# Vulnerabilities published in 2024


- [CVE-2024-51796](https://insights.sbomify.com/CVE-2024-51796/): WordPress Trendy Restaurant Menu plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51795](https://insights.sbomify.com/CVE-2024-51795/): WordPress Pdf Embedder Fay plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51794](https://insights.sbomify.com/CVE-2024-51794/): WordPress Storely theme <= 14.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51793](https://insights.sbomify.com/CVE-2024-51793/): WordPress RepairBuddy plugin <= 3.8115 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-51792](https://insights.sbomify.com/CVE-2024-51792/): WordPress Audio Record plugin <= 1.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-51791](https://insights.sbomify.com/CVE-2024-51791/): WordPress Forms plugin <= 2.8.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-51790](https://insights.sbomify.com/CVE-2024-51790/): WordPress HB AUDIO GALLERY plugin <= 3.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-5179](https://insights.sbomify.com/CVE-2024-5179/): Cowidgets – Elementor Addons <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion (high 8.8)
- [CVE-2024-51789](https://insights.sbomify.com/CVE-2024-51789/): WordPress Image Classify plugin <= 1.0.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-51788](https://insights.sbomify.com/CVE-2024-51788/): WordPress The Novel Design Store Directory plugin <= 4.3.0 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-51787](https://insights.sbomify.com/CVE-2024-51787/): WordPress ElementsReady Addons for Elementor plugin <= 6.4.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51786](https://insights.sbomify.com/CVE-2024-51786/): WordPress Realty by BestWebSoft plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51785](https://insights.sbomify.com/CVE-2024-51785/): WordPress Responsive Filterable Portfolio plugin <= 1.0.22 - Server Side Request Forgery (SSRF) vulnerability (medium 4.4)
- [CVE-2024-51784](https://insights.sbomify.com/CVE-2024-51784/): WordPress FriendStore for WooCommerce plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51783](https://insights.sbomify.com/CVE-2024-51783/): WordPress Forms: 3rd-Party Post Again plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51782](https://insights.sbomify.com/CVE-2024-51782/): WordPress Loginplus plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51781](https://insights.sbomify.com/CVE-2024-51781/): WordPress Firework Shoppable Live Video plugin <= 6.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51780](https://insights.sbomify.com/CVE-2024-51780/): WordPress eewee admin custom plugin <= 1.8.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5178](https://insights.sbomify.com/CVE-2024-5178/): Incomplete Input Validation in SecurelyAccess API (medium 6.9)
- [CVE-2024-51779](https://insights.sbomify.com/CVE-2024-51779/): WordPress Don't Break The Code plugin <= .3.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51778](https://insights.sbomify.com/CVE-2024-51778/): WordPress Satisfaction Reports from Help Scout plugin <= 2.0.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51776](https://insights.sbomify.com/CVE-2024-51776/): WordPress Daily Image plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51775](https://insights.sbomify.com/CVE-2024-51775/): Apache Zeppelin: Command Injection via CSWSH (high 7.5)
- [CVE-2024-51774](https://insights.sbomify.com/CVE-2024-51774/): Security feature bypass in qbittorrent:qbittorrent (high 8.1)
- [CVE-2024-51773](https://insights.sbomify.com/CVE-2024-51773/): Cross-site scripting in HPE Aruba Networking ClearPass Policy Manager (medium 4.8)
- [CVE-2024-51772](https://insights.sbomify.com/CVE-2024-51772/): Command injection in HPE Aruba Networking ClearPass Policy Manager (medium 6.4)
- [CVE-2024-51771](https://insights.sbomify.com/CVE-2024-51771/): Code injection in HPE Aruba Networking ClearPass Policy Manager (high 7.2)
- [CVE-2024-51770](https://insights.sbomify.com/CVE-2024-51770/): Information disclosure in HPE AutoPass License Server (high 7.5)
- [CVE-2024-5177](https://insights.sbomify.com/CVE-2024-5177/): Hash Elements <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter in Multiple Widgets (medium 6.4)
- [CVE-2024-51769](https://insights.sbomify.com/CVE-2024-51769/): Information disclosure in HPE AutoPass License Server (high 7.5)
- [CVE-2024-51768](https://insights.sbomify.com/CVE-2024-51768/): Code injection in HPE AutoPass License Server (high 8.0)
- [CVE-2024-51767](https://insights.sbomify.com/CVE-2024-51767/): Auth bypass in HPE AutoPass License Server (high 7.3)
- [CVE-2024-51766](https://insights.sbomify.com/CVE-2024-51766/): HPE NonStop DISK UTIL, Local Denial of Service vulnerability (medium 6.5)
- [CVE-2024-51765](https://insights.sbomify.com/CVE-2024-51765/): Misconfiguration in Cray System Management Software (medium 5.5)
- [CVE-2024-51764](https://insights.sbomify.com/CVE-2024-51764/): Misconfiguration in SGI CXFS (medium 5.5)
- [CVE-2024-51763](https://insights.sbomify.com/CVE-2024-51763/): WordPress Team Showcase and Slider plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51762](https://insights.sbomify.com/CVE-2024-51762/): WordPress PropertyShift plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51761](https://insights.sbomify.com/CVE-2024-51761/): WordPress WPHelpful plugin <= 1.2.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51760](https://insights.sbomify.com/CVE-2024-51760/): WordPress Dashing Memberships plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5176](https://insights.sbomify.com/CVE-2024-5176/): Vulnerability in Welch Allyn Configuration Tool Software (critical 9.4)
- [CVE-2024-51759](https://insights.sbomify.com/CVE-2024-51759/): WordPress SVT Simple plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51758](https://insights.sbomify.com/CVE-2024-51758/): Exported files stored in default (`public`) filesystem if not reconfigured in filament (low 2.3)
- [CVE-2024-51757](https://insights.sbomify.com/CVE-2024-51757/): Fixes security vulnerability that allowed for server side code to be executed by a <script> tag (critical 9.3)
- [CVE-2024-51756](https://insights.sbomify.com/CVE-2024-51756/): cap-std doesn't fully sandbox all the Windows device filenames (low 2.3)
- [CVE-2024-51755](https://insights.sbomify.com/CVE-2024-51755/): Unguarded calls to __isset() and to array-accesses when the sandbox is enabled in Twig (low 2.2)
- [CVE-2024-51754](https://insights.sbomify.com/CVE-2024-51754/): Unguarded calls to __toString() when nesting an object into an array in Twig (low 2.2)
- [CVE-2024-51753](https://insights.sbomify.com/CVE-2024-51753/): Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-remix (low 2.1)
- [CVE-2024-51752](https://insights.sbomify.com/CVE-2024-51752/): Refresh tokens are logged when the debug flag is enabled in @workos-inc/authkit-nextjs (low 2.1)
- [CVE-2024-51751](https://insights.sbomify.com/CVE-2024-51751/): Arbitrary file read with File and UploadButton components in Gradio (medium 6.5)
- [CVE-2024-51750](https://insights.sbomify.com/CVE-2024-51750/): Element allows a malicious homeserver can modify events leading to unrenderable events or rooms (medium 5.0)
- [CVE-2024-51749](https://insights.sbomify.com/CVE-2024-51749/): Element's thumbnails can be abused to misrepresent the content of an attachment (low 3.5)
- [CVE-2024-51748](https://insights.sbomify.com/CVE-2024-51748/): Remote code execution through language setting in kanboard (critical 9.1)
- [CVE-2024-51747](https://insights.sbomify.com/CVE-2024-51747/): Arbitrary File Read and Delete in kanboard (critical 9.1)
- [CVE-2024-51746](https://insights.sbomify.com/CVE-2024-51746/): Use of incorrect Rekor entries during verification in gitsign (low 1.8)
- [CVE-2024-51745](https://insights.sbomify.com/CVE-2024-51745/): Wasmtime doesn't fully sandbox all the Windows device filenames (low 2.3)
- [CVE-2024-51744](https://insights.sbomify.com/CVE-2024-51744/): Bad documentation of error handling in ParseWithClaims can lead to potentially dangerous situations in golang-jwt (low 3.1)
- [CVE-2024-51743](https://insights.sbomify.com/CVE-2024-51743/): Arbitrary File Write leading up to remote code execution (instructor accounts) (high 7.1)
- [CVE-2024-51741](https://insights.sbomify.com/CVE-2024-51741/): Redis allows denial-of-service due to malformed ACL selectors (medium 4.4)
- [CVE-2024-51740](https://insights.sbomify.com/CVE-2024-51740/): SSRF through arbitrary PHP class instantiation in the user portal in Combodo iTop (medium 4.3)
- [CVE-2024-5174](https://insights.sbomify.com/CVE-2024-5174/): Broken Authentication in Gliffy (medium 5.3)
- [CVE-2024-51739](https://insights.sbomify.com/CVE-2024-51739/): Users enumeration allowed through Rest API in Combodo iTop (high 7.5)
- [CVE-2024-51738](https://insights.sbomify.com/CVE-2024-51738/): Sunshine improperly enforces pairing protocol request order (high 7.7)
- [CVE-2024-51737](https://insights.sbomify.com/CVE-2024-51737/): RediSearch Integer Overflow with LIMIT or KNN arguments can lead to RCE (high 7.0)
- [CVE-2024-51736](https://insights.sbomify.com/CVE-2024-51736/): Command execution hijack on Windows with Process class in symfony/process (not scored)
- [CVE-2024-51735](https://insights.sbomify.com/CVE-2024-51735/): Stored Cross-site Scripting to RCE on Osmedeus Web Server (high 8.7)
- [CVE-2024-51734](https://insights.sbomify.com/CVE-2024-51734/): User data deletion by anoynmous users in Zope (high 8.7)
- [CVE-2024-5173](https://insights.sbomify.com/CVE-2024-5173/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 6.4)
- [CVE-2024-51729](https://insights.sbomify.com/CVE-2024-51729/): mm: use aligned address in copy_user_gigantic_page() (high 7.8)
- [CVE-2024-51727](https://insights.sbomify.com/CVE-2024-51727/): Ruijie Reyee OS Premature Release of Resource During Expected Lifetime (high 7.1)
- [CVE-2024-51723](https://insights.sbomify.com/CVE-2024-51723/): Vulnerability in Management Console Impacts BlackBerry AtHoc (medium 4.6)
- [CVE-2024-51722](https://insights.sbomify.com/CVE-2024-51722/): Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE (medium 6.4)
- [CVE-2024-51721](https://insights.sbomify.com/CVE-2024-51721/): Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE (high 7.3)
- [CVE-2024-51720](https://insights.sbomify.com/CVE-2024-51720/): Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE (medium 4.8)
- [CVE-2024-5172](https://insights.sbomify.com/CVE-2024-5172/): Expert Invoice <= 1.0.2 -Admin+ Stored XSS (medium 4.8)
- [CVE-2024-51719](https://insights.sbomify.com/CVE-2024-51719/): WordPress Simplistic SEO plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51718](https://insights.sbomify.com/CVE-2024-51718/): WordPress Simple Modal plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51717](https://insights.sbomify.com/CVE-2024-51717/): WordPress Ajax Content Filter plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51716](https://insights.sbomify.com/CVE-2024-51716/): WordPress Twitter real time search scrolling plugin <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51715](https://insights.sbomify.com/CVE-2024-51715/): WordPress ClickWhale plugin <= 2.4.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51714](https://insights.sbomify.com/CVE-2024-51714/): WordPress User Password Reset plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51713](https://insights.sbomify.com/CVE-2024-51713/): WordPress HQ60 Fidelity Card plugin <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51712](https://insights.sbomify.com/CVE-2024-51712/): WordPress Jigoshop plugin <= 1.4.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51711](https://insights.sbomify.com/CVE-2024-51711/): WordPress Saragna plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51710](https://insights.sbomify.com/CVE-2024-51710/): WordPress Responsive Data Table plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-5171](https://insights.sbomify.com/CVE-2024-5171/): heap buffer overflow in libaom (critical 10.0)
- [CVE-2024-51709](https://insights.sbomify.com/CVE-2024-51709/): WordPress TeleAdmin plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51708](https://insights.sbomify.com/CVE-2024-51708/): WordPress Narnoo Commerce Manager plugin <= 1.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51707](https://insights.sbomify.com/CVE-2024-51707/): WordPress WP Visual Adverts plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51706](https://insights.sbomify.com/CVE-2024-51706/): WordPress UW Freelancer plugin <= 0.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51705](https://insights.sbomify.com/CVE-2024-51705/): WordPress WP MMenu Lite plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51704](https://insights.sbomify.com/CVE-2024-51704/): WordPress imPress plugin <= 0.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51703](https://insights.sbomify.com/CVE-2024-51703/): WordPress WP-Basics plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51702](https://insights.sbomify.com/CVE-2024-51702/): WordPress SrcSet Responsive Images for WordPress plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51701](https://insights.sbomify.com/CVE-2024-51701/): WordPress MG Post Contributors plugin <= 1.3. - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51700](https://insights.sbomify.com/CVE-2024-51700/): WordPress NAVER Analytics plugin <= 0.9 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-5170](https://insights.sbomify.com/CVE-2024-5170/): Logo Manager For Enamad <= 0.7.1 - Admin+ Stored XSS via Widget (medium 5.7)
- [CVE-2024-51699](https://insights.sbomify.com/CVE-2024-51699/): WordPress Buooy Sticky Header plugin <= 0.5.2 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51698](https://insights.sbomify.com/CVE-2024-51698/): WordPress Master Bar plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51697](https://insights.sbomify.com/CVE-2024-51697/): WordPress Doofinder plugin <= 0.5.4 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-51696](https://insights.sbomify.com/CVE-2024-51696/): WordPress Content Syndication Toolkit Reader plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/219/