# Vulnerabilities published in 2024


- [CVE-2024-9404](https://insights.sbomify.com/CVE-2024-9404/): Denial-of-Service Vulnerability (medium 6.9)
- [CVE-2024-9403](https://insights.sbomify.com/CVE-2024-9403/): Memory corruption in Firefox (high 7.3)
- [CVE-2024-9402](https://insights.sbomify.com/CVE-2024-9402/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-9401](https://insights.sbomify.com/CVE-2024-9401/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-9400](https://insights.sbomify.com/CVE-2024-9400/): Memory corruption in Firefox (high 8.8)
- [CVE-2024-9399](https://insights.sbomify.com/CVE-2024-9399/): Denial of service in Firefox (high 7.5)
- [CVE-2024-9398](https://insights.sbomify.com/CVE-2024-9398/): Information disclosure in Firefox (medium 5.3)
- [CVE-2024-9397](https://insights.sbomify.com/CVE-2024-9397/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2024-9396](https://insights.sbomify.com/CVE-2024-9396/): Memory corruption in Firefox (high 8.8)
- [CVE-2024-9395](https://insights.sbomify.com/CVE-2024-9395/): Security feature bypass in Firefox (medium 5.3)
- [CVE-2024-9394](https://insights.sbomify.com/CVE-2024-9394/): Cross-site scripting in Firefox (medium 6.1)
- [CVE-2024-9393](https://insights.sbomify.com/CVE-2024-9393/): Security feature bypass in Firefox (high 7.5)
- [CVE-2024-9392](https://insights.sbomify.com/CVE-2024-9392/): Security feature bypass in Firefox (critical 9.8)
- [CVE-2024-9391](https://insights.sbomify.com/CVE-2024-9391/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2024-9390](https://insights.sbomify.com/CVE-2024-9390/): RegistrationMagic < 6.0.2.1 - Stored XSS (medium 4.8)
- [CVE-2024-9388](https://insights.sbomify.com/CVE-2024-9388/): Black Widgets For Elementor <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9387](https://insights.sbomify.com/CVE-2024-9387/): URL Redirection to Untrusted Site ('Open Redirect') in GitLab (medium 6.4)
- [CVE-2024-9386](https://insights.sbomify.com/CVE-2024-9386/): Cross-site scripting in Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme (medium 6.4)
- [CVE-2024-9385](https://insights.sbomify.com/CVE-2024-9385/): Themify Builder <= 7.6.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9384](https://insights.sbomify.com/CVE-2024-9384/): Quantity Dynamic Pricing & Bulk Discounts for WooCommerce <= 3.8.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9383](https://insights.sbomify.com/CVE-2024-9383/): Parcel Pro <= 1.8.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9382](https://insights.sbomify.com/CVE-2024-9382/): Gantry 4 Framework <= 4.1.21 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9381](https://insights.sbomify.com/CVE-2024-9381/): Path traversal in CSA (Cloud Services Appliance) (high 7.2)
- [CVE-2024-9380](https://insights.sbomify.com/CVE-2024-9380/): Ivanti Cloud Services Appliance (CSA) OS Command Injection (high 7.2, exploited in the wild)
- [CVE-2024-9379](https://insights.sbomify.com/CVE-2024-9379/): Ivanti Cloud Services Appliance (CSA) SQL Injection (medium 6.5, exploited in the wild)
- [CVE-2024-9378](https://insights.sbomify.com/CVE-2024-9378/): YML for Yandex Market <= 4.7.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9377](https://insights.sbomify.com/CVE-2024-9377/): Products, Order & Customers Export for WooCommerce <= 2.0.15 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9376](https://insights.sbomify.com/CVE-2024-9376/): Cross-site scripting in Kata Plus – Addons for Elementor – Widgets, Extensions and Templates (medium 6.4)
- [CVE-2024-9375](https://insights.sbomify.com/CVE-2024-9375/): WordPress Captcha Plugin by Captcha Bank <= 4.0.36 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9374](https://insights.sbomify.com/CVE-2024-9374/): Terms descriptions <= 3.4.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9373](https://insights.sbomify.com/CVE-2024-9373/): Elemenda <= 0.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9372](https://insights.sbomify.com/CVE-2024-9372/): WP Blocks Hub <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9371](https://insights.sbomify.com/CVE-2024-9371/): Branda – White Label & Branding, Custom Login Page Customizer <= 3.4.19 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9369](https://insights.sbomify.com/CVE-2024-9369/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-9368](https://insights.sbomify.com/CVE-2024-9368/): Aggregator Advanced Settings <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9367](https://insights.sbomify.com/CVE-2024-9367/): Allocation of Resources Without Limits or Throttling in GitLab (medium 4.3)
- [CVE-2024-9366](https://insights.sbomify.com/CVE-2024-9366/): Easy Menu Manager | WPZest <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9365](https://insights.sbomify.com/CVE-2024-9365/): Cross-Site Request Forgery (CSRF) in polyaxon/polyaxon (medium 6.5)
- [CVE-2024-9364](https://insights.sbomify.com/CVE-2024-9364/): SendGrid for WordPress <= 1.4 - Missing Authorization to Authenticated (Subscriber+) Log Deletion (medium 4.3)
- [CVE-2024-9363](https://insights.sbomify.com/CVE-2024-9363/): Unauthorized File Deletion in polyaxon/polyaxon (high 7.5)
- [CVE-2024-9362](https://insights.sbomify.com/CVE-2024-9362/): Directory Traversal in polyaxon/polyaxon (high 7.5)
- [CVE-2024-9361](https://insights.sbomify.com/CVE-2024-9361/): Missing authorization in Bulk images optimizer: Resize, optimize, convert to webp, rename … (medium 4.3)
- [CVE-2024-9360](https://insights.sbomify.com/CVE-2024-9360/): code-projects Restaurant Reservation System updatebal.php sql injection (medium 6.9)
- [CVE-2024-9359](https://insights.sbomify.com/CVE-2024-9359/): code-projects Restaurant Reservation System addcompany.php sql injection (medium 6.9)
- [CVE-2024-9358](https://insights.sbomify.com/CVE-2024-9358/): ThingsBoard HTTP RPC API resource consumption (medium 6.0)
- [CVE-2024-9357](https://insights.sbomify.com/CVE-2024-9357/): xili-tidy-tags <= 1.12.04 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9356](https://insights.sbomify.com/CVE-2024-9356/): Yotpo: Product & Photo Reviews for WooCommerce <= 1.7.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9355](https://insights.sbomify.com/CVE-2024-9355/): Golang-fips: golang fips zeroed buffer (medium 6.5)
- [CVE-2024-9354](https://insights.sbomify.com/CVE-2024-9354/): Estatik Mortgage Calculator <= 2.0.11 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9353](https://insights.sbomify.com/CVE-2024-9353/): Popularis Extra <= 1.2.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9352](https://insights.sbomify.com/CVE-2024-9352/): Cross-site request forgery in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 4.3)
- [CVE-2024-9351](https://insights.sbomify.com/CVE-2024-9351/): Cross-site request forgery in Forminator Forms – Contact Form, Payment Form & Custom Form Builder (medium 4.3)
- [CVE-2024-9350](https://insights.sbomify.com/CVE-2024-9350/): DPD Baltic Shipping <= 1.2.83 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9349](https://insights.sbomify.com/CVE-2024-9349/): Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9348](https://insights.sbomify.com/CVE-2024-9348/): Docker Desktop before v4.34.3 allows RCE via unsanitized GitHub source link in Build view (high 8.9)
- [CVE-2024-9347](https://insights.sbomify.com/CVE-2024-9347/): The Ultimate WordPress Toolkit – WP Extended <= 3.0.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9346](https://insights.sbomify.com/CVE-2024-9346/): Embed videos and respect privacy <= 1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9345](https://insights.sbomify.com/CVE-2024-9345/): Product Delivery Date for WooCommerce – Lite <= 2.7.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-9344](https://insights.sbomify.com/CVE-2024-9344/): Cross-site scripting in BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript (medium 6.1)
- [CVE-2024-9343](https://insights.sbomify.com/CVE-2024-9343/): Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console (medium 6.1)
- [CVE-2024-9342](https://insights.sbomify.com/CVE-2024-9342/): Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts (medium 6.3)
- [CVE-2024-9341](https://insights.sbomify.com/CVE-2024-9341/): Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library (medium 5.4)
- [CVE-2024-9340](https://insights.sbomify.com/CVE-2024-9340/): Denial of Service (DoS) via Multipart Boundary in zenml-io/zenml (high 7.5)
- [CVE-2024-9334](https://insights.sbomify.com/CVE-2024-9334/): Information Disclosure in E-Kent's Pallium Vehicle Tracking (high 8.2)
- [CVE-2024-9333](https://insights.sbomify.com/CVE-2024-9333/): Permission bypass in M-Files Connector for Copilot (medium 5.3)
- [CVE-2024-9329](https://insights.sbomify.com/CVE-2024-9329/): Glassfish redirect to untrusted site (medium 6.9)
- [CVE-2024-9328](https://insights.sbomify.com/CVE-2024-9328/): SourceCodester Advocate Office Management System edit_client.php sql injection (medium 5.3)
- [CVE-2024-9327](https://insights.sbomify.com/CVE-2024-9327/): code-projects Blood Bank System forgot.php sql injection (medium 5.3)
- [CVE-2024-9326](https://insights.sbomify.com/CVE-2024-9326/): PHPGurukul Online Shopping Portal Admin Panel index.php sql injection (medium 6.9)
- [CVE-2024-9325](https://insights.sbomify.com/CVE-2024-9325/): Intelbras InControl incontrol-service-watchdog.exe unquoted search path (high 8.5)
- [CVE-2024-9324](https://insights.sbomify.com/CVE-2024-9324/): Intelbras InControl Relatório de Operadores Page operador code injection (medium 5.3)
- [CVE-2024-9323](https://insights.sbomify.com/CVE-2024-9323/): SourceCodester Inventory Management System add_staff.php cross site scripting (medium 5.3)
- [CVE-2024-9322](https://insights.sbomify.com/CVE-2024-9322/): code-projects Supply Chain Management edit_manufacturer.php sql injection (medium 5.3)
- [CVE-2024-9321](https://insights.sbomify.com/CVE-2024-9321/): SourceCodester Online Railway Reservation System view_details.php access control (medium 6.9)
- [CVE-2024-9320](https://insights.sbomify.com/CVE-2024-9320/): SourceCodester Online Timesheet App Add Timesheet Form add-timesheet.php cross site scripting (medium 5.3)
- [CVE-2024-9319](https://insights.sbomify.com/CVE-2024-9319/): SourceCodester Online Timesheet App delete-timesheet.php sql injection (medium 5.3)
- [CVE-2024-9318](https://insights.sbomify.com/CVE-2024-9318/): SourceCodester Advocate Office Management System activate.php sql injection (medium 5.3)
- [CVE-2024-9317](https://insights.sbomify.com/CVE-2024-9317/): SourceCodester Online Eyewear Shop Master.php delete_category sql injection (medium 5.3)
- [CVE-2024-9316](https://insights.sbomify.com/CVE-2024-9316/): code-projects Blood Bank Management System B+.php sql injection (medium 5.3)
- [CVE-2024-9315](https://insights.sbomify.com/CVE-2024-9315/): SourceCodester Employee and Visitor Gate Pass Logging System manage_department.php sql injection (medium 5.3)
- [CVE-2024-9314](https://insights.sbomify.com/CVE-2024-9314/): Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.228 - Authenticated (Administrator+) PHP Object Injection (high 7.2)
- [CVE-2024-9313](https://insights.sbomify.com/CVE-2024-9313/): PAM module may allow accessing with the credentials of another user (high 8.8)
- [CVE-2024-9312](https://insights.sbomify.com/CVE-2024-9312/): Authd allows attacker-controlled usernames to yield controllable UIDs (high 7.5)
- [CVE-2024-9311](https://insights.sbomify.com/CVE-2024-9311/): Cross-Site Request Forgery to XSS in haotian-liu/llava (medium 6.1)
- [CVE-2024-9310](https://insights.sbomify.com/CVE-2024-9310/): Security feature bypass in Collision Avoidance Systems (medium 6.0)
- [CVE-2024-9309](https://insights.sbomify.com/CVE-2024-9309/): SSRF in POST /worker_generate_stream API endpoint in haotian-liu/llava (critical 9.3)
- [CVE-2024-9308](https://insights.sbomify.com/CVE-2024-9308/): Open Redirect in haotian-liu/llava (medium 6.1)
- [CVE-2024-9307](https://insights.sbomify.com/CVE-2024-9307/): mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files (critical 9.9)
- [CVE-2024-9306](https://insights.sbomify.com/CVE-2024-9306/): WP Booking Calendar <= 10.6 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-9305](https://insights.sbomify.com/CVE-2024-9305/): AppPresser – Mobile App Framework <= 4.4.4 - Privilege Escalation and Account Takeover via Weak OTP (high 8.1)
- [CVE-2024-9304](https://insights.sbomify.com/CVE-2024-9304/): LocateAndFilter <= 1.6.14 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9302](https://insights.sbomify.com/CVE-2024-9302/): Auth bypass in App Builder – Create Native Android & iOS Apps On The Flight (high 8.1)
- [CVE-2024-9301](https://insights.sbomify.com/CVE-2024-9301/): Path traversal in E2Nest (high 8.7)
- [CVE-2024-9300](https://insights.sbomify.com/CVE-2024-9300/): SourceCodester Online Railway Reservation System Message Us Form contact_us.php cross site scripting (medium 6.9)
- [CVE-2024-9299](https://insights.sbomify.com/CVE-2024-9299/): SourceCodester Online Railway Reservation System ?page=reserve cross site scripting (medium 5.3)
- [CVE-2024-9298](https://insights.sbomify.com/CVE-2024-9298/): SourceCodester Online Railway Reservation System Ticket ?page=tickets access control (medium 5.3)
- [CVE-2024-9297](https://insights.sbomify.com/CVE-2024-9297/): SourceCodester Online Railway Reservation System admin improper authorization (medium 5.3)
- [CVE-2024-9296](https://insights.sbomify.com/CVE-2024-9296/): SourceCodester Advocate Office Management System forgot_pass.php sql injection (medium 6.9)
- [CVE-2024-9295](https://insights.sbomify.com/CVE-2024-9295/): SourceCodester Advocate Office Management System login.php sql injection (medium 6.9)
- [CVE-2024-9294](https://insights.sbomify.com/CVE-2024-9294/): dingfanzu CMS saveNewPwd.php sql injection (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/142/