# Vulnerabilities published in 2024


- [CVE-2024-32133](https://insights.sbomify.com/CVE-2024-32133/): WordPress EZ Form Calculator plugin <= 2.14.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-32132](https://insights.sbomify.com/CVE-2024-32132/): WordPress CBX Bookmark & Favorite plugin <= 1.7.20 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-32131](https://insights.sbomify.com/CVE-2024-32131/): WordPress Download Manager plugin <= 3.2.82 - File Password Lock Bypass vulnerability (medium 5.3)
- [CVE-2024-32130](https://insights.sbomify.com/CVE-2024-32130/): WordPress Payment Forms for Paystack plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3213](https://insights.sbomify.com/CVE-2024-3213/): Relevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update (medium 5.3)
- [CVE-2024-32129](https://insights.sbomify.com/CVE-2024-32129/): WordPress Freshdesk (official) plugin <= 2.3.6 - Open Redirection vulnerability (medium 4.7)
- [CVE-2024-32128](https://insights.sbomify.com/CVE-2024-32128/): WordPress Realtyna Organic IDX plugin + WPL Real Estate plugin <= 4.14.4 - Unauthenticated SQL Injection vulnerability (critical 9.3)
- [CVE-2024-32127](https://insights.sbomify.com/CVE-2024-32127/): WordPress Find Duplicates plugin <= 1.4.6 - Auth. SQL Injection vulnerability (high 8.5)
- [CVE-2024-32126](https://insights.sbomify.com/CVE-2024-32126/): WordPress Navigation menu as dropdown Widget plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32125](https://insights.sbomify.com/CVE-2024-32125/): WordPress BA Book Everything plugin <= 1.6.4 - Auth. SQL Injection vulnerability (high 8.5)
- [CVE-2024-32124](https://insights.sbomify.com/CVE-2024-32124/): Missing authorization in FortiIsolator (medium 4.0)
- [CVE-2024-32123](https://insights.sbomify.com/CVE-2024-32123/): Command injection in FortiAnalyzer (medium 6.5)
- [CVE-2024-32122](https://insights.sbomify.com/CVE-2024-32122/): Information disclosure in FortiOS (low 2.1)
- [CVE-2024-32119](https://insights.sbomify.com/CVE-2024-32119/): Auth bypass in FortiClientEMS (medium 4.6)
- [CVE-2024-32118](https://insights.sbomify.com/CVE-2024-32118/): Command injection in FortiAnalyzer (medium 6.3)
- [CVE-2024-32117](https://insights.sbomify.com/CVE-2024-32117/): Path traversal in FortiAnalyzer (medium 4.7)
- [CVE-2024-32116](https://insights.sbomify.com/CVE-2024-32116/): Path traversal in FortiAnalyzer (medium 4.8)
- [CVE-2024-32115](https://insights.sbomify.com/CVE-2024-32115/): Path traversal in FortiManager (medium 5.2)
- [CVE-2024-32114](https://insights.sbomify.com/CVE-2024-32114/): Apache ActiveMQ: Jolokia and REST API were not secured with default configuration (high 8.5)
- [CVE-2024-32113](https://insights.sbomify.com/CVE-2024-32113/): Apache OFBiz Path Traversal (critical 9.1, exploited in the wild)
- [CVE-2024-32112](https://insights.sbomify.com/CVE-2024-32112/): WordPress Leadinfo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32111](https://insights.sbomify.com/CVE-2024-32111/): WordPress core < 6.5.5 - Auth. Arbitrary .html File Read (Windows Only) vulnerability (medium 5.0)
- [CVE-2024-32110](https://insights.sbomify.com/CVE-2024-32110/): Cross-site request forgery in WpEvently (medium 4.3)
- [CVE-2024-3211](https://insights.sbomify.com/CVE-2024-3211/): Shopping Cart & eCommerce Store <= 5.6.3 - Authenticated (Contributor+) SQL Injection (high 8.8)
- [CVE-2024-32109](https://insights.sbomify.com/CVE-2024-32109/): WordPress WP Matterport Shortcode plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32108](https://insights.sbomify.com/CVE-2024-32108/): WordPress Convert Post Types plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32107](https://insights.sbomify.com/CVE-2024-32107/): WordPress Finale Lite plugin <= 2.18.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32106](https://insights.sbomify.com/CVE-2024-32106/): WordPress WP Compress plugin <= 6.10.35 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32105](https://insights.sbomify.com/CVE-2024-32105/): Cross-site request forgery in ELEX WooCommerce Dynamic Pricing and Discounts (medium 4.3)
- [CVE-2024-32104](https://insights.sbomify.com/CVE-2024-32104/): WordPress NextMove Lite plugin <= 2.18.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32103](https://insights.sbomify.com/CVE-2024-32103/): WordPress Siteimprove plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-32102](https://insights.sbomify.com/CVE-2024-32102/): WordPress Crony Cronjob Manager plugin <= 0.5.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32101](https://insights.sbomify.com/CVE-2024-32101/): WordPress Email Marketing for WooCommerce plugin <= 1.14.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32100](https://insights.sbomify.com/CVE-2024-32100/): WordPress Easy Digital Downloads plugin <= 3.2.11 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-3210](https://insights.sbomify.com/CVE-2024-3210/): Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 6.4)
- [CVE-2024-32099](https://insights.sbomify.com/CVE-2024-32099/): WordPress WP Mail Catcher plugin <= 2.1.6 - Cross Site Request Forgery vulnerability (medium 4.3)
- [CVE-2024-32098](https://insights.sbomify.com/CVE-2024-32098/): WordPress Advanced Page Visit Counter plugin <= 8.0.6 - Auth. SQL Injection (SQLi) vulnerability (high 7.6)
- [CVE-2024-32097](https://insights.sbomify.com/CVE-2024-32097/): WordPress GEO my WordPress plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-32096](https://insights.sbomify.com/CVE-2024-32096/): WordPress WP Synchro plugin <= 1.11.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-32095](https://insights.sbomify.com/CVE-2024-32095/): WordPress MultiParcels Shipping For WooCommerce plugin < 1.16.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32094](https://insights.sbomify.com/CVE-2024-32094/): WordPress Church Content plugin <= 2.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32093](https://insights.sbomify.com/CVE-2024-32093/): WordPress Novelist plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-32092](https://insights.sbomify.com/CVE-2024-32092/): WordPress Kimili Flash Embed plugin <= 2.5.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-32091](https://insights.sbomify.com/CVE-2024-32091/): WordPress Sangar Slider plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 6.5)
- [CVE-2024-32090](https://insights.sbomify.com/CVE-2024-32090/): WordPress Church Admin plugin <= 4.0.27 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3209](https://insights.sbomify.com/CVE-2024-3209/): UPX bele.h get_ne64 heap-based overflow (medium 5.5)
- [CVE-2024-32089](https://insights.sbomify.com/CVE-2024-32089/): WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32088](https://insights.sbomify.com/CVE-2024-32088/): WordPress Website Builder plugin <= 6.15.20 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32087](https://insights.sbomify.com/CVE-2024-32087/): SQL injection in Product Feed on WooCommerce for Google (high 7.6)
- [CVE-2024-32086](https://insights.sbomify.com/CVE-2024-32086/): WordPress Citadela Listing plugin <= 5.18.1 - Unauth. Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-32085](https://insights.sbomify.com/CVE-2024-32085/): WordPress Citadela Listing plugin < 5.20.0 - Cross-Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-32084](https://insights.sbomify.com/CVE-2024-32084/): WordPress Before And After plugin <= 3.9 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-32083](https://insights.sbomify.com/CVE-2024-32083/): WordPress Easy Logo plugin <= 1.9.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-32082](https://insights.sbomify.com/CVE-2024-32082/): WordPress Sync Post With Other Site plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) to XSS vulnerability (high 7.1)
- [CVE-2024-32081](https://insights.sbomify.com/CVE-2024-32081/): WordPress Filter Custom Fields & Taxonomies Light plugin <= 1.05 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-32080](https://insights.sbomify.com/CVE-2024-32080/): WordPress Search Keyword Redirect plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-3208](https://insights.sbomify.com/CVE-2024-3208/): Sydney Toolbox <= 1.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallery (medium 6.4)
- [CVE-2024-32079](https://insights.sbomify.com/CVE-2024-32079/): WordPress Advanced iFrame plugin <= 2024.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-32078](https://insights.sbomify.com/CVE-2024-32078/): WordPress FV Player plugin <= 7.5.44.7212 - Unvalidated Redirects and Forwards vulnerability (medium 4.1)
- [CVE-2024-32077](https://insights.sbomify.com/CVE-2024-32077/): Apache Airflow: XSS vulnerability in Task Instance Log/Log Details (medium 5.4)
- [CVE-2024-3207](https://insights.sbomify.com/CVE-2024-3207/): ermig1979 Simd SimdMemoryStream.h ReadUnsigned heap-based overflow (medium 5.5)
- [CVE-2024-32066](https://insights.sbomify.com/CVE-2024-32066/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32065](https://insights.sbomify.com/CVE-2024-32065/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32064](https://insights.sbomify.com/CVE-2024-32064/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32063](https://insights.sbomify.com/CVE-2024-32063/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32062](https://insights.sbomify.com/CVE-2024-32062/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32061](https://insights.sbomify.com/CVE-2024-32061/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32060](https://insights.sbomify.com/CVE-2024-32060/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-3206](https://insights.sbomify.com/CVE-2024-3206/): Missing authorization in Different Menu in Different Pages – Conditional Menu (medium 4.3)
- [CVE-2024-32059](https://insights.sbomify.com/CVE-2024-32059/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32058](https://insights.sbomify.com/CVE-2024-32058/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32057](https://insights.sbomify.com/CVE-2024-32057/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32056](https://insights.sbomify.com/CVE-2024-32056/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32055](https://insights.sbomify.com/CVE-2024-32055/): Memory corruption in Simcenter Femap (high 7.3)
- [CVE-2024-32053](https://insights.sbomify.com/CVE-2024-32053/): CyberPower PowerPanel business Use of Hard-coded Credentials (critical 9.8)
- [CVE-2024-32051](https://insights.sbomify.com/CVE-2024-32051/): Information disclosure in RoamWiFi R10 (medium 6.5)
- [CVE-2024-32049](https://insights.sbomify.com/CVE-2024-32049/): BIG-IP Next Central Manager vulnerability (high 7.4)
- [CVE-2024-32048](https://insights.sbomify.com/CVE-2024-32048/): Denial of service in Intel(R) Distribution of OpenVINO(TM) Model Server software (medium 6.0)
- [CVE-2024-32047](https://insights.sbomify.com/CVE-2024-32047/): CyberPower PowerPanel business Active Debug Code (critical 9.8)
- [CVE-2024-32046](https://insights.sbomify.com/CVE-2024-32046/): Detailed error discloses full file path with dev mode off (medium 4.3)
- [CVE-2024-32045](https://insights.sbomify.com/CVE-2024-32045/): Playbook run link to private channel grants channel access (medium 5.9)
- [CVE-2024-32044](https://insights.sbomify.com/CVE-2024-32044/): Privilege escalation in Intel(R) Arc(TM) Pro Graphics for Windows drivers (medium 5.4)
- [CVE-2024-32042](https://insights.sbomify.com/CVE-2024-32042/): CyberPower PowerPanel business Storing Passwords in a Recoverable Format (medium 4.9)
- [CVE-2024-32041](https://insights.sbomify.com/CVE-2024-32041/): FreeRDP OutOfBound Read in zgfx_decompress_segment (critical 9.8)
- [CVE-2024-32040](https://insights.sbomify.com/CVE-2024-32040/): FreeRDP vulnerable to integer underflow in nsc_rle_decode (high 8.1)
- [CVE-2024-3204](https://insights.sbomify.com/CVE-2024-3204/): c-blosc2 ndlz4x4.c ndlz4_decompress heap-based overflow (high 7.3)
- [CVE-2024-32039](https://insights.sbomify.com/CVE-2024-32039/): FreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_data (critical 9.8)
- [CVE-2024-32038](https://insights.sbomify.com/CVE-2024-32038/): Wazuh Analysis Engine Event Decoder Heap-based Buffer Overflow Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-32037](https://insights.sbomify.com/CVE-2024-32037/): GeoNetwork vulnerable to search end-point information disclosure in response headers (not scored)
- [CVE-2024-32036](https://insights.sbomify.com/CVE-2024-32036/): SixLabors.ImageSharp vulnerable to data leakage (medium 5.3)
- [CVE-2024-32035](https://insights.sbomify.com/CVE-2024-32035/): Memory Allocation with Excessive Size Value in SixLabors.ImageSharp (medium 5.3)
- [CVE-2024-32034](https://insights.sbomify.com/CVE-2024-32034/): Cross-site scripting (XSS) in the decidim admin activity log (medium 6.8)
- [CVE-2024-32030](https://insights.sbomify.com/CVE-2024-32030/): Remote code execution via JNDI resolution in JMX metrics collection in Kafka UI (high 8.1)
- [CVE-2024-3203](https://insights.sbomify.com/CVE-2024-3203/): c-blosc2 ndlz8x8.c ndlz8_decompress heap-based overflow (high 7.3)
- [CVE-2024-32028](https://insights.sbomify.com/CVE-2024-32028/): Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore (medium 4.1)
- [CVE-2024-32027](https://insights.sbomify.com/CVE-2024-32027/): Kohya_ss is vulnerable to a command injection in `finetune_gui.py` (`GHSL-2024-022`) (critical 9.1)
- [CVE-2024-32026](https://insights.sbomify.com/CVE-2024-32026/): Kohya_ss is vulnerable to a command injection in `git_caption_gui.py` (`GHSL-2024-020`) (critical 9.1)
- [CVE-2024-32025](https://insights.sbomify.com/CVE-2024-32025/): Kohya_ss is vulnerable to a command injection in `group_images_gui.py` (`GHSL-2024-021`) (critical 9.1)
- [CVE-2024-32024](https://insights.sbomify.com/CVE-2024-32024/): Kohya_ss vulenrable to path injection in `common_gui.py` `add_pre_postfix` function (`GHSL-2024-023`) (medium 6.5)
- [CVE-2024-32023](https://insights.sbomify.com/CVE-2024-32023/): Kohya_ss vulnerable to path injection in `common_gui.py` `find_and_replace` function (`GHSL-2024-024`) (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/372/