# Vulnerabilities published in 2024


- [CVE-2024-22368](https://insights.sbomify.com/CVE-2024-22368/): Denial of service in tozt:spreadsheet\ (medium 5.5)
- [CVE-2024-22366](https://insights.sbomify.com/CVE-2024-22366/): Command injection in WLX202 (medium 6.8)
- [CVE-2024-22365](https://insights.sbomify.com/CVE-2024-22365/): Denial of service in linux-pam:linux-pam (medium 5.5)
- [CVE-2024-22363](https://insights.sbomify.com/CVE-2024-22363/): SheetJS Regular Expression Denial of Service (ReDoS) (high 7.5)
- [CVE-2024-22362](https://insights.sbomify.com/CVE-2024-22362/): Drupal Denial of Service vulnerability (high 7.5)
- [CVE-2024-22361](https://insights.sbomify.com/CVE-2024-22361/): IBM Semeru Runtime information disclosure (medium 5.9)
- [CVE-2024-22360](https://insights.sbomify.com/CVE-2024-22360/): IBM Db2 for Linux, UNIX and Windows denial of service (medium 5.3)
- [CVE-2024-2236](https://insights.sbomify.com/CVE-2024-2236/): Libgcrypt: vulnerable to marvin attack (medium 5.9)
- [CVE-2024-22359](https://insights.sbomify.com/CVE-2024-22359/): IBM UrbanCode Deploy cross-site scripting (medium 6.1)
- [CVE-2024-22358](https://insights.sbomify.com/CVE-2024-22358/): IBM UrbanCode Deploy session fixation (medium 6.3)
- [CVE-2024-22357](https://insights.sbomify.com/CVE-2024-22357/): IBM Sterling B2B Integrator cross-site scripting (medium 5.4)
- [CVE-2024-22356](https://insights.sbomify.com/CVE-2024-22356/): IBM App Connect Enterprise and IBM Integration Bus for z/OS information disclosure (medium 4.9)
- [CVE-2024-22355](https://insights.sbomify.com/CVE-2024-22355/): IBM QRadar Suite information dislosure (medium 5.9)
- [CVE-2024-22354](https://insights.sbomify.com/CVE-2024-22354/): IBM WebSphere Application Server XML external entity injection (high 7.0)
- [CVE-2024-22353](https://insights.sbomify.com/CVE-2024-22353/): IBM WebSphere Application Server Liberty denial of service (medium 5.9)
- [CVE-2024-22352](https://insights.sbomify.com/CVE-2024-22352/): IBM InfoSphere Information Server information disclosure (medium 6.5)
- [CVE-2024-22351](https://insights.sbomify.com/CVE-2024-22351/): IBM InfoSphere Information Server session fixation (medium 6.3)
- [CVE-2024-2235](https://insights.sbomify.com/CVE-2024-2235/): Himer - Social Questions and Answers < 2.1.1 - Bypass Poll Voting Restrictions via CSRF (medium 6.3)
- [CVE-2024-22349](https://insights.sbomify.com/CVE-2024-22349/): IBM UrbanCode Velocity information disclosure (medium 4.0)
- [CVE-2024-22348](https://insights.sbomify.com/CVE-2024-22348/): IBM UrbanCode Velocity cross-origin resource sharing (medium 5.3)
- [CVE-2024-22347](https://insights.sbomify.com/CVE-2024-22347/): IBM UrbanCode Velocity information disclosure (medium 5.9)
- [CVE-2024-22346](https://insights.sbomify.com/CVE-2024-22346/): IBM i privilege escalation (high 8.4)
- [CVE-2024-22345](https://insights.sbomify.com/CVE-2024-22345/): IBM TXSeries for Multiplatforms information disclosure (medium 6.2)
- [CVE-2024-22344](https://insights.sbomify.com/CVE-2024-22344/): IBM TXSeries for Multiplatforms information disclosure (medium 6.1)
- [CVE-2024-22343](https://insights.sbomify.com/CVE-2024-22343/): IBM TXSeries for Multiplatforms information disclosure (medium 4.0)
- [CVE-2024-22341](https://insights.sbomify.com/CVE-2024-22341/): IBM Watson Query on Cloud Pak for Data information disclosure (medium 5.3)
- [CVE-2024-22340](https://insights.sbomify.com/CVE-2024-22340/): IBM Common Cryptographic Architecture information disclosure (medium 6.5)
- [CVE-2024-2234](https://insights.sbomify.com/CVE-2024-2234/): Himer - Social Questions and Answers < 2.1.1 - Contributor+ Stored XSS (medium 6.3)
- [CVE-2024-22339](https://insights.sbomify.com/CVE-2024-22339/): IBM UrbanCode Deploy information disclosure (medium 4.3)
- [CVE-2024-22338](https://insights.sbomify.com/CVE-2024-22338/): IBM Security Verify Access OIDC Provider information disclosure (medium 4.0)
- [CVE-2024-22337](https://insights.sbomify.com/CVE-2024-22337/): IBM QRadar Suite information disclosure (medium 5.1)
- [CVE-2024-22336](https://insights.sbomify.com/CVE-2024-22336/): IBM QRadar Suite information disclosure (medium 5.1)
- [CVE-2024-22335](https://insights.sbomify.com/CVE-2024-22335/): IBM QRadar Suite information disclosure (medium 5.1)
- [CVE-2024-22334](https://insights.sbomify.com/CVE-2024-22334/): IBM UrbanCode Deploy improper privilege control (medium 4.4)
- [CVE-2024-22333](https://insights.sbomify.com/CVE-2024-22333/): IBM Maximo Application Suite information disclosure (low 3.3)
- [CVE-2024-22332](https://insights.sbomify.com/CVE-2024-22332/): IBM Integration Bus for z/OS denial of service (medium 6.5)
- [CVE-2024-22331](https://insights.sbomify.com/CVE-2024-22331/): IBM UrbanCode Deploy information disclosure (medium 6.2)
- [CVE-2024-22330](https://insights.sbomify.com/CVE-2024-22330/): IBM Security Verify Governance information disclosure (medium 5.9)
- [CVE-2024-2233](https://insights.sbomify.com/CVE-2024-2233/): Himer - Social Questions and Answers < 2.1.1 - Multiple CSRF on the Group Section (medium 6.3)
- [CVE-2024-22329](https://insights.sbomify.com/CVE-2024-22329/): IBM WebSphere Application Server server-side request forgery (medium 4.3)
- [CVE-2024-22328](https://insights.sbomify.com/CVE-2024-22328/): IBM Maximo Application Suite information disclosure (high 7.5)
- [CVE-2024-22326](https://insights.sbomify.com/CVE-2024-22326/): IBM System Storage improper authentication (medium 5.0)
- [CVE-2024-22320](https://insights.sbomify.com/CVE-2024-22320/): IBM Operational Decision Manager code execution (critical 9.8)
- [CVE-2024-2232](https://insights.sbomify.com/CVE-2024-2232/): Himer - Social Questions and Answers < 2.1.3 - CSRF While Sending the Invites (high 8.1)
- [CVE-2024-22319](https://insights.sbomify.com/CVE-2024-22319/): IBM Operational Decision Manager JDNI injection (high 8.1)
- [CVE-2024-22318](https://insights.sbomify.com/CVE-2024-22318/): IBM i Access Client Solutions information disclosure (medium 5.1)
- [CVE-2024-22317](https://insights.sbomify.com/CVE-2024-22317/): IBM App Connect Enterprise denial of service (critical 9.1)
- [CVE-2024-22316](https://insights.sbomify.com/CVE-2024-22316/): IBM Sterling File Gateway improper access control (medium 4.3)
- [CVE-2024-22315](https://insights.sbomify.com/CVE-2024-22315/): IBM Fusion improper communication restriction (medium 4.0)
- [CVE-2024-22314](https://insights.sbomify.com/CVE-2024-22314/): IBM Storage Defender - Resiliency Service information disclosure (medium 5.9)
- [CVE-2024-22313](https://insights.sbomify.com/CVE-2024-22313/): IBM Storage Defender - Resiliency Service information disclosure (medium 6.2)
- [CVE-2024-22312](https://insights.sbomify.com/CVE-2024-22312/): IBM Storage Defender - Resiliency Service information disclosure (medium 4.4)
- [CVE-2024-22311](https://insights.sbomify.com/CVE-2024-22311/): WordPress Simply Schedule Appointments plugin <= 1.6.6.20 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-22310](https://insights.sbomify.com/CVE-2024-22310/): WordPress Formzu WP Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-2231](https://insights.sbomify.com/CVE-2024-2231/): Himer - Social Questions and Answers < 2.1.1 - Subscriber+ Private Group Joining via IDOR (medium 6.5)
- [CVE-2024-22309](https://insights.sbomify.com/CVE-2024-22309/): WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object Injection (high 8.7)
- [CVE-2024-22308](https://insights.sbomify.com/CVE-2024-22308/): WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirection (low 3.4)
- [CVE-2024-22307](https://insights.sbomify.com/CVE-2024-22307/): WordPress WP-Lister Lite for eBay plugin <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-22306](https://insights.sbomify.com/CVE-2024-22306/): WordPress Mang Board WP Plugin <= 1.7.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-22305](https://insights.sbomify.com/CVE-2024-22305/): Missing authorization in Contact Form builder with drag & drop for WordPress – Kali Forms (high 7.5)
- [CVE-2024-22304](https://insights.sbomify.com/CVE-2024-22304/): WordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2024-22303](https://insights.sbomify.com/CVE-2024-22303/): WordPress Houzez theme <= 3.2.4 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-22302](https://insights.sbomify.com/CVE-2024-22302/): WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-22301](https://insights.sbomify.com/CVE-2024-22301/): WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2024-22300](https://insights.sbomify.com/CVE-2024-22300/): WordPress Icegram Express plugin <= 5.7.11 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-22299](https://insights.sbomify.com/CVE-2024-22299/): WordPress FV Player plugin <= 7.5.41.7212 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-22298](https://insights.sbomify.com/CVE-2024-22298/): WordPress Amelia plugin <= 1.0.98 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-22297](https://insights.sbomify.com/CVE-2024-22297/): WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-22296](https://insights.sbomify.com/CVE-2024-22296/): WordPress 12 Step Meeting List plugin <= 3.14.28 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-22295](https://insights.sbomify.com/CVE-2024-22295/): WordPress Robo Gallery Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-22294](https://insights.sbomify.com/CVE-2024-22294/): WordPress Download IP2Location Country Blocker Plugin <= 2.33.3 is vulnerable to Sensitive Data Exposure (medium 5.3)
- [CVE-2024-22293](https://insights.sbomify.com/CVE-2024-22293/): WordPress BP Profile Search Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-22292](https://insights.sbomify.com/CVE-2024-22292/): WordPress WP To Do Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-22291](https://insights.sbomify.com/CVE-2024-22291/): WordPress Browser Theme Color Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-22290](https://insights.sbomify.com/CVE-2024-22290/): WordPress Custom Dashboard Widgets Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2024-2229](https://insights.sbomify.com/CVE-2024-2229/): Deserialization in EcoStruxure Power Design - Ecodial (high 7.8)
- [CVE-2024-22289](https://insights.sbomify.com/CVE-2024-22289/): WordPress Post views Stats plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-22288](https://insights.sbomify.com/CVE-2024-22288/): Cross-site scripting in WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels (high 7.1)
- [CVE-2024-22287](https://insights.sbomify.com/CVE-2024-22287/): WordPress Better Anchor Links Plugin <= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2024-22286](https://insights.sbomify.com/CVE-2024-22286/): WordPress BA Plus Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-22285](https://insights.sbomify.com/CVE-2024-22285/): WordPress Frontpage Manager Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2024-22284](https://insights.sbomify.com/CVE-2024-22284/): WordPress Asgaros Forum Plugin <= 2.7.2 is vulnerable to PHP Object Injection (high 8.7)
- [CVE-2024-22283](https://insights.sbomify.com/CVE-2024-22283/): WordPress Delhivery Logistics Courier Plugin <= 1.0.107 is vulnerable to SQL Injection (high 8.5)
- [CVE-2024-22282](https://insights.sbomify.com/CVE-2024-22282/): WordPress SimpleMap Store Locator Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-22281](https://insights.sbomify.com/CVE-2024-22281/): Apache Helix Front (UI): Helix front hard-coded secret in the express-session (high 7.5)
- [CVE-2024-22280](https://insights.sbomify.com/CVE-2024-22280/): VMSA-2024-0017: VMware Aria Automation updates address SQL-injection vulnerability (CVE-2024-22280) (high 8.5)
- [CVE-2024-2228](https://insights.sbomify.com/CVE-2024-2228/): IdentityIQ Authorization of QuickLink Target Identities Vulnerability (high 7.1)
- [CVE-2024-22279](https://insights.sbomify.com/CVE-2024-22279/): GoRouter Denial of Service Attack (medium 5.9)
- [CVE-2024-22278](https://insights.sbomify.com/CVE-2024-22278/): Harbor fails to validate the user permissions when updating project configurations (medium 6.4)
- [CVE-2024-22277](https://insights.sbomify.com/CVE-2024-22277/): Cross-site scripting in VMware Cloud Director Availability (medium 6.4)
- [CVE-2024-22276](https://insights.sbomify.com/CVE-2024-22276/): Information disclosure in VMware Cloud Director Object Storage Extension (medium 5.3)
- [CVE-2024-22275](https://insights.sbomify.com/CVE-2024-22275/): Information disclosure in VMware Cloud Foundation (vCenter Server) (medium 4.9)
- [CVE-2024-22274](https://insights.sbomify.com/CVE-2024-22274/): Code injection in VMware Cloud Foundation (vCenter Server) (high 7.2)
- [CVE-2024-22273](https://insights.sbomify.com/CVE-2024-22273/): Memory corruption in VMware Cloud Foundation (ESXi) (high 8.1)
- [CVE-2024-22272](https://insights.sbomify.com/CVE-2024-22272/): Missing authorization in VMware Cloud Director (medium 4.9)
- [CVE-2024-22271](https://insights.sbomify.com/CVE-2024-22271/): Spring Cloud Function Web DOS Vulnerability (high 8.2)
- [CVE-2024-22270](https://insights.sbomify.com/CVE-2024-22270/): Information disclosure in VMware Fusion (high 7.1)
- [CVE-2024-2227](https://insights.sbomify.com/CVE-2024-2227/): IdentityIQ JavaServer Faces File Path Traversal Vulnerability (critical 10.0)
- [CVE-2024-22269](https://insights.sbomify.com/CVE-2024-22269/): Information disclosure in VMware Fusion (high 7.1)
- [CVE-2024-22268](https://insights.sbomify.com/CVE-2024-22268/): Memory corruption in VMware Fusion (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/444/