# Vulnerabilities published in 2024


- [CVE-2024-22161](https://insights.sbomify.com/CVE-2024-22161/): WordPress HD Quiz Plugin <= 1.8.11 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-22160](https://insights.sbomify.com/CVE-2024-22160/): WordPress Image Tag Manager Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-2216](https://insights.sbomify.com/CVE-2024-2216/): Jenkins docker-build-step Plugin missing permission check (high 8.8)
- [CVE-2024-22159](https://insights.sbomify.com/CVE-2024-22159/): WordPress WOLF Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-22158](https://insights.sbomify.com/CVE-2024-22158/): WordPress PeepSo Core: Photos Plugin < 6.3.1.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-22157](https://insights.sbomify.com/CVE-2024-22157/): WordPress SalesKing plugin <= 1.6.15 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-22156](https://insights.sbomify.com/CVE-2024-22156/): WordPress SalesKing plugin <= 1.6.15 - Unauthenticated Plugin Settings Change vulnerability (medium 6.5)
- [CVE-2024-22155](https://insights.sbomify.com/CVE-2024-22155/): WordPress WooCommerce plugin <= 8.5.2 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-22154](https://insights.sbomify.com/CVE-2024-22154/): WordPress SalesKing Plugin <= 1.6.15 is vulnerable to Sensitive Data Exposure (high 7.5)
- [CVE-2024-22153](https://insights.sbomify.com/CVE-2024-22153/): WordPress Stock Locations for WooCommerce Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-22152](https://insights.sbomify.com/CVE-2024-22152/): WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File Upload (high 8.0)
- [CVE-2024-22151](https://insights.sbomify.com/CVE-2024-22151/): WordPress Import and export users and customers plugin <= 1.24.6 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-22150](https://insights.sbomify.com/CVE-2024-22150/): Cross-site scripting in Portfolio & Image Gallery for WordPress | PowerFolio (medium 6.5)
- [CVE-2024-2215](https://insights.sbomify.com/CVE-2024-2215/): Jenkins docker-build-step Plugin Cross-Site Request Forgery vulnerability (medium 6.1)
- [CVE-2024-22149](https://insights.sbomify.com/CVE-2024-22149/): WordPress cformsII plugin <= 15.0.5 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-22148](https://insights.sbomify.com/CVE-2024-22148/): WordPress WP Smart Editor Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-22147](https://insights.sbomify.com/CVE-2024-22147/): WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.7.5 is vulnerable to SQL Injection (high 7.6)
- [CVE-2024-22146](https://insights.sbomify.com/CVE-2024-22146/): WordPress Schema & Structured Data for WP & AMP Plugin <= 1.25 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-22145](https://insights.sbomify.com/CVE-2024-22145/): WordPress InstaWP Connect plugin <= 0.1.0.8 - Arbitrary Option Update to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-22144](https://insights.sbomify.com/CVE-2024-22144/): Code injection in Anti-Malware Security and Brute-Force Firewall (critical 9.0)
- [CVE-2024-22143](https://insights.sbomify.com/CVE-2024-22143/): WordPress WP Spell Check Plugin <= 9.17 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2024-22142](https://insights.sbomify.com/CVE-2024-22142/): WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-22141](https://insights.sbomify.com/CVE-2024-22141/): WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data Exposure (medium 6.5)
- [CVE-2024-22140](https://insights.sbomify.com/CVE-2024-22140/): WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF) (high 8.8)
- [CVE-2024-2214](https://insights.sbomify.com/CVE-2024-2214/): Missing array size check in _Mtxinit() in the Xtensa port (high 7.0)
- [CVE-2024-22139](https://insights.sbomify.com/CVE-2024-22139/): WordPress WordPress Manutenção plugin <= 1.0.6 - Bypass vulnerability (low 3.7)
- [CVE-2024-22138](https://insights.sbomify.com/CVE-2024-22138/): WordPress Seraphinite Accelerator plugin <= 2.20.47 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-22137](https://insights.sbomify.com/CVE-2024-22137/): WordPress Constant Contact Forms by MailMunch Plugin <= 2.0.11 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-22136](https://insights.sbomify.com/CVE-2024-22136/): WordPress Droit Elementor Addons Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-22135](https://insights.sbomify.com/CVE-2024-22135/): WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File Upload (high 8.0)
- [CVE-2024-22134](https://insights.sbomify.com/CVE-2024-22134/): WordPress Contact Form 7 Extension For Mailchimp Plugin <= 0.5.70 is vulnerable to Server Side Request Forgery (SSRF) (medium 4.9)
- [CVE-2024-22133](https://insights.sbomify.com/CVE-2024-22133/): Improper Access Control in SAP Fiori Front End Server (medium 4.6)
- [CVE-2024-22132](https://insights.sbomify.com/CVE-2024-22132/): Code Injection vulnerability in SAP IDES Systems (high 7.4)
- [CVE-2024-22131](https://insights.sbomify.com/CVE-2024-22131/): Code Injection vulnerability in SAP ABA (Application Basis) (critical 9.1)
- [CVE-2024-22130](https://insights.sbomify.com/CVE-2024-22130/): Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI (high 7.6)
- [CVE-2024-2213](https://insights.sbomify.com/CVE-2024-2213/): Improper Authentication in zenml-io/zenml (low 3.3)
- [CVE-2024-22129](https://insights.sbomify.com/CVE-2024-22129/): Cross-Site Scripting (XSS) vulnerability in SAP Companion (medium 5.4)
- [CVE-2024-22128](https://insights.sbomify.com/CVE-2024-22128/): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Business Client for HTML (medium 4.7)
- [CVE-2024-22127](https://insights.sbomify.com/CVE-2024-22127/): Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in) (critical 9.1)
- [CVE-2024-22126](https://insights.sbomify.com/CVE-2024-22126/): Cross Site Scripting vulnerability in SAP NetWeaver AS Java (User Admin Application) (medium 6.1)
- [CVE-2024-22125](https://insights.sbomify.com/CVE-2024-22125/): Information Disclosure vulnerability in Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) (high 7.4)
- [CVE-2024-22124](https://insights.sbomify.com/CVE-2024-22124/): Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager (medium 4.1)
- [CVE-2024-22123](https://insights.sbomify.com/CVE-2024-22123/): Zabbix Arbitrary File Read (low 2.7)
- [CVE-2024-22122](https://insights.sbomify.com/CVE-2024-22122/): AT(GSM) Command Injection (low 3.0)
- [CVE-2024-22121](https://insights.sbomify.com/CVE-2024-22121/): Zabbix Agent MSI Installer Allows Non-Admin User to Access Change Option via msiexec.exe (medium 6.1)
- [CVE-2024-22120](https://insights.sbomify.com/CVE-2024-22120/): Time Based SQL Injection in Zabbix Server Audit Log (critical 9.1)
- [CVE-2024-2212](https://insights.sbomify.com/CVE-2024-2212/): Integer overflow in ThreadX (high 7.3)
- [CVE-2024-22119](https://insights.sbomify.com/CVE-2024-22119/): Stored XSS in graph items select form (medium 5.5)
- [CVE-2024-22117](https://insights.sbomify.com/CVE-2024-22117/): Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added (low 2.2)
- [CVE-2024-22116](https://insights.sbomify.com/CVE-2024-22116/): Remote code execution within ping script (critical 9.9)
- [CVE-2024-22114](https://insights.sbomify.com/CVE-2024-22114/): System Information Widget in Global View Dashboard exposes information about Hosts to Users without Permission (medium 4.3)
- [CVE-2024-22113](https://insights.sbomify.com/CVE-2024-22113/): Open redirect in Access analysis CGI An-Analyzer (medium 6.1)
- [CVE-2024-2211](https://insights.sbomify.com/CVE-2024-2211/): Cross-Site Scripting vulnerability in Gophish Admin Panel (medium 4.6)
- [CVE-2024-22108](https://insights.sbomify.com/CVE-2024-22108/): SQL injection in gttb:gtb central console (critical 9.8)
- [CVE-2024-22107](https://insights.sbomify.com/CVE-2024-22107/): Command injection in gttb:gtb central console (high 7.2)
- [CVE-2024-22106](https://insights.sbomify.com/CVE-2024-22106/): Privilege escalation in jungo:windriver (high 8.8)
- [CVE-2024-22105](https://insights.sbomify.com/CVE-2024-22105/): Denial of service in jungo:windriver (medium 5.5)
- [CVE-2024-22104](https://insights.sbomify.com/CVE-2024-22104/): Memory corruption in jungo:windriver (medium 5.5)
- [CVE-2024-22103](https://insights.sbomify.com/CVE-2024-22103/): Memory corruption in jungo:windriver (medium 4.4)
- [CVE-2024-22102](https://insights.sbomify.com/CVE-2024-22102/): Denial of service in jungo:windriver (medium 5.5)
- [CVE-2024-22100](https://insights.sbomify.com/CVE-2024-22100/): MicroDicom DICOM Heap-based Buffer Overflow (high 7.8)
- [CVE-2024-2210](https://insights.sbomify.com/CVE-2024-2210/): The Plus Addons for Elementor <= 5.4.1 - Authenticated (Contributor+) Local File Inclusion via Team Member Listing (medium 6.4)
- [CVE-2024-22099](https://insights.sbomify.com/CVE-2024-22099/): NULL pointer deference in rfcomm_check_security in Linux kernel (medium 6.3)
- [CVE-2024-22098](https://insights.sbomify.com/CVE-2024-22098/): AVSession has a use after free vulnerability (medium 6.5)
- [CVE-2024-22097](https://insights.sbomify.com/CVE-2024-22097/): Memory corruption in libbiosig (critical 9.8)
- [CVE-2024-22096](https://insights.sbomify.com/CVE-2024-22096/): Relative Path Traversal in Rapid SCADA (medium 6.5)
- [CVE-2024-22095](https://insights.sbomify.com/CVE-2024-22095/): Privilege escalation in UEFI firmware for some Intel(R) Server D50DNP Family products (high 7.2)
- [CVE-2024-22093](https://insights.sbomify.com/CVE-2024-22093/): Appliance mode iControl REST vulnerability (high 8.7)
- [CVE-2024-22092](https://insights.sbomify.com/CVE-2024-22092/): Bundlemanager has an authentication bypass vulnerability (high 7.7)
- [CVE-2024-22091](https://insights.sbomify.com/CVE-2024-22091/): Excessive resource consumption due to lack to request path size limits (low 3.1)
- [CVE-2024-2209](https://insights.sbomify.com/CVE-2024-2209/): HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code (medium 6.3)
- [CVE-2024-22088](https://insights.sbomify.com/CVE-2024-22088/): Use after free in chendotjs:lotos webserver (critical 9.8)
- [CVE-2024-22087](https://insights.sbomify.com/CVE-2024-22087/): Memory corruption in alekseykurepin:pico http server in c (critical 9.8)
- [CVE-2024-22086](https://insights.sbomify.com/CVE-2024-22086/): Memory corruption in hayyp:cherry (critical 9.8)
- [CVE-2024-22085](https://insights.sbomify.com/CVE-2024-22085/): Misconfiguration in elspec-ltd:g5dfr firmware (medium 6.2)
- [CVE-2024-22084](https://insights.sbomify.com/CVE-2024-22084/): Information disclosure in elspec-ltd:g5dfr firmware (high 7.5)
- [CVE-2024-22083](https://insights.sbomify.com/CVE-2024-22083/): Hardcoded credentials in elspec-ltd:g5dfr firmware (medium 6.5)
- [CVE-2024-22082](https://insights.sbomify.com/CVE-2024-22082/): Information disclosure in elspec-ltd:g5dfr firmware (high 7.5)
- [CVE-2024-22081](https://insights.sbomify.com/CVE-2024-22081/): Memory corruption in elspec-ltd:g5dfr firmware (critical 9.8)
- [CVE-2024-22080](https://insights.sbomify.com/CVE-2024-22080/): Memory corruption in elspec-ltd:g5dfr firmware (critical 9.8)
- [CVE-2024-2208](https://insights.sbomify.com/CVE-2024-2208/): Sound Research SECOMN64 Escalation of Privilege (high 8.8)
- [CVE-2024-22079](https://insights.sbomify.com/CVE-2024-22079/): Path traversal in elspec-ltd:g5dfr firmware (high 7.5)
- [CVE-2024-22078](https://insights.sbomify.com/CVE-2024-22078/): Privilege escalation in elspec-ltd:g5dfr firmware (high 8.8)
- [CVE-2024-22077](https://insights.sbomify.com/CVE-2024-22077/): Misconfiguration in elspec-ltd:g5dfr firmware (medium 5.3)
- [CVE-2024-22076](https://insights.sbomify.com/CVE-2024-22076/): Code injection in myq-solution:print server (critical 9.8)
- [CVE-2024-22075](https://insights.sbomify.com/CVE-2024-22075/): Firefly III allows webhooks HTML Injection. (medium 6.1)
- [CVE-2024-22074](https://insights.sbomify.com/CVE-2024-22074/): Missing authorization in dynamsoft:dynamsoft service (critical 9.8)
- [CVE-2024-2207](https://insights.sbomify.com/CVE-2024-2207/): Sound Research SECOMN64 Escalation of Privilege (medium 6.0)
- [CVE-2024-22069](https://insights.sbomify.com/CVE-2024-22069/): Permission and Access Control Vulnerability in ZXV10 XT802/ET301 (high 7.1)
- [CVE-2024-22068](https://insights.sbomify.com/CVE-2024-22068/): Weak Password Vulnerability in ZTE ZSR V2 Intelligent Multi Service Router (medium 6.0)
- [CVE-2024-22067](https://insights.sbomify.com/CVE-2024-22067/): ZTE NH8091 product has an improper permission control vulnerability (medium 6.8)
- [CVE-2024-22066](https://insights.sbomify.com/CVE-2024-22066/): Information disclosure in ZXR10 1800-2S (high 7.5)
- [CVE-2024-22065](https://insights.sbomify.com/CVE-2024-22065/): ZTE MF258 Pro product has a OS Command injection vulnerability (medium 6.8)
- [CVE-2024-22064](https://insights.sbomify.com/CVE-2024-22064/): Configuration error Vulnerability in ZTE ZXUN-ePDG (high 8.3)
- [CVE-2024-22063](https://insights.sbomify.com/CVE-2024-22063/): ZTE ZENIC ONE R58 product has a CSV injection vulnerability (high 7.6)
- [CVE-2024-22062](https://insights.sbomify.com/CVE-2024-22062/): Permissions and Access Control Vulnerability in ZTE ZXCLOUD IRAI (medium 6.3)
- [CVE-2024-22061](https://insights.sbomify.com/CVE-2024-22061/): Memory corruption in Avalanche (high 8.1)
- [CVE-2024-22060](https://insights.sbomify.com/CVE-2024-22060/): File upload in ITSM (high 8.7)
- [CVE-2024-2206](https://insights.sbomify.com/CVE-2024-2206/): SSRF Vulnerability in gradio-app/gradio (high 7.3)
- [CVE-2024-22059](https://insights.sbomify.com/CVE-2024-22059/): SQL injection in ITSM (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/446/