# Vulnerabilities published in 2024


- [CVE-2024-8966](https://insights.sbomify.com/CVE-2024-8966/): Denial of Service in gradio-app/gradio (high 7.5)
- [CVE-2024-8965](https://insights.sbomify.com/CVE-2024-8965/): Absolute Reviews <= 1.1.3 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Criteria Name (medium 6.4)
- [CVE-2024-8964](https://insights.sbomify.com/CVE-2024-8964/): Cross-site scripting in Image Optimizer, Resizer and CDN – Sirv (medium 6.4)
- [CVE-2024-8963](https://insights.sbomify.com/CVE-2024-8963/): Ivanti Cloud Services Appliance (CSA) Path Traversal (critical 9.4, exploited in the wild)
- [CVE-2024-8962](https://insights.sbomify.com/CVE-2024-8962/): Cross-site scripting in WPBITS Addons For Elementor Page Builder (medium 6.4)
- [CVE-2024-8961](https://insights.sbomify.com/CVE-2024-8961/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-8960](https://insights.sbomify.com/CVE-2024-8960/): Cowidgets – Elementor Addons <= 1.2.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-8959](https://insights.sbomify.com/CVE-2024-8959/): Cross-site scripting in WP Adminify – White Label WordPress, Admin Menu Editor, Login Customizer (medium 6.4)
- [CVE-2024-8958](https://insights.sbomify.com/CVE-2024-8958/): Unrestricted File Write and Read in composiohq/composio (high 7.2)
- [CVE-2024-8957](https://insights.sbomify.com/CVE-2024-8957/): PTZOptics PT30X-SDI/NDI Cameras OS Command Injection (high 7.2, exploited in the wild)
- [CVE-2024-8956](https://insights.sbomify.com/CVE-2024-8956/): PTZOptics PT30X-SDI/NDI Cameras Authentication Bypass (critical 9.1, exploited in the wild)
- [CVE-2024-8955](https://insights.sbomify.com/CVE-2024-8955/): SSRF in composiohq/composio (medium 6.8)
- [CVE-2024-8954](https://insights.sbomify.com/CVE-2024-8954/): Authentication Bypass in composiohq/composio (critical 9.8)
- [CVE-2024-8953](https://insights.sbomify.com/CVE-2024-8953/): Unsafe eval usage in composiohq/composio (high 7.2)
- [CVE-2024-8952](https://insights.sbomify.com/CVE-2024-8952/): SSRF in composiohq/composio (medium 6.8)
- [CVE-2024-8951](https://insights.sbomify.com/CVE-2024-8951/): SourceCodester Resort Reservation System manage_fee.php cross site scripting (medium 5.3)
- [CVE-2024-8950](https://insights.sbomify.com/CVE-2024-8950/): SQLi in Arne Informatics' Piramit Automation (critical 9.9)
- [CVE-2024-8949](https://insights.sbomify.com/CVE-2024-8949/): SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership management (medium 5.3)
- [CVE-2024-8948](https://insights.sbomify.com/CVE-2024-8948/): MicroPython objint.c mpz_as_bytes heap-based overflow (medium 6.9)
- [CVE-2024-8947](https://insights.sbomify.com/CVE-2024-8947/): MicroPython objarray.c use after free (medium 6.3)
- [CVE-2024-8946](https://insights.sbomify.com/CVE-2024-8946/): MicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflow (medium 6.9)
- [CVE-2024-8945](https://insights.sbomify.com/CVE-2024-8945/): CodeCanyon RISE Ultimate Project Manager save sql injection (medium 5.3)
- [CVE-2024-8944](https://insights.sbomify.com/CVE-2024-8944/): code-projects Hospital Management System check_availability.php sql injection (medium 6.9)
- [CVE-2024-8943](https://insights.sbomify.com/CVE-2024-8943/): LatePoint <= 5.0.12 - Authentication Bypass (critical 9.8)
- [CVE-2024-8942](https://insights.sbomify.com/CVE-2024-8942/): Cross-site Scripting vulnerability on Scriptcase (medium 6.3)
- [CVE-2024-8941](https://insights.sbomify.com/CVE-2024-8941/): Path Traversal vulnerability on Scriptcase (high 7.5)
- [CVE-2024-8940](https://insights.sbomify.com/CVE-2024-8940/): Unrestricted Upload of File with Dangerous Type vulnerability on Scriptcase (critical 10.0)
- [CVE-2024-8939](https://insights.sbomify.com/CVE-2024-8939/): Vllm: denials of service in vllm json web api (medium 6.2)
- [CVE-2024-8938](https://insights.sbomify.com/CVE-2024-8938/): Memory corruption in Modicon M340 CPU (part numbers BMXP34*) (critical 9.2)
- [CVE-2024-8937](https://insights.sbomify.com/CVE-2024-8937/): Memory corruption in Modicon M340 CPU (part numbers BMXP34*) (high 8.3)
- [CVE-2024-8936](https://insights.sbomify.com/CVE-2024-8936/): Other in Modicon M340 CPU (part numbers BMXP34*) (high 8.3)
- [CVE-2024-8935](https://insights.sbomify.com/CVE-2024-8935/): Weak cryptography in Modicon M340 CPU (part numbers BMXP34*) (high 7.7)
- [CVE-2024-8934](https://insights.sbomify.com/CVE-2024-8934/): Beckhoff: Local command injection via TwinCAT Package Manager (medium 6.5)
- [CVE-2024-8933](https://insights.sbomify.com/CVE-2024-8933/): Other in Modicon M340 CPU (part numbers BMXP34*) (high 7.5)
- [CVE-2024-8932](https://insights.sbomify.com/CVE-2024-8932/): OOB access in ldap_escape (critical 9.8)
- [CVE-2024-8929](https://insights.sbomify.com/CVE-2024-8929/): Leak partial content of the heap through heap buffer over-read in mysqlnd (medium 5.8)
- [CVE-2024-8927](https://insights.sbomify.com/CVE-2024-8927/): cgi.force_redirect configuration is bypassable due to the environment variable collision (high 7.5)
- [CVE-2024-8926](https://insights.sbomify.com/CVE-2024-8926/): PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass) (high 8.1)
- [CVE-2024-8925](https://insights.sbomify.com/CVE-2024-8925/): Erroneous parsing of multipart form data (low 3.1)
- [CVE-2024-8924](https://insights.sbomify.com/CVE-2024-8924/): Unauthenticated Blind SQL Injection in Core Platform (high 8.7)
- [CVE-2024-8923](https://insights.sbomify.com/CVE-2024-8923/): Sandbox Escape in Now Platform (critical 9.3)
- [CVE-2024-8922](https://insights.sbomify.com/CVE-2024-8922/): Product Enquiry for WooCommerce <= 2.2.33.33 - Authenticated (Author+) PHP Object Injection in enquiry_detail.php (high 8.8)
- [CVE-2024-8921](https://insights.sbomify.com/CVE-2024-8921/): Zita Elementor Site Library <= 1.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-8920](https://insights.sbomify.com/CVE-2024-8920/): Fonto – Custom Web Fonts Manager <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-8919](https://insights.sbomify.com/CVE-2024-8919/): Cross-site scripting in Confetti Fall Animation (medium 6.4)
- [CVE-2024-8918](https://insights.sbomify.com/CVE-2024-8918/): File Manager Pro <= 8.3.9 - Unauthenticated Limited JavaScript File Upload (high 7.4)
- [CVE-2024-8917](https://insights.sbomify.com/CVE-2024-8917/): AnWP Football Leagues <= 0.16.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-8916](https://insights.sbomify.com/CVE-2024-8916/): Suki Sites Import <= 1.2.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-8915](https://insights.sbomify.com/CVE-2024-8915/): Category Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-8914](https://insights.sbomify.com/CVE-2024-8914/): Cross-site scripting in Thanh Toán Quét Mã QR Code Tự Động – MoMo, ViettelPay, VNPay và 40 ngân hàng Việt Nam (high 7.2)
- [CVE-2024-8913](https://insights.sbomify.com/CVE-2024-8913/): Information disclosure in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 4.3)
- [CVE-2024-8912](https://insights.sbomify.com/CVE-2024-8912/): HTTP Request Smuggling in Looker (high 8.9)
- [CVE-2024-8911](https://insights.sbomify.com/CVE-2024-8911/): LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection (critical 9.8)
- [CVE-2024-8910](https://insights.sbomify.com/CVE-2024-8910/): Information disclosure in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 4.3)
- [CVE-2024-8909](https://insights.sbomify.com/CVE-2024-8909/): Other in Chrome (medium 4.3)
- [CVE-2024-8908](https://insights.sbomify.com/CVE-2024-8908/): Other in Chrome (medium 4.3)
- [CVE-2024-8907](https://insights.sbomify.com/CVE-2024-8907/): Cross-site scripting in Chrome (medium 6.1)
- [CVE-2024-8906](https://insights.sbomify.com/CVE-2024-8906/): Other in Chrome (medium 4.3)
- [CVE-2024-8905](https://insights.sbomify.com/CVE-2024-8905/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-8904](https://insights.sbomify.com/CVE-2024-8904/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-8903](https://insights.sbomify.com/CVE-2024-8903/): Privilege escalation in Acronis Cyber Protect Cloud Agent (medium 4.7)
- [CVE-2024-8902](https://insights.sbomify.com/CVE-2024-8902/): Information disclosure in Addon Elements for Elementor (formerly Elementor Addon Elements) (medium 4.3)
- [CVE-2024-8901](https://insights.sbomify.com/CVE-2024-8901/): Lack of JWT issuer and signer validation (medium 6.9)
- [CVE-2024-8900](https://insights.sbomify.com/CVE-2024-8900/): Security feature bypass in Firefox (high 7.5)
- [CVE-2024-8899](https://insights.sbomify.com/CVE-2024-8899/): Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Sensitive Information Exposure via sg_content_template (medium 4.3)
- [CVE-2024-8898](https://insights.sbomify.com/CVE-2024-8898/): Path Traversal in parisneo/lollms-webui (medium 6.7)
- [CVE-2024-8897](https://insights.sbomify.com/CVE-2024-8897/): Open redirect in Firefox for Android (medium 6.1)
- [CVE-2024-8896](https://insights.sbomify.com/CVE-2024-8896/): Autodesk AutoCAD DXF File Parsing Unitialized Variable Code Execution Vulnerability (high 7.8)
- [CVE-2024-8894](https://insights.sbomify.com/CVE-2024-8894/): Out-of-bounds Write vulnerability in ODA SDK versions < 2025.10 (high 8.1)
- [CVE-2024-8893](https://insights.sbomify.com/CVE-2024-8893/): Hardcoded credentials in GW1500‑XS (high 7.3)
- [CVE-2024-8892](https://insights.sbomify.com/CVE-2024-8892/): Uncontrolled Resource Consumption vulnerability on CIRCUTOR TCP2RS+ (medium 5.3)
- [CVE-2024-8891](https://insights.sbomify.com/CVE-2024-8891/): Exposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMT (medium 5.3)
- [CVE-2024-8890](https://insights.sbomify.com/CVE-2024-8890/): Insertion of Sensitive Information Into Sent Data vulnerability on CIRCUTOR Q-SMT (high 8.0)
- [CVE-2024-8889](https://insights.sbomify.com/CVE-2024-8889/): Improper Input Validation vulnerability on CIRCUTOR TCP2RS+ (critical 9.3)
- [CVE-2024-8888](https://insights.sbomify.com/CVE-2024-8888/): Insufficient Session Expiration vulnerability on CIRCUTOR Q-SMT (critical 10.0)
- [CVE-2024-8887](https://insights.sbomify.com/CVE-2024-8887/): Authentication bypass vulnerability on CIRCUTOR Q-SMT (critical 10.0)
- [CVE-2024-8885](https://insights.sbomify.com/CVE-2024-8885/): Privilege escalation in Sophos Intercept X (high 8.8)
- [CVE-2024-8884](https://insights.sbomify.com/CVE-2024-8884/): Information disclosure in System Monitor application in Harmony Industrial PC HMIBMO/HMIBMI/HMIPSO/HMIBMP/HMIBMU/HMIPSP/HMIPEP series (critical 9.8)
- [CVE-2024-8883](https://insights.sbomify.com/CVE-2024-8883/): Keycloak: vulnerable redirect uri validation results in open redirec (medium 6.1)
- [CVE-2024-8882](https://insights.sbomify.com/CVE-2024-8882/): Memory corruption in GS1900-48 firmware (medium 4.5)
- [CVE-2024-8881](https://insights.sbomify.com/CVE-2024-8881/): Command injection in GS1900-48 firmware (medium 6.8)
- [CVE-2024-8880](https://insights.sbomify.com/CVE-2024-8880/): playSMS Template index.php code injection (medium 6.3)
- [CVE-2024-8878](https://insights.sbomify.com/CVE-2024-8878/): Unauthenticated Password Reset (critical 10.0)
- [CVE-2024-8877](https://insights.sbomify.com/CVE-2024-8877/): SQL Injection (medium 6.9)
- [CVE-2024-8876](https://insights.sbomify.com/CVE-2024-8876/): xiaohe4966 TpMeCMS lang path traversal (medium 5.3)
- [CVE-2024-8875](https://insights.sbomify.com/CVE-2024-8875/): vedees wcms finder.php path traversal (medium 5.3)
- [CVE-2024-8874](https://insights.sbomify.com/CVE-2024-8874/): AJAX Login and Registration modal popup + inline form <= 2.24 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8873](https://insights.sbomify.com/CVE-2024-8873/): PeproDev WooCommerce Receipt Uploader <= 2.6.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8872](https://insights.sbomify.com/CVE-2024-8872/): Store Hours for WooCommerce <= 4.3.20 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8871](https://insights.sbomify.com/CVE-2024-8871/): Pricing Tables WordPress Plugin – Easy Pricing Tables <= 3.2.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8870](https://insights.sbomify.com/CVE-2024-8870/): Forms for Mailchimp by Optin Cat – Grow Your MailChimp List <= 2.5.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8869](https://insights.sbomify.com/CVE-2024-8869/): TOTOLINK A720R exportOvpn os command injection (low 2.3)
- [CVE-2024-8868](https://insights.sbomify.com/CVE-2024-8868/): code-projects Crud Operation System savedata.php sql injection (medium 6.9)
- [CVE-2024-8867](https://insights.sbomify.com/CVE-2024-8867/): Perfex CRM Parameter Clients.php cross site scripting (medium 5.3)
- [CVE-2024-8866](https://insights.sbomify.com/CVE-2024-8866/): AutoCMS robot.php cross site scripting (medium 6.9)
- [CVE-2024-8865](https://insights.sbomify.com/CVE-2024-8865/): composiohq composio api.py path path traversal (medium 5.1)
- [CVE-2024-8864](https://insights.sbomify.com/CVE-2024-8864/): composiohq composio calculator.py Calculator code injection (medium 5.1)
- [CVE-2024-8863](https://insights.sbomify.com/CVE-2024-8863/): aimhubio aim Text Explorer textbox.tsx dangerouslySetInnerHTML cross site scripting (medium 5.3)
- [CVE-2024-8862](https://insights.sbomify.com/CVE-2024-8862/): h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization (medium 6.9)
- [CVE-2024-8861](https://insights.sbomify.com/CVE-2024-8861/): Cross-site scripting in ProfileGrid – User Profiles, Groups and Communities (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/146/