# Vulnerabilities published in 2024


- [CVE-2024-30242](https://insights.sbomify.com/CVE-2024-30242/): WordPress Contact Form to Any API plugin <= 1.1.8 - Auth. SQL Injection vulnerability (high 8.5)
- [CVE-2024-30241](https://insights.sbomify.com/CVE-2024-30241/): SQL injection in ProfileGrid (high 8.5)
- [CVE-2024-30240](https://insights.sbomify.com/CVE-2024-30240/): WordPress Calendarista plugin <= 15.5.7 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-3024](https://insights.sbomify.com/CVE-2024-3024/): appneta tcpreplay get.c get_layer4_v6 heap-based overflow (medium 5.3)
- [CVE-2024-30239](https://insights.sbomify.com/CVE-2024-30239/): WordPress Zoho Campaigns plugin <= 2.0.6 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-30238](https://insights.sbomify.com/CVE-2024-30238/): WordPress Photos and Files Contest Gallery plugin <= 21.3.2 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-30237](https://insights.sbomify.com/CVE-2024-30237/): WordPress Slider by Supsystic plugin <= 1.8.10 - SQL Injection vulnerability (high 7.6)
- [CVE-2024-30236](https://insights.sbomify.com/CVE-2024-30236/): WordPress Contest Gallery plugin <= 21.3.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-30235](https://insights.sbomify.com/CVE-2024-30235/): WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-30234](https://insights.sbomify.com/CVE-2024-30234/): WordPress WholesaleX plugin <= 1.3.1 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-30233](https://insights.sbomify.com/CVE-2024-30233/): WordPress WholesaleX plugin <= 1.3.1 - Sensitive Data Exposure on User Export vulnerability (medium 6.5)
- [CVE-2024-30232](https://insights.sbomify.com/CVE-2024-30232/): WordPress Exclusive Addons for Elementor plugin <= 2.6.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30231](https://insights.sbomify.com/CVE-2024-30231/): WordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-30230](https://insights.sbomify.com/CVE-2024-30230/): WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerability (high 8.2)
- [CVE-2024-3023](https://insights.sbomify.com/CVE-2024-3023/): AnnounceKit <= 2.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-30229](https://insights.sbomify.com/CVE-2024-30229/): WordPress Give plugin <= 3.4.2 - PHP Object Injection vulnerability (high 8.0)
- [CVE-2024-30228](https://insights.sbomify.com/CVE-2024-30228/): WordPress Hercules Core plugin <= 6.4 - Auth. PHP Object Injection vulnerability (critical 9.9)
- [CVE-2024-30227](https://insights.sbomify.com/CVE-2024-30227/): WordPress Geo Controller plugin <= 8.6.4 - PHP Object Injection vulnerability (critical 9.0)
- [CVE-2024-30226](https://insights.sbomify.com/CVE-2024-30226/): WordPress BetterDocs plugin <= 3.3.3 - Unauthenticated PHP Object Injection vulnerability (critical 9.0)
- [CVE-2024-30225](https://insights.sbomify.com/CVE-2024-30225/): WordPress WP Migrate plugin <= 2.6.10 - Unauthenticated PHP Object Injection vulnerability (critical 10.0)
- [CVE-2024-30224](https://insights.sbomify.com/CVE-2024-30224/): WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated PHP Object Injection vulnerability (critical 10.0)
- [CVE-2024-30223](https://insights.sbomify.com/CVE-2024-30223/): WordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerability (critical 9.0)
- [CVE-2024-30222](https://insights.sbomify.com/CVE-2024-30222/): WordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerability (high 8.5)
- [CVE-2024-30221](https://insights.sbomify.com/CVE-2024-30221/): WordPress Sunshine Photo Cart plugin <= 3.1.1 - PHP Object Injection vulnerability (medium 5.4)
- [CVE-2024-30220](https://insights.sbomify.com/CVE-2024-30220/): Command injection in MZK-MF300HP2 (high 8.8)
- [CVE-2024-3022](https://insights.sbomify.com/CVE-2024-3022/): File upload in Appointment Booking Calendar Plugin and Scheduling Plugin – BookingPress (high 7.2)
- [CVE-2024-30219](https://insights.sbomify.com/CVE-2024-30219/): Other in MZK-MF300HP2 (medium 6.8)
- [CVE-2024-30218](https://insights.sbomify.com/CVE-2024-30218/): Denial of service (DOS) vulnerability in SAP NetWeaver AS ABAP and ABAP Platform (medium 6.5)
- [CVE-2024-30217](https://insights.sbomify.com/CVE-2024-30217/): Missing Authorization check in SAP S/4 HANA (Cash Management) (medium 4.3)
- [CVE-2024-30216](https://insights.sbomify.com/CVE-2024-30216/): Missing Authorization check in SAP S/4 HANA (Cash Management) (medium 4.3)
- [CVE-2024-30215](https://insights.sbomify.com/CVE-2024-30215/): Cross-Site Scripting (XSS) vulnerability in SAP Business Connector (medium 4.8)
- [CVE-2024-30214](https://insights.sbomify.com/CVE-2024-30214/): Cross-Site Scripting (XSS) vulnerability in SAP Business Connector (medium 4.8)
- [CVE-2024-30213](https://insights.sbomify.com/CVE-2024-30213/): StoneFly Storage Concentrator (SC and SCVM) before 8.0.4.26 allows remote authenticated users to achieve Command Injection via a Ping URL, l (high 8.8)
- [CVE-2024-30212](https://insights.sbomify.com/CVE-2024-30212/): Microchip Harmony 3 Core library allows read and write access to RAM via a SCSI READ or WRITE command (high 7.0)
- [CVE-2024-30211](https://insights.sbomify.com/CVE-2024-30211/): Privilege escalation in Intel(R) ME driver pack installer engines (medium 5.3)
- [CVE-2024-30210](https://insights.sbomify.com/CVE-2024-30210/): IOSIX IO-1020 Micro ELD Use of Default Credentials (high 7.4)
- [CVE-2024-3021](https://insights.sbomify.com/CVE-2024-3021/): Mhr Post Ticker <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-30209](https://insights.sbomify.com/CVE-2024-30209/): Weak cryptography in SIMATIC RTLS Locating Manager (critical 9.0)
- [CVE-2024-30208](https://insights.sbomify.com/CVE-2024-30208/): Missing authorization in SIMATIC RTLS Locating Manager (medium 5.2)
- [CVE-2024-30207](https://insights.sbomify.com/CVE-2024-30207/): Hardcoded credentials in SIMATIC RTLS Locating Manager (critical 10.0)
- [CVE-2024-30206](https://insights.sbomify.com/CVE-2024-30206/): Security feature bypass in SIMATIC RTLS Locating Manager (high 8.8)
- [CVE-2024-30205](https://insights.sbomify.com/CVE-2024-30205/): Security feature bypass in debian:debian linux (high 7.1)
- [CVE-2024-30204](https://insights.sbomify.com/CVE-2024-30204/): Misconfiguration in debian:debian linux (low 2.8)
- [CVE-2024-30203](https://insights.sbomify.com/CVE-2024-30203/): Security feature bypass in debian:debian linux (medium 5.5)
- [CVE-2024-30202](https://insights.sbomify.com/CVE-2024-30202/): Code injection in gnu:emacs (high 7.8)
- [CVE-2024-30201](https://insights.sbomify.com/CVE-2024-30201/): WordPress WP Smart Import plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30200](https://insights.sbomify.com/CVE-2024-30200/): WordPress BEAR plugin <= 1.1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-3020](https://insights.sbomify.com/CVE-2024-3020/): Deserialization in Carousel, Slider, Photo Gallery with Lightbox, Video Slider, by WP Carousel (high 7.2)
- [CVE-2024-30199](https://insights.sbomify.com/CVE-2024-30199/): WordPress WP-Lister Lite for Amazon plugin <= 2.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30198](https://insights.sbomify.com/CVE-2024-30198/): WordPress Buddyforms plugin <= 2.8.5 - Reflected Cross Site Scripting (XSS) vulnerability (medium 5.8)
- [CVE-2024-30197](https://insights.sbomify.com/CVE-2024-30197/): WordPress Church Admin plugin <= 4.0.26 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30196](https://insights.sbomify.com/CVE-2024-30196/): WordPress Easy Social Share Buttons plugin <= 9.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30195](https://insights.sbomify.com/CVE-2024-30195/): WordPress New RoyalSlider plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30194](https://insights.sbomify.com/CVE-2024-30194/): WordPress Sunshine Photo Cart plugin <= 3.1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-30193](https://insights.sbomify.com/CVE-2024-30193/): WordPress Church Admin plugin <= 4.1.17 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30192](https://insights.sbomify.com/CVE-2024-30192/): WordPress Pinterest Plugin <= 1.8.2 - Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-30191](https://insights.sbomify.com/CVE-2024-30191/): Auth bypass in SCALANCE W1748-1 M12 (high 8.4)
- [CVE-2024-30190](https://insights.sbomify.com/CVE-2024-30190/): Auth bypass in SCALANCE W1748-1 M12 (medium 6.1)
- [CVE-2024-3019](https://insights.sbomify.com/CVE-2024-3019/): Pcp: exposure of the redis server backend allows remote command execution via pmproxy (high 8.8)
- [CVE-2024-30189](https://insights.sbomify.com/CVE-2024-30189/): Auth bypass in SCALANCE W721-1 RJ45 (medium 6.1)
- [CVE-2024-30188](https://insights.sbomify.com/CVE-2024-30188/): Apache DolphinScheduler: Resource File Read And Write Vulnerability (high 8.8)
- [CVE-2024-30187](https://insights.sbomify.com/CVE-2024-30187/): Business logic in anope:anope (medium 5.3)
- [CVE-2024-30186](https://insights.sbomify.com/CVE-2024-30186/): WordPress Prime Slider plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30185](https://insights.sbomify.com/CVE-2024-30185/): WordPress Element Pack Elementor Addons plugin <= 5.5.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30184](https://insights.sbomify.com/CVE-2024-30184/): WordPress Popup Builder plugin <= 4.2.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30183](https://insights.sbomify.com/CVE-2024-30183/): WordPress WPBakery Page Builder Addons by Livemesh plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30182](https://insights.sbomify.com/CVE-2024-30182/): WordPress HT Mega – Absolute Addons For Elementor plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30181](https://insights.sbomify.com/CVE-2024-30181/): WordPress Locatoraid Store Locator plugin <= 3.9.30 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-30180](https://insights.sbomify.com/CVE-2024-30180/): WordPress Easy Social Feed plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-3018](https://insights.sbomify.com/CVE-2024-3018/): Essential Addons for Elementor <= 5.9.13 - Authenticated (Author+) PHP Object Injection via error_resetpassword (high 8.8)
- [CVE-2024-30179](https://insights.sbomify.com/CVE-2024-30179/): WordPress Bold Page Builder plugin <= 4.7.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30178](https://insights.sbomify.com/CVE-2024-30178/): WordPress Simply Static plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-30177](https://insights.sbomify.com/CVE-2024-30177/): WordPress Exclusive Addons for Elementor plugin <= 2.6.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-30176](https://insights.sbomify.com/CVE-2024-30176/): Information disclosure in logpoint:siem (medium 5.3)
- [CVE-2024-30172](https://insights.sbomify.com/CVE-2024-30172/): Bouncy Castle crafted signature and public key can be used to trigger an infinite loop (high 7.5)
- [CVE-2024-30171](https://insights.sbomify.com/CVE-2024-30171/): Bouncy Castle affected by timing side-channel for RSA key exchange ("The Marvin Attack") (medium 5.9)
- [CVE-2024-30170](https://insights.sbomify.com/CVE-2024-30170/): Denial of service in ssh:privx (high 7.5)
- [CVE-2024-3017](https://insights.sbomify.com/CVE-2024-3017/): Denial of service in multi-protocol gateway - Zigbee + Thread (medium 6.5)
- [CVE-2024-30167](https://insights.sbomify.com/CVE-2024-30167/): /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a P (medium 6.3)
- [CVE-2024-30166](https://insights.sbomify.com/CVE-2024-30166/): Memory corruption in trustedfirmware:mbed tls (critical 9.1)
- [CVE-2024-30165](https://insights.sbomify.com/CVE-2024-30165/): Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands w (high 7.1)
- [CVE-2024-30164](https://insights.sbomify.com/CVE-2024-30164/): Amazon AWS Client VPN has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions. (medium 6.7)
- [CVE-2024-30163](https://insights.sbomify.com/CVE-2024-30163/): SQL injection in invisioncommunity:invisioncommunity (critical 9.8)
- [CVE-2024-30162](https://insights.sbomify.com/CVE-2024-30162/): Invision Community through 4.7.16 allows remote code execution via the applications/core/modules/admin/editor/toolbar.php IPS\core\modules\a (high 7.2)
- [CVE-2024-30161](https://insights.sbomify.com/CVE-2024-30161/): Use after free in qt:qt (medium 6.5)
- [CVE-2024-30160](https://insights.sbomify.com/CVE-2024-30160/): Cross-site scripting in mitel:micollab (medium 4.8)
- [CVE-2024-3016](https://insights.sbomify.com/CVE-2024-3016/): Missing authorization in ITK-12D-1(BK)TEL (critical 9.1)
- [CVE-2024-30159](https://insights.sbomify.com/CVE-2024-30159/): Cross-site scripting in mitel:micollab (medium 4.8)
- [CVE-2024-30158](https://insights.sbomify.com/CVE-2024-30158/): SQL injection in mitel:micollab (high 7.2)
- [CVE-2024-30157](https://insights.sbomify.com/CVE-2024-30157/): SQL injection in mitel:micollab (high 7.2)
- [CVE-2024-30156](https://insights.sbomify.com/CVE-2024-30156/): Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhausti (high 7.5)
- [CVE-2024-30155](https://insights.sbomify.com/CVE-2024-30155/): HCL SX is susceptible to cookie with Insecure, Improper, or Missing SameSite attribute vulnerability (medium 5.5)
- [CVE-2024-30154](https://insights.sbomify.com/CVE-2024-30154/): HCL SX is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability (medium 5.3)
- [CVE-2024-30152](https://insights.sbomify.com/CVE-2024-30152/): HCL SX is affected by usage of a weak cryptographic algorithm (medium 6.5)
- [CVE-2024-30151](https://insights.sbomify.com/CVE-2024-30151/): HCL BigFix Service Management (SM) is susceptible to Broken Access Control Vulnerability (high 8.3)
- [CVE-2024-30150](https://insights.sbomify.com/CVE-2024-30150/): An unauthenticated privilege escalation vulnerability affects HCL MyCloud (medium 5.3)
- [CVE-2024-3015](https://insights.sbomify.com/CVE-2024-3015/): SourceCodester Simple Subscription Website manage_plan.php sql injection (medium 6.3)
- [CVE-2024-30149](https://insights.sbomify.com/CVE-2024-30149/): HCL AppScan Source is affected by an expired TLS/SSL certificate (medium 4.8)
- [CVE-2024-30148](https://insights.sbomify.com/CVE-2024-30148/): HCL Leap is affected by improper access control (medium 4.1)
- [CVE-2024-30147](https://insights.sbomify.com/CVE-2024-30147/): HCL Leap is affected by a cross-site scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/386/