# Vulnerabilities published in 2024


- [CVE-2024-51995](https://insights.sbomify.com/CVE-2024-51995/): Logic bug in ajax.render.php allows for bypass of 'backOffice' access control in Combodo iTop (high 7.1)
- [CVE-2024-51994](https://insights.sbomify.com/CVE-2024-51994/): Cross-site Scripting in portal picture upload in Combodo iTop (high 7.1)
- [CVE-2024-51993](https://insights.sbomify.com/CVE-2024-51993/): Password is stored in clear in the database in Combodo iTop (low 3.4)
- [CVE-2024-51992](https://insights.sbomify.com/CVE-2024-51992/): Method Exposure Vulnerability in Modals in orchid/platform (medium 4.1)
- [CVE-2024-51991](https://insights.sbomify.com/CVE-2024-51991/): October CMS Allows Unprotected SVG Rename in Media Manager (low 1.1)
- [CVE-2024-51990](https://insights.sbomify.com/CVE-2024-51990/): Path traversal via crafted Git repositories in jj (critical 9.3)
- [CVE-2024-5199](https://insights.sbomify.com/CVE-2024-5199/): Spotify Play Button <= 1.0 - Contributor+ Stored XSS (medium 6.1)
- [CVE-2024-51989](https://insights.sbomify.com/CVE-2024-51989/): Cross-site Scripting (XSS) Vulnerability in PasswordPusher (high 7.1)
- [CVE-2024-51988](https://insights.sbomify.com/CVE-2024-51988/): HTTP API's queue deletion endpoint does not verify that the user has a required permission (medium 6.5)
- [CVE-2024-51987](https://insights.sbomify.com/CVE-2024-51987/): HTTP Client uses incorrect token after refresh in Duende.AccessTokenManagement.OpenIdConnect (medium 5.4)
- [CVE-2024-51984](https://insights.sbomify.com/CVE-2024-51984/): Information disclosure in ADS-1700W (medium 6.8)
- [CVE-2024-51983](https://insights.sbomify.com/CVE-2024-51983/): Denial of service in ADS-1250W (high 7.5)
- [CVE-2024-51982](https://insights.sbomify.com/CVE-2024-51982/): Denial of service in ADS-2400N (high 7.5)
- [CVE-2024-51981](https://insights.sbomify.com/CVE-2024-51981/): Server-side request forgery in ADS-2400N (medium 5.3)
- [CVE-2024-51980](https://insights.sbomify.com/CVE-2024-51980/): Server-side request forgery in ADS-2400N (medium 5.3)
- [CVE-2024-5198](https://insights.sbomify.com/CVE-2024-5198/): Null dereference in OpenVPN-GUI (low 3.3)
- [CVE-2024-51979](https://insights.sbomify.com/CVE-2024-51979/): Memory corruption in ADS-2400N (high 7.2)
- [CVE-2024-51978](https://insights.sbomify.com/CVE-2024-51978/): Auth bypass in ADS-1250W (critical 9.8)
- [CVE-2024-51977](https://insights.sbomify.com/CVE-2024-51977/): Information disclosure in DCP-1610W (medium 5.3)
- [CVE-2024-5197](https://insights.sbomify.com/CVE-2024-5197/): Integer overflow in libvpx (medium 5.9)
- [CVE-2024-51966](https://insights.sbomify.com/CVE-2024-51966/): Directory traversal vulnerability in ArcGIS Server (medium 4.9)
- [CVE-2024-51963](https://insights.sbomify.com/CVE-2024-51963/): Stored XSS in ArcGIS Server Manager (medium 4.8)
- [CVE-2024-51962](https://insights.sbomify.com/CVE-2024-51962/): SQL injection vulnerability in ArcGIS Server (high 8.7)
- [CVE-2024-51961](https://insights.sbomify.com/CVE-2024-51961/): Local file inclusion (LFI) vulnerability in ArcGIS Server (high 7.5)
- [CVE-2024-51960](https://insights.sbomify.com/CVE-2024-51960/): Stored XSS in ArcGIS Server Administrator Directory (medium 4.8)
- [CVE-2024-5196](https://insights.sbomify.com/CVE-2024-5196/): Arris VAP2500 tools_command.php command injection (medium 5.1)
- [CVE-2024-51959](https://insights.sbomify.com/CVE-2024-51959/): Stored XSS issue in Server Admin API (medium 4.8)
- [CVE-2024-51958](https://insights.sbomify.com/CVE-2024-51958/): Directory traversal vulnerability in the admin api for service thumbnails (medium 4.9)
- [CVE-2024-51957](https://insights.sbomify.com/CVE-2024-51957/): Stored XSS vulnerability in ArcGIS Rest Services Directory (medium 4.8)
- [CVE-2024-51956](https://insights.sbomify.com/CVE-2024-51956/): Stored XSS vulnerability in ArcGIS Server Administrator Directory (medium 4.8)
- [CVE-2024-51954](https://insights.sbomify.com/CVE-2024-51954/): Unauthorized access to secure services in ArcGIS Server (high 8.5)
- [CVE-2024-51953](https://insights.sbomify.com/CVE-2024-51953/): Stored XSS in ArcGIS Server Rest services (medium 4.8)
- [CVE-2024-51952](https://insights.sbomify.com/CVE-2024-51952/): Stored XSS issue in ArcGIS Server (medium 4.8)
- [CVE-2024-51951](https://insights.sbomify.com/CVE-2024-51951/): Stored XSS in Server Admin API (medium 4.8)
- [CVE-2024-51950](https://insights.sbomify.com/CVE-2024-51950/): Stored XSS in Server Admin under Services > lifecycleinfos (medium 4.8)
- [CVE-2024-5195](https://insights.sbomify.com/CVE-2024-5195/): Arris VAP2500 diag_s.php command injection (medium 5.1)
- [CVE-2024-51949](https://insights.sbomify.com/CVE-2024-51949/): Stored XSS vulnerability in Rest Services under OGCFeature Service and Map Service (medium 4.8)
- [CVE-2024-51948](https://insights.sbomify.com/CVE-2024-51948/): Stored XSS vulnerability in Rest Services under Job ID (medium 4.8)
- [CVE-2024-51947](https://insights.sbomify.com/CVE-2024-51947/): Stored XSS vulnerability in Rest Services under Layer name (medium 4.8)
- [CVE-2024-51946](https://insights.sbomify.com/CVE-2024-51946/): Stored XSS in Rest Services Directory under Identify operation (medium 4.8)
- [CVE-2024-51945](https://insights.sbomify.com/CVE-2024-51945/): Stored XSS issues in Server Admin API (medium 4.8)
- [CVE-2024-51944](https://insights.sbomify.com/CVE-2024-51944/): Stored XSS in Rest Services Directory (medium 4.8)
- [CVE-2024-51942](https://insights.sbomify.com/CVE-2024-51942/): Stored XSS vulnerability in Rest Admin API under Hosted Feature Services page (medium 4.8)
- [CVE-2024-51941](https://insights.sbomify.com/CVE-2024-51941/): Apache Ambari: Remote Code Injection in Ambari Metrics and AMS Alerts (high 8.8)
- [CVE-2024-51940](https://insights.sbomify.com/CVE-2024-51940/): WordPress WP Responsive Video plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5194](https://insights.sbomify.com/CVE-2024-5194/): Arris VAP2500 assoc_table.php command injection (medium 5.1)
- [CVE-2024-51939](https://insights.sbomify.com/CVE-2024-51939/): WordPress Stylish Internal Links plugin <= 1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51938](https://insights.sbomify.com/CVE-2024-51938/): WordPress Charity Addon for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51937](https://insights.sbomify.com/CVE-2024-51937/): WordPress IA Map Analytics Basic plugin <= 20170413 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51936](https://insights.sbomify.com/CVE-2024-51936/): WordPress ESB Testimonials plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51935](https://insights.sbomify.com/CVE-2024-51935/): WordPress Fast Video and Image Display plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51934](https://insights.sbomify.com/CVE-2024-51934/): WordPress Ekiline Block Collection plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51933](https://insights.sbomify.com/CVE-2024-51933/): WordPress Cookie Nonsense for YT plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51932](https://insights.sbomify.com/CVE-2024-51932/): WordPress Kings Tab Slider plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51931](https://insights.sbomify.com/CVE-2024-51931/): WordPress AzonBox plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51930](https://insights.sbomify.com/CVE-2024-51930/): WordPress Custom URL Shortener plugin <= 0.3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5193](https://insights.sbomify.com/CVE-2024-5193/): Ritlabs TinyWeb Server Request crlf injection (medium 6.9)
- [CVE-2024-51929](https://insights.sbomify.com/CVE-2024-51929/): WordPress Icon Widget plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51928](https://insights.sbomify.com/CVE-2024-51928/): WordPress Blocks Post Grid plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51927](https://insights.sbomify.com/CVE-2024-51927/): WordPress Rig Elements For Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51926](https://insights.sbomify.com/CVE-2024-51926/): WordPress GreenCon plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51925](https://insights.sbomify.com/CVE-2024-51925/): WordPress Testimonial Slider Shortcode plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51924](https://insights.sbomify.com/CVE-2024-51924/): WordPress WP Agenda plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51923](https://insights.sbomify.com/CVE-2024-51923/): WordPress Websand Subscription Form plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51922](https://insights.sbomify.com/CVE-2024-51922/): WordPress VP Sitemap plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51921](https://insights.sbomify.com/CVE-2024-51921/): WordPress scrollup plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51920](https://insights.sbomify.com/CVE-2024-51920/): WordPress Map Store Locator plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5192](https://insights.sbomify.com/CVE-2024-5192/): Cross-site scripting in FunnelKit – Funnel Builder for WooCommerce Checkout (medium 6.4)
- [CVE-2024-51919](https://insights.sbomify.com/CVE-2024-51919/): WordPress Fancy Product Designer plugin <= 6.4.3 - Unauthenticated Arbitrary File Upload vulnerability (critical 9.0)
- [CVE-2024-51918](https://insights.sbomify.com/CVE-2024-51918/): WordPress Pay With Stripe plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51917](https://insights.sbomify.com/CVE-2024-51917/): WordPress Multiple Votes in one page plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51916](https://insights.sbomify.com/CVE-2024-51916/): WordPress Multifox Plus plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51915](https://insights.sbomify.com/CVE-2024-51915/): WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51914](https://insights.sbomify.com/CVE-2024-51914/): WordPress drop in image slideshow gallery plugin <= 12.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51913](https://insights.sbomify.com/CVE-2024-51913/): WordPress Mapme plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51912](https://insights.sbomify.com/CVE-2024-51912/): WordPress IntelliWidget Elements plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51911](https://insights.sbomify.com/CVE-2024-51911/): WordPress Featured product by category name plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51910](https://insights.sbomify.com/CVE-2024-51910/): WordPress Assist24 Help Desk plugin <= 20150401.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5191](https://insights.sbomify.com/CVE-2024-5191/): Cross-site scripting in Branda – White Label & Branding, Free Login Page Customizer (medium 6.4)
- [CVE-2024-51909](https://insights.sbomify.com/CVE-2024-51909/): WordPress audioCase plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51908](https://insights.sbomify.com/CVE-2024-51908/): WordPress Adventure Bucket List plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51907](https://insights.sbomify.com/CVE-2024-51907/): WordPress WP Virtual Room Configurator plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51906](https://insights.sbomify.com/CVE-2024-51906/): WordPress RSV 360 View plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51905](https://insights.sbomify.com/CVE-2024-51905/): WordPress RSV PDF Preview plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51904](https://insights.sbomify.com/CVE-2024-51904/): WordPress Embed documents shortcode plugin <= 1.5 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51903](https://insights.sbomify.com/CVE-2024-51903/): WordPress WP Listings Pro plugin <= 3.0.14 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51902](https://insights.sbomify.com/CVE-2024-51902/): WordPress TinyCode plugin <= 1.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51901](https://insights.sbomify.com/CVE-2024-51901/): WordPress Smooth Maps plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51900](https://insights.sbomify.com/CVE-2024-51900/): WordPress What Would Seth Godin Do plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-51899](https://insights.sbomify.com/CVE-2024-51899/): WordPress Simple Pricing Table plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51898](https://insights.sbomify.com/CVE-2024-51898/): WordPress Semantic Shortcode plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51897](https://insights.sbomify.com/CVE-2024-51897/): WordPress News Articles plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51896](https://insights.sbomify.com/CVE-2024-51896/): WordPress Magic Slider plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51895](https://insights.sbomify.com/CVE-2024-51895/): WordPress Minical Hotel Booking Plugin plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51894](https://insights.sbomify.com/CVE-2024-51894/): WordPress Topbar ID for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51893](https://insights.sbomify.com/CVE-2024-51893/): WordPress Postify: Post Layout For Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51892](https://insights.sbomify.com/CVE-2024-51892/): WordPress Sell Media File with Stripe plugin <= 1.0.6 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51891](https://insights.sbomify.com/CVE-2024-51891/): WordPress Official SalesWizard CRM Plugin plugin <= 1.0.3 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51890](https://insights.sbomify.com/CVE-2024-51890/): WordPress Geoportail Shortcode plugin <= 2.4.4 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5189](https://insights.sbomify.com/CVE-2024-5189/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/217/