# Vulnerabilities published in 2024


- [CVE-2024-28007](https://insights.sbomify.com/CVE-2024-28007/): Auth bypass in CR2500P (critical 9.8)
- [CVE-2024-28006](https://insights.sbomify.com/CVE-2024-28006/): Auth bypass in CR2500P (medium 5.3)
- [CVE-2024-28005](https://insights.sbomify.com/CVE-2024-28005/): Code injection in CR2500P (medium 4.7)
- [CVE-2024-28004](https://insights.sbomify.com/CVE-2024-28004/): WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-28003](https://insights.sbomify.com/CVE-2024-28003/): WordPress Max Mega Menu plugin <= 3.3 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-28002](https://insights.sbomify.com/CVE-2024-28002/): WordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-28001](https://insights.sbomify.com/CVE-2024-28001/): WordPress Favicon Rotator plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-28000](https://insights.sbomify.com/CVE-2024-28000/): WordPress LiteSpeed Cache plugin <= 6.3.0.1 - Unauthenticated Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-2800](https://insights.sbomify.com/CVE-2024-2800/): Uncontrolled Resource Consumption in GitLab (medium 6.5)
- [CVE-2024-27999](https://insights.sbomify.com/CVE-2024-27999/): WordPress Preview E-mails for WooCommerce plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27998](https://insights.sbomify.com/CVE-2024-27998/): WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27997](https://insights.sbomify.com/CVE-2024-27997/): WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-27996](https://insights.sbomify.com/CVE-2024-27996/): WordPress Survey Maker plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-27995](https://insights.sbomify.com/CVE-2024-27995/): WordPress ARMember plugin <= 4.0.23 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-27994](https://insights.sbomify.com/CVE-2024-27994/): WordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27993](https://insights.sbomify.com/CVE-2024-27993/): WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27992](https://insights.sbomify.com/CVE-2024-27992/): WordPress Link Whisper Free plugin <= 0.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27991](https://insights.sbomify.com/CVE-2024-27991/): WordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-27990](https://insights.sbomify.com/CVE-2024-27990/): WordPress The Moneytizer plugin <= 9.5.20 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-2799](https://insights.sbomify.com/CVE-2024-2799/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 6.4)
- [CVE-2024-27989](https://insights.sbomify.com/CVE-2024-27989/): Cross-site scripting in WP Responsive Tabs horizontal vertical and accordion Tabs (medium 6.5)
- [CVE-2024-27988](https://insights.sbomify.com/CVE-2024-27988/): WordPress WEN Responsive Columns plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-27987](https://insights.sbomify.com/CVE-2024-27987/): WordPress Give plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27986](https://insights.sbomify.com/CVE-2024-27986/): WordPress Livemesh Addons for Elementor Plugin <= 8.3.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-27985](https://insights.sbomify.com/CVE-2024-27985/): WordPress PropertyHive plugin <= 2.0.9 - PHP Object Injection vulnerability (medium 5.4)
- [CVE-2024-27984](https://insights.sbomify.com/CVE-2024-27984/): Path traversal in Avalanche (high 7.1)
- [CVE-2024-27983](https://insights.sbomify.com/CVE-2024-27983/): Race condition in Node (high 8.2)
- [CVE-2024-27982](https://insights.sbomify.com/CVE-2024-27982/): Other in Node (medium 6.5)
- [CVE-2024-27981](https://insights.sbomify.com/CVE-2024-27981/): Command injection in UniFi Network Application (critical 9.8)
- [CVE-2024-27980](https://insights.sbomify.com/CVE-2024-27980/): Command injection in Node (high 8.1)
- [CVE-2024-2798](https://insights.sbomify.com/CVE-2024-2798/): Royal Elementor Addons and Templates <= 1.3.971 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-27978](https://insights.sbomify.com/CVE-2024-27978/): Null dereference in Avalanche (medium 6.5)
- [CVE-2024-27977](https://insights.sbomify.com/CVE-2024-27977/): Path traversal in Avalanche (high 7.1)
- [CVE-2024-27976](https://insights.sbomify.com/CVE-2024-27976/): Path traversal in Avalanche (high 8.8)
- [CVE-2024-27975](https://insights.sbomify.com/CVE-2024-27975/): Use after free in Avalanche (high 8.8)
- [CVE-2024-27974](https://insights.sbomify.com/CVE-2024-27974/): Cross-site request forgery in ApeosPort-IV C2270 (medium 6.3)
- [CVE-2024-27972](https://insights.sbomify.com/CVE-2024-27972/): WordPress WP Fusion Lite plugin <= 3.41.24 - Remote Code Execution (RCE) vulnerability (critical 9.9)
- [CVE-2024-27971](https://insights.sbomify.com/CVE-2024-27971/): WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability (high 8.3)
- [CVE-2024-27970](https://insights.sbomify.com/CVE-2024-27970/): WordPress WP SendFox plugin <= 1.3.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-2797](https://insights.sbomify.com/CVE-2024-2797/): MailerLite – Signup forms (official) <= 1.7.6 - Missing Authorization (medium 5.3)
- [CVE-2024-27969](https://insights.sbomify.com/CVE-2024-27969/): WordPress Free Downloads WooCommerce plugin <= 3.5.8.2 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-27968](https://insights.sbomify.com/CVE-2024-27968/): WordPress Super Page Cache for Cloudflare plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability (high 7.1)
- [CVE-2024-27967](https://insights.sbomify.com/CVE-2024-27967/): WordPress DSGVO All in one for WP plugin <= 4.3 - Cross Site Request Forgery (CSRF) vulnerability (medium 4.3)
- [CVE-2024-27966](https://insights.sbomify.com/CVE-2024-27966/): WordPress Quiz And Survey Master plugin <= 8.2.2 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-27965](https://insights.sbomify.com/CVE-2024-27965/): WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability (medium 5.9)
- [CVE-2024-27964](https://insights.sbomify.com/CVE-2024-27964/): WordPress Zippy plugin <= 1.6.9 - Arbitrary File Upload vulnerability (high 8.8)
- [CVE-2024-27963](https://insights.sbomify.com/CVE-2024-27963/): WordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-27962](https://insights.sbomify.com/CVE-2024-27962/): WordPress wp-mpdf plugin <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27961](https://insights.sbomify.com/CVE-2024-27961/): WordPress AntiSpam for Contact Form 7 plugin <= 0.6.0 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27960](https://insights.sbomify.com/CVE-2024-27960/): WordPress Email Subscription Popup plugin <= 1.2.20 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-2796](https://insights.sbomify.com/CVE-2024-2796/): SSRF in Akana API Platform (critical 9.3)
- [CVE-2024-27959](https://insights.sbomify.com/CVE-2024-27959/): WordPress APIExperts Square for WooCommerce plugin <= 4.2.9 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27958](https://insights.sbomify.com/CVE-2024-27958/): WordPress Visualizer plugin <= 3.10.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27957](https://insights.sbomify.com/CVE-2024-27957/): WordPress Pie Register plugin <= 3.8.3.1 - Unauthenticated Arbitrary File Upload vulnerability (critical 10.0)
- [CVE-2024-27956](https://insights.sbomify.com/CVE-2024-27956/): WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability (critical 9.9)
- [CVE-2024-27955](https://insights.sbomify.com/CVE-2024-27955/): WordPress Automatic plugin <= 3.92.0 - CSRF to Privilege Escalation vulnerability (high 8.8)
- [CVE-2024-27954](https://insights.sbomify.com/CVE-2024-27954/): WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary File Download and SSRF vulnerability (critical 9.3)
- [CVE-2024-27953](https://insights.sbomify.com/CVE-2024-27953/): WordPress Cryptocurrency Widgets – Price Ticker & Coins List Plugin <= 2.6.8 is vulnerable to Broken Access Control (medium 4.7)
- [CVE-2024-27952](https://insights.sbomify.com/CVE-2024-27952/): WordPress Advanced Sermons plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-27951](https://insights.sbomify.com/CVE-2024-27951/): WordPress Multiple Page Generator Plugin <= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability (critical 9.1)
- [CVE-2024-27950](https://insights.sbomify.com/CVE-2024-27950/): WordPress Sirv plugin <= 7.2.0 - Broken Access Control vulnerability (medium 5.4)
- [CVE-2024-2795](https://insights.sbomify.com/CVE-2024-2795/): SEO SIMPLE PACK <= 3.2.1 - Information Exposure (medium 5.3)
- [CVE-2024-27949](https://insights.sbomify.com/CVE-2024-27949/): WordPress Sirv plugin <= 7.2.0 - Server Side Request Forgery (SSRF) vulnerability (medium 5.4)
- [CVE-2024-27948](https://insights.sbomify.com/CVE-2024-27948/): WordPress Atahualpa Theme <= 3.7.24 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2024-27947](https://insights.sbomify.com/CVE-2024-27947/): Information disclosure in RUGGEDCOM CROSSBOW (medium 5.3)
- [CVE-2024-27946](https://insights.sbomify.com/CVE-2024-27946/): Path traversal in RUGGEDCOM CROSSBOW (medium 6.5)
- [CVE-2024-27945](https://insights.sbomify.com/CVE-2024-27945/): File upload in RUGGEDCOM CROSSBOW (high 7.2)
- [CVE-2024-27944](https://insights.sbomify.com/CVE-2024-27944/): File upload in RUGGEDCOM CROSSBOW (high 7.2)
- [CVE-2024-27943](https://insights.sbomify.com/CVE-2024-27943/): File upload in RUGGEDCOM CROSSBOW (high 7.2)
- [CVE-2024-27942](https://insights.sbomify.com/CVE-2024-27942/): Missing authorization in RUGGEDCOM CROSSBOW (high 7.5)
- [CVE-2024-27941](https://insights.sbomify.com/CVE-2024-27941/): SQL injection in RUGGEDCOM CROSSBOW (high 8.8)
- [CVE-2024-27940](https://insights.sbomify.com/CVE-2024-27940/): SQL injection in RUGGEDCOM CROSSBOW (high 8.8)
- [CVE-2024-2794](https://insights.sbomify.com/CVE-2024-2794/): Gutenberg Block Editor Toolkit – EditorsKit <= 1.40.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-27939](https://insights.sbomify.com/CVE-2024-27939/): File upload in RUGGEDCOM CROSSBOW (critical 9.8)
- [CVE-2024-27938](https://insights.sbomify.com/CVE-2024-27938/): SMTP Smuggling in Postal (medium 5.3)
- [CVE-2024-27937](https://insights.sbomify.com/CVE-2024-27937/): glpi Users emails enumeration (medium 6.5)
- [CVE-2024-27936](https://insights.sbomify.com/CVE-2024-27936/): Deno interactive permission prompt spoofing via improper ANSI stripping (high 8.8)
- [CVE-2024-27935](https://insights.sbomify.com/CVE-2024-27935/): Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination (high 7.2)
- [CVE-2024-27934](https://insights.sbomify.com/CVE-2024-27934/): *const c_void / ExternalPointer unsoundness leading to use-after-free (high 8.4)
- [CVE-2024-27933](https://insights.sbomify.com/CVE-2024-27933/): Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypass (high 8.3)
- [CVE-2024-27932](https://insights.sbomify.com/CVE-2024-27932/): Deno's improper suffix match testing for DENO_AUTH_TOKENS (medium 4.6)
- [CVE-2024-27931](https://insights.sbomify.com/CVE-2024-27931/): Insufficient permission checking in `Deno.makeTemp*` APIs (medium 5.8)
- [CVE-2024-27930](https://insights.sbomify.com/CVE-2024-27930/): Sensitive fields access through dropdowns in GLPI (medium 6.5)
- [CVE-2024-2793](https://insights.sbomify.com/CVE-2024-2793/): Cross-site scripting in Atarim – Visual Feedback, Review & AI Collaboration (high 7.2)
- [CVE-2024-27929](https://insights.sbomify.com/CVE-2024-27929/): Use After Free in SixLabors.ImageSharp (high 7.1)
- [CVE-2024-27928](https://insights.sbomify.com/CVE-2024-27928/): Vantage6: 2FA can be circumvented with hacked email access (medium 5.9)
- [CVE-2024-27927](https://insights.sbomify.com/CVE-2024-27927/): RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4 (medium 6.5)
- [CVE-2024-27926](https://insights.sbomify.com/CVE-2024-27926/): RSSHub Cross-site Scripting vulnerability caused by internal media proxy (medium 6.1)
- [CVE-2024-27923](https://insights.sbomify.com/CVE-2024-27923/): Remote Code Execution by uploading a phar file using frontmatter (high 8.8)
- [CVE-2024-27922](https://insights.sbomify.com/CVE-2024-27922/): HTTP Handling Vulnerability in the Bare server (critical 9.8)
- [CVE-2024-27921](https://insights.sbomify.com/CVE-2024-27921/): Grav File Upload Path Traversal vulnerability (high 8.8)
- [CVE-2024-27920](https://insights.sbomify.com/CVE-2024-27920/): Unsigned code template execution through workflows in projectdiscovery/nuclei (high 7.4)
- [CVE-2024-2792](https://insights.sbomify.com/CVE-2024-2792/): Cross-site scripting in Addon Elements for Elementor (formerly Elementor Addon Elements) (medium 6.4)
- [CVE-2024-27919](https://insights.sbomify.com/CVE-2024-27919/): HTTP/2: memory exhaustion due to CONTINUATION frame flood (high 7.5)
- [CVE-2024-27918](https://insights.sbomify.com/CVE-2024-27918/): Coder's OIDC authentication allows email with partially matching domain to register (high 8.2)
- [CVE-2024-27917](https://insights.sbomify.com/CVE-2024-27917/): Shopware's session is persistent in Cache for 404 pages (high 7.5)
- [CVE-2024-27916](https://insights.sbomify.com/CVE-2024-27916/): `GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user (high 7.1)
- [CVE-2024-27915](https://insights.sbomify.com/CVE-2024-27915/): Sulu grants access to pages regardless of role permissions (medium 6.8)
- [CVE-2024-27914](https://insights.sbomify.com/CVE-2024-27914/): Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI (medium 5.3)
- [CVE-2024-27913](https://insights.sbomify.com/CVE-2024-27913/): Denial of service in frrouting:frrouting (medium 6.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/402/