# Vulnerabilities published in 2024


- [CVE-2024-49238](https://insights.sbomify.com/CVE-2024-49238/): WordPress ADIF Log Search Widget plugin <= 1.0f - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49237](https://insights.sbomify.com/CVE-2024-49237/): WordPress Ahmeti Wp Timeline plugin <= 5.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-49236](https://insights.sbomify.com/CVE-2024-49236/): WordPress Crazy Call To Action Box plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49235](https://insights.sbomify.com/CVE-2024-49235/): WordPress Contact Forms, Live Support, CRM, Video Messages plugin <= 1.10.2 - Sensitive Data Exposure vulnerability (high 7.5)
- [CVE-2024-49234](https://insights.sbomify.com/CVE-2024-49234/): WordPress Plexx Elementor Extension plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49233](https://insights.sbomify.com/CVE-2024-49233/): WordPress MAS Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49232](https://insights.sbomify.com/CVE-2024-49232/): WordPress El mejor Cluster plugin <= 1.1.15 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49231](https://insights.sbomify.com/CVE-2024-49231/): WordPress WordPress Video plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49230](https://insights.sbomify.com/CVE-2024-49230/): WordPress Ajax Custom CSS/JS plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-4923](https://insights.sbomify.com/CVE-2024-4923/): Codezips E-Commerce Site addproduct.php unrestricted upload (medium 5.3)
- [CVE-2024-49229](https://insights.sbomify.com/CVE-2024-49229/): WordPress Better Author Bio plugin <= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49228](https://insights.sbomify.com/CVE-2024-49228/): WordPress bVerse Convert plugin <= 1.3.7.1 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49227](https://insights.sbomify.com/CVE-2024-49227/): WordPress Free Stock Photos Foter plugin <= 1.5.4 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2024-49226](https://insights.sbomify.com/CVE-2024-49226/): WordPress TAKETIN To WP Membership plugin <= 2.8.17 - PHP Object Injection vulnerability (high 8.8)
- [CVE-2024-49225](https://insights.sbomify.com/CVE-2024-49225/): WordPress wpPricing Builder plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-49224](https://insights.sbomify.com/CVE-2024-49224/): WordPress Mitm Bug Tracker plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-49223](https://insights.sbomify.com/CVE-2024-49223/): WordPress CJ Change Howdy plugin <= 3.3.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-49222](https://insights.sbomify.com/CVE-2024-49222/): WordPress WPGuppy plugin <= 1.1.0 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-49221](https://insights.sbomify.com/CVE-2024-49221/): WordPress cSlider plugin <= 2.4.2 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-49220](https://insights.sbomify.com/CVE-2024-49220/): WordPress Cookie Scanner plugin <= 1.1 - CSRF to Stored XSS vulnerability (high 7.1)
- [CVE-2024-4922](https://insights.sbomify.com/CVE-2024-4922/): SourceCodester Simple Image Stack Website cross site scripting (medium 5.3)
- [CVE-2024-49219](https://insights.sbomify.com/CVE-2024-49219/): WordPress RS-Members plugin <= 1.0.3 - Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-49218](https://insights.sbomify.com/CVE-2024-49218/): WordPress Recently plugin <= 1.1 - PHP Object Injection vulnerability (critical 9.8)
- [CVE-2024-49217](https://insights.sbomify.com/CVE-2024-49217/): WordPress Adding drop down roles in registration plugin <= 1.1 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-49216](https://insights.sbomify.com/CVE-2024-49216/): WordPress Feed Comments Number plugin <= 0.2.1 - Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-49214](https://insights.sbomify.com/CVE-2024-49214/): QUIC in HAProxy 3.1.x before 3.1-dev7, 3.0.x before 3.0.5, and 2.9.x before 2.9.11 allows opening a 0-RTT session with a spoofed IP address. (medium 5.3)
- [CVE-2024-49211](https://insights.sbomify.com/CVE-2024-49211/): Cross-site scripting in archerirm:archer (medium 5.2)
- [CVE-2024-49210](https://insights.sbomify.com/CVE-2024-49210/): Cross-site scripting in archerirm:archer (medium 5.2)
- [CVE-2024-4921](https://insights.sbomify.com/CVE-2024-4921/): SourceCodester Employee and Visitor Gate Pass Logging System unrestricted upload (medium 5.3)
- [CVE-2024-49209](https://insights.sbomify.com/CVE-2024-49209/): Missing authorization in archerirm:archer (medium 6.5)
- [CVE-2024-49208](https://insights.sbomify.com/CVE-2024-49208/): Missing authorization in archerirm:archer (medium 5.9)
- [CVE-2024-49203](https://insights.sbomify.com/CVE-2024-49203/): Querydsl vulnerable to HQL injection through orderBy (not scored)
- [CVE-2024-49202](https://insights.sbomify.com/CVE-2024-49202/): Keyfactor Command before 12.5.0 has Incorrect Access Control: access tokens are over permissioned, aka 64099. (high 7.6)
- [CVE-2024-49201](https://insights.sbomify.com/CVE-2024-49201/): Keyfactor Remote File Orchestrator (aka remote-file-orchestrator) 2.8 before 2.8.1 allows Information Disclosure: sensitive information coul (medium 4.3)
- [CVE-2024-49200](https://insights.sbomify.com/CVE-2024-49200/): Memory corruption in insyde:kernel (medium 6.4)
- [CVE-2024-4920](https://insights.sbomify.com/CVE-2024-4920/): SourceCodester Online Discussion Forum Site registerH.php unrestricted upload (medium 6.9)
- [CVE-2024-49197](https://insights.sbomify.com/CVE-2024-49197/): Memory corruption in samsung:exynos 1080 firmware (medium 6.5)
- [CVE-2024-49196](https://insights.sbomify.com/CVE-2024-49196/): Memory corruption in samsung:exynos 1480 firmware (high 7.5)
- [CVE-2024-49195](https://insights.sbomify.com/CVE-2024-49195/): Memory corruption in trustedfirmware:mbed tls (critical 9.8)
- [CVE-2024-49194](https://insights.sbomify.com/CVE-2024-49194/): Databricks JDBC Driver Command Injection vulnerability (high 7.3)
- [CVE-2024-49193](https://insights.sbomify.com/CVE-2024-49193/): Zendesk before 2024-07-02 allows remote attackers to read ticket history via e-mail spoofing, because Cc fields are extracted from incoming (high 7.5)
- [CVE-2024-4919](https://insights.sbomify.com/CVE-2024-4919/): Campcodes Online Examination System addCourseExe.php sql injection (medium 5.3)
- [CVE-2024-4918](https://insights.sbomify.com/CVE-2024-4918/): Campcodes Online Examination System updateQuestion.php sql injection (medium 5.3)
- [CVE-2024-4917](https://insights.sbomify.com/CVE-2024-4917/): Campcodes Online Examination System submitAnswerExe.php sql injection (medium 5.3)
- [CVE-2024-4916](https://insights.sbomify.com/CVE-2024-4916/): Campcodes Online Examination System selExamAttemptExe.php sql injection (medium 5.3)
- [CVE-2024-4915](https://insights.sbomify.com/CVE-2024-4915/): Campcodes Online Examination System result.php sql injection (medium 5.3)
- [CVE-2024-49147](https://insights.sbomify.com/CVE-2024-49147/): Microsoft Update Catalog Elevation of Privilege Vulnerability (critical 9.3)
- [CVE-2024-49142](https://insights.sbomify.com/CVE-2024-49142/): Microsoft Access Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-4914](https://insights.sbomify.com/CVE-2024-4914/): Campcodes Online Examination System ranking-exam.php sql injection (medium 5.3)
- [CVE-2024-49138](https://insights.sbomify.com/CVE-2024-49138/): Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow (high 7.8, exploited in the wild)
- [CVE-2024-49132](https://insights.sbomify.com/CVE-2024-49132/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-4913](https://insights.sbomify.com/CVE-2024-4913/): Campcodes Online Examination System exam.php sql injection (medium 5.3)
- [CVE-2024-49129](https://insights.sbomify.com/CVE-2024-49129/): Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability (high 7.5)
- [CVE-2024-49128](https://insights.sbomify.com/CVE-2024-49128/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49127](https://insights.sbomify.com/CVE-2024-49127/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49126](https://insights.sbomify.com/CVE-2024-49126/): Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49125](https://insights.sbomify.com/CVE-2024-49125/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-49124](https://insights.sbomify.com/CVE-2024-49124/): Lightweight Directory Access Protocol (LDAP) Client Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49123](https://insights.sbomify.com/CVE-2024-49123/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49122](https://insights.sbomify.com/CVE-2024-49122/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49121](https://insights.sbomify.com/CVE-2024-49121/): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (high 7.5)
- [CVE-2024-49120](https://insights.sbomify.com/CVE-2024-49120/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-4912](https://insights.sbomify.com/CVE-2024-4912/): Campcodes Online Examination System addExamExe.php sql injection (medium 5.3)
- [CVE-2024-49119](https://insights.sbomify.com/CVE-2024-49119/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49118](https://insights.sbomify.com/CVE-2024-49118/): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49117](https://insights.sbomify.com/CVE-2024-49117/): Windows Hyper-V Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-49116](https://insights.sbomify.com/CVE-2024-49116/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49115](https://insights.sbomify.com/CVE-2024-49115/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49114](https://insights.sbomify.com/CVE-2024-49114/): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-49113](https://insights.sbomify.com/CVE-2024-49113/): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (high 7.5)
- [CVE-2024-49112](https://insights.sbomify.com/CVE-2024-49112/): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (critical 9.8)
- [CVE-2024-49111](https://insights.sbomify.com/CVE-2024-49111/): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2024-49110](https://insights.sbomify.com/CVE-2024-49110/): Windows Mobile Broadband Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2024-4911](https://insights.sbomify.com/CVE-2024-4911/): Campcodes Complete Web-Based School Management System student_exam_mark_update_form.php sql injection (medium 5.3)
- [CVE-2024-49109](https://insights.sbomify.com/CVE-2024-49109/): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2024-49108](https://insights.sbomify.com/CVE-2024-49108/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49107](https://insights.sbomify.com/CVE-2024-49107/): WmsRepair Service Elevation of Privilege Vulnerability (high 7.3)
- [CVE-2024-49106](https://insights.sbomify.com/CVE-2024-49106/): Windows Remote Desktop Services Remote Code Execution Vulnerability (high 8.1)
- [CVE-2024-49105](https://insights.sbomify.com/CVE-2024-49105/): Remote Desktop Client Remote Code Execution Vulnerability (high 8.4)
- [CVE-2024-49104](https://insights.sbomify.com/CVE-2024-49104/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-49103](https://insights.sbomify.com/CVE-2024-49103/): Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability (medium 4.3)
- [CVE-2024-49102](https://insights.sbomify.com/CVE-2024-49102/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-49101](https://insights.sbomify.com/CVE-2024-49101/): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2024-4910](https://insights.sbomify.com/CVE-2024-4910/): Campcodes Complete Web-Based School Management System student_exam_mark_insert_form1.php sql injection (medium 5.3)
- [CVE-2024-49099](https://insights.sbomify.com/CVE-2024-49099/): Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability (medium 4.3)
- [CVE-2024-49098](https://insights.sbomify.com/CVE-2024-49098/): Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability (medium 4.3)
- [CVE-2024-49097](https://insights.sbomify.com/CVE-2024-49097/): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2024-49096](https://insights.sbomify.com/CVE-2024-49096/): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (high 7.5)
- [CVE-2024-49095](https://insights.sbomify.com/CVE-2024-49095/): Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability (high 7.0)
- [CVE-2024-49094](https://insights.sbomify.com/CVE-2024-49094/): Wireless Wide Area Network Service (WwanSvc) Elevation of Privilege Vulnerability (medium 6.6)
- [CVE-2024-49093](https://insights.sbomify.com/CVE-2024-49093/): Windows Resilient File System (ReFS) Elevation of Privilege Vulnerability (high 8.8)
- [CVE-2024-49092](https://insights.sbomify.com/CVE-2024-49092/): Windows Mobile Broadband Driver Elevation of Privilege Vulnerability (medium 6.8)
- [CVE-2024-49091](https://insights.sbomify.com/CVE-2024-49091/): Windows Domain Name Service Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-49090](https://insights.sbomify.com/CVE-2024-49090/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-4909](https://insights.sbomify.com/CVE-2024-4909/): Campcodes Complete Web-Based School Management System student_due_payment.php sql injection (medium 5.3)
- [CVE-2024-49089](https://insights.sbomify.com/CVE-2024-49089/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 7.2)
- [CVE-2024-49088](https://insights.sbomify.com/CVE-2024-49088/): Windows Common Log File System Driver Elevation of Privilege Vulnerability (high 7.8)
- [CVE-2024-49087](https://insights.sbomify.com/CVE-2024-49087/): Windows Mobile Broadband Driver Information Disclosure Vulnerability (medium 4.6)
- [CVE-2024-49086](https://insights.sbomify.com/CVE-2024-49086/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-49085](https://insights.sbomify.com/CVE-2024-49085/): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/240/