# Vulnerabilities published in 2024


- [CVE-2024-9511](https://insights.sbomify.com/CVE-2024-9511/): Deserialization in FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider (critical 9.8)
- [CVE-2024-9508](https://insights.sbomify.com/CVE-2024-9508/): Horner Automation Cscape Out-of-bounds Read (high 8.5)
- [CVE-2024-9507](https://insights.sbomify.com/CVE-2024-9507/): Path traversal in Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder (medium 4.9)
- [CVE-2024-9506](https://insights.sbomify.com/CVE-2024-9506/): Regular Expression Denial of Service (ReDoS) (low 3.7)
- [CVE-2024-9505](https://insights.sbomify.com/CVE-2024-9505/): Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder (medium 6.4)
- [CVE-2024-9504](https://insights.sbomify.com/CVE-2024-9504/): Cross-site scripting in Booking calendar, Appointment Booking System (high 7.2)
- [CVE-2024-9503](https://insights.sbomify.com/CVE-2024-9503/): Maintenance & Coming Soon Redirect Animation <= 2.1.3 - Missing Authorization to Settings Update (medium 4.3)
- [CVE-2024-9502](https://insights.sbomify.com/CVE-2024-9502/): Cross-site scripting in Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits (medium 6.4)
- [CVE-2024-9501](https://insights.sbomify.com/CVE-2024-9501/): Wp Social Login and Register Social Counter <= 3.0.7 - Authentication Bypass via WordPress.com OAuth provider (critical 9.8)
- [CVE-2024-9500](https://insights.sbomify.com/CVE-2024-9500/): Autodesk ADP Desktop SDK Privilege Escalation Vulnerability (high 7.8)
- [CVE-2024-9499](https://insights.sbomify.com/CVE-2024-9499/): Uncontrolled search path can lead to DLL hijacking in USBXpress Win 98SE Dev Kit installer (high 8.6)
- [CVE-2024-9498](https://insights.sbomify.com/CVE-2024-9498/): Uncontrolled search path can lead to DLL hijacking in USBXpress SDK installer (high 8.6)
- [CVE-2024-9497](https://insights.sbomify.com/CVE-2024-9497/): Uncontrolled search path can lead to DLL hijacking in USBXpress 4 SDK installer (high 8.6)
- [CVE-2024-9496](https://insights.sbomify.com/CVE-2024-9496/): Uncontrolled search path can lead to DLL hijacking in USBXpress Dev Kit installer (high 8.6)
- [CVE-2024-9495](https://insights.sbomify.com/CVE-2024-9495/): Uncontrolled search path can lead to DLL hijacking in CP210x VCP Windows installer (high 8.6)
- [CVE-2024-9494](https://insights.sbomify.com/CVE-2024-9494/): Uncontrolled search path can lead to DLL hijacking in CP210 VCP Win 2k installer (high 8.6)
- [CVE-2024-9493](https://insights.sbomify.com/CVE-2024-9493/): Uncontrolled search path can lead to DLL hijacking in ToolStick installer (high 8.6)
- [CVE-2024-9492](https://insights.sbomify.com/CVE-2024-9492/): Uncontrolled search path can lead to DLL hijacking in Flash Programming Utility installer (high 8.6)
- [CVE-2024-9491](https://insights.sbomify.com/CVE-2024-9491/): Uncontrolled search path can lead to DLL hijacking in Configuration Wizard 2 installer (high 8.6)
- [CVE-2024-9490](https://insights.sbomify.com/CVE-2024-9490/): Uncontrolled search path can lead to DLL hijacking in Silicon Labs IDE installer (high 8.6)
- [CVE-2024-9489](https://insights.sbomify.com/CVE-2024-9489/): Autodesk AutoCAD DWG File Parsing Memory Corruption Code Execution Vulnerability (high 7.8)
- [CVE-2024-9488](https://insights.sbomify.com/CVE-2024-9488/): Comments – wpDiscuz <= 7.6.24 - Authentication Bypass via WordPress.com OAuth provider (critical 9.8)
- [CVE-2024-9487](https://insights.sbomify.com/CVE-2024-9487/): Auth bypass in Enterprise Server (critical 9.5)
- [CVE-2024-9486](https://insights.sbomify.com/CVE-2024-9486/): VM images built with Image Builder and Proxmox provider use default credentials (critical 9.8)
- [CVE-2024-9484](https://insights.sbomify.com/CVE-2024-9484/): Null dereference in Antivirus (medium 5.1)
- [CVE-2024-9483](https://insights.sbomify.com/CVE-2024-9483/): Uninitialized variable in digital signiture verification may crash the application (medium 5.1)
- [CVE-2024-9482](https://insights.sbomify.com/CVE-2024-9482/): Out of Bounds write on scan of malformed Mach-O file may crash the application (medium 5.1)
- [CVE-2024-9481](https://insights.sbomify.com/CVE-2024-9481/): Out of Bounds write on scan of malformed eml file may crash the application (medium 5.1)
- [CVE-2024-9479](https://insights.sbomify.com/CVE-2024-9479/): Privilege escalation in upKeeper Instant Privilege Access (critical 10.0)
- [CVE-2024-9478](https://insights.sbomify.com/CVE-2024-9478/): Privilege escalation in upKeeper Instant Privilege Access (critical 10.0)
- [CVE-2024-9477](https://insights.sbomify.com/CVE-2024-9477/): XSS in AirTies' Air4443 Firmware (medium 4.6)
- [CVE-2024-9476](https://insights.sbomify.com/CVE-2024-9476/): Privilege escalation vulnerability for Organizations in Grafana (medium 5.1)
- [CVE-2024-9475](https://insights.sbomify.com/CVE-2024-9475/): SQL injection in Poll Maker – Versus Polls, Anonymous Polls, Image Polls (medium 4.9)
- [CVE-2024-9474](https://insights.sbomify.com/CVE-2024-9474/): Palo Alto Networks PAN-OS Management Interface OS Command Injection (medium 6.9, exploited in the wild)
- [CVE-2024-9473](https://insights.sbomify.com/CVE-2024-9473/): GlobalProtect App: Local Privilege Escalation (PE) Vulnerability (medium 5.2)
- [CVE-2024-9472](https://insights.sbomify.com/CVE-2024-9472/): PAN-OS: Firewall Denial of Service (DoS) Using Specially Crafted Traffic (high 8.7)
- [CVE-2024-9471](https://insights.sbomify.com/CVE-2024-9471/): PAN-OS: Privilege Escalation (PE) Vulnerability in XML API (medium 5.1)
- [CVE-2024-9470](https://insights.sbomify.com/CVE-2024-9470/): Cortex XSOAR: Information Disclosure Vulnerability (medium 5.3)
- [CVE-2024-9469](https://insights.sbomify.com/CVE-2024-9469/): Cortex XDR Agent: Local Windows User Can Disable the Agent (medium 5.7)
- [CVE-2024-9468](https://insights.sbomify.com/CVE-2024-9468/): PAN-OS: Firewall Denial of Service (DoS) via a Maliciously Crafted Packet (high 8.2)
- [CVE-2024-9467](https://insights.sbomify.com/CVE-2024-9467/): Expedition: Reflected Cross-Site Scripting Vulnerability Leads to Expedition Session Disclosure (high 7.0)
- [CVE-2024-9466](https://insights.sbomify.com/CVE-2024-9466/): Expedition: Cleartext Storage of Information Leads to Firewall Admin Credential Disclosure (high 8.2)
- [CVE-2024-9465](https://insights.sbomify.com/CVE-2024-9465/): Palo Alto Networks Expedition SQL Injection (critical 9.2, exploited in the wild)
- [CVE-2024-9464](https://insights.sbomify.com/CVE-2024-9464/): Expedition: Authenticated OS Command Injection Vulnerability Leads to Firewall Admin Credential Disclosure (critical 9.3)
- [CVE-2024-9463](https://insights.sbomify.com/CVE-2024-9463/): Palo Alto Networks Expedition OS Command Injection (critical 9.9, exploited in the wild)
- [CVE-2024-9462](https://insights.sbomify.com/CVE-2024-9462/): Cross-site scripting in Poll Maker – Versus Polls, Anonymous Polls, Image Polls (medium 5.5)
- [CVE-2024-9461](https://insights.sbomify.com/CVE-2024-9461/): Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings (high 7.2)
- [CVE-2024-9460](https://insights.sbomify.com/CVE-2024-9460/): Codezips Online Shopping Portal index.php sql injection (medium 6.9)
- [CVE-2024-9459](https://insights.sbomify.com/CVE-2024-9459/): SQL Injection (high 8.3)
- [CVE-2024-9458](https://insights.sbomify.com/CVE-2024-9458/): Reservit Hotel < 3.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-9457](https://insights.sbomify.com/CVE-2024-9457/): WP Builder <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9456](https://insights.sbomify.com/CVE-2024-9456/): WP Awesome Login <= 0.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9455](https://insights.sbomify.com/CVE-2024-9455/): WP Cleanup and Basic Functions <= 2.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9454](https://insights.sbomify.com/CVE-2024-9454/): PriPre <= 0.4.11 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9453](https://insights.sbomify.com/CVE-2024-9453/): Jenkins-image: sensitive data disclosure when using openshift jenkins image (medium 6.5)
- [CVE-2024-9452](https://insights.sbomify.com/CVE-2024-9452/): Branding <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9451](https://insights.sbomify.com/CVE-2024-9451/): Embed PDF Viewer <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via height and width Parameters (medium 6.4)
- [CVE-2024-9450](https://insights.sbomify.com/CVE-2024-9450/): Cross-site request forgery in Free Booking Plugin for Hotels, Restaurants and Car Rentals (medium 6.5)
- [CVE-2024-9449](https://insights.sbomify.com/CVE-2024-9449/): Auto iFrame <= 1.7 - Authenticated (Author+) Stored Cross-Site Scripting via tag Parameter (medium 6.4)
- [CVE-2024-9448](https://insights.sbomify.com/CVE-2024-9448/): Security feature bypass in EOS (high 7.5)
- [CVE-2024-9447](https://insights.sbomify.com/CVE-2024-9447/): Exposure of Sensitive Information in transformeroptimus/superagi (medium 6.5)
- [CVE-2024-9446](https://insights.sbomify.com/CVE-2024-9446/): WP Simple Anchors Links <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpanchor Shortcode (medium 6.4)
- [CVE-2024-9445](https://insights.sbomify.com/CVE-2024-9445/): Cross-site scripting in Display Medium Posts (medium 6.4)
- [CVE-2024-9444](https://insights.sbomify.com/CVE-2024-9444/): ElementsReady Addons for Elementor <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9443](https://insights.sbomify.com/CVE-2024-9443/): Basticom Framework <= 1.5.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9442](https://insights.sbomify.com/CVE-2024-9442/): F4 Improvements <= 1.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9441](https://insights.sbomify.com/CVE-2024-9441/): Linear eMerge e3-Series Forgot Password Command Injection (critical 9.8)
- [CVE-2024-9440](https://insights.sbomify.com/CVE-2024-9440/): Slim Select 2.0 createOption "text" XSS (medium 5.4)
- [CVE-2024-9439](https://insights.sbomify.com/CVE-2024-9439/): Remote Code Execution in transformeroptimus/superagi (high 8.8)
- [CVE-2024-9438](https://insights.sbomify.com/CVE-2024-9438/): SEUR Oficial <= 2.2.11 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9437](https://insights.sbomify.com/CVE-2024-9437/): Unauthenticated Denial of Service in transformeroptimus/superagi (high 7.5)
- [CVE-2024-9436](https://insights.sbomify.com/CVE-2024-9436/): Cross-site scripting in PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes (medium 6.1)
- [CVE-2024-9435](https://insights.sbomify.com/CVE-2024-9435/): ShiftController Employee Shift Scheduling <= 4.9.66 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9434](https://insights.sbomify.com/CVE-2024-9434/): WPGlobus Translate Options <= 2.2.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-9432](https://insights.sbomify.com/CVE-2024-9432/): Cleartext Storage of Sensitive Information vulnerability has been discovered in OpenText™ Vertica. (medium 6.9)
- [CVE-2024-9431](https://insights.sbomify.com/CVE-2024-9431/): Improper Privilege Management in transformeroptimus/superagi (medium 6.5)
- [CVE-2024-9430](https://insights.sbomify.com/CVE-2024-9430/): Missing authorization in Get Quote For Woocommerce – Request A Quote For Woocommerce (medium 5.3)
- [CVE-2024-9429](https://insights.sbomify.com/CVE-2024-9429/): code-projects Restaurant Reservation System filter2.php sql injection (medium 5.3)
- [CVE-2024-9428](https://insights.sbomify.com/CVE-2024-9428/): Popup Builder < 4.3.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-9427](https://insights.sbomify.com/CVE-2024-9427/): Koji: escape html tag characters in the query string (medium 5.4)
- [CVE-2024-9426](https://insights.sbomify.com/CVE-2024-9426/): Aqua SVG Sprite <= 3.0.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9425](https://insights.sbomify.com/CVE-2024-9425/): Cross-site scripting in Advanced Category and Custom Taxonomy Image (medium 6.4)
- [CVE-2024-9423](https://insights.sbomify.com/CVE-2024-9423/): Certain HP LaserJet Printers – Potential Denial of Service (medium 5.3)
- [CVE-2024-9422](https://insights.sbomify.com/CVE-2024-9422/): GEO My WordPress < 4.5 - Admin+ Arbitrary File Upload (medium 6.6)
- [CVE-2024-9421](https://insights.sbomify.com/CVE-2024-9421/): Login Logout Shortcode <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter (medium 6.4)
- [CVE-2024-9420](https://insights.sbomify.com/CVE-2024-9420/): Use after free in Connect Secure (high 8.8)
- [CVE-2024-9419](https://insights.sbomify.com/CVE-2024-9419/): Memory corruption in HP Smart Universal Printing Driver (high 7.8)
- [CVE-2024-9418](https://insights.sbomify.com/CVE-2024-9418/): Insufficiently Protected Credentials in transformeroptimus/superagi (medium 6.5)
- [CVE-2024-9417](https://insights.sbomify.com/CVE-2024-9417/): Hash Form - Drag & Drop Form Builder <= 1.1.9 - Unauthenticated Limited File Upload (medium 6.1)
- [CVE-2024-9416](https://insights.sbomify.com/CVE-2024-9416/): Cross-site scripting in Modula Image Gallery – Photo Grid & Video Gallery (medium 6.4)
- [CVE-2024-9415](https://insights.sbomify.com/CVE-2024-9415/): Path Traversal in transformeroptimus/superagi (high 8.8)
- [CVE-2024-9414](https://insights.sbomify.com/CVE-2024-9414/): Cross-site Scripting vulnerability in LCDS LAquis SCADA (high 7.0)
- [CVE-2024-9413](https://insights.sbomify.com/CVE-2024-9413/): Memory corruption in SCP-Firmware (high 8.0)
- [CVE-2024-9412](https://insights.sbomify.com/CVE-2024-9412/): Improper Authorization Vulnerability in Rockwell Automation Verve® Asset Manager (high 8.4)
- [CVE-2024-9411](https://insights.sbomify.com/CVE-2024-9411/): OFCMS add.json add cross site scripting (medium 5.3)
- [CVE-2024-9410](https://insights.sbomify.com/CVE-2024-9410/): Ada.cx SSRF via Sentry Misconfiguration (medium 5.3)
- [CVE-2024-9409](https://insights.sbomify.com/CVE-2024-9409/): Denial of service in PowerLogic PM5320 (high 8.7)
- [CVE-2024-9408](https://insights.sbomify.com/CVE-2024-9408/): Eclipse GlassFish is vulnerable to Server Side Request Forgery attacks through specific endpoints (high 8.9)
- [CVE-2024-9407](https://insights.sbomify.com/CVE-2024-9407/): Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction (medium 4.7)
- [CVE-2024-9405](https://insights.sbomify.com/CVE-2024-9405/): Path traversal in Pluck CMS (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/141/