# Vulnerabilities published in 2024


- [CVE-2024-6499](https://insights.sbomify.com/CVE-2024-6499/): WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure (medium 5.3)
- [CVE-2024-6498](https://insights.sbomify.com/CVE-2024-6498/): CollectChat < 2.4.4 - Admin+ XSS (medium 4.8)
- [CVE-2024-6497](https://insights.sbomify.com/CVE-2024-6497/): SEO Plugin by Squirrly SEO <= 12.3.19 - Authenticated (Contributor+) SQL Injection via url Parameter (high 8.8)
- [CVE-2024-6496](https://insights.sbomify.com/CVE-2024-6496/): Light Poll <= 1.0.0 - Polls Deletion via CSRF (medium 6.5)
- [CVE-2024-6495](https://insights.sbomify.com/CVE-2024-6495/): Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-6494](https://insights.sbomify.com/CVE-2024-6494/): WordPress File Upload < 4.24.8 - Unauthenticated Stored XSS (medium 6.1)
- [CVE-2024-6493](https://insights.sbomify.com/CVE-2024-6493/): NinjaTeam Header Footer Custom Code < 1.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6492](https://insights.sbomify.com/CVE-2024-6492/): Information disclosure in Remote Desktop Manager (high 7.4)
- [CVE-2024-6491](https://insights.sbomify.com/CVE-2024-6491/): Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authentication to MailChimp API key update (medium 4.3)
- [CVE-2024-6490](https://insights.sbomify.com/CVE-2024-6490/): Master Slider – Responsive Touch Slider <= 3.9.10 - CSRF to slider deletion (medium 6.5)
- [CVE-2024-6489](https://insights.sbomify.com/CVE-2024-6489/): Getwid – Gutenberg Blocks <= 2.0.10 - Missing Authorization to Google API key update (medium 5.3)
- [CVE-2024-6487](https://insights.sbomify.com/CVE-2024-6487/): Inline Related Posts < 3.8.0 - Admin+ Stored XSS (medium 5.9)
- [CVE-2024-6486](https://insights.sbomify.com/CVE-2024-6486/): ImageMagick Engine < 1.7.11 - Administrator+ OS Command Injection (high 7.2)
- [CVE-2024-6485](https://insights.sbomify.com/CVE-2024-6485/): XSS in Bootstrap button component (medium 6.4)
- [CVE-2024-6483](https://insights.sbomify.com/CVE-2024-6483/): Arbitrary File/Directory Deletion in aimhubio/aim (medium 5.3)
- [CVE-2024-6482](https://insights.sbomify.com/CVE-2024-6482/): Login with phone number <= 1.7.49 - Authenticated (Subscriber+) Authorization Bypass to Privilege Escalation (high 8.8)
- [CVE-2024-6481](https://insights.sbomify.com/CVE-2024-6481/): Search Filter Pro < 2.5.18 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6480](https://insights.sbomify.com/CVE-2024-6480/): SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) Cross-Site Scripting (medium 6.4)
- [CVE-2024-6479](https://insights.sbomify.com/CVE-2024-6479/): SIP Reviews Shortcode for WooCommerce <= 1.2.3 - Authenticated (Contributor+) SQL Injection (medium 6.5)
- [CVE-2024-6478](https://insights.sbomify.com/CVE-2024-6478/): CTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6477](https://insights.sbomify.com/CVE-2024-6477/): UsersWP < 1.2.12 - Users Information Disclosure (high 7.5)
- [CVE-2024-6476](https://insights.sbomify.com/CVE-2024-6476/): Privilege escalation in AXIS Camera Station (medium 4.2)
- [CVE-2024-6473](https://insights.sbomify.com/CVE-2024-6473/): DLL Hijacking in Yandex Browser (high 8.4)
- [CVE-2024-6472](https://insights.sbomify.com/CVE-2024-6472/): Ability to trust not validated macro signatures removed in high security mode (high 7.8)
- [CVE-2024-6471](https://insights.sbomify.com/CVE-2024-6471/): SourceCodester Online Tours & Travels Management sms_setting.php sql injection (medium 5.3)
- [CVE-2024-6470](https://insights.sbomify.com/CVE-2024-6470/): playSMS Template injection (medium 5.1)
- [CVE-2024-6469](https://insights.sbomify.com/CVE-2024-6469/): playSMS Template injection (medium 5.1)
- [CVE-2024-6468](https://insights.sbomify.com/CVE-2024-6468/): Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior (high 7.5)
- [CVE-2024-6467](https://insights.sbomify.com/CVE-2024-6467/): BookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File Creation (high 8.8)
- [CVE-2024-6466](https://insights.sbomify.com/CVE-2024-6466/): Misconfiguration in WebSAM DeploymentManager (medium 5.3)
- [CVE-2024-6465](https://insights.sbomify.com/CVE-2024-6465/): WP Links Page <= 4.9.5 - Missing Authorization to Authenticated (Subscriber+) Limited Image Update (medium 4.3)
- [CVE-2024-6462](https://insights.sbomify.com/CVE-2024-6462/): DL Yandex Metrika <= 1.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6460](https://insights.sbomify.com/CVE-2024-6460/): Grow by Tradedoubler <= 2.0.21 - Unauthenticated LFI (critical 9.8)
- [CVE-2024-6459](https://insights.sbomify.com/CVE-2024-6459/): News Element Elementor Blog Magazine < 1.0.6 - Unauthenticated LFI (critical 9.8)
- [CVE-2024-6458](https://insights.sbomify.com/CVE-2024-6458/): WooCommerce Product Table Lite <= 3.5.1 - Missing Authorization to (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-6457](https://insights.sbomify.com/CVE-2024-6457/): HUSKY - Products Filter Professional for WooCommerce <= 1.3.6 - Unauthenticated Time-Based SQL Injection (critical 9.8)
- [CVE-2024-6456](https://insights.sbomify.com/CVE-2024-6456/): SQL Injection vulnerability in AVEVA Historian Server (high 8.5)
- [CVE-2024-6455](https://insights.sbomify.com/CVE-2024-6455/): ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function (medium 5.3)
- [CVE-2024-6453](https://insights.sbomify.com/CVE-2024-6453/): itsourcecode Farm Management System sql injection (medium 5.3)
- [CVE-2024-6452](https://insights.sbomify.com/CVE-2024-6452/): linlinjava litemall AdminGoodscontroller.java sql injection (medium 5.3)
- [CVE-2024-6451](https://insights.sbomify.com/CVE-2024-6451/): AI Engine < 2.5.1 - Admin+ RCE (high 7.2)
- [CVE-2024-6450](https://insights.sbomify.com/CVE-2024-6450/): Reflected XSS in HyperView Geoportal Toolkit (medium 5.3)
- [CVE-2024-6449](https://insights.sbomify.com/CVE-2024-6449/): Arbitrary cross-domain file inclusion in HyperView Geoportal Toolkit (medium 5.3)
- [CVE-2024-6448](https://insights.sbomify.com/CVE-2024-6448/): Mollie Payments for WooCommerce <= 7.7.0 - Unauthenticated Full Path Disclosure (medium 5.3)
- [CVE-2024-6447](https://insights.sbomify.com/CVE-2024-6447/): FULL <= 3.1.12 - Unauthenticated Stored Cross-Site Scripting via License Plan Parameter (high 7.2)
- [CVE-2024-6446](https://insights.sbomify.com/CVE-2024-6446/): Business Logic Errors in GitLab (low 3.5)
- [CVE-2024-6445](https://insights.sbomify.com/CVE-2024-6445/): Authenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeX (critical 10.0)
- [CVE-2024-6444](https://insights.sbomify.com/CVE-2024-6444/): Bluetooth: ots: missing buffer length check (medium 6.3)
- [CVE-2024-6443](https://insights.sbomify.com/CVE-2024-6443/): zephyr: out-of-bound read in utf8_trunc (medium 6.3)
- [CVE-2024-6442](https://insights.sbomify.com/CVE-2024-6442/): Bluetooth: ASCS Unchecked tailroom of the response buffer (medium 6.3)
- [CVE-2024-6441](https://insights.sbomify.com/CVE-2024-6441/): ORIPA LoaderXML.java deserialization (medium 5.3)
- [CVE-2024-6440](https://insights.sbomify.com/CVE-2024-6440/): SourceCodester Home Owners Collection Management System sql injection (medium 5.3)
- [CVE-2024-6439](https://insights.sbomify.com/CVE-2024-6439/): SourceCodester Home Owners Collection Management System unrestricted upload (medium 5.3)
- [CVE-2024-6438](https://insights.sbomify.com/CVE-2024-6438/): Hitout Carsale OrderController.java sql injection (medium 5.3)
- [CVE-2024-6437](https://insights.sbomify.com/CVE-2024-6437/): Security feature bypass in EOS - BGP Flowspec (medium 5.8)
- [CVE-2024-6436](https://insights.sbomify.com/CVE-2024-6436/): Rockwell Automation Input Validation Vulnerability exists in the SequenceManager™ Server (high 8.7)
- [CVE-2024-6435](https://insights.sbomify.com/CVE-2024-6435/): Rockwell Automation Privilege Escalation Vulnerability in Pavilion8® (high 8.7)
- [CVE-2024-6434](https://insights.sbomify.com/CVE-2024-6434/): Premium Addons for Elementor <= 4.10.35 - Regular Expressions Denial of Service (low 3.1)
- [CVE-2024-6433](https://insights.sbomify.com/CVE-2024-6433/): Local File Inclusion in stitionai/devika (high 7.5)
- [CVE-2024-6432](https://insights.sbomify.com/CVE-2024-6432/): Cross-site scripting in Content Blocks (Custom Post Widget) (medium 6.4)
- [CVE-2024-6431](https://insights.sbomify.com/CVE-2024-6431/): Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-6429](https://insights.sbomify.com/CVE-2024-6429/): Content Spoofing in Multiple WSO2 Products via Error Message Injection (medium 4.3)
- [CVE-2024-6428](https://insights.sbomify.com/CVE-2024-6428/): Limited DoS due to permitting creating users with user-defined IDs (medium 5.3)
- [CVE-2024-6427](https://insights.sbomify.com/CVE-2024-6427/): Uncontrolled Resource Consumption vulnerability in MESbook (high 7.5)
- [CVE-2024-6426](https://insights.sbomify.com/CVE-2024-6426/): Information exposure vulnerability vulnerability in MESbook (high 8.1)
- [CVE-2024-6425](https://insights.sbomify.com/CVE-2024-6425/): Incorrect Provision of Specified Functionality vulnerability in MESbook (critical 9.1)
- [CVE-2024-6424](https://insights.sbomify.com/CVE-2024-6424/): Server-Side Request Forgery vulnerability in MESbook (critical 9.3)
- [CVE-2024-6423](https://insights.sbomify.com/CVE-2024-6423/): Sensitive Data Exposure via URL Parameters in Multiple WSO2 Products Allows Confidential Information Leakage (medium 4.0)
- [CVE-2024-6422](https://insights.sbomify.com/CVE-2024-6422/): Pepperl+Fuchs: OIT Products can be manipulated via unintended Telnet access (critical 9.8)
- [CVE-2024-6421](https://insights.sbomify.com/CVE-2024-6421/): Pepperl+Fuchs: Incorrectly configured FTP-Server in OIT Products (high 7.5)
- [CVE-2024-6420](https://insights.sbomify.com/CVE-2024-6420/): Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure (high 8.6)
- [CVE-2024-6419](https://insights.sbomify.com/CVE-2024-6419/): SourceCodester Medicine Tracker System sql injection (medium 5.3)
- [CVE-2024-6418](https://insights.sbomify.com/CVE-2024-6418/): SourceCodester Medicine Tracker System sql injection (medium 6.9)
- [CVE-2024-6417](https://insights.sbomify.com/CVE-2024-6417/): SourceCodester Simple Online Bidding System sql injection (medium 5.3)
- [CVE-2024-6416](https://insights.sbomify.com/CVE-2024-6416/): SeaCMS sql injection (medium 5.3)
- [CVE-2024-6415](https://insights.sbomify.com/CVE-2024-6415/): Ingenico Estate Manager New Widget cross site scripting (medium 5.1)
- [CVE-2024-6414](https://insights.sbomify.com/CVE-2024-6414/): Parsec Automation TrakSYS Export Page contentpage direct request (medium 6.9)
- [CVE-2024-6412](https://insights.sbomify.com/CVE-2024-6412/): HTML Forms – Simple WordPress Forms Plugin < 1.3.34 - Bulk Delete via CSRF (medium 6.5)
- [CVE-2024-6411](https://insights.sbomify.com/CVE-2024-6411/): Privilege escalation in ProfileGrid – User Profiles, Groups and Communities (high 8.8)
- [CVE-2024-6410](https://insights.sbomify.com/CVE-2024-6410/): ProfileGrid <= 5.8.9 - Authenticated (Subscriber+) Insecure Direct Object Reference (medium 4.3)
- [CVE-2024-6409](https://insights.sbomify.com/CVE-2024-6409/): Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9 (high 7.0)
- [CVE-2024-6408](https://insights.sbomify.com/CVE-2024-6408/): Slider by 10Web < 1.2.57 - Editor+ Stored XSS (medium 5.4)
- [CVE-2024-6407](https://insights.sbomify.com/CVE-2024-6407/): Information disclosure in Wiser Home Controller WHC-5918A (critical 9.8)
- [CVE-2024-6406](https://insights.sbomify.com/CVE-2024-6406/): Sensetive Data Exposure in Yordam Information Technology's Mobile Library Application (high 8.5)
- [CVE-2024-6405](https://insights.sbomify.com/CVE-2024-6405/): Floating Social Buttons <= 1.5 - Cross-Site Request Forgery (medium 6.1)
- [CVE-2024-6403](https://insights.sbomify.com/CVE-2024-6403/): Tenda A301 SetOnlineDevName formWifiBasicSet stack-based overflow (high 7.1)
- [CVE-2024-6402](https://insights.sbomify.com/CVE-2024-6402/): Tenda A301 SetOnlineDevName fromSetWirelessRepeat stack-based overflow (high 7.1)
- [CVE-2024-6401](https://insights.sbomify.com/CVE-2024-6401/): SQLi in SFS Consulting's InsureE GL (critical 9.2)
- [CVE-2024-6400](https://insights.sbomify.com/CVE-2024-6400/): Cleartext Storage of Username and Password in Finrota's Netahsilat (high 8.2)
- [CVE-2024-6398](https://insights.sbomify.com/CVE-2024-6398/): Information disclosure in Secure Web Gateway (medium 4.3)
- [CVE-2024-6397](https://insights.sbomify.com/CVE-2024-6397/): InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.44 - Authentication Bypass to Admin (critical 9.8)
- [CVE-2024-6396](https://insights.sbomify.com/CVE-2024-6396/): Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim (critical 9.8)
- [CVE-2024-6395](https://insights.sbomify.com/CVE-2024-6395/): GitHub Enterprise Server Information Disclosure Vulnerability Exposes Private Repository Names via Deploy Keys (medium 6.3)
- [CVE-2024-6394](https://insights.sbomify.com/CVE-2024-6394/): Local File Inclusion in parisneo/lollms-webui (high 7.5)
- [CVE-2024-6393](https://insights.sbomify.com/CVE-2024-6393/): NextGEN Gallery < 3.59.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-6392](https://insights.sbomify.com/CVE-2024-6392/): Missing authorization in Image Optimizer, Resizer and CDN – Sirv (medium 5.4)
- [CVE-2024-6391](https://insights.sbomify.com/CVE-2024-6391/): oik <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via bw_button Shortcode (medium 6.4)
- [CVE-2024-6390](https://insights.sbomify.com/CVE-2024-6390/): Quiz and Survey Master (QSM) < 9.1.0 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-6389](https://insights.sbomify.com/CVE-2024-6389/): Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab (medium 4.3)
- [CVE-2024-6388](https://insights.sbomify.com/CVE-2024-6388/): Information disclosure in Ubuntu Advantage Desktop Pro (medium 5.9)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/169/