# Vulnerabilities published in 2024


- [CVE-2024-24890](https://insights.sbomify.com/CVE-2024-24890/): Command injection in ioprobe of gala-gopher (high 7.8)
- [CVE-2024-2489](https://insights.sbomify.com/CVE-2024-2489/): Tenda AC18 SetNetControlList formSetQosBand stack-based overflow (high 8.8)
- [CVE-2024-24889](https://insights.sbomify.com/CVE-2024-24889/): WordPress All 404 Pages Redirect to Homepage Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.1)
- [CVE-2024-24888](https://insights.sbomify.com/CVE-2024-24888/): WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.2.25 - Server Side Request Forgery (SSRF) vulnerability (medium 6.4)
- [CVE-2024-24887](https://insights.sbomify.com/CVE-2024-24887/): WordPress Contest Gallery Plugin <= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF) (medium 5.4)
- [CVE-2024-24886](https://insights.sbomify.com/CVE-2024-24886/): WordPress Product Labels For Woocommerce Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-24885](https://insights.sbomify.com/CVE-2024-24885/): WordPress Woocommerce Vietnam Checkout Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-24884](https://insights.sbomify.com/CVE-2024-24884/): WordPress Contact Form 7 Connector Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-24883](https://insights.sbomify.com/CVE-2024-24883/): WordPress Prime Slider plugin <= 3.11.10 - Broken Access Control on Duplicate Post vulnerability (medium 4.3)
- [CVE-2024-24882](https://insights.sbomify.com/CVE-2024-24882/): WordPress LMS by Masteriyo plugin <= 1.7.2 - Privilege Escalation vulnerability (critical 9.8)
- [CVE-2024-24881](https://insights.sbomify.com/CVE-2024-24881/): WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24880](https://insights.sbomify.com/CVE-2024-24880/): WordPress Apollo13 Framework Extensions Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-2488](https://insights.sbomify.com/CVE-2024-2488/): Tenda AC18 SetPptpServerCfg formSetPPTPServer stack-based overflow (high 8.8)
- [CVE-2024-24879](https://insights.sbomify.com/CVE-2024-24879/): WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24878](https://insights.sbomify.com/CVE-2024-24878/): WordPress Portugal CTT Tracking for WooCommerce plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-24877](https://insights.sbomify.com/CVE-2024-24877/): WordPress Wonder Slider Lite Plugin <= 13.9 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24876](https://insights.sbomify.com/CVE-2024-24876/): WordPress Admin Menu Editor Plugin <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-24875](https://insights.sbomify.com/CVE-2024-24875/): WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-24874](https://insights.sbomify.com/CVE-2024-24874/): WordPress Polls CP plugin <= 1.0.71 - Content Injection vulnerability (medium 5.3)
- [CVE-2024-24873](https://insights.sbomify.com/CVE-2024-24873/): WordPress Polls CP plugin <= 1.0.71 - Polls Limitation Bypass vulnerability (medium 5.3)
- [CVE-2024-24872](https://insights.sbomify.com/CVE-2024-24872/): WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-24871](https://insights.sbomify.com/CVE-2024-24871/): WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-24870](https://insights.sbomify.com/CVE-2024-24870/): WordPress Advanced iFrame Plugin <= 2023.10 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-2487](https://insights.sbomify.com/CVE-2024-2487/): Tenda AC18 SetOnlineDevName formSetDeviceName stack-based overflow (high 8.8)
- [CVE-2024-24869](https://insights.sbomify.com/CVE-2024-24869/): WordPress Total Upkeep plugin <= 1.15.8 - Arbitrary File Download vulnerability (high 7.5)
- [CVE-2024-24868](https://insights.sbomify.com/CVE-2024-24868/): WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL Injection (high 8.5)
- [CVE-2024-24867](https://insights.sbomify.com/CVE-2024-24867/): WordPress WP Stats Manager plugin <= 6.9.4 - Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-24866](https://insights.sbomify.com/CVE-2024-24866/): WordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24865](https://insights.sbomify.com/CVE-2024-24865/): WordPress Scroll Triggered Box Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-24864](https://insights.sbomify.com/CVE-2024-24864/): Race condition vulnerability in Linux kernel media/dvb-core in dvbdmx_write() (medium 5.3)
- [CVE-2024-24861](https://insights.sbomify.com/CVE-2024-24861/): Race condition vulnerability in Linux kernel media/xc4000 xc4000_get_frequency() (low 3.3)
- [CVE-2024-24860](https://insights.sbomify.com/CVE-2024-24860/): Race condition vulnerability in Linux kernel bluetooth driver in {min,max}_key_size_set() (medium 4.6)
- [CVE-2024-2486](https://insights.sbomify.com/CVE-2024-2486/): Tenda AC18 QuickIndex formQuickIndex stack-based overflow (high 8.8)
- [CVE-2024-24859](https://insights.sbomify.com/CVE-2024-24859/): Race condition vulnerability in Linux kernel bluetooth sniff_{min,max}_interval_set() (medium 4.6)
- [CVE-2024-24858](https://insights.sbomify.com/CVE-2024-24858/): Race condition vulnerability in Linux kernel net/bluetooth in {conn,adv}_{min,max}_interval_set() (medium 4.6)
- [CVE-2024-24857](https://insights.sbomify.com/CVE-2024-24857/): Race condition vulnerability in Linux kernel bluetooth in conn_info_{min,max}_age_set() (medium 4.6)
- [CVE-2024-24856](https://insights.sbomify.com/CVE-2024-24856/): NULL pointer deference in acpi_db_convert_to_package of Linux acpi module (medium 5.3)
- [CVE-2024-24855](https://insights.sbomify.com/CVE-2024-24855/): Race condition vulnerability in Linux kernel scsi device driver lpfc_unregister_fcf_rescan() (medium 5.0)
- [CVE-2024-24853](https://insights.sbomify.com/CVE-2024-24853/): Privilege escalation in Intel(R) Processor (high 7.3)
- [CVE-2024-24852](https://insights.sbomify.com/CVE-2024-24852/): Privilege escalation in Intel(R) Ethernet Adapter Complete Driver Pack (medium 5.4)
- [CVE-2024-24851](https://insights.sbomify.com/CVE-2024-24851/): Memory corruption in P3-550E (high 7.5)
- [CVE-2024-24850](https://insights.sbomify.com/CVE-2024-24850/): WordPress Quicksand Post Filter jQuery plugin <= 3.1.1 - Broken Access Control vulnerability (medium 5.3)
- [CVE-2024-2485](https://insights.sbomify.com/CVE-2024-2485/): Tenda AC18 SetSpeedWan formSetSpeedWan stack-based overflow (high 8.8)
- [CVE-2024-24849](https://insights.sbomify.com/CVE-2024-24849/): WordPress Quicksand Post Filter jQuery Plugin Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-24848](https://insights.sbomify.com/CVE-2024-24848/): WordPress PT Sign Ups Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24847](https://insights.sbomify.com/CVE-2024-24847/): WordPress CalculatorPro Calculators Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24846](https://insights.sbomify.com/CVE-2024-24846/): WordPress Mighty Addons for Elementor Plugin <= 1.9.3 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-24845](https://insights.sbomify.com/CVE-2024-24845/): WordPress Post Thumbnail Editor plugin <= 2.4.8 - Unauthenticated Sensitive Data Exposure vulnerability (medium 5.3)
- [CVE-2024-24844](https://insights.sbomify.com/CVE-2024-24844/): WordPress PowerPack Pro for Elementor plugin <= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerability (high 7.5)
- [CVE-2024-24843](https://insights.sbomify.com/CVE-2024-24843/): WordPress PowerPack Pro for Elementor Plugin < 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF) (high 7.1)
- [CVE-2024-24842](https://insights.sbomify.com/CVE-2024-24842/): Deserialization in Knowledge Base for Documentation, FAQs with AI Assistance (high 8.7)
- [CVE-2024-24841](https://insights.sbomify.com/CVE-2024-24841/): WordPress Add Customer for WooCommerce Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-24840](https://insights.sbomify.com/CVE-2024-24840/): WordPress Element Pack Elementor Addons plugin <= 5.4.11 - Broken Access Control on Duplicate Post vulnerability (medium 4.3)
- [CVE-2024-2484](https://insights.sbomify.com/CVE-2024-2484/): Cross-site scripting in Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More (medium 6.4)
- [CVE-2024-24839](https://insights.sbomify.com/CVE-2024-24839/): WordPress Structured Content Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-24838](https://insights.sbomify.com/CVE-2024-24838/): WordPress Five Star Restaurant Reviews Plugin <= 2.3.5 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-24837](https://insights.sbomify.com/CVE-2024-24837/): Cross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress plugins (medium 4.3)
- [CVE-2024-24836](https://insights.sbomify.com/CVE-2024-24836/): WordPress GDPR Data Request Form Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-24835](https://insights.sbomify.com/CVE-2024-24835/): WordPress BEAR plugin <= 1.1.4 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-24834](https://insights.sbomify.com/CVE-2024-24834/): WordPress BEAR Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-24833](https://insights.sbomify.com/CVE-2024-24833/): WordPress Happy Addons for Elementor plugin <= 3.10.1 - Broken Access Control on Post Clone vulnerability (medium 4.3)
- [CVE-2024-24832](https://insights.sbomify.com/CVE-2024-24832/): WordPress EventPrime plugin <= 3.3.9 - Broken Access Control vulnerability (high 8.2)
- [CVE-2024-24831](https://insights.sbomify.com/CVE-2024-24831/): WordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerability (medium 6.5)
- [CVE-2024-24830](https://insights.sbomify.com/CVE-2024-24830/): OpenObserve Privilege Escalation Vulnerability in Users API (critical 10.0)
- [CVE-2024-2483](https://insights.sbomify.com/CVE-2024-2483/): Surya2Developer Hostel Management Service Password Change change-password.php cross-site request forgery (medium 4.3)
- [CVE-2024-24829](https://insights.sbomify.com/CVE-2024-24829/): SSRF in Sentry via Phabricator integration (medium 4.3)
- [CVE-2024-24828](https://insights.sbomify.com/CVE-2024-24828/): Local Privilege Escalation in execuatables bundled by pkg (medium 6.6)
- [CVE-2024-24827](https://insights.sbomify.com/CVE-2024-24827/): No rate limits on POST /uploads endpoint in Discourse (medium 5.3)
- [CVE-2024-24826](https://insights.sbomify.com/CVE-2024-24826/): Out-of-bounds read in QuickTimeVideo::NikonTagsDecoder in Exiv2 (medium 5.5)
- [CVE-2024-24825](https://insights.sbomify.com/CVE-2024-24825/): TokenManager not checking permissions on cached tokens in DIRAC (critical 9.1)
- [CVE-2024-24824](https://insights.sbomify.com/CVE-2024-24824/): graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request (high 8.8)
- [CVE-2024-24823](https://insights.sbomify.com/CVE-2024-24823/): graylog2-server Session Fixation vulnerability through cookie injection (medium 5.7)
- [CVE-2024-24822](https://insights.sbomify.com/CVE-2024-24822/): Pimcore Admin Classic Bundle permissions are not getting checked when working with tags (medium 6.5)
- [CVE-2024-24821](https://insights.sbomify.com/CVE-2024-24821/): Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer (high 8.8)
- [CVE-2024-24820](https://insights.sbomify.com/CVE-2024-24820/): Icinga Director configuration is susceptible to Cross-Site Request Forgery (high 8.3)
- [CVE-2024-2482](https://insights.sbomify.com/CVE-2024-2482/): Surya2Developer Hostel Management Service HTTP POST Request check_availability.php observable response discrepancy (low 3.7)
- [CVE-2024-24819](https://insights.sbomify.com/CVE-2024-24819/): icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF (medium 5.3)
- [CVE-2024-24818](https://insights.sbomify.com/CVE-2024-24818/): EspoCRM weakness in "Forgot password" (medium 5.9)
- [CVE-2024-24817](https://insights.sbomify.com/CVE-2024-24817/): User can see invitees in events created in PMs and private categories (medium 4.3)
- [CVE-2024-24816](https://insights.sbomify.com/CVE-2024-24816/): Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature (medium 6.1)
- [CVE-2024-24815](https://insights.sbomify.com/CVE-2024-24815/): CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection (medium 6.1)
- [CVE-2024-24814](https://insights.sbomify.com/CVE-2024-24814/): Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc (high 7.5)
- [CVE-2024-24813](https://insights.sbomify.com/CVE-2024-24813/): Frappe SQL Injection from reporting logic (high 7.5)
- [CVE-2024-24812](https://insights.sbomify.com/CVE-2024-24812/): Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages (medium 5.4)
- [CVE-2024-24811](https://insights.sbomify.com/CVE-2024-24811/): Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution (critical 9.8)
- [CVE-2024-24810](https://insights.sbomify.com/CVE-2024-24810/): WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges (high 8.3)
- [CVE-2024-2481](https://insights.sbomify.com/CVE-2024-2481/): Surya2Developer Hostel Management System manage-students.php access control (medium 6.5)
- [CVE-2024-24809](https://insights.sbomify.com/CVE-2024-24809/): Traccar vulnerable to Path Traversal: 'dir/../../filename' and Unrestricted Upload of File with Dangerous Type (high 8.5)
- [CVE-2024-24808](https://insights.sbomify.com/CVE-2024-24808/): pyLoad open redirect vulnerability due to improper validation of the is_safe_url function (medium 4.7)
- [CVE-2024-24807](https://insights.sbomify.com/CVE-2024-24807/): Sulu is vulnerable to HTML Injection via Autocomplete Suggestion (low 2.7)
- [CVE-2024-24806](https://insights.sbomify.com/CVE-2024-24806/): Improper Domain Lookup that potentially leads to SSRF attacks in libuv (high 7.3)
- [CVE-2024-24805](https://insights.sbomify.com/CVE-2024-24805/): WordPress WP Dummy Content Generator plugin <= 3.1.2 - Broken Access Control vulnerability (medium 4.3)
- [CVE-2024-24804](https://insights.sbomify.com/CVE-2024-24804/): WordPress MW WP Form Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-24803](https://insights.sbomify.com/CVE-2024-24803/): WordPress Ultra Companion Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-24802](https://insights.sbomify.com/CVE-2024-24802/): WordPress JTRT Responsive Tables Plugin <= 4.1.9 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)
- [CVE-2024-24801](https://insights.sbomify.com/CVE-2024-24801/): WordPress OWL Carousel Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS) (medium 6.5)
- [CVE-2024-24800](https://insights.sbomify.com/CVE-2024-24800/): WordPress Product Feed PRO for WooCommerce plugin <= 13.2.5 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)
- [CVE-2024-2480](https://insights.sbomify.com/CVE-2024-2480/): MHA Sistemas arMHAzena Executa Page sql injection (medium 6.3)
- [CVE-2024-24799](https://insights.sbomify.com/CVE-2024-24799/): WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerability (medium 6.5)
- [CVE-2024-24798](https://insights.sbomify.com/CVE-2024-24798/): WordPress Debug Plugin <= 1.10 is vulnerable to Cross Site Request Forgery (CSRF) (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/427/