# Vulnerabilities published in 2024


- [CVE-2024-1703](https://insights.sbomify.com/CVE-2024-1703/): ZhongBangKeJi CRMEB openfile absolute path traversal (low 3.5)
- [CVE-2024-1702](https://insights.sbomify.com/CVE-2024-1702/): keerti1924 PHP-MYSQL-User-Login-System edit.php sql injection (medium 6.3)
- [CVE-2024-1701](https://insights.sbomify.com/CVE-2024-1701/): keerti1924 PHP-MYSQL-User-Login-System edit.php access control (medium 5.3)
- [CVE-2024-1700](https://insights.sbomify.com/CVE-2024-1700/): keerti1924 PHP-MYSQL-User-Login-System signup.php cross site scripting (medium 4.3)
- [CVE-2024-1698](https://insights.sbomify.com/CVE-2024-1698/): SQL injection in NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar (critical 9.8)
- [CVE-2024-1697](https://insights.sbomify.com/CVE-2024-1697/): Custom WooCommerce Checkout Fields Editor <= 1.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1696](https://insights.sbomify.com/CVE-2024-1696/): Santesoft Sante FFT Imaging Out-of-bounds Write (high 7.8)
- [CVE-2024-1695](https://insights.sbomify.com/CVE-2024-1695/): Privilege escalation in HP Application Enabling Software Driver (medium 5.7)
- [CVE-2024-1694](https://insights.sbomify.com/CVE-2024-1694/): Security feature bypass in Omaha (high 7.8)
- [CVE-2024-1693](https://insights.sbomify.com/CVE-2024-1693/): SP Project & Document Manager <= 4.70 - Authenticated (Subscriber+) Arbitrary Folder Name Update (medium 4.3)
- [CVE-2024-1692](https://insights.sbomify.com/CVE-2024-1692/): Cross-site scripting in BoldGrid Easy SEO – Simple and Effective SEO (medium 6.4)
- [CVE-2024-1691](https://insights.sbomify.com/CVE-2024-1691/): Otter Blocks PRO <= 2.6.3 - Unauthenticated Stored Cross-Site Scripting via SVG Upload (medium 6.1)
- [CVE-2024-1690](https://insights.sbomify.com/CVE-2024-1690/): Missing authorization in Wallet for WooCommerce (medium 4.3)
- [CVE-2024-1689](https://insights.sbomify.com/CVE-2024-1689/): WooCommerce Tools <= 1.2.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Module Deactivation (medium 4.3)
- [CVE-2024-1688](https://insights.sbomify.com/CVE-2024-1688/): Woo Total Sales <= 3.1.4 - Missing Authorization to Unauthenticated Sales Report Retrieval (medium 5.3)
- [CVE-2024-1687](https://insights.sbomify.com/CVE-2024-1687/): Missing authorization in Thank You Page Customizer for WooCommerce – Increase Your Sales (medium 5.4)
- [CVE-2024-1686](https://insights.sbomify.com/CVE-2024-1686/): Missing authorization in Thank You Page Customizer for WooCommerce – Increase Your Sales (medium 4.3)
- [CVE-2024-1685](https://insights.sbomify.com/CVE-2024-1685/): Social Media Share Buttons <= 2.1.0 - Authenticated (Subscriber+) PHP Object Injection (high 8.8)
- [CVE-2024-1684](https://insights.sbomify.com/CVE-2024-1684/): Otter Blocks PRO <= 2.6.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via File Field CSS (medium 6.4)
- [CVE-2024-1683](https://insights.sbomify.com/CVE-2024-1683/): DLL Injection in Tenable Identity Exposure Secure Relay (high 7.3)
- [CVE-2024-1682](https://insights.sbomify.com/CVE-2024-1682/): Unclaimed S3 Bucket Reference in psf/requests Documentation (medium 4.3)
- [CVE-2024-1681](https://insights.sbomify.com/CVE-2024-1681/): Log Injection Vulnerability in corydolphin/flask-cors (medium 5.3)
- [CVE-2024-1680](https://insights.sbomify.com/CVE-2024-1680/): Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-1679](https://insights.sbomify.com/CVE-2024-1679/): Cross-site scripting in Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce (medium 6.4)
- [CVE-2024-1678](https://insights.sbomify.com/CVE-2024-1678/): Subway – Private Site Option <= 2.1.4 - Improper Access Control to Sensitive Information Exposure via REST API (medium 5.3)
- [CVE-2024-1677](https://insights.sbomify.com/CVE-2024-1677/): Missing authorization in Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce (medium 6.3)
- [CVE-2024-1676](https://insights.sbomify.com/CVE-2024-1676/): Security feature bypass in Chrome (critical 9.8)
- [CVE-2024-1675](https://insights.sbomify.com/CVE-2024-1675/): Security feature bypass in Chrome (high 8.8)
- [CVE-2024-1674](https://insights.sbomify.com/CVE-2024-1674/): Security feature bypass in Chrome (medium 6.3)
- [CVE-2024-1673](https://insights.sbomify.com/CVE-2024-1673/): Use after free in Chrome (high 8.8)
- [CVE-2024-1672](https://insights.sbomify.com/CVE-2024-1672/): Security feature bypass in Chrome (high 8.8)
- [CVE-2024-1671](https://insights.sbomify.com/CVE-2024-1671/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2024-1670](https://insights.sbomify.com/CVE-2024-1670/): Use after free in Chrome (high 8.8)
- [CVE-2024-1669](https://insights.sbomify.com/CVE-2024-1669/): Memory corruption in Chrome (medium 6.5)
- [CVE-2024-1668](https://insights.sbomify.com/CVE-2024-1668/): Avada <= 7.11.5 - Authenticated(Contributor+) Sensitive Information Exposure via Form Entries (medium 6.5)
- [CVE-2024-1666](https://insights.sbomify.com/CVE-2024-1666/): Unauthorized Radar Creation in lunary-ai/lunary (high 7.5)
- [CVE-2024-1664](https://insights.sbomify.com/CVE-2024-1664/): Responsive Gallery Grid < 2.3.11 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-1663](https://insights.sbomify.com/CVE-2024-1663/): Ultimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1662](https://insights.sbomify.com/CVE-2024-1662/): Information Disclosure in Porty's PowerBank (high 7.5)
- [CVE-2024-1661](https://insights.sbomify.com/CVE-2024-1661/): Totolink X6000R shadow hard-coded credentials (low 2.5)
- [CVE-2024-1660](https://insights.sbomify.com/CVE-2024-1660/): Top Bar < 3.0.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1659](https://insights.sbomify.com/CVE-2024-1659/): Arbitrary File Upload in MegaBIP (critical 9.3)
- [CVE-2024-1658](https://insights.sbomify.com/CVE-2024-1658/): Grid Shortcodes < 1.1.1 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-1657](https://insights.sbomify.com/CVE-2024-1657/): Platform: insecure websocket used when interacting with eda server (high 8.1)
- [CVE-2024-1656](https://insights.sbomify.com/CVE-2024-1656/): Misconfiguration in Octopus Server (low 2.6)
- [CVE-2024-1655](https://insights.sbomify.com/CVE-2024-1655/): ASUS WiFi Router - OS Command Injection (high 8.8)
- [CVE-2024-1654](https://insights.sbomify.com/CVE-2024-1654/): Unauthorized write operations in PaperCut NG/MF (high 7.2)
- [CVE-2024-1653](https://insights.sbomify.com/CVE-2024-1653/): Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition (medium 4.3)
- [CVE-2024-1652](https://insights.sbomify.com/CVE-2024-1652/): Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory (medium 4.3)
- [CVE-2024-1651](https://insights.sbomify.com/CVE-2024-1651/): Torrentpier 2.4.1 - RCE (critical 10.0)
- [CVE-2024-1650](https://insights.sbomify.com/CVE-2024-1650/): Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory (medium 4.3)
- [CVE-2024-1649](https://insights.sbomify.com/CVE-2024-1649/): Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory (medium 4.3)
- [CVE-2024-1648](https://insights.sbomify.com/CVE-2024-1648/): electron-pdf 20.0.0 - Local File Read via Server Side XSS (high 7.5)
- [CVE-2024-1647](https://insights.sbomify.com/CVE-2024-1647/): pyhtml2pdf 0.0.6 - Local File Read via Server Side XSS (high 7.5)
- [CVE-2024-1646](https://insights.sbomify.com/CVE-2024-1646/): Authentication Bypass in parisneo/lollms-webui (high 8.2)
- [CVE-2024-1645](https://insights.sbomify.com/CVE-2024-1645/): Mollie Forms <= 2.6.3 - Missing Authorization (medium 4.3)
- [CVE-2024-1644](https://insights.sbomify.com/CVE-2024-1644/): Suite CRM v7.14.2 - RCE via Local File Inclusion (critical 9.9)
- [CVE-2024-1643](https://insights.sbomify.com/CVE-2024-1643/): Unauthorized Organization Access in lunary-ai/lunary (critical 9.1)
- [CVE-2024-1642](https://insights.sbomify.com/CVE-2024-1642/): MainWP Dashboard <= 4.6.0.1 - Cross-Site Request Forgery via posting_bulk (medium 4.3)
- [CVE-2024-1641](https://insights.sbomify.com/CVE-2024-1641/): Accordion <= 2.2.96 - Missing Authorization to Authenticated(Contributor+) Post Duplication (medium 5.4)
- [CVE-2024-1640](https://insights.sbomify.com/CVE-2024-1640/): Missing authorization in Bit Form – Custom Contact Form, Multi Step, Conversational Form & Payment Form builder (medium 5.3)
- [CVE-2024-1639](https://insights.sbomify.com/CVE-2024-1639/): Missing authorization in License Manager for WooCommerce (medium 6.5)
- [CVE-2024-1638](https://insights.sbomify.com/CVE-2024-1638/): Bluetooth characteristic LESC security requirement not enforced without additional flags (high 8.2)
- [CVE-2024-1637](https://insights.sbomify.com/CVE-2024-1637/): 360 Javascript Viewer <= 1.7.12 - Missing Authorization to Plugin Settings Update (medium 4.3)
- [CVE-2024-1636](https://insights.sbomify.com/CVE-2024-1636/): Potential Cross-Site Scripting (XSS) in the page editing area (high 8.0)
- [CVE-2024-1635](https://insights.sbomify.com/CVE-2024-1635/): Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol (high 7.5)
- [CVE-2024-1634](https://insights.sbomify.com/CVE-2024-1634/): Missing authorization in Scheduling Plugin – Online Booking for WordPress (medium 6.5)
- [CVE-2024-1633](https://insights.sbomify.com/CVE-2024-1633/): FIP Header Integer Overflow (low 2.0)
- [CVE-2024-1632](https://insights.sbomify.com/CVE-2024-1632/): Incorrect access control in the Sitefinity backend (high 8.8)
- [CVE-2024-1631](https://insights.sbomify.com/CVE-2024-1631/): agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate` (critical 9.1)
- [CVE-2024-1630](https://insights.sbomify.com/CVE-2024-1630/): Path traversal in LOGIQ E10 (high 7.7)
- [CVE-2024-1629](https://insights.sbomify.com/CVE-2024-1629/): Path traversal in LOGIQ E10 (medium 6.2)
- [CVE-2024-1628](https://insights.sbomify.com/CVE-2024-1628/): OS command injection vulnerabilities in GE HealthCare ultrasound devices (high 8.4)
- [CVE-2024-1626](https://insights.sbomify.com/CVE-2024-1626/): IDOR Vulnerability in lunary-ai/lunary (critical 9.1)
- [CVE-2024-1625](https://insights.sbomify.com/CVE-2024-1625/): IDOR Vulnerability in lunary-ai/lunary (high 7.5)
- [CVE-2024-1624](https://insights.sbomify.com/CVE-2024-1624/): Command injection in Documentation server (critical 9.4)
- [CVE-2024-1623](https://insights.sbomify.com/CVE-2024-1623/): Insufficient session timeout vulnerability in Sagemcom router (high 7.7)
- [CVE-2024-1622](https://insights.sbomify.com/CVE-2024-1622/): Routinator terminates when RTR connection is reset too quickly after opening (high 7.5)
- [CVE-2024-1621](https://insights.sbomify.com/CVE-2024-1621/): uniFLOW Online device registration susceptible to compromise (high 8.3)
- [CVE-2024-1619](https://insights.sbomify.com/CVE-2024-1619/): Other in Kaspersky Security for Linux Mail Server 8 (medium 6.1)
- [CVE-2024-1618](https://insights.sbomify.com/CVE-2024-1618/): Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard (high 7.8)
- [CVE-2024-1610](https://insights.sbomify.com/CVE-2024-1610/): OPPO Store app include remote account token hijacking and sensitive information leakage (high 8.7)
- [CVE-2024-1609](https://insights.sbomify.com/CVE-2024-1609/): OPPO Store APP has a WebView component privilege escalation vulnerability. (high 8.7)
- [CVE-2024-1608](https://insights.sbomify.com/CVE-2024-1608/): OPPO Usercenter Credit sdk (critical 9.1)
- [CVE-2024-1606](https://insights.sbomify.com/CVE-2024-1606/): HTML injection in BMC Control-M (medium 4.6)
- [CVE-2024-1605](https://insights.sbomify.com/CVE-2024-1605/): DLL side-loading in BMC Control-M (medium 6.6)
- [CVE-2024-1604](https://insights.sbomify.com/CVE-2024-1604/): Incorrect authorization in BMC Control-M (medium 6.4)
- [CVE-2024-1603](https://insights.sbomify.com/CVE-2024-1603/): confirmed (high 8.2)
- [CVE-2024-1602](https://insights.sbomify.com/CVE-2024-1602/): Stored XSS leading to RCE in parisneo/lollms-webui (high 8.8)
- [CVE-2024-1601](https://insights.sbomify.com/CVE-2024-1601/): SQL Injection in parisneo/lollms-webui (high 7.5)
- [CVE-2024-1600](https://insights.sbomify.com/CVE-2024-1600/): Local File Inclusion in parisneo/lollms-webui (critical 9.3)
- [CVE-2024-1598](https://insights.sbomify.com/CVE-2024-1598/): Potential buffer overflow when handling UEFI variables (high 7.5)
- [CVE-2024-1597](https://insights.sbomify.com/CVE-2024-1597/): pgjdbc SQL Injection via line comment generation (critical 10.0)
- [CVE-2024-1596](https://insights.sbomify.com/CVE-2024-1596/): Ninja Forms File Uploads <= 3.3.16 - Unauthenticated Stored Cross-Site Scripting via File Upload (high 7.2)
- [CVE-2024-1595](https://insights.sbomify.com/CVE-2024-1595/): Delta Electronics CNCSoft-B DOPSoft Uncontrolled Search Path Element (high 7.8)
- [CVE-2024-1594](https://insights.sbomify.com/CVE-2024-1594/): Local File Read via Path Traversal in mlflow/mlflow (high 7.5)
- [CVE-2024-1593](https://insights.sbomify.com/CVE-2024-1593/): Path Traversal via Parameter Smuggling in mlflow/mlflow (high 7.5)
- [CVE-2024-1592](https://insights.sbomify.com/CVE-2024-1592/): Complianz – GDPR/CCPA Cookie Consent <= 6.5.6 - Cross-Site Request Forgery to Data Request Deletion (medium 4.3)
- [CVE-2024-1591](https://insights.sbomify.com/CVE-2024-1591/): Privilege Management for Windows < 24.1 Information Leak (low 3.3)
- [CVE-2024-1590](https://insights.sbomify.com/CVE-2024-1590/): Cross-site scripting in Page Builder: Pagelayer – Drag and Drop website builder (medium 4.6)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/468/