# Vulnerabilities published in 2024


- [CVE-2024-9076](https://insights.sbomify.com/CVE-2024-9076/): DedeCMS article_string_mix.php os command injection (medium 5.1)
- [CVE-2024-9075](https://insights.sbomify.com/CVE-2024-9075/): Stirling-Tools Stirling-PDF Markdown-to-PDF cross site scripting (low 2.3)
- [CVE-2024-9074](https://insights.sbomify.com/CVE-2024-9074/): Advanced Blocks Pro <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9073](https://insights.sbomify.com/CVE-2024-9073/): Cross-site scripting in GutenGeek Free Gutenberg Blocks for WordPress (medium 6.4)
- [CVE-2024-9072](https://insights.sbomify.com/CVE-2024-9072/): Cross-site scripting in GDPR-Extensions-com – Consent Manager (medium 6.4)
- [CVE-2024-9071](https://insights.sbomify.com/CVE-2024-9071/): Cross-site scripting in Easy Demo Importer – A Modern One-Click Demo Import Solution (medium 6.4)
- [CVE-2024-9070](https://insights.sbomify.com/CVE-2024-9070/): Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml (critical 9.8)
- [CVE-2024-9069](https://insights.sbomify.com/CVE-2024-9069/): Cross-site scripting in Graphicsly – The ultimate graphics plugin for WordPress website builder ( Gutenberg, Elementor, Beaver Builder, WPBakery ) (medium 6.4)
- [CVE-2024-9068](https://insights.sbomify.com/CVE-2024-9068/): OneElements – Best Elementor Addons <= 1.3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9067](https://insights.sbomify.com/CVE-2024-9067/): Missing authorization in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress (medium 4.3)
- [CVE-2024-9066](https://insights.sbomify.com/CVE-2024-9066/): Marketing and SEO Booster <= 1.9.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9065](https://insights.sbomify.com/CVE-2024-9065/): WP Helper Premium <= 4.6.1 - Missing Authorization in whp_smtp_send_mail_test (medium 5.3)
- [CVE-2024-9064](https://insights.sbomify.com/CVE-2024-9064/): Elementor Inline SVG <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9062](https://insights.sbomify.com/CVE-2024-9062/): macOS Archify: Local Privilege Escalation (high 7.8)
- [CVE-2024-9061](https://insights.sbomify.com/CVE-2024-9061/): Code injection in WP Popup Builder – Popup Forms and Marketing Lead Generation (high 7.3)
- [CVE-2024-9060](https://insights.sbomify.com/CVE-2024-9060/): AVIF & SVG Uploader <= 1.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-9059](https://insights.sbomify.com/CVE-2024-9059/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2024-9058](https://insights.sbomify.com/CVE-2024-9058/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-9057](https://insights.sbomify.com/CVE-2024-9057/): Cross-site scripting in Curator.io (medium 6.4)
- [CVE-2024-9056](https://insights.sbomify.com/CVE-2024-9056/): Denial of Service in bentoml/bentoml (high 7.5)
- [CVE-2024-9055](https://insights.sbomify.com/CVE-2024-9055/): DPA Countermeasures need reseeding (medium 4.2)
- [CVE-2024-9054](https://insights.sbomify.com/CVE-2024-9054/): Remote code Execution inTimeProvider® 4100 (high 8.5)
- [CVE-2024-9053](https://insights.sbomify.com/CVE-2024-9053/): Remote Code Execution in vllm-project/vllm (critical 9.8)
- [CVE-2024-9051](https://insights.sbomify.com/CVE-2024-9051/): Cross-site scripting in WP Ultimate Post Grid (medium 6.4)
- [CVE-2024-9050](https://insights.sbomify.com/CVE-2024-9050/): Networkmanager-libreswan: local privilege escalation via leftupdown (high 7.8)
- [CVE-2024-9049](https://insights.sbomify.com/CVE-2024-9049/): Cross-site scripting in Beaver Builder Page Builder – Drag and Drop Website Builder (medium 6.4)
- [CVE-2024-9048](https://insights.sbomify.com/CVE-2024-9048/): y_project RuoYi Backend User Import SysUserServiceImpl.java SysUserServiceImpl cross site scripting (medium 6.3)
- [CVE-2024-9047](https://insights.sbomify.com/CVE-2024-9047/): Path traversal in Iptanus File Upload (critical 9.8)
- [CVE-2024-9046](https://insights.sbomify.com/CVE-2024-9046/): Privilege escalation in stARstudio (high 7.8)
- [CVE-2024-9044](https://insights.sbomify.com/CVE-2024-9044/): XML External Entity (XXE) Vulnerability in EasyTax (medium 4.6)
- [CVE-2024-9043](https://insights.sbomify.com/CVE-2024-9043/): Cellopoint Secure Email Gateway - Buffer Overflow (critical 9.8)
- [CVE-2024-9042](https://insights.sbomify.com/CVE-2024-9042/): Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API (medium 5.9)
- [CVE-2024-9041](https://insights.sbomify.com/CVE-2024-9041/): SourceCodester Best House Rental Management System ajax.php sql injection (medium 5.3)
- [CVE-2024-9040](https://insights.sbomify.com/CVE-2024-9040/): code-projects Blood Bank Management System Password cleartext storage in a file or on disk (medium 4.6)
- [CVE-2024-9039](https://insights.sbomify.com/CVE-2024-9039/): SourceCodester Best House Rental Management System ajax.php sql injection (medium 6.9)
- [CVE-2024-9038](https://insights.sbomify.com/CVE-2024-9038/): Codezips Online Shopping Portal insert-product.php unrestricted upload (medium 5.3)
- [CVE-2024-9037](https://insights.sbomify.com/CVE-2024-9037/): Codezips Internal Marks Calculation index.php sql injection (medium 6.9)
- [CVE-2024-9036](https://insights.sbomify.com/CVE-2024-9036/): itsourcecode Online Bookstore admin_add.php unrestricted upload (medium 5.3)
- [CVE-2024-9035](https://insights.sbomify.com/CVE-2024-9035/): code-projects Blood Bank Management System Admin Login login.php sql injection (medium 6.9)
- [CVE-2024-9034](https://insights.sbomify.com/CVE-2024-9034/): code-projects Patient Record Management System login.php sql injection (medium 6.9)
- [CVE-2024-9033](https://insights.sbomify.com/CVE-2024-9033/): SourceCodester Best House Rental Management System ajax.php cross site scripting (medium 5.3)
- [CVE-2024-9032](https://insights.sbomify.com/CVE-2024-9032/): SourceCodester Simple Forum-Discussion System index.php path traversal (medium 5.3)
- [CVE-2024-9031](https://insights.sbomify.com/CVE-2024-9031/): CodeCanyon CRMGo SaaS show cross site scripting (medium 5.3)
- [CVE-2024-9030](https://insights.sbomify.com/CVE-2024-9030/): CodeCanyon CRMGo SaaS note cross site scripting (medium 5.3)
- [CVE-2024-9029](https://insights.sbomify.com/CVE-2024-9029/): Freeimage: heap buffer overflow in tiff_read_iptc_profile (high 7.5)
- [CVE-2024-9028](https://insights.sbomify.com/CVE-2024-9028/): WP GPX Maps <= 1.7.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via sgpx Shortcode (medium 6.4)
- [CVE-2024-9027](https://insights.sbomify.com/CVE-2024-9027/): WPZOOM Shortcodes <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode (medium 6.4)
- [CVE-2024-9026](https://insights.sbomify.com/CVE-2024-9026/): PHP-FPM logs from children may be altered (low 3.3)
- [CVE-2024-9025](https://insights.sbomify.com/CVE-2024-9025/): Missing authorization in Sight – Professional Image Gallery and Portfolio (medium 5.3)
- [CVE-2024-9024](https://insights.sbomify.com/CVE-2024-9024/): Material Design Icons <= 0.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via mdi-icon Shortcode (medium 6.4)
- [CVE-2024-9023](https://insights.sbomify.com/CVE-2024-9023/): WP-WebAuthn <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wwa_login_form Shortcode (medium 6.4)
- [CVE-2024-9022](https://insights.sbomify.com/CVE-2024-9022/): SQL injection in TS Poll – Survey, Versus Poll, Image Poll, Video Poll (high 7.2)
- [CVE-2024-9021](https://insights.sbomify.com/CVE-2024-9021/): Relevanssi < 4.23.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-9020](https://insights.sbomify.com/CVE-2024-9020/): List category posts < 0.90.3 - Author+ Stored XSS (medium 5.4)
- [CVE-2024-9019](https://insights.sbomify.com/CVE-2024-9019/): Cross-site scripting in SecuPress with Simple SSL – Simple and Performant Security (medium 6.4)
- [CVE-2024-9018](https://insights.sbomify.com/CVE-2024-9018/): WP Easy Gallery <= 4.8.5 - Authenticated (Contributor+) SQL Injection via key Parameter (high 8.8)
- [CVE-2024-9017](https://insights.sbomify.com/CVE-2024-9017/): PeepSo Core: Groups <= 6.4.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Description (medium 6.4)
- [CVE-2024-9014](https://insights.sbomify.com/CVE-2024-9014/): OAuth2 client id and secret exposed through the web browser in pgAdmin 4 (critical 9.9)
- [CVE-2024-9011](https://insights.sbomify.com/CVE-2024-9011/): code-projects Crud Operation System updata.php sql injection (medium 5.3)
- [CVE-2024-9009](https://insights.sbomify.com/CVE-2024-9009/): code-projects Online Quiz Site showtest.php sql injection (medium 5.3)
- [CVE-2024-9008](https://insights.sbomify.com/CVE-2024-9008/): SourceCodester Best Online News Portal Comment Section news-details.php sql injection (medium 5.3)
- [CVE-2024-9007](https://insights.sbomify.com/CVE-2024-9007/): jeanmarc77 123solar detailed.php cross site scripting (medium 5.3)
- [CVE-2024-9006](https://insights.sbomify.com/CVE-2024-9006/): jeanmarc77 123solar config_invt1.php code injection (medium 5.3)
- [CVE-2024-9005](https://insights.sbomify.com/CVE-2024-9005/): Deserialization in EcoStruxure Power Monitoring Expert (PME) (high 7.3)
- [CVE-2024-9004](https://insights.sbomify.com/CVE-2024-9004/): D-Link DAR-7000 Backup_Server_commit.php os command injection (medium 5.3)
- [CVE-2024-9003](https://insights.sbomify.com/CVE-2024-9003/): Jinan Chicheng Company JFlow Attachment EntityMutliFile_Load.do AttachmentUploadController access control (medium 5.3)
- [CVE-2024-9002](https://insights.sbomify.com/CVE-2024-9002/): Privilege escalation in Easergy Studio (high 7.8)
- [CVE-2024-9001](https://insights.sbomify.com/CVE-2024-9001/): TOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injection (medium 5.3)
- [CVE-2024-9000](https://insights.sbomify.com/CVE-2024-9000/): Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary (high 7.1)
- [CVE-2024-8999](https://insights.sbomify.com/CVE-2024-8999/): Improper Access Control in lunary-ai/lunary (critical 9.8)
- [CVE-2024-8998](https://insights.sbomify.com/CVE-2024-8998/): Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary (high 7.5)
- [CVE-2024-8997](https://insights.sbomify.com/CVE-2024-8997/): SQLi in Vestel's EVC04 Configuration Interface (critical 9.8)
- [CVE-2024-8996](https://insights.sbomify.com/CVE-2024-8996/): Grafana Agent Flow on Windows Unquoted service path (high 7.3)
- [CVE-2024-8995](https://insights.sbomify.com/CVE-2024-8995/): Authorization Code issued for Deleted User reuse in Multiple WSO2 Products Allows Unauthorized Access (medium 4.9)
- [CVE-2024-8994](https://insights.sbomify.com/CVE-2024-8994/): Information disclosure in Magic OS (medium 6.2)
- [CVE-2024-8993](https://insights.sbomify.com/CVE-2024-8993/): Information disclosure in Magic OS (medium 6.2)
- [CVE-2024-8992](https://insights.sbomify.com/CVE-2024-8992/): Information disclosure in Magic OS (medium 4.0)
- [CVE-2024-8991](https://insights.sbomify.com/CVE-2024-8991/): OSM <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via osm_map and osm_map_v3 Shortcodes (medium 6.4)
- [CVE-2024-8990](https://insights.sbomify.com/CVE-2024-8990/): Cross-site scripting in Geo Mashup (medium 6.4)
- [CVE-2024-8989](https://insights.sbomify.com/CVE-2024-8989/): Stars Testimonials <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stars_testimonials Shortcode (medium 6.4)
- [CVE-2024-8988](https://insights.sbomify.com/CVE-2024-8988/): Missing authorization in PeepSo Core: File Uploads (medium 5.3)
- [CVE-2024-8987](https://insights.sbomify.com/CVE-2024-8987/): Cross-site scripting in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress (medium 6.4)
- [CVE-2024-8986](https://insights.sbomify.com/CVE-2024-8986/): Information Leakage in grafana-plugin-sdk-go (critical 9.1)
- [CVE-2024-8985](https://insights.sbomify.com/CVE-2024-8985/): Cross-site scripting in Social Proof (Testimonial) Slider (medium 6.4)
- [CVE-2024-8984](https://insights.sbomify.com/CVE-2024-8984/): Denial of Service (DoS) in berriai/litellm (high 7.5)
- [CVE-2024-8983](https://insights.sbomify.com/CVE-2024-8983/): Custom Twitter Feeds < 2.2.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-8982](https://insights.sbomify.com/CVE-2024-8982/): Local File Inclusion in bentoml/openllm (medium 6.2)
- [CVE-2024-8981](https://insights.sbomify.com/CVE-2024-8981/): Broken Link Checker <= 2.4.0 - Reflected Cross-Site Scripting (high 7.1)
- [CVE-2024-8980](https://insights.sbomify.com/CVE-2024-8980/): Liferay Portal and Liferay DXP Vulnerable to CSRF in the Script Console (critical 9.6)
- [CVE-2024-8979](https://insights.sbomify.com/CVE-2024-8979/): Information disclosure in Essential Addons for Elementor – Popular Elementor Templates & Widgets (high 8.0)
- [CVE-2024-8978](https://insights.sbomify.com/CVE-2024-8978/): Information disclosure in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 5.7)
- [CVE-2024-8977](https://insights.sbomify.com/CVE-2024-8977/): Server-Side Request Forgery (SSRF) in GitLab (high 8.2)
- [CVE-2024-8975](https://insights.sbomify.com/CVE-2024-8975/): Grafana Alloy on Windows Unquoted service path (high 7.3)
- [CVE-2024-8974](https://insights.sbomify.com/CVE-2024-8974/): Incorrect Provision of Specified Functionality in GitLab (low 2.6)
- [CVE-2024-8973](https://insights.sbomify.com/CVE-2024-8973/): Allocation of Resources Without Limits or Throttling in GitLab (medium 6.5)
- [CVE-2024-8972](https://insights.sbomify.com/CVE-2024-8972/): SQLi in Mobil365 Informatics' Saha365 App (critical 9.8)
- [CVE-2024-8970](https://insights.sbomify.com/CVE-2024-8970/): Incorrect Authorization in GitLab (high 8.2)
- [CVE-2024-8969](https://insights.sbomify.com/CVE-2024-8969/): The SYSCOM Group OMFLOW - Exposure of Sensitive Data (medium 6.5)
- [CVE-2024-8968](https://insights.sbomify.com/CVE-2024-8968/): MaxButtons < 9.8.1 - Admin+ Stored XSS via Text Color (medium 4.7)
- [CVE-2024-8967](https://insights.sbomify.com/CVE-2024-8967/): Cross-site scripting in PWA — easy way to Progressive Web App (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/145/