# Vulnerabilities published in 2024


- [CVE-2024-31924](https://insights.sbomify.com/CVE-2024-31924/): WordPress EWWW Image Optimizer plugin <= 7.2.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31923](https://insights.sbomify.com/CVE-2024-31923/): WordPress Feather Login Page plugin <= 1.1.5 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31922](https://insights.sbomify.com/CVE-2024-31922/): WordPress Hosting Benchmark tool plugin <= 1.3.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31921](https://insights.sbomify.com/CVE-2024-31921/): WordPress Ultimate Product Catalog plugin <= 5.2.15 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31920](https://insights.sbomify.com/CVE-2024-31920/): WordPress Currency per Product for WooCommerce plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3192](https://insights.sbomify.com/CVE-2024-3192/): MailCleaner Admin Interface cross site scripting (medium 4.3)
- [CVE-2024-31919](https://insights.sbomify.com/CVE-2024-31919/): IBM MQ denial of service (medium 5.9)
- [CVE-2024-31916](https://insights.sbomify.com/CVE-2024-31916/): IBM OpenBMC information disclosure (high 7.5)
- [CVE-2024-31914](https://insights.sbomify.com/CVE-2024-31914/): IBM Sterling B2B Integrator cross-site scripting (medium 6.4)
- [CVE-2024-31913](https://insights.sbomify.com/CVE-2024-31913/): IBM Sterling B2B Integrator cross-site scripting (medium 5.5)
- [CVE-2024-31912](https://insights.sbomify.com/CVE-2024-31912/): IBM MQ privilege escalation (high 7.5)
- [CVE-2024-3191](https://insights.sbomify.com/CVE-2024-3191/): MailCleaner Email os command injection (critical 9.8)
- [CVE-2024-31908](https://insights.sbomify.com/CVE-2024-31908/): IBM Planning Analytics Local cross-site scripting (medium 6.4)
- [CVE-2024-31907](https://insights.sbomify.com/CVE-2024-31907/): Cross-site scripting in Planning Analytics Local (medium 5.4)
- [CVE-2024-31906](https://insights.sbomify.com/CVE-2024-31906/): IBM Automation Decision Services information disclosure (medium 6.2)
- [CVE-2024-31905](https://insights.sbomify.com/CVE-2024-31905/): IBM QRadar Network Packet Capture information disclosure (medium 5.9)
- [CVE-2024-31904](https://insights.sbomify.com/CVE-2024-31904/): IBM App Connect Enterprise denial of service (medium 6.5)
- [CVE-2024-31903](https://insights.sbomify.com/CVE-2024-31903/): IBM Sterling B2B Integrator Standard Edition code execution (high 8.8)
- [CVE-2024-31902](https://insights.sbomify.com/CVE-2024-31902/): IBM InfoSphere Information Server cross-site request forgery (medium 4.3)
- [CVE-2024-3190](https://insights.sbomify.com/CVE-2024-3190/): Cross-site scripting in Unlimited Elements For Elementor (medium 5.4)
- [CVE-2024-31899](https://insights.sbomify.com/CVE-2024-31899/): IBM Cognos Command Center information disclosure (medium 4.3)
- [CVE-2024-31898](https://insights.sbomify.com/CVE-2024-31898/): IBM InfoSphere Information Server data modification (medium 5.4)
- [CVE-2024-31897](https://insights.sbomify.com/CVE-2024-31897/): IBM Cloud Pak for Business Automation server-side request forgery (medium 4.3)
- [CVE-2024-31896](https://insights.sbomify.com/CVE-2024-31896/): IBM SPSS Statistics information disclosure (medium 5.9)
- [CVE-2024-31895](https://insights.sbomify.com/CVE-2024-31895/): IBM App Connect Enterprise information disclosure (medium 4.3)
- [CVE-2024-31894](https://insights.sbomify.com/CVE-2024-31894/): IBM App Connect Enterprise information disclosure (medium 4.3)
- [CVE-2024-31893](https://insights.sbomify.com/CVE-2024-31893/): IBM App Connect Enterprise information disclosure (medium 4.3)
- [CVE-2024-31892](https://insights.sbomify.com/CVE-2024-31892/): IBM Storage Scale SQL injection (high 7.5)
- [CVE-2024-31891](https://insights.sbomify.com/CVE-2024-31891/): IBM Storage Scale privilege escalation (high 7.8)
- [CVE-2024-31890](https://insights.sbomify.com/CVE-2024-31890/): IBM i privilege escalation (high 7.8)
- [CVE-2024-3189](https://insights.sbomify.com/CVE-2024-3189/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 5.4)
- [CVE-2024-31889](https://insights.sbomify.com/CVE-2024-31889/): IBM Planning Analytics Local cross-site scripting (medium 5.4)
- [CVE-2024-31887](https://insights.sbomify.com/CVE-2024-31887/): IBM Security Verify Privilege information disclosure (high 7.5)
- [CVE-2024-31883](https://insights.sbomify.com/CVE-2024-31883/): IBM Security Verify Access denial of service (medium 5.3)
- [CVE-2024-31882](https://insights.sbomify.com/CVE-2024-31882/): IBM Db2 denial of service (medium 5.3)
- [CVE-2024-31881](https://insights.sbomify.com/CVE-2024-31881/): IBM Db2 denial of service (medium 6.5)
- [CVE-2024-31880](https://insights.sbomify.com/CVE-2024-31880/): IBM Db2 denial of service (medium 5.3)
- [CVE-2024-3188](https://insights.sbomify.com/CVE-2024-3188/): Shortcodes Ultimate < 7.1.0 - Contributor+ Stored XSS (medium 6.3)
- [CVE-2024-31879](https://insights.sbomify.com/CVE-2024-31879/): IBM i denial of service (high 7.5)
- [CVE-2024-31878](https://insights.sbomify.com/CVE-2024-31878/): IBM i information disclosure (medium 5.3)
- [CVE-2024-31874](https://insights.sbomify.com/CVE-2024-31874/): IBM Security Verify Access Appliance denial of service (medium 6.2)
- [CVE-2024-31873](https://insights.sbomify.com/CVE-2024-31873/): IBM Security Verify Access Appliance information disclosure (high 7.5)
- [CVE-2024-31872](https://insights.sbomify.com/CVE-2024-31872/): IBM Security Verify Access Appliance missing certificate validation (high 7.5)
- [CVE-2024-31871](https://insights.sbomify.com/CVE-2024-31871/): IBM Security Verify Access Appliance improper certificate validation (high 7.5)
- [CVE-2024-31870](https://insights.sbomify.com/CVE-2024-31870/): IBM i information disclosure (low 3.3)
- [CVE-2024-3187](https://insights.sbomify.com/CVE-2024-3187/): Use after free in GoAhead (medium 5.9)
- [CVE-2024-31869](https://insights.sbomify.com/CVE-2024-31869/): Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config used (medium 5.3)
- [CVE-2024-31868](https://insights.sbomify.com/CVE-2024-31868/): Apache Zeppelin: XSS vulnerability in the helium module (medium 6.1)
- [CVE-2024-31867](https://insights.sbomify.com/CVE-2024-31867/): Apache Zeppelin: LDAP search filter query Injection Vulnerability (medium 6.5)
- [CVE-2024-31866](https://insights.sbomify.com/CVE-2024-31866/): Apache Zeppelin: Interpreter download command does not escape malicious code injection (critical 9.8)
- [CVE-2024-31865](https://insights.sbomify.com/CVE-2024-31865/): Apache Zeppelin: Cron arbitrary user impersonation with improper privileges (medium 6.5)
- [CVE-2024-31864](https://insights.sbomify.com/CVE-2024-31864/): Apache Zeppelin: Remote code execution by adding malicious JDBC connection string (critical 9.8)
- [CVE-2024-31863](https://insights.sbomify.com/CVE-2024-31863/): Apache Zeppelin: Replacing other users notebook, bypassing any permissions (medium 5.3)
- [CVE-2024-31862](https://insights.sbomify.com/CVE-2024-31862/): Apache Zeppelin: Denial of service with invalid notebook name (medium 5.3)
- [CVE-2024-31860](https://insights.sbomify.com/CVE-2024-31860/): Apache Zeppelin: Path traversal vulnerability (medium 6.5)
- [CVE-2024-3186](https://insights.sbomify.com/CVE-2024-3186/): Null dereference in GoAhead (medium 5.3)
- [CVE-2024-31859](https://insights.sbomify.com/CVE-2024-31859/): Member promoted to channel admin via playbooks run linking to channel (medium 4.3)
- [CVE-2024-31858](https://insights.sbomify.com/CVE-2024-31858/): Memory corruption in Intel(R) QuickAssist Technology software (high 7.3)
- [CVE-2024-31857](https://insights.sbomify.com/CVE-2024-31857/): Cross-site scripting in Forminator (medium 5.4)
- [CVE-2024-31856](https://insights.sbomify.com/CVE-2024-31856/): CyberPower PowerPanel business SQL Injection (high 8.8)
- [CVE-2024-31854](https://insights.sbomify.com/CVE-2024-31854/): Security feature bypass in SICAM TOOLBOX II (high 7.7)
- [CVE-2024-31853](https://insights.sbomify.com/CVE-2024-31853/): Security feature bypass in SICAM TOOLBOX II (high 7.7)
- [CVE-2024-31852](https://insights.sbomify.com/CVE-2024-31852/): LLVM before 18.1.3 generates code in which the LR register can be overwritten without data being saved to the stack, and thus there can some (medium 5.9)
- [CVE-2024-31851](https://insights.sbomify.com/CVE-2024-31851/): Path traversal in Sync (high 8.6)
- [CVE-2024-31850](https://insights.sbomify.com/CVE-2024-31850/): Path traversal in Arc (high 8.6)
- [CVE-2024-3185](https://insights.sbomify.com/CVE-2024-3185/): Rapid7 Insight Agent Sensitive Key Exposed To Local Users (medium 6.8)
- [CVE-2024-31849](https://insights.sbomify.com/CVE-2024-31849/): Path traversal in Connect (critical 9.8)
- [CVE-2024-31848](https://insights.sbomify.com/CVE-2024-31848/): Path traversal in API Server (critical 9.8)
- [CVE-2024-31847](https://insights.sbomify.com/CVE-2024-31847/): Cross-site scripting in italtel:embrace (medium 6.1)
- [CVE-2024-31846](https://insights.sbomify.com/CVE-2024-31846/): Missing authorization in italtel:embrace (high 7.5)
- [CVE-2024-31845](https://insights.sbomify.com/CVE-2024-31845/): Other in italtel:embrace (medium 5.3)
- [CVE-2024-31844](https://insights.sbomify.com/CVE-2024-31844/): Information disclosure in italtel:embrace (medium 5.3)
- [CVE-2024-31843](https://insights.sbomify.com/CVE-2024-31843/): Command injection in italtel:embrace (medium 4.1)
- [CVE-2024-31842](https://insights.sbomify.com/CVE-2024-31842/): Information disclosure in italtel:embrace (high 8.8)
- [CVE-2024-31841](https://insights.sbomify.com/CVE-2024-31841/): Path traversal in italtel:embrace (high 7.5)
- [CVE-2024-31840](https://insights.sbomify.com/CVE-2024-31840/): Information disclosure in italtel:embrace (medium 6.5)
- [CVE-2024-3184](https://insights.sbomify.com/CVE-2024-3184/): Null dereference in GoAhead (medium 5.9)
- [CVE-2024-31839](https://insights.sbomify.com/CVE-2024-31839/): tiagorlampert CHAOS vulnerable to Cross Site Scripting (medium 4.8)
- [CVE-2024-31837](https://insights.sbomify.com/CVE-2024-31837/): DMitry (Deepmagic Information Gathering Tool) 1.3a has a format-string vulnerability, with a threat model similar to CVE-2017-7938. (high 8.4)
- [CVE-2024-31835](https://insights.sbomify.com/CVE-2024-31835/): Cross-site scripting in flatpress:flatpress (medium 4.7)
- [CVE-2024-3183](https://insights.sbomify.com/CVE-2024-3183/): Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force (high 8.1)
- [CVE-2024-31828](https://insights.sbomify.com/CVE-2024-31828/): Lavalite CMS Cross Site Scripting vulnerability (medium 6.1)
- [CVE-2024-31823](https://insights.sbomify.com/CVE-2024-31823/): Code injection in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (critical 9.8)
- [CVE-2024-31822](https://insights.sbomify.com/CVE-2024-31822/): Code injection in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (critical 9.8)
- [CVE-2024-31821](https://insights.sbomify.com/CVE-2024-31821/): SQL injection in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (high 8.0)
- [CVE-2024-31820](https://insights.sbomify.com/CVE-2024-31820/): SQL injection in ecommerce-codeigniter-bootstrap project:ecommerce-codeigniter-bootstrap (critical 9.8)
- [CVE-2024-3182](https://insights.sbomify.com/CVE-2024-3182/): Information disclosure in Hawk (medium 6.5)
- [CVE-2024-31819](https://insights.sbomify.com/CVE-2024-31819/): WWBN AVideo Remote Code Execution (critical 9.8)
- [CVE-2024-31818](https://insights.sbomify.com/CVE-2024-31818/): Path traversal in derbynet:derbynet (critical 9.8)
- [CVE-2024-31817](https://insights.sbomify.com/CVE-2024-31817/): Information disclosure in totolink:ex200 firmware (high 7.5)
- [CVE-2024-31816](https://insights.sbomify.com/CVE-2024-31816/): Information disclosure in totolink:ex200 firmware (high 7.5)
- [CVE-2024-31815](https://insights.sbomify.com/CVE-2024-31815/): Missing authorization in totolink:ex200 firmware (critical 9.1)
- [CVE-2024-31814](https://insights.sbomify.com/CVE-2024-31814/): Auth bypass in totolink:ex200 firmware (high 8.8)
- [CVE-2024-31813](https://insights.sbomify.com/CVE-2024-31813/): Missing authorization in totolink:ex200 firmware (high 8.4)
- [CVE-2024-31812](https://insights.sbomify.com/CVE-2024-31812/): Information disclosure in totolink:ex200 firmware (medium 6.5)
- [CVE-2024-31811](https://insights.sbomify.com/CVE-2024-31811/): Command injection in totolink:ex200 firmware (high 8.0)
- [CVE-2024-31810](https://insights.sbomify.com/CVE-2024-31810/): Hardcoded credentials in totolink:ex200 firmware (critical 9.8)
- [CVE-2024-3181](https://insights.sbomify.com/CVE-2024-3181/): Concrete CMS Stored XSS in the Search Field (low 3.1)
- [CVE-2024-31809](https://insights.sbomify.com/CVE-2024-31809/): Command injection in totolink:ex200 firmware (high 8.8)
- [CVE-2024-31808](https://insights.sbomify.com/CVE-2024-31808/): Command injection in totolink:ex200 firmware (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/374/