# Vulnerabilities published in 2024


- [CVE-2024-51603](https://insights.sbomify.com/CVE-2024-51603/): WordPress NMR Strava activities plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51602](https://insights.sbomify.com/CVE-2024-51602/): WordPress Simple Job Manager plugin <= 1.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51601](https://insights.sbomify.com/CVE-2024-51601/): WordPress Website price calculator plugin <= 4.1 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-5160](https://insights.sbomify.com/CVE-2024-5160/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-51599](https://insights.sbomify.com/CVE-2024-51599/): WordPress Simple Business Manager plugin <= 4.6.7.4 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51598](https://insights.sbomify.com/CVE-2024-51598/): WordPress Selar.co Widget plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51597](https://insights.sbomify.com/CVE-2024-51597/): Cross-site scripting in ThemeShark Templates & Widgets for Elementor (medium 6.5)
- [CVE-2024-51596](https://insights.sbomify.com/CVE-2024-51596/): WordPress Business plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51595](https://insights.sbomify.com/CVE-2024-51595/): WordPress SKSDEV Toolkit plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51594](https://insights.sbomify.com/CVE-2024-51594/): WordPress Gmap Point List plugin <= 1.1.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51593](https://insights.sbomify.com/CVE-2024-51593/): WordPress Курс валют UAH plugin <= 2.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51592](https://insights.sbomify.com/CVE-2024-51592/): WordPress Meta Store Elements plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51591](https://insights.sbomify.com/CVE-2024-51591/): WordPress Slicko plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51590](https://insights.sbomify.com/CVE-2024-51590/): WordPress Hoo Addons for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5159](https://insights.sbomify.com/CVE-2024-5159/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-51589](https://insights.sbomify.com/CVE-2024-51589/): WordPress Bigmart Elements plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51588](https://insights.sbomify.com/CVE-2024-51588/): WordPress Super Addons for Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51587](https://insights.sbomify.com/CVE-2024-51587/): WordPress Definitive Addons for Elementor plugin <= 1.5.16 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51586](https://insights.sbomify.com/CVE-2024-51586/): WordPress Elementary Addons plugin <= 2.0.4 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51585](https://insights.sbomify.com/CVE-2024-51585/): WordPress Sales Page Addon plugin <= 1.4.5 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51584](https://insights.sbomify.com/CVE-2024-51584/): WordPress Marquee Elementor with Posts plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51583](https://insights.sbomify.com/CVE-2024-51583/): WordPress Kento Ads Rotator plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51582](https://insights.sbomify.com/CVE-2024-51582/): WordPress WP Hotel Booking plugin <= 2.2.9 - Local File Inclusion vulnerability (high 7.5)
- [CVE-2024-51581](https://insights.sbomify.com/CVE-2024-51581/): WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51580](https://insights.sbomify.com/CVE-2024-51580/): WordPress Clever Addons for Elementor plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-5158](https://insights.sbomify.com/CVE-2024-5158/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-51579](https://insights.sbomify.com/CVE-2024-51579/): WordPress 5 Stars Rating Funnel plugin <=1.4.01 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-51578](https://insights.sbomify.com/CVE-2024-51578/): WordPress 3D Presentation plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51577](https://insights.sbomify.com/CVE-2024-51577/): WordPress bpmn.io plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51576](https://insights.sbomify.com/CVE-2024-51576/): WordPress AMP Img Shortcode plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51575](https://insights.sbomify.com/CVE-2024-51575/): WordPress Extender All In One For Elementor plugin <= 1.0.3 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51574](https://insights.sbomify.com/CVE-2024-51574/): WordPress Simple Goods plugin <= 0.1.3 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51573](https://insights.sbomify.com/CVE-2024-51573/): WordPress ML Responsive Audio plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51572](https://insights.sbomify.com/CVE-2024-51572/): WordPress LH QR Codes plugin <= 1.06 - Stored Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51571](https://insights.sbomify.com/CVE-2024-51571/): WordPress MasterBip para Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-51570](https://insights.sbomify.com/CVE-2024-51570/): WordPress Easy Gallery plugin <= 1.4 - SQL Injection vulnerability (high 8.5)
- [CVE-2024-5157](https://insights.sbomify.com/CVE-2024-5157/): Use after free in Chrome (high 8.8)
- [CVE-2024-51569](https://insights.sbomify.com/CVE-2024-51569/): Memory corruption in Apache NimBLE (high 7.5)
- [CVE-2024-51568](https://insights.sbomify.com/CVE-2024-51568/): Command injection in cyberpanel:cyberpanel (critical 10.0)
- [CVE-2024-51567](https://insights.sbomify.com/CVE-2024-51567/): CyberPanel Incorrect Default Permissions (critical 10.0, exploited in the wild)
- [CVE-2024-51566](https://insights.sbomify.com/CVE-2024-51566/): bhyve(8) NVMe driver to guest-induced infinite loops. (medium 6.5)
- [CVE-2024-51565](https://insights.sbomify.com/CVE-2024-51565/): bhyve(8) hda driver buffer over-read (medium 6.5)
- [CVE-2024-51564](https://insights.sbomify.com/CVE-2024-51564/): bhyve(8) infinite loop in the hda audio driver (high 7.5)
- [CVE-2024-51563](https://insights.sbomify.com/CVE-2024-51563/): bhyve(8) virtio_vq_recordon time-of-check to time-of-use race (medium 6.5)
- [CVE-2024-51562](https://insights.sbomify.com/CVE-2024-51562/): bhyve(8) nvme_opc_get_log_page buffer over-read (medium 6.5)
- [CVE-2024-51561](https://insights.sbomify.com/CVE-2024-51561/): Authentication bypass Vulnerability in Aero (critical 9.3)
- [CVE-2024-51560](https://insights.sbomify.com/CVE-2024-51560/): Improper Error Handling Vulnerability in Wave 2.0 (high 7.1)
- [CVE-2024-5156](https://insights.sbomify.com/CVE-2024-5156/): Flatsome <= 3.18.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-51559](https://insights.sbomify.com/CVE-2024-51559/): Improper Access Control Vulnerability in Wave 2.0 (high 7.1)
- [CVE-2024-51558](https://insights.sbomify.com/CVE-2024-51558/): Brute Force Attack Vulnerability in Wave 2.0 (critical 9.3)
- [CVE-2024-51557](https://insights.sbomify.com/CVE-2024-51557/): No Rate Limiting Vulnerability in Wave 2.0 (high 7.1)
- [CVE-2024-51556](https://insights.sbomify.com/CVE-2024-51556/): Sensitive Information Disclosure Vulnerability in Wave 2.0 (high 7.1)
- [CVE-2024-51555](https://insights.sbomify.com/CVE-2024-51555/): Force Change of Default Credentials (critical 9.3)
- [CVE-2024-51554](https://insights.sbomify.com/CVE-2024-51554/): off-by-one-error (high 8.8)
- [CVE-2024-51553](https://insights.sbomify.com/CVE-2024-51553/): Predictable Filename (high 7.0)
- [CVE-2024-51552](https://insights.sbomify.com/CVE-2024-51552/): Weak Password Storage (high 7.1)
- [CVE-2024-51551](https://insights.sbomify.com/CVE-2024-51551/): Default Credentials (critical 9.3)
- [CVE-2024-51550](https://insights.sbomify.com/CVE-2024-51550/): Data Validation / Sanitization (critical 9.3)
- [CVE-2024-5155](https://insights.sbomify.com/CVE-2024-5155/): Inquiry Cart <= 3.4.2 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-51549](https://insights.sbomify.com/CVE-2024-51549/): Absolute Path Traversal (critical 9.3)
- [CVE-2024-51548](https://insights.sbomify.com/CVE-2024-51548/): Dangerous File Upload (high 8.7)
- [CVE-2024-51547](https://insights.sbomify.com/CVE-2024-51547/): Credentials Disclosure - keys (critical 9.3)
- [CVE-2024-51546](https://insights.sbomify.com/CVE-2024-51546/): Credentails Disclosure (high 8.7)
- [CVE-2024-51545](https://insights.sbomify.com/CVE-2024-51545/): Username Enumeration (critical 9.3)
- [CVE-2024-51544](https://insights.sbomify.com/CVE-2024-51544/): Service Control (high 8.8)
- [CVE-2024-51543](https://insights.sbomify.com/CVE-2024-51543/): Information Disclosure (high 8.8)
- [CVE-2024-51542](https://insights.sbomify.com/CVE-2024-51542/): Configuration Download (high 8.8)
- [CVE-2024-51541](https://insights.sbomify.com/CVE-2024-51541/): Local File Inclusion (high 8.8)
- [CVE-2024-51540](https://insights.sbomify.com/CVE-2024-51540/): Integer overflow in ECS (high 8.1)
- [CVE-2024-5154](https://insights.sbomify.com/CVE-2024-5154/): Cri-o: malicious container can create symlink on host (high 8.1)
- [CVE-2024-51539](https://insights.sbomify.com/CVE-2024-51539/): SQL injection in Secure Connect Gateway - Appliance (low 2.3)
- [CVE-2024-51534](https://insights.sbomify.com/CVE-2024-51534/): Path traversal in PowerProtect DD (high 7.1)
- [CVE-2024-51532](https://insights.sbomify.com/CVE-2024-51532/): Command injection in PowerStore (high 7.1)
- [CVE-2024-51530](https://insights.sbomify.com/CVE-2024-51530/): Other in HarmonyOS (medium 6.6)
- [CVE-2024-5153](https://insights.sbomify.com/CVE-2024-5153/): Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion (critical 9.1)
- [CVE-2024-51529](https://insights.sbomify.com/CVE-2024-51529/): Other in HarmonyOS (medium 5.5)
- [CVE-2024-51528](https://insights.sbomify.com/CVE-2024-51528/): Information disclosure in EMUI (medium 4.0)
- [CVE-2024-51527](https://insights.sbomify.com/CVE-2024-51527/): Missing authorization in EMUI (medium 5.1)
- [CVE-2024-51526](https://insights.sbomify.com/CVE-2024-51526/): Missing authorization in HarmonyOS (high 8.2)
- [CVE-2024-51525](https://insights.sbomify.com/CVE-2024-51525/): Missing authorization in HarmonyOS (medium 6.2)
- [CVE-2024-51524](https://insights.sbomify.com/CVE-2024-51524/): Missing authorization in HarmonyOS (medium 4.0)
- [CVE-2024-51523](https://insights.sbomify.com/CVE-2024-51523/): Information disclosure in HarmonyOS (high 7.1)
- [CVE-2024-51522](https://insights.sbomify.com/CVE-2024-51522/): Other in HarmonyOS (medium 6.2)
- [CVE-2024-51521](https://insights.sbomify.com/CVE-2024-51521/): Other in HarmonyOS (medium 5.7)
- [CVE-2024-51520](https://insights.sbomify.com/CVE-2024-51520/): Other in HarmonyOS (medium 5.5)
- [CVE-2024-5152](https://insights.sbomify.com/CVE-2024-5152/): ElementsReady Addons for Elementor <= 6.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-51519](https://insights.sbomify.com/CVE-2024-51519/): Other in HarmonyOS (medium 5.0)
- [CVE-2024-51518](https://insights.sbomify.com/CVE-2024-51518/): Other in HarmonyOS (medium 5.3)
- [CVE-2024-51517](https://insights.sbomify.com/CVE-2024-51517/): Memory corruption in HarmonyOS (medium 5.1)
- [CVE-2024-51516](https://insights.sbomify.com/CVE-2024-51516/): Missing authorization in HarmonyOS (medium 6.2)
- [CVE-2024-51515](https://insights.sbomify.com/CVE-2024-51515/): Race condition in HarmonyOS (medium 6.2)
- [CVE-2024-51514](https://insights.sbomify.com/CVE-2024-51514/): Other in HarmonyOS (medium 5.3)
- [CVE-2024-51513](https://insights.sbomify.com/CVE-2024-51513/): Denial of service in HarmonyOS (medium 5.5)
- [CVE-2024-51512](https://insights.sbomify.com/CVE-2024-51512/): Other in HarmonyOS (medium 6.2)
- [CVE-2024-51511](https://insights.sbomify.com/CVE-2024-51511/): Other in HarmonyOS (medium 6.2)
- [CVE-2024-51510](https://insights.sbomify.com/CVE-2024-51510/): Memory corruption in EMUI (high 7.6)
- [CVE-2024-5151](https://insights.sbomify.com/CVE-2024-5151/): SULly < 4.3.1 - Admin+ Stored XSS (high 7.1)
- [CVE-2024-51509](https://insights.sbomify.com/CVE-2024-51509/): Cross-site scripting in tiki:tiki (medium 4.8)
- [CVE-2024-51508](https://insights.sbomify.com/CVE-2024-51508/): Cross-site scripting in tiki:tiki (medium 4.8)
- [CVE-2024-51507](https://insights.sbomify.com/CVE-2024-51507/): Cross-site scripting in tiki:tiki (medium 4.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/221/