# Vulnerabilities published in 2024


- [CVE-2024-1807](https://insights.sbomify.com/CVE-2024-1807/): Product Sort and Display for WooCommerce <= 2.4.1 - Missing Authorization (medium 6.5)
- [CVE-2024-1806](https://insights.sbomify.com/CVE-2024-1806/): Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 6.4)
- [CVE-2024-1805](https://insights.sbomify.com/CVE-2024-1805/): WPBakery Visual Composer <= 7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button onclick attribute (medium 6.4)
- [CVE-2024-1804](https://insights.sbomify.com/CVE-2024-1804/): Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_import_from_xml (medium 4.3)
- [CVE-2024-1803](https://insights.sbomify.com/CVE-2024-1803/): Missing authorization in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more (medium 4.3)
- [CVE-2024-1802](https://insights.sbomify.com/CVE-2024-1802/): Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more (medium 6.4)
- [CVE-2024-1801](https://insights.sbomify.com/CVE-2024-1801/): Progress Telerik Reporting Local Deserialization Vulnerability (high 7.7)
- [CVE-2024-1800](https://insights.sbomify.com/CVE-2024-1800/): Progress Telerik Report Server Deserialization (critical 9.9)
- [CVE-2024-1799](https://insights.sbomify.com/CVE-2024-1799/): SQL injection in GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress (high 8.8)
- [CVE-2024-1798](https://insights.sbomify.com/CVE-2024-1798/): Tutor LMS – Migration Tool <= 2.2.0 - Missing Authorization in tutor_lp_export_xml (medium 5.3)
- [CVE-2024-1797](https://insights.sbomify.com/CVE-2024-1797/): SQL injection in WP ULike – Like & Dislike Buttons for Engagement and Feedback (high 8.8)
- [CVE-2024-1796](https://insights.sbomify.com/CVE-2024-1796/): Cross-site scripting in HUSKY – Products Filter Professional for WooCommerce (medium 6.4)
- [CVE-2024-1795](https://insights.sbomify.com/CVE-2024-1795/): HUSKY – Products Filter for WooCommerce Professional <= 1.3.5.2 - Authenticated (Contributor+) SQL Injection (high 8.8)
- [CVE-2024-1794](https://insights.sbomify.com/CVE-2024-1794/): Forminator <= 1.29.0 - Unauthenticated Stored Cross-Site Scripting via File Upload (high 7.2)
- [CVE-2024-1793](https://insights.sbomify.com/CVE-2024-1793/): SQL injection in AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth (high 7.2)
- [CVE-2024-1792](https://insights.sbomify.com/CVE-2024-1792/): CMB2 <= 2.10.1 - Authenticated (Contributor+) PHP Object Injection (high 7.5)
- [CVE-2024-1791](https://insights.sbomify.com/CVE-2024-1791/): CodeMirror Blocks <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1790](https://insights.sbomify.com/CVE-2024-1790/): Ajax Load More <= 7.0.1 - Authenticated (Admin+) Directory Traversal to Arbitrary File Read (medium 4.9)
- [CVE-2024-1789](https://insights.sbomify.com/CVE-2024-1789/): SQL injection in WP SMTP (high 7.2)
- [CVE-2024-1787](https://insights.sbomify.com/CVE-2024-1787/): Cross-site scripting in Contests by Rewards Fuel (medium 6.4)
- [CVE-2024-1786](https://insights.sbomify.com/CVE-2024-1786/): D-Link DIR-600M C1 Telnet Service buffer overflow (high 7.5)
- [CVE-2024-1785](https://insights.sbomify.com/CVE-2024-1785/): Contests by Rewards Fuel <= 2.0.62 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-1784](https://insights.sbomify.com/CVE-2024-1784/): Limbas main_admin.php sql injection (low 3.9)
- [CVE-2024-1783](https://insights.sbomify.com/CVE-2024-1783/): Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflow (critical 9.8)
- [CVE-2024-1782](https://insights.sbomify.com/CVE-2024-1782/): Blue Triad EZAnalytics <= 1.0 - Reflected Cross-Site Scripting via 'bt_webid' (medium 6.1)
- [CVE-2024-1781](https://insights.sbomify.com/CVE-2024-1781/): Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection (medium 6.3)
- [CVE-2024-1780](https://insights.sbomify.com/CVE-2024-1780/): BizCalendar Web <= 1.1.0.25 - Reflected Cross-Site Scripting via 'tab' (medium 6.1)
- [CVE-2024-1779](https://insights.sbomify.com/CVE-2024-1779/): Missing authorization in Admin side data storage for Contact Form 7 (medium 5.3)
- [CVE-2024-1778](https://insights.sbomify.com/CVE-2024-1778/): Missing authorization in Admin side data storage for Contact Form 7 (medium 4.3)
- [CVE-2024-1777](https://insights.sbomify.com/CVE-2024-1777/): Admin side data storage for Contact Form 7 <= 1.1.1 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-1776](https://insights.sbomify.com/CVE-2024-1776/): Admin side data storage for Contact Form 7 <= 1.1.1 - Authenticated (Admin+) SQL Injection (high 7.2)
- [CVE-2024-1775](https://insights.sbomify.com/CVE-2024-1775/): Nextend Social Login and Register <= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error_description (medium 5.4)
- [CVE-2024-1774](https://insights.sbomify.com/CVE-2024-1774/): Customily Product Personalizer <= 1.23.3 - Unauthenticated Stored Cross-Site Scripting (high 7.2)
- [CVE-2024-1773](https://insights.sbomify.com/CVE-2024-1773/): PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection (high 8.8)
- [CVE-2024-1772](https://insights.sbomify.com/CVE-2024-1772/): Deserialization in Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio (high 8.8)
- [CVE-2024-1771](https://insights.sbomify.com/CVE-2024-1771/): Total <= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Update (medium 4.3)
- [CVE-2024-1770](https://insights.sbomify.com/CVE-2024-1770/): Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection (high 8.8)
- [CVE-2024-1769](https://insights.sbomify.com/CVE-2024-1769/): JM Twitter Cards <= 14 - Information Exposure via Meta Description (medium 5.3)
- [CVE-2024-1768](https://insights.sbomify.com/CVE-2024-1768/): Clever Fox <= 25.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1767](https://insights.sbomify.com/CVE-2024-1767/): Blocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1766](https://insights.sbomify.com/CVE-2024-1766/): Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting (medium 4.4)
- [CVE-2024-1765](https://insights.sbomify.com/CVE-2024-1765/): Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche (medium 5.9)
- [CVE-2024-1764](https://insights.sbomify.com/CVE-2024-1764/): Privilege escalation in Server (high 7.6)
- [CVE-2024-1763](https://insights.sbomify.com/CVE-2024-1763/): Missing authorization in Wp Social Login and Register Social Counter (medium 6.5)
- [CVE-2024-1762](https://insights.sbomify.com/CVE-2024-1762/): NextScripts: Social Networks Auto-Poster <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting via User Agent (medium 6.1)
- [CVE-2024-1761](https://insights.sbomify.com/CVE-2024-1761/): WP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (medium 6.4)
- [CVE-2024-1760](https://insights.sbomify.com/CVE-2024-1760/): Cross-site request forgery in Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin (medium 4.3)
- [CVE-2024-1759](https://insights.sbomify.com/CVE-2024-1759/): WP ULike <= 4.6.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1758](https://insights.sbomify.com/CVE-2024-1758/): SuperFaktura WooCommerce <= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery (medium 5.4)
- [CVE-2024-1756](https://insights.sbomify.com/CVE-2024-1756/): WooCommerce Customers Manager < 29.8 - Subscriber+ Email Disclosure (medium 6.5)
- [CVE-2024-1755](https://insights.sbomify.com/CVE-2024-1755/): NPS computy <= 2.7.5 - Results Deletion via CSRF (high 8.8)
- [CVE-2024-1754](https://insights.sbomify.com/CVE-2024-1754/): NPS computy <= 2.7.5 - Admin+ Stored XSS (medium 4.7)
- [CVE-2024-1753](https://insights.sbomify.com/CVE-2024-1753/): Buildah: buildah: container escape via improper bind mount validation (high 8.6)
- [CVE-2024-1752](https://insights.sbomify.com/CVE-2024-1752/): Font Farsi <= 1.6.6 - Admin+ Stored XSS in Settings (medium 6.1)
- [CVE-2024-1751](https://insights.sbomify.com/CVE-2024-1751/): Tutor LMS – eLearning and online course solution <= 2.6.1 - Authenticated (Subscriber+) SQL Injection (high 8.8)
- [CVE-2024-1750](https://insights.sbomify.com/CVE-2024-1750/): TemmokuMVC Image Download images_get_down.php img_replace deserialization (medium 5.6)
- [CVE-2024-1749](https://insights.sbomify.com/CVE-2024-1749/): Bdtask Bhojon Best Restaurant Management Software Message Page message cross site scripting (low 2.4)
- [CVE-2024-1748](https://insights.sbomify.com/CVE-2024-1748/): van_der_Schaar LAB AutoPrognosis Release Note load_model_from_file deserialization (medium 5.0)
- [CVE-2024-1747](https://insights.sbomify.com/CVE-2024-1747/): WooCommerce Customers Manager < 30.2 - Subscriber+ Stored XSS (medium 6.5)
- [CVE-2024-1746](https://insights.sbomify.com/CVE-2024-1746/): Testimonial Slider < 2.3.8 - Admin+ Stored XSS (medium 5.4)
- [CVE-2024-1745](https://insights.sbomify.com/CVE-2024-1745/): Testimonial Slider < 2.3.7 - Author+ Settings Update (medium 4.3)
- [CVE-2024-1744](https://insights.sbomify.com/CVE-2024-1744/): IDOR in Ariva Computer's Accord ORS (critical 9.2)
- [CVE-2024-1743](https://insights.sbomify.com/CVE-2024-1743/): WooCommerce Customers Manager < 29.8 - Reflected XSS (medium 5.9)
- [CVE-2024-1742](https://insights.sbomify.com/CVE-2024-1742/): Information disclosure in mk_oracle Checkmk agent plugin (low 3.8)
- [CVE-2024-1741](https://insights.sbomify.com/CVE-2024-1741/): Improper Authorization in lunary-ai/lunary (critical 9.1)
- [CVE-2024-1740](https://insights.sbomify.com/CVE-2024-1740/): Incorrect Authorization in lunary-ai/lunary (critical 9.1)
- [CVE-2024-1739](https://insights.sbomify.com/CVE-2024-1739/): Case Insensitive Email Address Validation Vulnerability in lunary-ai/lunary (high 7.5)
- [CVE-2024-1738](https://insights.sbomify.com/CVE-2024-1738/): Incorrect Authorization in lunary-ai/lunary (high 7.5)
- [CVE-2024-1737](https://insights.sbomify.com/CVE-2024-1737/): BIND's database will be slow if a very large number of RRs exist at the same name (high 7.5)
- [CVE-2024-1736](https://insights.sbomify.com/CVE-2024-1736/): Uncontrolled Resource Consumption in GitLab (medium 6.5)
- [CVE-2024-1735](https://insights.sbomify.com/CVE-2024-1735/): Armeria SAML authentication bypass due to missing validation on unsigned SAML messages (critical 9.1)
- [CVE-2024-1733](https://insights.sbomify.com/CVE-2024-1733/): Word Replacer Pro <= 1.0 - Missing Authorization to Unauthenticated Arbitrary Content Update (medium 5.3)
- [CVE-2024-1732](https://insights.sbomify.com/CVE-2024-1732/): Missing authorization in Sharkdropship & affiliate for AliExpress (medium 5.3)
- [CVE-2024-1731](https://insights.sbomify.com/CVE-2024-1731/): Auto Refresh Single Page <= 1.1 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-1730](https://insights.sbomify.com/CVE-2024-1730/): Cross-site scripting in Prime Slider – Addons for Elementor (medium 5.4)
- [CVE-2024-1729](https://insights.sbomify.com/CVE-2024-1729/): Timing Attack Vulnerability in gradio-app/gradio (medium 5.9)
- [CVE-2024-1728](https://insights.sbomify.com/CVE-2024-1728/): Local File Inclusion in gradio-app/gradio (high 7.5)
- [CVE-2024-1727](https://insights.sbomify.com/CVE-2024-1727/): CSRF Vulnerability in gradio-app/gradio (medium 4.3)
- [CVE-2024-1726](https://insights.sbomify.com/CVE-2024-1726/): Quarkus: security checks in resteasy reactive may trigger a denial of service (medium 5.3)
- [CVE-2024-1725](https://insights.sbomify.com/CVE-2024-1725/): Kubevirt-csi: persistentvolume allows access to hcp's root node (medium 6.5)
- [CVE-2024-1724](https://insights.sbomify.com/CVE-2024-1724/): snapd allows $HOME/bin symlink (medium 6.3)
- [CVE-2024-1723](https://insights.sbomify.com/CVE-2024-1723/): SiteOrigin Widgets Bundle <= 1.58.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1722](https://insights.sbomify.com/CVE-2024-1722/): Keycloak-core: dos via account lockout (low 3.7)
- [CVE-2024-1721](https://insights.sbomify.com/CVE-2024-1721/): Security feature bypass in Passwordless (medium 5.6)
- [CVE-2024-1720](https://insights.sbomify.com/CVE-2024-1720/): Cross-site scripting in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder (medium 4.7)
- [CVE-2024-1719](https://insights.sbomify.com/CVE-2024-1719/): Cross-site request forgery in Contact Form 7 – PayPal & Stripe Add-on (medium 4.3)
- [CVE-2024-1718](https://insights.sbomify.com/CVE-2024-1718/): Business logic in Claudio Sanches – Checkout Cielo for WooCommerce (medium 5.3)
- [CVE-2024-1717](https://insights.sbomify.com/CVE-2024-1717/): Admin Notices Manager <= 1.4.0 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval (medium 4.3)
- [CVE-2024-1716](https://insights.sbomify.com/CVE-2024-1716/): Admin Bar Remover <= 1.0.2.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update (medium 4.3)
- [CVE-2024-1714](https://insights.sbomify.com/CVE-2024-1714/): Access Request for Entitlement Values with Leading/Trailing Whitespace (high 7.1)
- [CVE-2024-1713](https://insights.sbomify.com/CVE-2024-1713/): Plv8 Deferred Trigger Privilege Escalation (high 7.2)
- [CVE-2024-1712](https://insights.sbomify.com/CVE-2024-1712/): Carousel Slider < 2.2.7 - Editor+ Stored XSS (medium 4.7)
- [CVE-2024-1711](https://insights.sbomify.com/CVE-2024-1711/): Create by Mediavine <= 1.9.4 - Unauthenticated SQL Injection via 'id' (critical 9.8)
- [CVE-2024-1710](https://insights.sbomify.com/CVE-2024-1710/): Addon Library <= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (high 8.8)
- [CVE-2024-1709](https://insights.sbomify.com/CVE-2024-1709/): ConnectWise ScreenConnect Authentication Bypass (critical 10.0, exploited in the wild)
- [CVE-2024-1708](https://insights.sbomify.com/CVE-2024-1708/): ConnectWise ScreenConnect Path Traversal (high 8.4, exploited in the wild)
- [CVE-2024-1707](https://insights.sbomify.com/CVE-2024-1707/): GARO WALLBOX GLB+ T2EV7 Software Update index.jsp#settings cross site scripting (medium 4.3)
- [CVE-2024-1706](https://insights.sbomify.com/CVE-2024-1706/): ZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting (medium 5.1)
- [CVE-2024-1705](https://insights.sbomify.com/CVE-2024-1705/): Shopwind Installation DefaultController.php actionCreate code injection (medium 5.6)
- [CVE-2024-1704](https://insights.sbomify.com/CVE-2024-1704/): ZhongBangKeJi CRMEB crud delete path traversal (medium 5.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/467/