# Vulnerabilities published in 2024


- [CVE-2024-29125](https://insights.sbomify.com/CVE-2024-29125/): WordPress Coupon Affiliates plugin <= 5.12.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29124](https://insights.sbomify.com/CVE-2024-29124/): WordPress Advanced Access Manager plugin <= 6.9.20 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29123](https://insights.sbomify.com/CVE-2024-29123/): WordPress Link Library plugin <= 7.6 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29122](https://insights.sbomify.com/CVE-2024-29122/): WordPress FV Player plugin <= 7.5.41.7212 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29121](https://insights.sbomify.com/CVE-2024-29121/): WordPress WooCommerce License Manager plugin <= 5.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29120](https://insights.sbomify.com/CVE-2024-29120/): Apache StreamPark: Information leakage vulnerability (medium 5.9)
- [CVE-2024-2912](https://insights.sbomify.com/CVE-2024-2912/): Insecure Deserialization Leading to RCE in bentoml/bentoml (critical 10.0)
- [CVE-2024-29119](https://insights.sbomify.com/CVE-2024-29119/): Privilege escalation in Spectrum Power 7 (high 8.5)
- [CVE-2024-29118](https://insights.sbomify.com/CVE-2024-29118/): WordPress Scrollsequence plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29117](https://insights.sbomify.com/CVE-2024-29117/): WordPress Contact Forms by Cimatti plugin <= 1.7.0 - Unauthenticated Stored Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29116](https://insights.sbomify.com/CVE-2024-29116/): WordPress WooThumbs for WooCommerce by Iconic plugin <= 5.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29115](https://insights.sbomify.com/CVE-2024-29115/): WordPress Smart Online Order for Clover plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29114](https://insights.sbomify.com/CVE-2024-29114/): WordPress Download Manager plugin <= 3.2.84 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29113](https://insights.sbomify.com/CVE-2024-29113/): WordPress RegistrationMagic plugin <= 5.2.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29112](https://insights.sbomify.com/CVE-2024-29112/): WordPress WooCommerce Google Feed Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29111](https://insights.sbomify.com/CVE-2024-29111/): WordPress Sitekit plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29110](https://insights.sbomify.com/CVE-2024-29110/): WordPress Tablesome plugin <= 1.0.27 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-2911](https://insights.sbomify.com/CVE-2024-2911/): Tianjin PubliCMS cross-site request forgery (medium 6.9)
- [CVE-2024-29109](https://insights.sbomify.com/CVE-2024-29109/): WordPress Shariff Wrapper plugin <= 4.6.10 - Contributor+ Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29108](https://insights.sbomify.com/CVE-2024-29108/): WordPress Happy Addons for Elementor plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29107](https://insights.sbomify.com/CVE-2024-29107/): WordPress Elementor Addon Elements plugin <= 1.12.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29106](https://insights.sbomify.com/CVE-2024-29106/): WordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29105](https://insights.sbomify.com/CVE-2024-29105/): WordPress WP Popups – WordPress Popup builder plugin <= 2.1.5.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29104](https://insights.sbomify.com/CVE-2024-29104/): WordPress Ticket Tailor plugin <= 1.10 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29103](https://insights.sbomify.com/CVE-2024-29103/): WordPress Database for Contact Form 7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29102](https://insights.sbomify.com/CVE-2024-29102/): WordPress Extensions For CF7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29101](https://insights.sbomify.com/CVE-2024-29101/): WordPress Jeg Elementor Kit plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29100](https://insights.sbomify.com/CVE-2024-29100/): WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerability (critical 9.1)
- [CVE-2024-2910](https://insights.sbomify.com/CVE-2024-2910/): Ruijie RG-EG350 HTTP POST Request vpnAction os command injection (medium 6.3)
- [CVE-2024-29099](https://insights.sbomify.com/CVE-2024-29099/): WordPress Evergreen Content Poster plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29098](https://insights.sbomify.com/CVE-2024-29098/): WordPress WP Calameo plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29097](https://insights.sbomify.com/CVE-2024-29097/): WordPress User profile plugin <= 2.0.20 - Subscriber+ Stored Cross Site Scripting (XSS) vulnerability (medium 6.3)
- [CVE-2024-29096](https://insights.sbomify.com/CVE-2024-29096/): WordPress MJM Clinic plugin <= 1.1.22 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29095](https://insights.sbomify.com/CVE-2024-29095/): WordPress Site Reviews plugin <= 6.11.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-29094](https://insights.sbomify.com/CVE-2024-29094/): WordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29093](https://insights.sbomify.com/CVE-2024-29093/): Cross-site request forgery in Builder for WooCommerce reviews shortcodes – ReviewShort (medium 4.3)
- [CVE-2024-29092](https://insights.sbomify.com/CVE-2024-29092/): WordPress Permalink Manager Lite plugin <= 2.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29091](https://insights.sbomify.com/CVE-2024-29091/): WordPress WP Armour plugin <= 2.1.13 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-29090](https://insights.sbomify.com/CVE-2024-29090/): WordPress AI Engine plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability (medium 6.8)
- [CVE-2024-2909](https://insights.sbomify.com/CVE-2024-2909/): Ruijie RG-EG350 HTTP POST Request setAction os command injection (high 8.8)
- [CVE-2024-29089](https://insights.sbomify.com/CVE-2024-29089/): WordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-29086](https://insights.sbomify.com/CVE-2024-29086/): Arkcompiler runtime has a stack overflow svulnerability (low 3.3)
- [CVE-2024-29085](https://insights.sbomify.com/CVE-2024-29085/): Missing authorization in BigDL software maintained by Intel(R) (medium 5.1)
- [CVE-2024-29083](https://insights.sbomify.com/CVE-2024-29083/): Misconfiguration in Intel(R) Distribution for Python software (medium 5.4)
- [CVE-2024-29082](https://insights.sbomify.com/CVE-2024-29082/): Vonets WiFi Bridges Improper Access Control (high 8.8)
- [CVE-2024-29080](https://insights.sbomify.com/CVE-2024-29080/): Privilege escalation in HP Display Control (medium 6.5)
- [CVE-2024-2908](https://insights.sbomify.com/CVE-2024-2908/): Call Now Button < 1.4.7 - Admin+ Stored XSS (medium 4.3)
- [CVE-2024-29079](https://insights.sbomify.com/CVE-2024-29079/): Privilege escalation in Intel(R) VROC software (medium 6.9)
- [CVE-2024-29078](https://insights.sbomify.com/CVE-2024-29078/): Misconfiguration in MosP kintai kanri (high 7.5)
- [CVE-2024-29077](https://insights.sbomify.com/CVE-2024-29077/): Privilege escalation in JAM STAPL Player software (medium 5.4)
- [CVE-2024-29076](https://insights.sbomify.com/CVE-2024-29076/): Denial of service in Intel(R) CST software (medium 6.8)
- [CVE-2024-29075](https://insights.sbomify.com/CVE-2024-29075/): Other in Mesh Wi-Fi router RP562B (medium 4.6)
- [CVE-2024-29074](https://insights.sbomify.com/CVE-2024-29074/): Telephony has an improper input validation vulnerability (medium 6.5)
- [CVE-2024-29073](https://insights.sbomify.com/CVE-2024-29073/): Anki Latex Incomplete Blocklist Vulnerability (medium 5.3)
- [CVE-2024-29072](https://insights.sbomify.com/CVE-2024-29072/): Privilege escalation in Foxit Reader (high 8.2)
- [CVE-2024-29071](https://insights.sbomify.com/CVE-2024-29071/): Hardcoded credentials in HGW BL1500HM (high 8.8)
- [CVE-2024-29070](https://insights.sbomify.com/CVE-2024-29070/): Apache StreamPark: session not invalidated after logout (critical 9.1)
- [CVE-2024-2907](https://insights.sbomify.com/CVE-2024-2907/): AGCA – Custom Dashboard & Login Page < 7.2.2 - Admin+ Stored XSS via Image URL (medium 6.8)
- [CVE-2024-29069](https://insights.sbomify.com/CVE-2024-29069/): snapd will follow archived symlinks when unpacking a filesystem (medium 4.8)
- [CVE-2024-29068](https://insights.sbomify.com/CVE-2024-29068/): snapd non-regular file indefinite blocking read (medium 5.8)
- [CVE-2024-29066](https://insights.sbomify.com/CVE-2024-29066/): Windows Distributed File System (DFS) Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-29064](https://insights.sbomify.com/CVE-2024-29064/): Windows Hyper-V Denial of Service Vulnerability (medium 6.2)
- [CVE-2024-29063](https://insights.sbomify.com/CVE-2024-29063/): Azure AI Search Information Disclosure Vulnerability (high 7.3)
- [CVE-2024-29062](https://insights.sbomify.com/CVE-2024-29062/): Secure Boot Security Feature Bypass Vulnerability (high 7.1)
- [CVE-2024-29061](https://insights.sbomify.com/CVE-2024-29061/): Secure Boot Security Feature Bypass Vulnerability (high 7.8)
- [CVE-2024-29060](https://insights.sbomify.com/CVE-2024-29060/): Visual Studio Elevation of Privilege Vulnerability (medium 6.7)
- [CVE-2024-2906](https://insights.sbomify.com/CVE-2024-2906/): WordPress Radio Player plugin <= 2.0.73 - Unauthenticated Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-29059](https://insights.sbomify.com/CVE-2024-29059/): Microsoft .NET Framework Information Disclosure (high 7.5, exploited in the wild)
- [CVE-2024-29057](https://insights.sbomify.com/CVE-2024-29057/): Microsoft Edge (Chromium-based) Spoofing Vulnerability (medium 4.3)
- [CVE-2024-29056](https://insights.sbomify.com/CVE-2024-29056/): Windows Authentication Elevation of Privilege Vulnerability (medium 4.3)
- [CVE-2024-29055](https://insights.sbomify.com/CVE-2024-29055/): Microsoft Defender for IoT Elevation of Privilege Vulnerability (high 7.2)
- [CVE-2024-29054](https://insights.sbomify.com/CVE-2024-29054/): Microsoft Defender for IoT Elevation of Privilege Vulnerability (high 7.2)
- [CVE-2024-29053](https://insights.sbomify.com/CVE-2024-29053/): Microsoft Defender for IoT Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-29052](https://insights.sbomify.com/CVE-2024-29052/): Windows Storage Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-29050](https://insights.sbomify.com/CVE-2024-29050/): Windows Cryptographic Services Remote Code Execution Vulnerability (high 8.4)
- [CVE-2024-2905](https://insights.sbomify.com/CVE-2024-2905/): Rpm-ostree: world-readable /etc/shadow file (medium 6.2)
- [CVE-2024-29049](https://insights.sbomify.com/CVE-2024-29049/): Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability (medium 4.1)
- [CVE-2024-29048](https://insights.sbomify.com/CVE-2024-29048/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-29047](https://insights.sbomify.com/CVE-2024-29047/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-29046](https://insights.sbomify.com/CVE-2024-29046/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-29045](https://insights.sbomify.com/CVE-2024-29045/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-29044](https://insights.sbomify.com/CVE-2024-29044/): Microsoft OLE DB Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-29043](https://insights.sbomify.com/CVE-2024-29043/): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-29042](https://insights.sbomify.com/CVE-2024-29042/): Translate Cache Poisoning Vulnerability (medium 5.3)
- [CVE-2024-29041](https://insights.sbomify.com/CVE-2024-29041/): Express.js Open Redirect in malformed URLs (medium 6.1)
- [CVE-2024-29040](https://insights.sbomify.com/CVE-2024-29040/): Fapi Verify Quote: Does not detect if quote was not generated by TPM (medium 4.3)
- [CVE-2024-2904](https://insights.sbomify.com/CVE-2024-2904/): WordPress Calliope theme <= 1.0.33 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-29039](https://insights.sbomify.com/CVE-2024-29039/): Missing check in tpm2_checkquote allows attackers to misrepresent the TPM state (critical 9.1)
- [CVE-2024-29038](https://insights.sbomify.com/CVE-2024-29038/): tpm2 does not detect if quote was not generated by TPM (medium 4.3)
- [CVE-2024-29037](https://insights.sbomify.com/CVE-2024-29037/): Default secret use for initial deployment (critical 9.1)
- [CVE-2024-29036](https://insights.sbomify.com/CVE-2024-29036/): Saleor Storefront session leak in cache (medium 4.3)
- [CVE-2024-29035](https://insights.sbomify.com/CVE-2024-29035/): Umbraco's Blind SSRF Leads to Port Scan by using Webhooks (medium 4.1)
- [CVE-2024-29034](https://insights.sbomify.com/CVE-2024-29034/): CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained (medium 6.8)
- [CVE-2024-29033](https://insights.sbomify.com/CVE-2024-29033/): GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace (high 7.5)
- [CVE-2024-29032](https://insights.sbomify.com/CVE-2024-29032/): `qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary code (medium 5.3)
- [CVE-2024-29031](https://insights.sbomify.com/CVE-2024-29031/): Meshery SQL Injection vulnerability (high 7.5)
- [CVE-2024-29030](https://insights.sbomify.com/CVE-2024-29030/): memos vulnerable to an SSRF in /api/resource (medium 5.8)
- [CVE-2024-2903](https://insights.sbomify.com/CVE-2024-2903/): Tenda AC7 GetParentControlInfo stack-based overflow (high 8.8)
- [CVE-2024-29029](https://insights.sbomify.com/CVE-2024-29029/): memos vulnerable to an SSRF in /o/get/image (medium 6.1)
- [CVE-2024-29028](https://insights.sbomify.com/CVE-2024-29028/): memos vulnerable to an SSRF in /o/get/httpmeta (medium 5.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/394/