomify.com/CVE-2024-3265/): WP Advanced Search <= 1.1.6 - Admin+ SQL Injection (medium 4.7)
- [CVE-2024-32649](https://insights.sbomify.com/CVE-2024-32649/): vyper performs double eval of the argument of sqrt (medium 5.3)
- [CVE-2024-32648](https://insights.sbomify.com/CVE-2024-32648/): vyper default functions don't respect nonreentrancy keys (medium 5.3)
- [CVE-2024-32647](https://insights.sbomify.com/CVE-2024-32647/): vyper performs double eval of raw_args in create_from_blueprint (medium 5.3)
- [CVE-2024-32646](https://insights.sbomify.com/CVE-2024-32646/): vyper performs double eval of the slice args when buffer from adhoc locations (medium 5.3)
- [CVE-2024-32645](https://insights.sbomify.com/CVE-2024-32645/): vyper performs incorrect topic logging in raw_log (medium 5.3)
- [CVE-2024-32644](https://insights.sbomify.com/CVE-2024-32644/): Evmos' transaction execution not accounting for all state transition after interaction with precompiles (critical 9.1)
- [CVE-2024-32643](https://insights.sbomify.com/CVE-2024-32643/): Masa CMS vulnerable to authentication bypass with /tag/ (high 7.5)
- [CVE-2024-32642](https://insights.sbomify.com/CVE-2024-32642/): Host header poisoning allows account takeover via password reset email (high 8.8)
- [CVE-2024-32641](https://insights.sbomify.com/CVE-2024-32641/): Masa CMS Vulnerable to Pre-Auth RCE via JSON API (critical 9.8)
- [CVE-2024-32640](https://insights.sbomify.com/CVE-2024-32640/): MasaCMS SQL Injection vulnerability (critical 9.8)
- [CVE-2024-3264](https://insights.sbomify.com/CVE-2024-3264/): Broken or Risky Cryptographic Algorithm in Mia Technology's Mia-Med Health Aplication (medium 5.3)
- [CVE-2024-32639](https://insights.sbomify.com/CVE-2024-32639/): Memory corruption in Tecnomatix Plant Simulation V2302 (high 7.8)
- [CVE-2024-32638](https://insights.sbomify.com/CVE-2024-32638/): Apache APISIX: Forward-Auth Request Smuggling (medium 6.3)
- [CVE-2024-32637](https://insights.sbomify.com/CVE-2024-32637/): Null dereference in JT2Go (medium 4.8)
- [CVE-2024-32636](https://insights.sbomify.com/CVE-2024-32636/): Memory corruption in JT2Go (high 7.3)
- [CVE-2024-32635](https://insights.sbomify.com/CVE-2024-32635/): Memory corruption in JT2Go (high 7.3)
- [CVE-2024-32634](https://insights.sbomify.com/CVE-2024-32634/): Logically dead code (medium 6.1)
- [CVE-2024-32633](https://insights.sbomify.com/CVE-2024-32633/): Unsigned compared against 0 (medium 4.0)
- [CVE-2024-32632](https://insights.sbomify.com/CVE-2024-32632/): Printf arg type mismatch in ATCMD (medium 6.6)
- [CVE-2024-32631](https://insights.sbomify.com/CVE-2024-32631/): Out-of-bounds read in telephony (high 7.2)
- [CVE-2024-3263](https://insights.sbomify.com/CVE-2024-3263/): Improper authentication in YMS VIS Pro (critical 9.8)
- [CVE-2024-32625](https://insights.sbomify.com/CVE-2024-32625/): Uninitialized scalar field (medium 5.8)
- [CVE-2024-32624](https://insights.sbomify.com/CVE-2024-32624/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-32623](https://insights.sbomify.com/CVE-2024-32623/): Memory corruption in hdfgroup:hdf5 (high 8.8)
- [CVE-2024-32622](https://insights.sbomify.com/CVE-2024-32622/): Memory corruption in hdfgroup:hdf5 (critical 9.1)
- [CVE-2024-32621](https://insights.sbomify.com/CVE-2024-32621/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2024-32620](https://insights.sbomify.com/CVE-2024-32620/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-3262](https://insights.sbomify.com/CVE-2024-3262/): Information exposure vulnerability in Request Tracker (RT) (medium 5.5)
- [CVE-2024-32619](https://insights.sbomify.com/CVE-2024-32619/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-32618](https://insights.sbomify.com/CVE-2024-32618/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-32617](https://insights.sbomify.com/CVE-2024-32617/): Memory corruption in hdfgroup:hdf5 (high 8.8)
- [CVE-2024-32616](https://insights.sbomify.com/CVE-2024-32616/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-32615](https://insights.sbomify.com/CVE-2024-32615/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2024-32614](https://insights.sbomify.com/CVE-2024-32614/): Memory corruption in hdfgroup:hdf5 (high 8.8)
- [CVE-2024-32613](https://insights.sbomify.com/CVE-2024-32613/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-32612](https://insights.sbomify.com/CVE-2024-32612/): Memory corruption in hdfgroup:hdf5 (high 7.4)
- [CVE-2024-32611](https://insights.sbomify.com/CVE-2024-32611/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2024-32610](https://insights.sbomify.com/CVE-2024-32610/): Use after free in hdfgroup:hdf5 (medium 5.7)
- [CVE-2024-3261](https://insights.sbomify.com/CVE-2024-3261/): Strong Testimonials < 3.1.12 - Contributor+ Stored XSS (medium 4.8)
- [CVE-2024-32609](https://insights.sbomify.com/CVE-2024-32609/): Denial of service in hdfgroup:hdf5 (high 7.5)
- [CVE-2024-32608](https://insights.sbomify.com/CVE-2024-32608/): Memory corruption in hdfgroup:hdf5 (critical 9.8)
- [CVE-2024-32607](https://insights.sbomify.com/CVE-2024-32607/): Memory corruption in hdfgroup:hdf5 (medium 5.7)
- [CVE-2024-32606](https://insights.sbomify.com/CVE-2024-32606/): Memory corruption in hdfgroup:hdf5 (medium 5.7)
- [CVE-2024-32605](https://insights.sbomify.com/CVE-2024-32605/): Memory corruption in hdfgroup:hdf5 (high 8.8)
- [CVE-2024-32604](https://insights.sbomify.com/CVE-2024-32604/): WordPress WP-Recall plugin <= 16.26.5 - Insecure Direct Object References (IDOR) vulnerability (medium 4.3)
- [CVE-2024-32603](https://insights.sbomify.com/CVE-2024-32603/): WordPress WooBuddy plugin <= 3.4.20 - PHP Object Injection vulnerability (high 8.5)
- [CVE-2024-32602](https://insights.sbomify.com/CVE-2024-32602/): WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.3.1 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-32601](https://insights.sbomify.com/CVE-2024-32601/): WordPress Popup Anything plugin <= 2.8 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-32600](https://insights.sbomify.com/CVE-2024-32600/): WordPress Master Slider plugin <= 3.9.5 - PHP Object Injection vulnerability (high 8.3)
- [CVE-2024-32599](https://insights.sbomify.com/CVE-2024-32599/): WordPress WP Dummy Content Generator plugin <= 3.2.1 - Arbitrary Code Execution vulnerability (critical 10.0)
- [CVE-2024-32598](https://insights.sbomify.com/CVE-2024-32598/): WordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32597](https://insights.sbomify.com/CVE-2024-32597/): WordPress WP Smart Import plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32596](https://insights.sbomify.com/CVE-2024-32596/): WordPress DSGVO Youtube plugin <= 1.4.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32595](https://insights.sbomify.com/CVE-2024-32595/): WordPress WP Helper Premium plugin < 4.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32594](https://insights.sbomify.com/CVE-2024-32594/): WordPress Attesa Extra plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32593](https://insights.sbomify.com/CVE-2024-32593/): WordPress WPBITS Addons For Elementor Page Builder plugin <= 1.3.4.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32592](https://insights.sbomify.com/CVE-2024-32592/): Cross-site scripting in Void Elementor WHMCS Elements For Elementor Page Builder (medium 6.5)
- [CVE-2024-32591](https://insights.sbomify.com/CVE-2024-32591/): WordPress Backend Designer plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32590](https://insights.sbomify.com/CVE-2024-32590/): WordPress Kattene plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3259](https://insights.sbomify.com/CVE-2024-3259/): SourceCodester Internship Portal Management System delete_activity.php sql injection (medium 6.3)
- [CVE-2024-32589](https://insights.sbomify.com/CVE-2024-32589/): WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Broken Access Control to XSS vulnerability (high 7.1)
- [CVE-2024-32588](https://insights.sbomify.com/CVE-2024-32588/): WordPress LearnPress Export Import plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32587](https://insights.sbomify.com/CVE-2024-32587/): WordPress EnvíaloSimple plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability (medium 5.8)
- [CVE-2024-32586](https://insights.sbomify.com/CVE-2024-32586/): WordPress Gutenberg Block Editor Toolkit plugin <= 1.40.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32585](https://insights.sbomify.com/CVE-2024-32585/): WordPress Import Content in WordPress & WooCommerce with Excel plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32584](https://insights.sbomify.com/CVE-2024-32584/): WordPress TeraWallet plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32583](https://insights.sbomify.com/CVE-2024-32583/): WordPress Photo Gallery by 10Web plugin <= 1.8.21 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32582](https://insights.sbomify.com/CVE-2024-32582/): WordPress Debug Log Manager plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32581](https://insights.sbomify.com/CVE-2024-32581/): WordPress Mortgage Calculators WP plugin <= 1.56 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32580](https://insights.sbomify.com/CVE-2024-32580/): WordPress Master Slider plugin <= 3.9.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3258](https://insights.sbomify.com/CVE-2024-3258/): SourceCodester Internship Portal Management System add_activity.php sql injection (medium 6.3)
- [CVE-2024-32579](https://insights.sbomify.com/CVE-2024-32579/): Cross-site scripting in Restaurant Menu – Food Ordering System – Table Reservation (medium 6.5)
- [CVE-2024-32578](https://insights.sbomify.com/CVE-2024-32578/): WordPress Sliderby10Web plugin <= 1.2.54 - Cross Site Scripting (XSS) vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/368/