# Vulnerabilities published in 2024


- [CVE-2024-29853](https://insights.sbomify.com/CVE-2024-29853/): Auth bypass in Agent for Windows (high 7.8)
- [CVE-2024-29852](https://insights.sbomify.com/CVE-2024-29852/): Missing authorization in Backup & Replication (low 2.7)
- [CVE-2024-29851](https://insights.sbomify.com/CVE-2024-29851/): Information disclosure in Backup & Replication (high 7.2)
- [CVE-2024-29850](https://insights.sbomify.com/CVE-2024-29850/): Auth bypass in Backup & Replication (high 8.8)
- [CVE-2024-2985](https://insights.sbomify.com/CVE-2024-2985/): Tenda FH1202 QuickIndex formQuickIndex stack-based overflow (high 8.8)
- [CVE-2024-29849](https://insights.sbomify.com/CVE-2024-29849/): Auth bypass in Backup & Replication (critical 9.8)
- [CVE-2024-29848](https://insights.sbomify.com/CVE-2024-29848/): File upload in Avalanche (high 7.2)
- [CVE-2024-29847](https://insights.sbomify.com/CVE-2024-29847/): Deserialization in EPM (critical 10.0)
- [CVE-2024-29846](https://insights.sbomify.com/CVE-2024-29846/): SQL injection in EPM (high 8.4)
- [CVE-2024-29844](https://insights.sbomify.com/CVE-2024-29844/): Hardcoded credentials in Evolution Controller (critical 9.8)
- [CVE-2024-29843](https://insights.sbomify.com/CVE-2024-29843/): Broken Access control on MOBILE_GET_USERS_LIST in Evolution Controller allows unauthenticated user enumeration (high 7.5)
- [CVE-2024-29842](https://insights.sbomify.com/CVE-2024-29842/): Missing authorization in Evolution Controller (high 7.5)
- [CVE-2024-29841](https://insights.sbomify.com/CVE-2024-29841/): Missing authorization in Evolution Controller (high 7.5)
- [CVE-2024-29840](https://insights.sbomify.com/CVE-2024-29840/): Missing authorization in Evolution Controller (high 7.5)
- [CVE-2024-2984](https://insights.sbomify.com/CVE-2024-2984/): Tenda FH1202 setcfm formSetCfm stack-based overflow (high 8.8)
- [CVE-2024-29839](https://insights.sbomify.com/CVE-2024-29839/): Missing authorization in Evolution Controller (high 7.5)
- [CVE-2024-29838](https://insights.sbomify.com/CVE-2024-29838/): Unsanitised variable on DAL_ADD in Evolution Controller causes application level denial of service and crash (high 7.5)
- [CVE-2024-29837](https://insights.sbomify.com/CVE-2024-29837/): Poor session management in Evolution Controller allows administrator functionality for unauthenticated connections (high 8.8)
- [CVE-2024-29836](https://insights.sbomify.com/CVE-2024-29836/): Broken Authentication on USER_CHANGE in Evolution Controller allows unauthenticated account creation and takeover (critical 9.8)
- [CVE-2024-29834](https://insights.sbomify.com/CVE-2024-29834/): Apache Pulsar: Improper Authorization For Namespace and Topic Management Endpoints (medium 6.4)
- [CVE-2024-29833](https://insights.sbomify.com/CVE-2024-29833/): WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler (medium 5.4)
- [CVE-2024-29832](https://insights.sbomify.com/CVE-2024-29832/): WordPress Photo Gallery Plugin <= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current_url (medium 6.1)
- [CVE-2024-29831](https://insights.sbomify.com/CVE-2024-29831/): Apache DolphinScheduler: RCE by arbitrary js execution (high 8.8)
- [CVE-2024-29830](https://insights.sbomify.com/CVE-2024-29830/): SQL injection in EPM (high 8.4)
- [CVE-2024-2983](https://insights.sbomify.com/CVE-2024-2983/): Tenda FH1202 SetClientState formSetClientState stack-based overflow (high 8.8)
- [CVE-2024-29829](https://insights.sbomify.com/CVE-2024-29829/): SQL injection in EPM (high 8.4)
- [CVE-2024-29828](https://insights.sbomify.com/CVE-2024-29828/): SQL injection in EPM (high 8.4)
- [CVE-2024-29827](https://insights.sbomify.com/CVE-2024-29827/): SQL injection in EPM (critical 9.6)
- [CVE-2024-29826](https://insights.sbomify.com/CVE-2024-29826/): SQL injection in EPM (critical 9.6)
- [CVE-2024-29825](https://insights.sbomify.com/CVE-2024-29825/): SQL injection in EPM (critical 9.6)
- [CVE-2024-29824](https://insights.sbomify.com/CVE-2024-29824/): Ivanti Endpoint Manager (EPM) SQL Injection (critical 9.6, exploited in the wild)
- [CVE-2024-29823](https://insights.sbomify.com/CVE-2024-29823/): SQL injection in EPM (critical 9.6)
- [CVE-2024-29822](https://insights.sbomify.com/CVE-2024-29822/): SQL injection in EPM (critical 9.6)
- [CVE-2024-29821](https://insights.sbomify.com/CVE-2024-29821/): Privilege escalation in DSM (high 7.8)
- [CVE-2024-29820](https://insights.sbomify.com/CVE-2024-29820/): WordPress PDF Builder for WPForms plugin <= 1.2.88 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-2982](https://insights.sbomify.com/CVE-2024-2982/): Tenda FH1202 WriteFacMac formWriteFacMac command injection (medium 5.5)
- [CVE-2024-29819](https://insights.sbomify.com/CVE-2024-29819/): WordPress WPFront Notification Bar plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29818](https://insights.sbomify.com/CVE-2024-29818/): WordPress WP Poll Maker plugin <= 3.1 - Authenticated Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29817](https://insights.sbomify.com/CVE-2024-29817/): WordPress affiliate-toolkit – WordPress Affiliate Plugin plugin <= 3.4.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29816](https://insights.sbomify.com/CVE-2024-29816/): WordPress Woo Viet plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29815](https://insights.sbomify.com/CVE-2024-29815/): WordPress WP Change Email Sender plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29814](https://insights.sbomify.com/CVE-2024-29814/): WordPress Exchange Rates Widget plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29813](https://insights.sbomify.com/CVE-2024-29813/): WordPress CartFlows plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29812](https://insights.sbomify.com/CVE-2024-29812/): WordPress ReviewX plugin <= 1.6.22 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29811](https://insights.sbomify.com/CVE-2024-29811/): WordPress Radio Player plugin <= 2.0.73 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29810](https://insights.sbomify.com/CVE-2024-29810/): WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg thumb_url (medium 5.4)
- [CVE-2024-2981](https://insights.sbomify.com/CVE-2024-2981/): Tenda FH1202 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow (high 8.8)
- [CVE-2024-29809](https://insights.sbomify.com/CVE-2024-29809/): WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_url (medium 5.4)
- [CVE-2024-29808](https://insights.sbomify.com/CVE-2024-29808/): WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_id (medium 5.4)
- [CVE-2024-29807](https://insights.sbomify.com/CVE-2024-29807/): WordPress DearFlip plugin <= 2.2.26 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29806](https://insights.sbomify.com/CVE-2024-29806/): WordPress ReDi Restaurant Reservation plugin <= 24.0128 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29805](https://insights.sbomify.com/CVE-2024-29805/): WordPress Shipping with Venipak for WooCommerce plugin <= 1.19.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29804](https://insights.sbomify.com/CVE-2024-29804/): WordPress Fancy Comments WordPress plugin <= 1.2.14 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29803](https://insights.sbomify.com/CVE-2024-29803/): WordPress FlatPM plugin < 3.1.05 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29802](https://insights.sbomify.com/CVE-2024-29802/): WordPress Football Pool plugin <= 2.11.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29801](https://insights.sbomify.com/CVE-2024-29801/): WordPress Fullscreen Galleria plugin <= 1.6.11 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29800](https://insights.sbomify.com/CVE-2024-29800/): WordPress Timber plugin <= 1.23.0 - Deserialization of untrusted data vulnerability (high 8.0)
- [CVE-2024-2980](https://insights.sbomify.com/CVE-2024-2980/): Tenda FH1202 execCommand formexeCommand stack-based overflow (high 8.8)
- [CVE-2024-29799](https://insights.sbomify.com/CVE-2024-29799/): WordPress WP Fast Total Search plugin <= 1.59.211 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29798](https://insights.sbomify.com/CVE-2024-29798/): WordPress Gratisfaction plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29797](https://insights.sbomify.com/CVE-2024-29797/): WordPress Grid Shortcodes plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29796](https://insights.sbomify.com/CVE-2024-29796/): WordPress Hot Random Image plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29795](https://insights.sbomify.com/CVE-2024-29795/): Cross-site scripting in Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more (medium 6.5)
- [CVE-2024-29794](https://insights.sbomify.com/CVE-2024-29794/): WordPress Conversios.io plugin <= 6.9.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29793](https://insights.sbomify.com/CVE-2024-29793/): WordPress MailChimp Forms by MailMunch plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29792](https://insights.sbomify.com/CVE-2024-29792/): WordPress Unlimited Elements for Elementor plugin <= 1.5.93 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29791](https://insights.sbomify.com/CVE-2024-29791/): WordPress Bulk NoIndex & NoFollow Toolkit plugin <= 2.01 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29790](https://insights.sbomify.com/CVE-2024-29790/): WordPress Squirrly SEO plugin <= 12.3.16 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-2979](https://insights.sbomify.com/CVE-2024-2979/): Tenda F1203 openSchedWifi setSchedWifi stack-based overflow (high 8.8)
- [CVE-2024-29789](https://insights.sbomify.com/CVE-2024-29789/): WordPress OneClick Chat to Order plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29788](https://insights.sbomify.com/CVE-2024-29788/): WordPress Podlove Web Player plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29787](https://insights.sbomify.com/CVE-2024-29787/): Use after free in Android (high 7.4)
- [CVE-2024-29786](https://insights.sbomify.com/CVE-2024-29786/): Memory corruption in Android (medium 6.4)
- [CVE-2024-29785](https://insights.sbomify.com/CVE-2024-29785/): Information disclosure in Android (medium 5.5)
- [CVE-2024-29784](https://insights.sbomify.com/CVE-2024-29784/): Integer overflow in Android (high 7.7)
- [CVE-2024-29783](https://insights.sbomify.com/CVE-2024-29783/): Memory corruption in Android (medium 6.7)
- [CVE-2024-29782](https://insights.sbomify.com/CVE-2024-29782/): Memory corruption in Android (medium 5.5)
- [CVE-2024-29781](https://insights.sbomify.com/CVE-2024-29781/): Memory corruption in Android (high 7.5)
- [CVE-2024-29780](https://insights.sbomify.com/CVE-2024-29780/): Information disclosure in Android (medium 5.5)
- [CVE-2024-2978](https://insights.sbomify.com/CVE-2024-2978/): Tenda F1203 setcfm formSetCfm stack-based overflow (high 8.8)
- [CVE-2024-29779](https://insights.sbomify.com/CVE-2024-29779/): Privilege escalation in Android (high 7.4)
- [CVE-2024-29778](https://insights.sbomify.com/CVE-2024-29778/): Memory corruption in Android (medium 4.7)
- [CVE-2024-29777](https://insights.sbomify.com/CVE-2024-29777/): WordPress Forminator plugin <= 1.29.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29776](https://insights.sbomify.com/CVE-2024-29776/): WordPress EventPrime plugin <= 3.3.9 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29775](https://insights.sbomify.com/CVE-2024-29775/): WordPress Frontend Dashboard plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29774](https://insights.sbomify.com/CVE-2024-29774/): WordPress WP Directory Kit plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29773](https://insights.sbomify.com/CVE-2024-29773/): WordPress BizPrint plugin <= 4.5.5 - CSRF to XSS vulnerability (high 7.1)
- [CVE-2024-29772](https://insights.sbomify.com/CVE-2024-29772/): WordPress MyBookTable Bookstore plugin <= 3.3.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29771](https://insights.sbomify.com/CVE-2024-29771/): WordPress Dracula Dark Mode plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29770](https://insights.sbomify.com/CVE-2024-29770/): WordPress Pretty Links plugin <= 3.6.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-2977](https://insights.sbomify.com/CVE-2024-2977/): Tenda F1203 QuickIndex formQuickIndex stack-based overflow (high 8.8)
- [CVE-2024-29769](https://insights.sbomify.com/CVE-2024-29769/): WordPress Portfolio Gallery plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29768](https://insights.sbomify.com/CVE-2024-29768/): WordPress Astra theme <= 4.6.4 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29767](https://insights.sbomify.com/CVE-2024-29767/): WordPress Doneren met Mollie plugin <= 2.10.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29766](https://insights.sbomify.com/CVE-2024-29766/): WordPress StreamWeasels Twitch Integration plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29765](https://insights.sbomify.com/CVE-2024-29765/): WordPress Aparat for WordPress plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29764](https://insights.sbomify.com/CVE-2024-29764/): WordPress Molongui plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29763](https://insights.sbomify.com/CVE-2024-29763/): WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29762](https://insights.sbomify.com/CVE-2024-29762/): WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29761](https://insights.sbomify.com/CVE-2024-29761/): WordPress WP Post Disclaimer plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/390/