# Vulnerabilities published in 2024


- [CVE-2024-9729](https://insights.sbomify.com/CVE-2024-9729/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9728](https://insights.sbomify.com/CVE-2024-9728/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9727](https://insights.sbomify.com/CVE-2024-9727/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9726](https://insights.sbomify.com/CVE-2024-9726/): Trimble SketchUp Viewer SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9725](https://insights.sbomify.com/CVE-2024-9725/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9724](https://insights.sbomify.com/CVE-2024-9724/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9723](https://insights.sbomify.com/CVE-2024-9723/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9722](https://insights.sbomify.com/CVE-2024-9722/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9721](https://insights.sbomify.com/CVE-2024-9721/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9720](https://insights.sbomify.com/CVE-2024-9720/): Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9719](https://insights.sbomify.com/CVE-2024-9719/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9718](https://insights.sbomify.com/CVE-2024-9718/): Trimble SketchUp Viewer SKP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9717](https://insights.sbomify.com/CVE-2024-9717/): Trimble SketchUp Viewer SKP File Parsing Uninitialized Variable Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9716](https://insights.sbomify.com/CVE-2024-9716/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9715](https://insights.sbomify.com/CVE-2024-9715/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9714](https://insights.sbomify.com/CVE-2024-9714/): Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9713](https://insights.sbomify.com/CVE-2024-9713/): Trimble SketchUp Pro SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9712](https://insights.sbomify.com/CVE-2024-9712/): Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-9711](https://insights.sbomify.com/CVE-2024-9711/): EKC Tournament Manager < 2.2.2 - Delete Tournaments via CSRF (medium 5.4)
- [CVE-2024-9710](https://insights.sbomify.com/CVE-2024-9710/): PostHog database_schema Server-Side Request Forgery Information Disclosure Vulnerability (high 7.1)
- [CVE-2024-9709](https://insights.sbomify.com/CVE-2024-9709/): EKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF (medium 5.4)
- [CVE-2024-9708](https://insights.sbomify.com/CVE-2024-9708/): Easy SVG Upload <= 1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9707](https://insights.sbomify.com/CVE-2024-9707/): Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation (critical 9.8)
- [CVE-2024-9706](https://insights.sbomify.com/CVE-2024-9706/): Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Unauthenticated Template Activation (medium 5.3)
- [CVE-2024-9705](https://insights.sbomify.com/CVE-2024-9705/): Ultimate Coming Soon & Maintenance <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Template Name Update (medium 4.3)
- [CVE-2024-9704](https://insights.sbomify.com/CVE-2024-9704/): Social Sharing (by Danny) <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-9703](https://insights.sbomify.com/CVE-2024-9703/): Arconix Shortcodes <= 2.1.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-9702](https://insights.sbomify.com/CVE-2024-9702/): Social Rocket <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-9701](https://insights.sbomify.com/CVE-2024-9701/): Remote Code Execution in kedro-org/kedro (critical 9.8)
- [CVE-2024-9700](https://insights.sbomify.com/CVE-2024-9700/): Missing authorization in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 5.3)
- [CVE-2024-9699](https://insights.sbomify.com/CVE-2024-9699/): Cross-Site Scripting (XSS) in flatpressblog/flatpress (high 7.5)
- [CVE-2024-9698](https://insights.sbomify.com/CVE-2024-9698/): Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files (high 7.2)
- [CVE-2024-9697](https://insights.sbomify.com/CVE-2024-9697/): Social Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update (medium 5.3)
- [CVE-2024-9696](https://insights.sbomify.com/CVE-2024-9696/): Rescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-9694](https://insights.sbomify.com/CVE-2024-9694/): CMSMasters Elementor Addon <= 1.14.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (medium 6.4)
- [CVE-2024-9693](https://insights.sbomify.com/CVE-2024-9693/): Incorrect Authorization in GitLab (high 8.5)
- [CVE-2024-9692](https://insights.sbomify.com/CVE-2024-9692/): Improper Access Control in Input in VIMESA VHF/FM Transmitter Blue Plus (medium 6.9)
- [CVE-2024-9689](https://insights.sbomify.com/CVE-2024-9689/): Post From Frontend <= 1.0.0 - Post Deletion via CSRF (medium 4.1)
- [CVE-2024-9687](https://insights.sbomify.com/CVE-2024-9687/): WP 2FA with Telegram <= 3.0 - Authenticated (Subscriber+) Authentication Bypass (high 8.8)
- [CVE-2024-9686](https://insights.sbomify.com/CVE-2024-9686/): Order Notification for Telegram <= 1.0.1 - Missing Authorization to Unauthenticated Send Telegram Test Message (medium 5.3)
- [CVE-2024-9685](https://insights.sbomify.com/CVE-2024-9685/): Notification for Telegram <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Send Telegram Test Message (medium 4.3)
- [CVE-2024-9684](https://insights.sbomify.com/CVE-2024-9684/): Memory corruption in IEC-60870-5-104 (high 7.5)
- [CVE-2024-9683](https://insights.sbomify.com/CVE-2024-9683/): Quay: quay allows successful authentication with trucated version of the password (medium 4.8)
- [CVE-2024-9682](https://insights.sbomify.com/CVE-2024-9682/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2024-9681](https://insights.sbomify.com/CVE-2024-9681/): HSTS subdomain overwrites parent cache entry (medium 5.9)
- [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild)
- [CVE-2024-9679](https://insights.sbomify.com/CVE-2024-9679/): Hardcoded credentials in DLP Extension (medium 5.3)
- [CVE-2024-9678](https://insights.sbomify.com/CVE-2024-9678/): SQL injection in DLP Extension (medium 4.9)
- [CVE-2024-9677](https://insights.sbomify.com/CVE-2024-9677/): Information disclosure in USG FLEX H series uOS firmware (medium 5.5)
- [CVE-2024-9676](https://insights.sbomify.com/CVE-2024-9676/): Path traversal in OpenShift Developer Tools and Services (medium 6.5)
- [CVE-2024-9675](https://insights.sbomify.com/CVE-2024-9675/): Buildah: buildah allows arbitrary directory mount (high 7.8)
- [CVE-2024-9674](https://insights.sbomify.com/CVE-2024-9674/): Cross-site scripting in Debrandify · Remove or Replace WordPress Branding (medium 6.4)
- [CVE-2024-9672](https://insights.sbomify.com/CVE-2024-9672/): Reflected XSS in PaperCut MF (medium 6.3)
- [CVE-2024-9671](https://insights.sbomify.com/CVE-2024-9671/): System: pdf invoices of the developer users can be seen if the url is known (medium 5.3)
- [CVE-2024-9670](https://insights.sbomify.com/CVE-2024-9670/): 2D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter (medium 6.1)
- [CVE-2024-9669](https://insights.sbomify.com/CVE-2024-9669/): File Manager Pro – Filester <= 1.8.5 - Authenticated (Administrator+) Local JavaScript File Inclusion (high 7.2)
- [CVE-2024-9668](https://insights.sbomify.com/CVE-2024-9668/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2024-9667](https://insights.sbomify.com/CVE-2024-9667/): Seriously Simple Podcasting <= 3.5.0 - Reflected Cross-Site Scripting via add_query_arg Parameter (medium 6.1)
- [CVE-2024-9666](https://insights.sbomify.com/CVE-2024-9666/): Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability (medium 4.7)
- [CVE-2024-9665](https://insights.sbomify.com/CVE-2024-9665/): Zimbra GraphQL Cross-Site Request Forgery Information Disclosure Vulnerability (medium 6.5)
- [CVE-2024-9664](https://insights.sbomify.com/CVE-2024-9664/): WP All Import Pro <= 4.9.7 - Authenticated (Administrator+) PHP Object Injection via Import File (high 7.2)
- [CVE-2024-9663](https://insights.sbomify.com/CVE-2024-9663/): CYAN Backup < 2.5.3 - Admin+ Stored XSS via Remote Storage Settings (medium 5.4)
- [CVE-2024-9662](https://insights.sbomify.com/CVE-2024-9662/): CYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings (medium 5.4)
- [CVE-2024-9661](https://insights.sbomify.com/CVE-2024-9661/): WP All Import Pro <= 4.9.7 - Cross-Site Request Forgery to Imported Content Deletion (medium 4.3)
- [CVE-2024-9660](https://insights.sbomify.com/CVE-2024-9660/): School Management <= 91.5.0 - Authenticated (Student+) Arbitrary File Upload (high 8.8)
- [CVE-2024-9659](https://insights.sbomify.com/CVE-2024-9659/): School Management <= 91.5.0 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-9658](https://insights.sbomify.com/CVE-2024-9658/): School Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalation (high 8.8)
- [CVE-2024-9657](https://insights.sbomify.com/CVE-2024-9657/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.5)
- [CVE-2024-9656](https://insights.sbomify.com/CVE-2024-9656/): Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9655](https://insights.sbomify.com/CVE-2024-9655/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-9654](https://insights.sbomify.com/CVE-2024-9654/): Easy Digital Downloads 3.1 - 3.3.4 - Improper Authorization to Paywall Bypass (low 3.7)
- [CVE-2024-9653](https://insights.sbomify.com/CVE-2024-9653/): Restaurant Menu – Food Ordering System – Table Reservation <= 2.4.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9652](https://insights.sbomify.com/CVE-2024-9652/): Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9651](https://insights.sbomify.com/CVE-2024-9651/): Contact Form Plugin by Fluent Forms < 5.2.1 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-9650](https://insights.sbomify.com/CVE-2024-9650/): WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip' (medium 6.5)
- [CVE-2024-9649](https://insights.sbomify.com/CVE-2024-9649/): WP ULike <= 4.7.4 - Cross-Site Request Forgery to Statistic Deletion (medium 4.3)
- [CVE-2024-9648](https://insights.sbomify.com/CVE-2024-9648/): WP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File Upload (medium 6.1)
- [CVE-2024-9647](https://insights.sbomify.com/CVE-2024-9647/): Kama SpamBlock <= 1.8.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9645](https://insights.sbomify.com/CVE-2024-9645/): Post Grid and Gutenberg Blocks < 2.2.93 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-9644](https://insights.sbomify.com/CVE-2024-9644/): Four-Faith F3x36 bapply.cgi Auth Bypass (critical 9.8)
- [CVE-2024-9643](https://insights.sbomify.com/CVE-2024-9643/): Four-Faith F3x36 Hidden Debug Credentials (critical 9.8)
- [CVE-2024-9642](https://insights.sbomify.com/CVE-2024-9642/): Editor Custom Color Palette <= 3.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9641](https://insights.sbomify.com/CVE-2024-9641/): LuckyWP Table of Contents < 2.1.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-9639](https://insights.sbomify.com/CVE-2024-9639/): Authenticated Remote Code Execution (high 7.5)
- [CVE-2024-9638](https://insights.sbomify.com/CVE-2024-9638/): Category Posts Widget < 4.9.18 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-9637](https://insights.sbomify.com/CVE-2024-9637/): Missing authorization in School Management System – WPSchoolPress (high 8.8)
- [CVE-2024-9636](https://insights.sbomify.com/CVE-2024-9636/): Post Grid and Gutenberg Blocks 2.2.85 - 2.3.3 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2024-9635](https://insights.sbomify.com/CVE-2024-9635/): Checkout with Cash App on WooCommerce <= 6.0.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9634](https://insights.sbomify.com/CVE-2024-9634/): Deserialization in GiveWP – Donation Plugin and Fundraising Platform (critical 9.8)
- [CVE-2024-9633](https://insights.sbomify.com/CVE-2024-9633/): Incorrect Ownership Assignment in GitLab (low 3.1)
- [CVE-2024-9632](https://insights.sbomify.com/CVE-2024-9632/): Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (high 7.8)
- [CVE-2024-9631](https://insights.sbomify.com/CVE-2024-9631/): Inefficient Algorithmic Complexity in GitLab (high 7.5)
- [CVE-2024-9630](https://insights.sbomify.com/CVE-2024-9630/): WPS Telegram Chat <= 4.6.0 - Missing Authorization to Information Exposure (medium 5.4)
- [CVE-2024-9629](https://insights.sbomify.com/CVE-2024-9629/): Missing authorization in Message Bridge for Contact Form 7 and Telegram (medium 5.4)
- [CVE-2024-9628](https://insights.sbomify.com/CVE-2024-9628/): WPS Telegram Chat <= 4.6.0 - Authenticated (Subscriber+) Unauthorized Access to Telegram Bot API (medium 6.3)
- [CVE-2024-9627](https://insights.sbomify.com/CVE-2024-9627/): TeploBot - Telegram Bot for WP <= 1.3 - Telegram Bot Token Disclosure (high 8.6)
- [CVE-2024-9626](https://insights.sbomify.com/CVE-2024-9626/): Missing authorization in Editorial Assistant by Sovrn (medium 4.3)
- [CVE-2024-9624](https://insights.sbomify.com/CVE-2024-9624/): WP All Import Pro <= 4.9.3 - Authenticated (Administrator+) Server-Side Request Forgery via File Import (high 7.6)
- [CVE-2024-9623](https://insights.sbomify.com/CVE-2024-9623/): Incorrect Authorization in GitLab (medium 4.9)
- [CVE-2024-9622](https://insights.sbomify.com/CVE-2024-9622/): HTTP Request Smuggling Leading to Client Timeouts in resteasy-netty4 (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/139/