# Vulnerabilities published in 2024


- [CVE-2024-9621](https://insights.sbomify.com/CVE-2024-9621/): Io.quarkiverse.cxf:quarkus-cxf: quarkus cxf may log user password and secret to application log (medium 5.3)
- [CVE-2024-9620](https://insights.sbomify.com/CVE-2024-9620/): Event-driven automation in ansible automation platform (aap): ansible event-driven automation (eda) lacks encryption (medium 5.3)
- [CVE-2024-9619](https://insights.sbomify.com/CVE-2024-9619/): WP SHAPES <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9618](https://insights.sbomify.com/CVE-2024-9618/): Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets (medium 6.4)
- [CVE-2024-9617](https://insights.sbomify.com/CVE-2024-9617/): IDOR in danswer-ai/danswer (medium 6.5)
- [CVE-2024-9616](https://insights.sbomify.com/CVE-2024-9616/): BlockMeister – Block Pattern Builder <= 3.1.10 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9615](https://insights.sbomify.com/CVE-2024-9615/): BulkPress <= 0.3.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9614](https://insights.sbomify.com/CVE-2024-9614/): Constant Contact Forms by MailMunch <= 2.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9613](https://insights.sbomify.com/CVE-2024-9613/): FormFacade – WordPress plugin for Google Forms <= 1.3.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9612](https://insights.sbomify.com/CVE-2024-9612/): Unauthorized Access in danswer-ai/danswer (medium 6.5)
- [CVE-2024-9611](https://insights.sbomify.com/CVE-2024-9611/): Increase upload file size & Maximum Execution Time limit <= 2.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9610](https://insights.sbomify.com/CVE-2024-9610/): Language Switcher <= 3.7.13 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9609](https://insights.sbomify.com/CVE-2024-9609/): LearnPress Export Import – WordPress extension for LearnPress <= 4.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9608](https://insights.sbomify.com/CVE-2024-9608/): MyParcel <= 4.24.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9607](https://insights.sbomify.com/CVE-2024-9607/): 10Web Social Post Feed <= 1.2.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9606](https://insights.sbomify.com/CVE-2024-9606/): Improper Output Neutralization for Logs in berriai/litellm (high 7.5)
- [CVE-2024-9603](https://insights.sbomify.com/CVE-2024-9603/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-9602](https://insights.sbomify.com/CVE-2024-9602/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-9601](https://insights.sbomify.com/CVE-2024-9601/): Cross-site scripting in Qubely – Advanced Gutenberg Blocks (medium 6.5)
- [CVE-2024-9600](https://insights.sbomify.com/CVE-2024-9600/): Ditty < 3.1.47 - Author+ Stored XSS (medium 4.8)
- [CVE-2024-9599](https://insights.sbomify.com/CVE-2024-9599/): Popup Box < 4.7.8 - Admin+ Stored XSS (medium 5.4)
- [CVE-2024-9598](https://insights.sbomify.com/CVE-2024-9598/): AMP for WP – Accelerated Mobile Pages <= 1.0.99.1 - Cross-Site Request Forgery to Privilege Escalation (high 8.8)
- [CVE-2024-9597](https://insights.sbomify.com/CVE-2024-9597/): Path Traversal in parisneo/lollms (high 7.1)
- [CVE-2024-9596](https://insights.sbomify.com/CVE-2024-9596/): Inclusion of Sensitive Information in Source Code in GitLab (low 3.7)
- [CVE-2024-9595](https://insights.sbomify.com/CVE-2024-9595/): TablePress <= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-9594](https://insights.sbomify.com/CVE-2024-9594/): VM images built with Image Builder with some providers use default credentials during builds (medium 6.3)
- [CVE-2024-9593](https://insights.sbomify.com/CVE-2024-9593/): Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Unauthenticated (Limited) Remote Code Execution (high 8.3)
- [CVE-2024-9592](https://insights.sbomify.com/CVE-2024-9592/): Cross-site request forgery in Easy PayPal Gift Certificate (medium 6.1)
- [CVE-2024-9591](https://insights.sbomify.com/CVE-2024-9591/): Category and Taxonomy Image <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-9590](https://insights.sbomify.com/CVE-2024-9590/): Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Editor+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-9589](https://insights.sbomify.com/CVE-2024-9589/): Category and Taxonomy Meta Fields <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 5.5)
- [CVE-2024-9588](https://insights.sbomify.com/CVE-2024-9588/): Category and Taxonomy Meta Fields <= 1.0.0 - Cross-Site Request Forgery to Taxonomy Meta Add/Delete (medium 5.4)
- [CVE-2024-9587](https://insights.sbomify.com/CVE-2024-9587/): Linkz.ai <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX (medium 5.4)
- [CVE-2024-9586](https://insights.sbomify.com/CVE-2024-9586/): Linkz.ai <= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update (medium 6.5)
- [CVE-2024-9585](https://insights.sbomify.com/CVE-2024-9585/): Image Map Pro <= 6.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-9584](https://insights.sbomify.com/CVE-2024-9584/): Image Map Pro <= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete (medium 5.4)
- [CVE-2024-9583](https://insights.sbomify.com/CVE-2024-9583/): RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 4.23.12 - Missing Authorization (medium 4.3)
- [CVE-2024-9582](https://insights.sbomify.com/CVE-2024-9582/): Accordion Slider <= 1.9.11 - Authenticted (Contributor+) Stored Cross-Site Scripting via HTML Attribute (medium 6.4)
- [CVE-2024-9581](https://insights.sbomify.com/CVE-2024-9581/): Shortcodes AnyWhere <= 1.0.1 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-9579](https://insights.sbomify.com/CVE-2024-9579/): Certain Poly Video Conference Devices – Potential Remote Code Execution (high 7.5)
- [CVE-2024-9578](https://insights.sbomify.com/CVE-2024-9578/): Hide Links <= 1.4.2 - Unauthenticated Shortcode Execution (medium 5.3)
- [CVE-2024-9576](https://insights.sbomify.com/CVE-2024-9576/): Improper access control in Linux Workbooth Distro (high 7.0)
- [CVE-2024-9575](https://insights.sbomify.com/CVE-2024-9575/): Local File Inclusion in pretix-widget WordPress plugin (high 8.5)
- [CVE-2024-9574](https://insights.sbomify.com/CVE-2024-9574/): SQL Injection vulnerability in SOPlanning (critical 9.8)
- [CVE-2024-9573](https://insights.sbomify.com/CVE-2024-9573/): SQL Injection vulnerability in SOPlanning (medium 6.3)
- [CVE-2024-9572](https://insights.sbomify.com/CVE-2024-9572/): Cross-Site Scripting vulnerability in SOPlanning (medium 6.3)
- [CVE-2024-9571](https://insights.sbomify.com/CVE-2024-9571/): Cross-Site Scripting vulnerability in SOPlanning (medium 6.3)
- [CVE-2024-9570](https://insights.sbomify.com/CVE-2024-9570/): D-Link DIR-619L B1 formEasySetTimezone buffer overflow (high 8.7)
- [CVE-2024-9569](https://insights.sbomify.com/CVE-2024-9569/): D-Link DIR-619L B1 formEasySetPassword buffer overflow (high 8.7)
- [CVE-2024-9568](https://insights.sbomify.com/CVE-2024-9568/): D-Link DIR-619L B1 formAdvNetwork buffer overflow (high 8.7)
- [CVE-2024-9567](https://insights.sbomify.com/CVE-2024-9567/): D-Link DIR-619L B1 formAdvFirewall buffer overflow (high 8.7)
- [CVE-2024-9566](https://insights.sbomify.com/CVE-2024-9566/): D-Link DIR-619L B1 formDeviceReboot buffer overflow (high 8.7)
- [CVE-2024-9565](https://insights.sbomify.com/CVE-2024-9565/): D-Link DIR-605L formSetPassword buffer overflow (high 8.7)
- [CVE-2024-9564](https://insights.sbomify.com/CVE-2024-9564/): D-Link DIR-605L formWlanWizardSetup buffer overflow (high 8.7)
- [CVE-2024-9563](https://insights.sbomify.com/CVE-2024-9563/): D-Link DIR-605L formWlanSetup_Wizard buffer overflow (high 8.7)
- [CVE-2024-9562](https://insights.sbomify.com/CVE-2024-9562/): D-Link DIR-605L formSetWizard2 buffer overflow (high 8.7)
- [CVE-2024-9561](https://insights.sbomify.com/CVE-2024-9561/): D-Link DIR-605L formSetWAN_Wizard52 buffer overflow (high 8.7)
- [CVE-2024-9560](https://insights.sbomify.com/CVE-2024-9560/): ESAFENET CDG Catelogs;logindojojs delCatelogs sql injection (medium 5.3)
- [CVE-2024-9559](https://insights.sbomify.com/CVE-2024-9559/): D-Link DIR-605L formWlanSetup buffer overflow (high 8.7)
- [CVE-2024-9558](https://insights.sbomify.com/CVE-2024-9558/): D-Link DIR-605L formSetWanPPTP buffer overflow (high 8.7)
- [CVE-2024-9557](https://insights.sbomify.com/CVE-2024-9557/): D-Link DIR-605L formSetWanPPPoE buffer overflow (high 8.7)
- [CVE-2024-9556](https://insights.sbomify.com/CVE-2024-9556/): D-Link DIR-605L formSetEnableWizard buffer overflow (high 8.7)
- [CVE-2024-9555](https://insights.sbomify.com/CVE-2024-9555/): D-Link DIR-605L formSetEasy_Wizard buffer overflow (high 8.7)
- [CVE-2024-9554](https://insights.sbomify.com/CVE-2024-9554/): Sovell Smart Canteen System Password Reset suanfa.py Check_ET_CheckPwdz201 authorization (medium 6.3)
- [CVE-2024-9553](https://insights.sbomify.com/CVE-2024-9553/): D-Link DIR-605L formdumpeasysetup buffer overflow (high 8.7)
- [CVE-2024-9552](https://insights.sbomify.com/CVE-2024-9552/): D-Link DIR-605L formSetWanNonLogin buffer overflow (high 8.7)
- [CVE-2024-9551](https://insights.sbomify.com/CVE-2024-9551/): D-Link DIR-605L formSetWanL2TP buffer overflow (high 8.7)
- [CVE-2024-9550](https://insights.sbomify.com/CVE-2024-9550/): D-Link DIR-605L formLogDnsquery buffer overflow (high 8.7)
- [CVE-2024-9549](https://insights.sbomify.com/CVE-2024-9549/): D-Link DIR-605L formEasySetupWizard formEasySetupWizard2 buffer overflow (high 8.7)
- [CVE-2024-9548](https://insights.sbomify.com/CVE-2024-9548/): Slimstat Analytics <= 5.2.6 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-9546](https://insights.sbomify.com/CVE-2024-9546/): WPIDE <= 3.4.9 - Unauthenticated Full Path Dislcosure (medium 5.3)
- [CVE-2024-9545](https://insights.sbomify.com/CVE-2024-9545/): Cross-site scripting in Shortcodes and extra features for Phlox theme (medium 6.4)
- [CVE-2024-9544](https://insights.sbomify.com/CVE-2024-9544/): Cross-site scripting in MapSVG (medium 6.4)
- [CVE-2024-9543](https://insights.sbomify.com/CVE-2024-9543/): Powerpress <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode (medium 6.4)
- [CVE-2024-9542](https://insights.sbomify.com/CVE-2024-9542/): Information disclosure in Sky Addons – Elementor Addons with Widgets & Templates (medium 4.3)
- [CVE-2024-9541](https://insights.sbomify.com/CVE-2024-9541/): Information disclosure in News Kit Addons For Elementor (medium 4.3)
- [CVE-2024-9540](https://insights.sbomify.com/CVE-2024-9540/): Information disclosure in Sina Extension for Elementor (medium 4.3)
- [CVE-2024-9539](https://insights.sbomify.com/CVE-2024-9539/): Information disclosure in GitHub Enterprise Server (medium 5.7)
- [CVE-2024-9538](https://insights.sbomify.com/CVE-2024-9538/): ShopLentor <= 2.9.8 - Authenticated (Contributor+) Sensitive Information Exposure via WL: FAQ Widget Elementor Template (medium 4.3)
- [CVE-2024-9537](https://insights.sbomify.com/CVE-2024-9537/): ScienceLogic SL1 Unspecified (critical 9.3, exploited in the wild)
- [CVE-2024-9536](https://insights.sbomify.com/CVE-2024-9536/): ESAFENET CDG MultiServerBackService sql injection (medium 5.3)
- [CVE-2024-9535](https://insights.sbomify.com/CVE-2024-9535/): D-Link DIR-605L formEasySetupWWConfig buffer overflow (high 8.7)
- [CVE-2024-9534](https://insights.sbomify.com/CVE-2024-9534/): D-Link DIR-605L formEasySetPassword buffer overflow (high 8.7)
- [CVE-2024-9533](https://insights.sbomify.com/CVE-2024-9533/): D-Link DIR-605L formDeviceReboot buffer overflow (high 8.7)
- [CVE-2024-9532](https://insights.sbomify.com/CVE-2024-9532/): D-Link DIR-605L formAdvanceSetup buffer overflow (high 8.7)
- [CVE-2024-9531](https://insights.sbomify.com/CVE-2024-9531/): Missing authorization in MultiVendorX – WooCommerce Multivendor Marketplace Solutions (medium 4.3)
- [CVE-2024-9530](https://insights.sbomify.com/CVE-2024-9530/): Qi Addons For Elementor <= 1.8.0 - Sensitive Information Exposure (medium 4.3)
- [CVE-2024-9529](https://insights.sbomify.com/CVE-2024-9529/): Secure Custom Fields < 6.3.6.3 - Admin+ Remote Code Execution (medium 6.6)
- [CVE-2024-9528](https://insights.sbomify.com/CVE-2024-9528/): Cross-site scripting in Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder (medium 4.9)
- [CVE-2024-9526](https://insights.sbomify.com/CVE-2024-9526/): Stored XSS in Kubeflow Pipeline View (high 7.1)
- [CVE-2024-9524](https://insights.sbomify.com/CVE-2024-9524/): Privilege Escalation Vulnerability in Avira Prime Version 1.1.96.2 (high 7.8)
- [CVE-2024-9522](https://insights.sbomify.com/CVE-2024-9522/): WP Users Masquerade <= 2.0.0 - Authenticated (Subscriber+) Authentication Bypass (high 8.8)
- [CVE-2024-9521](https://insights.sbomify.com/CVE-2024-9521/): SEO Manager <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta (medium 6.4)
- [CVE-2024-9520](https://insights.sbomify.com/CVE-2024-9520/): UserPlus <= 2.0 - Missing Authorization via Multiple Functions (medium 6.3)
- [CVE-2024-9519](https://insights.sbomify.com/CVE-2024-9519/): UserPlus <= 2.0 - Authenticated (Editor+) Registration Form Update to Privilege Escalation (high 7.2)
- [CVE-2024-9518](https://insights.sbomify.com/CVE-2024-9518/): UserPlus <= 2.0 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2024-9515](https://insights.sbomify.com/CVE-2024-9515/): D-Link DIR-605L formSetQoS buffer overflow (high 8.7)
- [CVE-2024-9514](https://insights.sbomify.com/CVE-2024-9514/): D-Link DIR-605L formSetDomainFilter buffer overflow (high 8.7)
- [CVE-2024-9513](https://insights.sbomify.com/CVE-2024-9513/): Netadmin Software NetAdmin IAM HTTP POST Request ReturnUserQuestionsFilled information exposure (medium 6.3)
- [CVE-2024-9512](https://insights.sbomify.com/CVE-2024-9512/): Time-of-check Time-of-use (TOCTOU) Race Condition in GitLab (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/140/