# Vulnerabilities published in 2024


- [CVE-2024-8860](https://insights.sbomify.com/CVE-2024-8860/): Tourfic <= 2.14.5 - Missing Authorization in Multiple Functions (medium 4.3)
- [CVE-2024-8859](https://insights.sbomify.com/CVE-2024-8859/): Path Traversal in mlflow/mlflow (high 7.5)
- [CVE-2024-8858](https://insights.sbomify.com/CVE-2024-8858/): Cross-site scripting in Livemesh Addons by Elementor (medium 6.4)
- [CVE-2024-8857](https://insights.sbomify.com/CVE-2024-8857/): WordPress Auction <= 3.7 - Editor+ Stored XSS (medium 4.8)
- [CVE-2024-8856](https://insights.sbomify.com/CVE-2024-8856/): Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload (critical 9.8)
- [CVE-2024-8855](https://insights.sbomify.com/CVE-2024-8855/): WordPress Auction <= 3.7 - Editor+ SQL Injection (critical 9.8)
- [CVE-2024-8854](https://insights.sbomify.com/CVE-2024-8854/): Polls CP <= 1.0.75 - Admin+ Stored XSS via Custom Styles (medium 5.4)
- [CVE-2024-8853](https://insights.sbomify.com/CVE-2024-8853/): Webo-facto <= 1.40 - Unauthenticated Privilege Escalation (critical 9.8)
- [CVE-2024-8852](https://insights.sbomify.com/CVE-2024-8852/): All-in-One WP Migration and Backup <= 7.86 - Unauthenticated Information Disclosure via Error Logs (medium 5.3)
- [CVE-2024-8851](https://insights.sbomify.com/CVE-2024-8851/): Polls CP <= 1.0.75 - Admin+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-8850](https://insights.sbomify.com/CVE-2024-8850/): MC4WP: Mailchimp for WordPress 4.9.9 - 4.9.16 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8849](https://insights.sbomify.com/CVE-2024-8849/): PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8848](https://insights.sbomify.com/CVE-2024-8848/): PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8847](https://insights.sbomify.com/CVE-2024-8847/): PDF-XChange Editor Doc Object Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8846](https://insights.sbomify.com/CVE-2024-8846/): PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8845](https://insights.sbomify.com/CVE-2024-8845/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8844](https://insights.sbomify.com/CVE-2024-8844/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8843](https://insights.sbomify.com/CVE-2024-8843/): PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8842](https://insights.sbomify.com/CVE-2024-8842/): PDF-XChange Editor RTF File Parsing Uninitialized Variable Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8841](https://insights.sbomify.com/CVE-2024-8841/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8840](https://insights.sbomify.com/CVE-2024-8840/): PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8839](https://insights.sbomify.com/CVE-2024-8839/): PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8838](https://insights.sbomify.com/CVE-2024-8838/): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8837](https://insights.sbomify.com/CVE-2024-8837/): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8836](https://insights.sbomify.com/CVE-2024-8836/): PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8835](https://insights.sbomify.com/CVE-2024-8835/): PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8834](https://insights.sbomify.com/CVE-2024-8834/): PDF-XChange Editor TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8833](https://insights.sbomify.com/CVE-2024-8833/): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8832](https://insights.sbomify.com/CVE-2024-8832/): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8831](https://insights.sbomify.com/CVE-2024-8831/): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8830](https://insights.sbomify.com/CVE-2024-8830/): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8829](https://insights.sbomify.com/CVE-2024-8829/): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8828](https://insights.sbomify.com/CVE-2024-8828/): PDF-XChange Editor EMF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8827](https://insights.sbomify.com/CVE-2024-8827/): PDF-XChange Editor PPM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8826](https://insights.sbomify.com/CVE-2024-8826/): PDF-XChange Editor XPS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8825](https://insights.sbomify.com/CVE-2024-8825/): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8824](https://insights.sbomify.com/CVE-2024-8824/): PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8823](https://insights.sbomify.com/CVE-2024-8823/): PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8822](https://insights.sbomify.com/CVE-2024-8822/): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8821](https://insights.sbomify.com/CVE-2024-8821/): PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8820](https://insights.sbomify.com/CVE-2024-8820/): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8819](https://insights.sbomify.com/CVE-2024-8819/): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8818](https://insights.sbomify.com/CVE-2024-8818/): PDF-XChange Editor U3D File Parsing Use-After-Free Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8817](https://insights.sbomify.com/CVE-2024-8817/): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8816](https://insights.sbomify.com/CVE-2024-8816/): PDF-XChange Editor U3D File Parsing Use-After-Free Information Disclosure Vulnerability (low 3.3)
- [CVE-2024-8815](https://insights.sbomify.com/CVE-2024-8815/): PDF-XChange Editor U3D File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8814](https://insights.sbomify.com/CVE-2024-8814/): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8813](https://insights.sbomify.com/CVE-2024-8813/): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8812](https://insights.sbomify.com/CVE-2024-8812/): PDF-XChange Editor U3D File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-8811](https://insights.sbomify.com/CVE-2024-8811/): WinZip Mark-of-the-Web Bypass Vulnerability (high 7.8)
- [CVE-2024-8810](https://insights.sbomify.com/CVE-2024-8810/): Privilege escalation in Enterprise Server (high 8.7)
- [CVE-2024-8809](https://insights.sbomify.com/CVE-2024-8809/): Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-8808](https://insights.sbomify.com/CVE-2024-8808/): Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-8807](https://insights.sbomify.com/CVE-2024-8807/): Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-8806](https://insights.sbomify.com/CVE-2024-8806/): Cohesive Networks VNS3 Command Injection Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-8805](https://insights.sbomify.com/CVE-2024-8805/): BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-8804](https://insights.sbomify.com/CVE-2024-8804/): Code Embed <= 2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-8803](https://insights.sbomify.com/CVE-2024-8803/): Bulk NoIndex & NoFollow Toolkit <= 2.15 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8802](https://insights.sbomify.com/CVE-2024-8802/): Clio Grow <= 1.0.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8801](https://insights.sbomify.com/CVE-2024-8801/): Happy Addons for Elementor <= 3.12.2 - Authenticated (Contributor+) Sensitive Information Exposure (medium 4.3)
- [CVE-2024-8800](https://insights.sbomify.com/CVE-2024-8800/): Cross-site scripting in RabbitLoader – AI Speed Optimization, Caching & CDN for WordPress & WooCommerce (medium 6.1)
- [CVE-2024-8799](https://insights.sbomify.com/CVE-2024-8799/): Custom Banners <= 3.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8798](https://insights.sbomify.com/CVE-2024-8798/): Bluetooth: classic: avdtp: missing buffer length check (high 7.5)
- [CVE-2024-8797](https://insights.sbomify.com/CVE-2024-8797/): WP Booking System – Booking Calendar <= 2.0.19.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8796](https://insights.sbomify.com/CVE-2024-8796/): Insufficient Default OTP Shared Secret Length (medium 6.0)
- [CVE-2024-8795](https://insights.sbomify.com/CVE-2024-8795/): BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover (high 8.8)
- [CVE-2024-8794](https://insights.sbomify.com/CVE-2024-8794/): BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset (medium 5.3)
- [CVE-2024-8793](https://insights.sbomify.com/CVE-2024-8793/): Cross-site scripting in Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers (medium 6.1)
- [CVE-2024-8792](https://insights.sbomify.com/CVE-2024-8792/): Subscribe to Comments <= 2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8791](https://insights.sbomify.com/CVE-2024-8791/): Auth bypass in Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More (critical 9.8)
- [CVE-2024-8790](https://insights.sbomify.com/CVE-2024-8790/): Social Share With Floating Bar <= 1.0.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8789](https://insights.sbomify.com/CVE-2024-8789/): Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary (high 7.5)
- [CVE-2024-8788](https://insights.sbomify.com/CVE-2024-8788/): EU/UK VAT Manager for WooCommerce <= 2.12.12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8787](https://insights.sbomify.com/CVE-2024-8787/): Smart Online Order for Clover <= 1.5.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8786](https://insights.sbomify.com/CVE-2024-8786/): Auto Featured Image from Title <= 2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-8785](https://insights.sbomify.com/CVE-2024-8785/): WhatsUp Gold Registry Overwrite Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-8784](https://insights.sbomify.com/CVE-2024-8784/): QDocs Smart School Management System Chat mynewuser sql injection (medium 5.3)
- [CVE-2024-8783](https://insights.sbomify.com/CVE-2024-8783/): OpenTibiaBR MyAAC Post Reply new_post.php cross site scripting (medium 5.3)
- [CVE-2024-8782](https://insights.sbomify.com/CVE-2024-8782/): JFinalCMS edit delete path traversal (medium 5.3)
- [CVE-2024-8781](https://insights.sbomify.com/CVE-2024-8781/): Container Escape Vulnerability in TR7's Application Security Platform (ASP) (high 8.7)
- [CVE-2024-8780](https://insights.sbomify.com/CVE-2024-8780/): The SYSCOM Group OMFLOW - Improper Authorization for Data Query Function (medium 6.5)
- [CVE-2024-8779](https://insights.sbomify.com/CVE-2024-8779/): The SYSCOM Group OMFLOW - Broken Access Control (high 8.8)
- [CVE-2024-8778](https://insights.sbomify.com/CVE-2024-8778/): The SYSCOM Group OMFLOW - Arbitrary File Read (medium 6.5)
- [CVE-2024-8777](https://insights.sbomify.com/CVE-2024-8777/): The SYSCOM Group OMFLOW - Information Leakage (high 7.5)
- [CVE-2024-8776](https://insights.sbomify.com/CVE-2024-8776/): INTUMIT SmartRobot - Cross-site Scripting (medium 6.1)
- [CVE-2024-8775](https://insights.sbomify.com/CVE-2024-8775/): Ansible-core: exposure of sensitive information in ansible vault files due to improper logging (medium 5.5)
- [CVE-2024-8774](https://insights.sbomify.com/CVE-2024-8774/): Privilege Escalation in SIMPLE.ERP (high 7.7)
- [CVE-2024-8773](https://insights.sbomify.com/CVE-2024-8773/): Protocol Downgrade in SIMPLE.ERP (high 8.3)
- [CVE-2024-8772](https://insights.sbomify.com/CVE-2024-8772/): Race condition in AXIS OS (medium 4.3)
- [CVE-2024-8771](https://insights.sbomify.com/CVE-2024-8771/): Missing authorization in Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress (medium 4.3)
- [CVE-2024-8770](https://insights.sbomify.com/CVE-2024-8770/): Cross-site scripting in GitHub Enterprise Server (medium 5.8)
- [CVE-2024-8769](https://insights.sbomify.com/CVE-2024-8769/): Arbitrary File Deletion via Relative Path Traversal in aimhubio/aim (critical 9.1)
- [CVE-2024-8768](https://insights.sbomify.com/CVE-2024-8768/): Vllm: a completions api request with an empty prompt will crash the vllm api server. (high 7.5)
- [CVE-2024-8767](https://insights.sbomify.com/CVE-2024-8767/): Privilege escalation in Acronis Backup extension for Plesk (critical 9.9)
- [CVE-2024-8766](https://insights.sbomify.com/CVE-2024-8766/): Privilege escalation in Acronis Cyber Protect 16 (medium 6.7)
- [CVE-2024-8765](https://insights.sbomify.com/CVE-2024-8765/): Improper Path Equivalence Resolution in lunary-ai/lunary (high 7.3)
- [CVE-2024-8764](https://insights.sbomify.com/CVE-2024-8764/): Improper Authorization in lunary-ai/lunary (high 7.5)
- [CVE-2024-8763](https://insights.sbomify.com/CVE-2024-8763/): Regular Expression Denial of Service (ReDoS) in lunary-ai/lunary (high 7.5)
- [CVE-2024-8762](https://insights.sbomify.com/CVE-2024-8762/): code-projects Crud Operation System updatedata.php sql injection (medium 5.3)
- [CVE-2024-8761](https://insights.sbomify.com/CVE-2024-8761/): Share This Image <= 2.03 - Open Redirect via link Parameter (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/147/