# Vulnerabilities published in 2024 - [CVE-2024-3248](https://insights.sbomify.com/CVE-2024-3248/): Stack overflow in Xpdf 4.05 due to object loop in attachments (low 2.9) - [CVE-2024-32479](https://insights.sbomify.com/CVE-2024-32479/): LibreNMS's Improper Sanitization on Service template name leads to Stored XSS (high 7.1) - [CVE-2024-32478](https://insights.sbomify.com/CVE-2024-32478/): Git Credential Manager (GCM)'s Debian package does not set root ownership on installed files (medium 6.9) - [CVE-2024-32477](https://insights.sbomify.com/CVE-2024-32477/): Race condition when flushing input stream leads to permission prompt bypass (high 7.7) - [CVE-2024-32476](https://insights.sbomify.com/CVE-2024-32476/): Denial of Service via malicious jqPathExpressions in ignoreDifferences (medium 6.5) - [CVE-2024-32475](https://insights.sbomify.com/CVE-2024-32475/): Envoy RELEASE_ASSERT using auto_sni with :authority header > 255 bytes (high 7.5) - [CVE-2024-32474](https://insights.sbomify.com/CVE-2024-32474/): Sentry's superuser cleartext password leaked in logs (high 7.3) - [CVE-2024-32473](https://insights.sbomify.com/CVE-2024-32473/): Moby IPv6 enabled on IPv4-only network interfaces (medium 4.7) - [CVE-2024-32472](https://insights.sbomify.com/CVE-2024-32472/): excalidraw vulnerable to a Stored XSS in excalidraw's web embed component (medium 6.1) - [CVE-2024-32470](https://insights.sbomify.com/CVE-2024-32470/): Tolgee' API keys created by server admin users bypass the permission check (medium 6.5) - [CVE-2024-3247](https://insights.sbomify.com/CVE-2024-3247/): Stack overflow in Xpdf 4.05 due to object loop in PDF object stream (low 2.9) - [CVE-2024-32469](https://insights.sbomify.com/CVE-2024-32469/): Decidim has cross-site scripting (XSS) in the pagination (high 7.1) - [CVE-2024-32468](https://insights.sbomify.com/CVE-2024-32468/): Improper neutralization of input during web page generation ("Cross-site Scripting") in deno_doc HTML generator (medium 5.4) - [CVE-2024-32467](https://insights.sbomify.com/CVE-2024-32467/): Meteraphsere vulnerable to unauthorized viewing by workspace members (medium 5.7) - [CVE-2024-32466](https://insights.sbomify.com/CVE-2024-32466/): Tolgee's API key scopes not checked when querying translation data (low 2.7) - [CVE-2024-32465](https://insights.sbomify.com/CVE-2024-32465/): Git's protections for cloning untrusted repositories can be bypassed (high 7.4) - [CVE-2024-32464](https://insights.sbomify.com/CVE-2024-32464/): ActionText ContentAttachment can Contain Unsanitized HTML (medium 6.1) - [CVE-2024-32463](https://insights.sbomify.com/CVE-2024-32463/): phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `` tags (high 7.1) - [CVE-2024-32462](https://insights.sbomify.com/CVE-2024-32462/): Flatpak vulnerable to a sandbox escape via RequestBackground portal due to bad argument parsing (high 8.4) - [CVE-2024-32461](https://insights.sbomify.com/CVE-2024-32461/): LibreNMS vulnerable to time-based SQL injection that leads to database extraction (high 7.1) - [CVE-2024-32460](https://insights.sbomify.com/CVE-2024-32460/): FreeRDP Out-Of-Bounds Read in interleaved_decompress (high 8.1) - [CVE-2024-3246](https://insights.sbomify.com/CVE-2024-3246/): LiteSpeed Cache <= 6.2.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1) - [CVE-2024-32459](https://insights.sbomify.com/CVE-2024-32459/): FreeRDP Out-Of-Bounds Read in ncrush_decompress (critical 9.8) - [CVE-2024-32458](https://insights.sbomify.com/CVE-2024-32458/): FreeRDP Out-Of-Bounds Read in planar_skip_plane_rle (critical 9.8) - [CVE-2024-32457](https://insights.sbomify.com/CVE-2024-32457/): WordPress Elements Plus! plugin <= 2.16.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-32456](https://insights.sbomify.com/CVE-2024-32456/): WordPress Envo Extra plugin <= 1.8.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5) - [CVE-2024-32455](https://insights.sbomify.com/CVE-2024-32455/): WordPress Fatal Error Notify plugin <= 1.5.2 - Broken Access Control vulnerability (medium 4.3) - [CVE-2024-32454](https://insights.sbomify.com/CVE-2024-32454/): WordPress Wappointment plugin <= 2.6.0 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4) - [CVE-2024-32453](https://insights.sbomify.com/CVE-2024-32453/): WordPress POEditor plugin <= 0.9.8 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-32452](https://insights.sbomify.com/CVE-2024-32452/): WordPress Shopping Cart & eCommerce Store plugin <= 5.5.19 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4) - [CVE-2024-32451](https://insights.sbomify.com/CVE-2024-32451/): WordPress Legal Pages plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32450](https://insights.sbomify.com/CVE-2024-32450/): WordPress WpTravelly plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-3245](https://insights.sbomify.com/CVE-2024-3245/): Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more (medium 6.4) - [CVE-2024-32449](https://insights.sbomify.com/CVE-2024-32449/): WordPress RestroPress plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4) - [CVE-2024-32448](https://insights.sbomify.com/CVE-2024-32448/): WordPress Ads.txt Admin plugin <= 1.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32447](https://insights.sbomify.com/CVE-2024-32447/): WordPress AWP Classifieds plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32446](https://insights.sbomify.com/CVE-2024-32446/): WordPress Wallet System for WooCommerce plugin <= 2.5.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4) - [CVE-2024-32445](https://insights.sbomify.com/CVE-2024-32445/): WordPress WebinarIgnition plugin <= 3.05.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4) - [CVE-2024-32444](https://insights.sbomify.com/CVE-2024-32444/): WordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerability (critical 9.8) - [CVE-2024-32443](https://insights.sbomify.com/CVE-2024-32443/): WordPress IP2Location Country Blocker plugin <= 2.34.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32442](https://insights.sbomify.com/CVE-2024-32442/): WordPress Zoho Campaigns plugin <= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32441](https://insights.sbomify.com/CVE-2024-32441/): WordPress Zoho Campaigns plugin <= 2.0.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32440](https://insights.sbomify.com/CVE-2024-32440/): WordPress Asgaros Forum plugin <= 2.8.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-3244](https://insights.sbomify.com/CVE-2024-3244/): Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more (medium 6.4) - [CVE-2024-32439](https://insights.sbomify.com/CVE-2024-32439/): WordPress WP Client Reports plugin <= 1.0.22 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32438](https://insights.sbomify.com/CVE-2024-32438/): WordPress SEO Booster plugin <= 3.8.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32437](https://insights.sbomify.com/CVE-2024-32437/): WordPress eCommerce Product Catalog plugin <= 3.3.28 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32436](https://insights.sbomify.com/CVE-2024-32436/): WordPress Gift Cards plugin <= 4.4.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32435](https://insights.sbomify.com/CVE-2024-32435/): WordPress AffiEasy plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32434](https://insights.sbomify.com/CVE-2024-32434/): WordPress Order Delivery Date for WooCommerce plugin <= 3.20.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32433](https://insights.sbomify.com/CVE-2024-32433/): WordPress BEAF plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3) - [CVE-2024-32432](https://insights.sbomify.com/CVE-2024-32432/): WordPress Ovic Addon Toolkit plugin <= 2.6.1 - Broken Access Control vulnerability (medium 4.3) - [CVE-2024-32431](https://insights.sbomify.com/CVE-2024-32431/): WordPress Import Users from CSV plugin <= 1.2 - PHP Object Injection (medium 4.4) - [CVE-2024-32430](https://insights.sbomify.com/CVE-2024-32430/): WordPress ActiveCampaign plugin <= 8.1.14 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4) - [CVE-2024-3243](https://insights.sbomify.com/CVE-2024-3243/): Missing authorization in Customer Reviews for WooCommerce (medium 4.3) - [CVE-2024-32429](https://insights.sbomify.com/CVE-2024-32429/): WordPress Remove Footer Credit plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-32428](https://insights.sbomify.com/CVE-2024-32428/): WordPress MWW Disclaimer Buttons plugin <= 3.0.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 5.9) - [CVE-2024-3242](https://insights.sbomify.com/CVE-2024-3242/): Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload (high 8.8) - [CVE-2024-32418](https://insights.sbomify.com/CVE-2024-32418/): Code injection in flusity:flusity (critical 9.8) - [CVE-2024-3241](https://insights.sbomify.com/CVE-2024-3241/): Ultimate Blocks < 3.1.7 - Contributor+ Stored XSS (medium 5.4) - [CVE-2024-32409](https://insights.sbomify.com/CVE-2024-32409/): Cross-site scripting in sem-cms:semcms (high 7.1) - [CVE-2024-32407](https://insights.sbomify.com/CVE-2024-32407/): Code injection in inducer:relate (high 8.8) - [CVE-2024-32406](https://insights.sbomify.com/CVE-2024-32406/): Code injection in inducer:relate (high 7.5) - [CVE-2024-32405](https://insights.sbomify.com/CVE-2024-32405/): Cross-site scripting in inducer:relate (low 2.6) - [CVE-2024-32404](https://insights.sbomify.com/CVE-2024-32404/): Code injection in inducer:relate (medium 6.0) - [CVE-2024-3240](https://insights.sbomify.com/CVE-2024-3240/): ConvertPlug <= 3.5.25 - Authenticated (Contributor+) PHP Object Injection (high 8.8) - [CVE-2024-32399](https://insights.sbomify.com/CVE-2024-32399/): Directory Traversal vulnerability in RaidenMAILD Mail Server v.4.9.4 and before allows a remote attacker to obtain sensitive information via (high 7.6) - [CVE-2024-32394](https://insights.sbomify.com/CVE-2024-32394/): An issue in ruijie.com/cn RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S_07150910 and RG-RSR10-01G-T(WA)-S RSR_3.0(1)B9P2_RSR10-01G-TW-S (high 8.8) - [CVE-2024-32392](https://insights.sbomify.com/CVE-2024-32392/): Cross-site scripting in cmsimple:cmsimple (medium 4.5) - [CVE-2024-32391](https://insights.sbomify.com/CVE-2024-32391/): Cross-site scripting in maccms:maccms (high 7.3) - [CVE-2024-3239](https://insights.sbomify.com/CVE-2024-3239/): PostX < 4.0.2 - Contributor+ Stored XSS (medium 5.4) - [CVE-2024-32389](https://insights.sbomify.com/CVE-2024-32389/): Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensiti (low 3.5) - [CVE-2024-32388](https://insights.sbomify.com/CVE-2024-32388/): Misconfiguration in kerlink:keros (medium 5.3) - [CVE-2024-32387](https://insights.sbomify.com/CVE-2024-32387/): An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via th (medium 5.7) - [CVE-2024-32386](https://insights.sbomify.com/CVE-2024-32386/): Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sen (high 7.3) - [CVE-2024-32385](https://insights.sbomify.com/CVE-2024-32385/): An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via a (medium 4.3) - [CVE-2024-32384](https://insights.sbomify.com/CVE-2024-32384/): Weak cryptography in kerlink:keros (medium 6.8) - [CVE-2024-3238](https://insights.sbomify.com/CVE-2024-3238/): WordPress Menu Plugin — Superfly Responsive Menu <= 5.0.29 - Cross-Site Request Forgery to Arbitrary File Deletion (high 8.8) - [CVE-2024-32371](https://insights.sbomify.com/CVE-2024-32371/): Privilege escalation in hsclabs:mailinspector (high 7.5) - [CVE-2024-32370](https://insights.sbomify.com/CVE-2024-32370/): Information disclosure in hsclabs:mailinspector (critical 9.8) - [CVE-2024-3237](https://insights.sbomify.com/CVE-2024-3237/): ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update (medium 5.4) - [CVE-2024-32369](https://insights.sbomify.com/CVE-2024-32369/): SQL injection in hsclabs:mailinspector (medium 4.3) - [CVE-2024-32368](https://insights.sbomify.com/CVE-2024-32368/): Insecure Permission vulnerability in Agasta Sanketlife 2.0 Pocket 12-Lead ECG Monitor FW Version 3.0 allows a local attacker to cause a deni (high 7.3) - [CVE-2024-3236](https://insights.sbomify.com/CVE-2024-3236/): Easy Notify Lite < 1.1.33 - Contributor+ Stored XSS (medium 5.4) - [CVE-2024-32359](https://insights.sbomify.com/CVE-2024-32359/): An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtai (medium 6.9) - [CVE-2024-32358](https://insights.sbomify.com/CVE-2024-32358/): Code injection in jpress:jpress (high 7.5) - [CVE-2024-32355](https://insights.sbomify.com/CVE-2024-32355/): Command injection in totolink:x5000r firmware (high 8.0) - [CVE-2024-32354](https://insights.sbomify.com/CVE-2024-32354/): Command injection in totolink:x5000r firmware (medium 6.0) - [CVE-2024-32353](https://insights.sbomify.com/CVE-2024-32353/): Command injection in totolink:x5000r firmware (critical 9.8) - [CVE-2024-32352](https://insights.sbomify.com/CVE-2024-32352/): Command injection in totolink:x5000r firmware (high 8.8) - [CVE-2024-32351](https://insights.sbomify.com/CVE-2024-32351/): Command injection in totolink:x5000r firmware (high 8.8) - [CVE-2024-32350](https://insights.sbomify.com/CVE-2024-32350/): Command injection in totolink:x5000r firmware (high 8.8) - [CVE-2024-3235](https://insights.sbomify.com/CVE-2024-3235/): Essential Grid <= 3.1.1 - Unauthenticated Private Post Disclosure (medium 5.3) - [CVE-2024-32349](https://insights.sbomify.com/CVE-2024-32349/): Command injection in totolink:x5000r firmware (medium 6.0) - [CVE-2024-32345](https://insights.sbomify.com/CVE-2024-32345/): Cross-site scripting in cmsimple:cmsimple (high 7.2) - [CVE-2024-32344](https://insights.sbomify.com/CVE-2024-32344/): Cross-site scripting in cmsimple:cmsimple (medium 6.8) - [CVE-2024-32343](https://insights.sbomify.com/CVE-2024-32343/): Cross-site scripting in boidcms:boidcms (medium 6.1) - [CVE-2024-32342](https://insights.sbomify.com/CVE-2024-32342/): Cross-site scripting in boidcms:boidcms (medium 6.1) - [CVE-2024-32341](https://insights.sbomify.com/CVE-2024-32341/): Cross-site scripting in wondercms:wondercms (medium 5.4) - [CVE-2024-32340](https://insights.sbomify.com/CVE-2024-32340/): Cross-site scripting in wondercms:wondercms (critical 9.6) --- From sbomify Insights: https://insights.sbomify.com/years/2024/page/370/