# Vulnerabilities published in 2024


- [CVE-2024-31408](https://insights.sbomify.com/CVE-2024-31408/): Command injection in IX-BA (high 8.0)
- [CVE-2024-31407](https://insights.sbomify.com/CVE-2024-31407/): Privilege escalation in Intel(R) High Level Synthesis Compiler software for Intel(R) Quartus(R) Prime Pro Edition Software (medium 5.4)
- [CVE-2024-31406](https://insights.sbomify.com/CVE-2024-31406/): Other in RoamWiFi R10 (high 8.8)
- [CVE-2024-31404](https://insights.sbomify.com/CVE-2024-31404/): Information disclosure in Cybozu Garoon (medium 4.3)
- [CVE-2024-31403](https://insights.sbomify.com/CVE-2024-31403/): Missing authorization in Cybozu Garoon (medium 5.4)
- [CVE-2024-31402](https://insights.sbomify.com/CVE-2024-31402/): Missing authorization in Cybozu Garoon (medium 4.3)
- [CVE-2024-31401](https://insights.sbomify.com/CVE-2024-31401/): Cross-site scripting in Cybozu Garoon (critical 9.0)
- [CVE-2024-31400](https://insights.sbomify.com/CVE-2024-31400/): Information disclosure in Cybozu Garoon (medium 6.5)
- [CVE-2024-3140](https://insights.sbomify.com/CVE-2024-3140/): SourceCodester Computer Laboratory Management System cross site scripting (low 3.5)
- [CVE-2024-31399](https://insights.sbomify.com/CVE-2024-31399/): Denial of service in Cybozu Garoon (medium 5.3)
- [CVE-2024-31398](https://insights.sbomify.com/CVE-2024-31398/): Information disclosure in Cybozu Garoon (medium 4.3)
- [CVE-2024-31397](https://insights.sbomify.com/CVE-2024-31397/): Denial of service in Cybozu Garoon (medium 4.9)
- [CVE-2024-31396](https://insights.sbomify.com/CVE-2024-31396/): Code injection in a-blog cms Ver.3.0.x series (medium 6.6)
- [CVE-2024-31395](https://insights.sbomify.com/CVE-2024-31395/): Cross-site scripting in a-blog cms (medium 6.1)
- [CVE-2024-31394](https://insights.sbomify.com/CVE-2024-31394/): Path traversal in a-blog cms (medium 6.5)
- [CVE-2024-31393](https://insights.sbomify.com/CVE-2024-31393/): Security feature bypass in Firefox for iOS (medium 4.3)
- [CVE-2024-31392](https://insights.sbomify.com/CVE-2024-31392/): Security feature bypass in Firefox for iOS (high 7.5)
- [CVE-2024-31391](https://insights.sbomify.com/CVE-2024-31391/): Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentials (medium 6.5)
- [CVE-2024-31390](https://insights.sbomify.com/CVE-2024-31390/): WordPress Breakdance plugin <= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2024-3139](https://insights.sbomify.com/CVE-2024-3139/): SourceCodester Computer Laboratory Management System save_users improper authorization (medium 5.4)
- [CVE-2024-31389](https://insights.sbomify.com/CVE-2024-31389/): WordPress MihanPanel plugin < 12.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31388](https://insights.sbomify.com/CVE-2024-31388/): WordPress Tablesome plugin <= 1.0.25 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31387](https://insights.sbomify.com/CVE-2024-31387/): WordPress Popup Likebox plugin <= 3.7.2 - Cross-Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31386](https://insights.sbomify.com/CVE-2024-31386/): Multiple WordPress themes affected by Cross-Site Request Forgery vulnerability (medium 4.3)
- [CVE-2024-31385](https://insights.sbomify.com/CVE-2024-31385/): WordPress ReDi Restaurant Reservation plugin <= 24.0128 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31384](https://insights.sbomify.com/CVE-2024-31384/): WordPress Spa and Salon theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31383](https://insights.sbomify.com/CVE-2024-31383/): WordPress PopularFX theme <= 1.2.4 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31382](https://insights.sbomify.com/CVE-2024-31382/): WordPress Blocksy theme <= 2.0.22 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31381](https://insights.sbomify.com/CVE-2024-31381/): WordPress Spotlight Social Feeds plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31380](https://insights.sbomify.com/CVE-2024-31380/): WordPress Oxygen plugin <= 4.9 - Authenticated Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2024-3138](https://insights.sbomify.com/CVE-2024-3138/): francoisjacquet RosarioSIS Add Portal Note cross site scripting (low 3.5)
- [CVE-2024-31379](https://insights.sbomify.com/CVE-2024-31379/): WordPress Smash Balloon Social Post Feed plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31378](https://insights.sbomify.com/CVE-2024-31378/): WordPress MailChimp Forms by MailMunch plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31377](https://insights.sbomify.com/CVE-2024-31377/): WordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-31376](https://insights.sbomify.com/CVE-2024-31376/): WordPress Dashboard To-Do List plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31375](https://insights.sbomify.com/CVE-2024-31375/): WordPress WP2LEADS plugin <= 3.2.7 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-31374](https://insights.sbomify.com/CVE-2024-31374/): WordPress AppPresser plugin <= 4.3.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31373](https://insights.sbomify.com/CVE-2024-31373/): WordPress E2Pdf plugin <= 1.20.27 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31372](https://insights.sbomify.com/CVE-2024-31372/): WordPress No-Bot Registration plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31371](https://insights.sbomify.com/CVE-2024-31371/): WordPress WP Event Aggregator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31370](https://insights.sbomify.com/CVE-2024-31370/): WordPress CodeisAwesome AIKit plugin <= 4.14.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-3137](https://insights.sbomify.com/CVE-2024-3137/): Improper Privilege Management in uvdesk/community-skeleton (high 7.1)
- [CVE-2024-31369](https://insights.sbomify.com/CVE-2024-31369/): WordPress Soledad theme <= 8.4.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 5.4)
- [CVE-2024-31368](https://insights.sbomify.com/CVE-2024-31368/): WordPress Soledad theme <= 8.4.2 - Unauthenticated Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-31367](https://insights.sbomify.com/CVE-2024-31367/): WordPress Soledad theme <= 8.4.2 - Authenticated Broken Access Control vulnerability (high 7.1)
- [CVE-2024-31366](https://insights.sbomify.com/CVE-2024-31366/): WordPress Post Type Builder (PTB) plugin <= 2.0.8 - Auth. Arbitrary Post/Page Creation vulnerability (high 7.1)
- [CVE-2024-31365](https://insights.sbomify.com/CVE-2024-31365/): WordPress Post Type Builder (PTB) plugin < 2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-31364](https://insights.sbomify.com/CVE-2024-31364/): Cross-site request forgery in ELEX WooCommerce Dynamic Pricing and Discounts (medium 4.3)
- [CVE-2024-31363](https://insights.sbomify.com/CVE-2024-31363/): WordPress LifterLMS plugin <= 7.5.0 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31362](https://insights.sbomify.com/CVE-2024-31362/): Cross-site request forgery in ProfileGrid (medium 4.3)
- [CVE-2024-31361](https://insights.sbomify.com/CVE-2024-31361/): WordPress bunny.net plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31360](https://insights.sbomify.com/CVE-2024-31360/): WordPress Benchmark Email Lite plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-3136](https://insights.sbomify.com/CVE-2024-3136/): MasterStudy LMS <= 3.3.3 - Unauthenticated Local File Inclusion via template (critical 9.8)
- [CVE-2024-31359](https://insights.sbomify.com/CVE-2024-31359/): WordPress Premmerce Product Filter for WooCommerce plugin <= 3.7.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31358](https://insights.sbomify.com/CVE-2024-31358/): WordPress 5 Stars Rating Funnel plugin <= 1.2.67 - Arbitrary Content Deletion vulnerability (high 7.5)
- [CVE-2024-31357](https://insights.sbomify.com/CVE-2024-31357/): WordPress Ultimate Store Kit Elementor Addons plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31356](https://insights.sbomify.com/CVE-2024-31356/): WordPress User Activity Log plugin <= 1.8 - Auth. SQL Injection vulnerability (high 7.6)
- [CVE-2024-31355](https://insights.sbomify.com/CVE-2024-31355/): WordPress Slideshow Gallery LITE plugin <= 1.7.8 - Auth. SQL Injection vulnerability (high 8.5)
- [CVE-2024-31354](https://insights.sbomify.com/CVE-2024-31354/): WordPress Slideshow Gallery LITE plugin <= 1.7.8 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-31353](https://insights.sbomify.com/CVE-2024-31353/): WordPress Slideshow Gallery LITE plugin <= 1.7.8 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-31352](https://insights.sbomify.com/CVE-2024-31352/): WordPress Icegram Express plugin <= 5.7.13 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-31351](https://insights.sbomify.com/CVE-2024-31351/): WordPress Copymatic plugin <= 1.6 - Unauthenticated Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-31350](https://insights.sbomify.com/CVE-2024-31350/): WordPress AWP Classifieds plugin <= 4.3.1 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-3135](https://insights.sbomify.com/CVE-2024-3135/): Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localai (medium 6.5)
- [CVE-2024-31349](https://insights.sbomify.com/CVE-2024-31349/): WordPress MailMunch – Grow your Email List plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31348](https://insights.sbomify.com/CVE-2024-31348/): WordPress Super Testimonials plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31347](https://insights.sbomify.com/CVE-2024-31347/): WordPress Tracking Code Manager plugin <= 2.1.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-31346](https://insights.sbomify.com/CVE-2024-31346/): WordPress Gradient Text Widget for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-31345](https://insights.sbomify.com/CVE-2024-31345/): WordPress Auto Poster plugin <= 1.2 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-31344](https://insights.sbomify.com/CVE-2024-31344/): WordPress Easy Login Styler plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-31343](https://insights.sbomify.com/CVE-2024-31343/): Missing authorization in MP3 Audio Player for Music, Radio & Podcast by Sonaar (high 7.5)
- [CVE-2024-31342](https://insights.sbomify.com/CVE-2024-31342/): WordPress Gallery Exporter plugin <= 1.3 - Arbitrary File Download vulnerability (medium 6.5)
- [CVE-2024-31341](https://insights.sbomify.com/CVE-2024-31341/): WordPress User Profile Builder plugin <= 3.11.2 - Bypass Vulnerability vulnerability (medium 5.3)
- [CVE-2024-31340](https://insights.sbomify.com/CVE-2024-31340/): Weak cryptography in TP-Link Tapo (medium 4.8)
- [CVE-2024-3134](https://insights.sbomify.com/CVE-2024-3134/): Master Addons for Elementor <= 2.0.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-31339](https://insights.sbomify.com/CVE-2024-31339/): Use after free in Android (high 7.8)
- [CVE-2024-31337](https://insights.sbomify.com/CVE-2024-31337/): Memory corruption in Android (high 8.4)
- [CVE-2024-31336](https://insights.sbomify.com/CVE-2024-31336/): Memory corruption in Android (high 8.4)
- [CVE-2024-31335](https://insights.sbomify.com/CVE-2024-31335/): Privilege escalation in Android (high 8.4)
- [CVE-2024-31334](https://insights.sbomify.com/CVE-2024-31334/): Privilege escalation in Android (medium 6.7)
- [CVE-2024-31333](https://insights.sbomify.com/CVE-2024-31333/): Integer overflow in Android (high 7.8)
- [CVE-2024-31332](https://insights.sbomify.com/CVE-2024-31332/): Missing authorization in Android (high 8.4)
- [CVE-2024-31331](https://insights.sbomify.com/CVE-2024-31331/): Business logic in Android (high 7.8)
- [CVE-2024-31328](https://insights.sbomify.com/CVE-2024-31328/): Security feature bypass in Android (high 8.8)
- [CVE-2024-31327](https://insights.sbomify.com/CVE-2024-31327/): Race condition in Android (medium 5.3)
- [CVE-2024-31326](https://insights.sbomify.com/CVE-2024-31326/): Business logic in Android (high 7.8)
- [CVE-2024-31325](https://insights.sbomify.com/CVE-2024-31325/): Information disclosure in Android (high 7.8)
- [CVE-2024-31324](https://insights.sbomify.com/CVE-2024-31324/): Security feature bypass in Android (high 7.8)
- [CVE-2024-31323](https://insights.sbomify.com/CVE-2024-31323/): Security feature bypass in Android (high 7.8)
- [CVE-2024-31322](https://insights.sbomify.com/CVE-2024-31322/): Privilege escalation in Android (medium 6.3)
- [CVE-2024-31320](https://insights.sbomify.com/CVE-2024-31320/): Privilege escalation in Android (high 7.4)
- [CVE-2024-31319](https://insights.sbomify.com/CVE-2024-31319/): Privilege escalation in Android (high 8.4)
- [CVE-2024-31318](https://insights.sbomify.com/CVE-2024-31318/): Missing authorization in Android (high 7.8)
- [CVE-2024-31317](https://insights.sbomify.com/CVE-2024-31317/): Deserialization in Android (high 7.8)
- [CVE-2024-31316](https://insights.sbomify.com/CVE-2024-31316/): Privilege escalation in Android (high 7.8)
- [CVE-2024-31315](https://insights.sbomify.com/CVE-2024-31315/): Privilege escalation in Android (medium 5.3)
- [CVE-2024-31314](https://insights.sbomify.com/CVE-2024-31314/): Denial of service in Android (medium 6.2)
- [CVE-2024-31313](https://insights.sbomify.com/CVE-2024-31313/): Memory corruption in Android (high 7.8)
- [CVE-2024-31312](https://insights.sbomify.com/CVE-2024-31312/): Missing authorization in Android (medium 5.5)
- [CVE-2024-31311](https://insights.sbomify.com/CVE-2024-31311/): Memory corruption in Android (medium 6.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/377/