# Vulnerabilities published in 2024


- [CVE-2024-1589](https://insights.sbomify.com/CVE-2024-1589/): SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Form Settings (medium 6.1)
- [CVE-2024-1588](https://insights.sbomify.com/CVE-2024-1588/): SendPress Newsletters <= 1.23.11.6 - Admin+ Stored XSS via Settings (medium 6.8)
- [CVE-2024-1587](https://insights.sbomify.com/CVE-2024-1587/): Newsmatic <= 1.3.4 - Unauthenticated Information Exposure via newsmatic_filter_posts_load_tab_content (medium 5.3)
- [CVE-2024-1586](https://insights.sbomify.com/CVE-2024-1586/): Schema & Structured Data for WP & AMP <= 1.26 - Authenticated (Custom) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1585](https://insights.sbomify.com/CVE-2024-1585/): Metform Elementor Contact Form Builder <= 3.8.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-1584](https://insights.sbomify.com/CVE-2024-1584/): Analytify <= 5.2.1 - Missing Authorization to Unauthenticated Google Analytics Tracking ID Modification (medium 5.3)
- [CVE-2024-1582](https://insights.sbomify.com/CVE-2024-1582/): WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-1580](https://insights.sbomify.com/CVE-2024-1580/): Integer overflow in VideoLAN dav1d (medium 5.9)
- [CVE-2024-1579](https://insights.sbomify.com/CVE-2024-1579/): Insufficient seeding of random number generator (high 8.1)
- [CVE-2024-1578](https://insights.sbomify.com/CVE-2024-1578/): Multiple MiCard PLUS card reader dropped characters (medium 5.3)
- [CVE-2024-1577](https://insights.sbomify.com/CVE-2024-1577/): Remote Code Execution in MegaBIP (critical 9.3)
- [CVE-2024-1576](https://insights.sbomify.com/CVE-2024-1576/): SQL Injection in MegaBIP (critical 9.3)
- [CVE-2024-1575](https://insights.sbomify.com/CVE-2024-1575/): Privilege escalation in WBE660S firmware (medium 6.5)
- [CVE-2024-1574](https://insights.sbomify.com/CVE-2024-1574/): Privilege escalation in AnalytiX (medium 6.7)
- [CVE-2024-1573](https://insights.sbomify.com/CVE-2024-1573/): Auth bypass in AnalytiX (medium 5.9)
- [CVE-2024-1572](https://insights.sbomify.com/CVE-2024-1572/): WP ULike <= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-1571](https://insights.sbomify.com/CVE-2024-1571/): WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed (medium 4.4)
- [CVE-2024-1570](https://insights.sbomify.com/CVE-2024-1570/): ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-1569](https://insights.sbomify.com/CVE-2024-1569/): Uncontrolled Resource Consumption in parisneo/lollms-webui (medium 5.3)
- [CVE-2024-1568](https://insights.sbomify.com/CVE-2024-1568/): Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheck (medium 6.4)
- [CVE-2024-1567](https://insights.sbomify.com/CVE-2024-1567/): Royal Elementor Addons and Templates <= 1.3.94 - Unauthenticated Limited File Upload (high 8.2)
- [CVE-2024-1566](https://insights.sbomify.com/CVE-2024-1566/): Redirects <= 1.2.1 - Missing Authorization via save (medium 6.5)
- [CVE-2024-1565](https://insights.sbomify.com/CVE-2024-1565/): EmbedPress <= 3.9.10 - Authenticated(Contributor+) Stored Cross-Site Scripting via PDF Widget URL (medium 6.4)
- [CVE-2024-1564](https://insights.sbomify.com/CVE-2024-1564/): Schema Pro < 2.7.16 - Contributor+ Custom Field Access (medium 4.3)
- [CVE-2024-1563](https://insights.sbomify.com/CVE-2024-1563/): Race condition in Focus for iOS (high 8.1)
- [CVE-2024-1562](https://insights.sbomify.com/CVE-2024-1562/): WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorization (medium 5.3)
- [CVE-2024-1561](https://insights.sbomify.com/CVE-2024-1561/): Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio (high 7.5)
- [CVE-2024-1560](https://insights.sbomify.com/CVE-2024-1560/): Path Traversal Vulnerability in mlflow/mlflow (high 8.1)
- [CVE-2024-1559](https://insights.sbomify.com/CVE-2024-1559/): Link Library <= 7.6 - Unauthenticated Stored Cross-Site Scripting (medium 6.5)
- [CVE-2024-1558](https://insights.sbomify.com/CVE-2024-1558/): Path Traversal Vulnerability in mlflow/mlflow (high 7.5)
- [CVE-2024-1557](https://insights.sbomify.com/CVE-2024-1557/): Memory corruption in Firefox (high 8.1)
- [CVE-2024-1556](https://insights.sbomify.com/CVE-2024-1556/): Null dereference in Firefox (medium 6.5)
- [CVE-2024-1555](https://insights.sbomify.com/CVE-2024-1555/): Security feature bypass in Firefox (high 8.3)
- [CVE-2024-1554](https://insights.sbomify.com/CVE-2024-1554/): Security feature bypass in Firefox (critical 9.8)
- [CVE-2024-1553](https://insights.sbomify.com/CVE-2024-1553/): Memory corruption in Firefox (high 8.1)
- [CVE-2024-1552](https://insights.sbomify.com/CVE-2024-1552/): Memory corruption in Firefox (high 7.5)
- [CVE-2024-1551](https://insights.sbomify.com/CVE-2024-1551/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2024-1550](https://insights.sbomify.com/CVE-2024-1550/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2024-1549](https://insights.sbomify.com/CVE-2024-1549/): Security feature bypass in Firefox (medium 6.1)
- [CVE-2024-1548](https://insights.sbomify.com/CVE-2024-1548/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2024-1547](https://insights.sbomify.com/CVE-2024-1547/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2024-1546](https://insights.sbomify.com/CVE-2024-1546/): Memory corruption in Firefox (high 7.5)
- [CVE-2024-1545](https://insights.sbomify.com/CVE-2024-1545/): Fault Injection of RSA encryption in WolfCrypt (medium 5.9)
- [CVE-2024-1544](https://insights.sbomify.com/CVE-2024-1544/): ECDSA nonce bias caused by truncation (medium 4.1)
- [CVE-2024-1543](https://insights.sbomify.com/CVE-2024-1543/): AES T-Table sub-cache-line leakage (medium 4.1)
- [CVE-2024-1541](https://insights.sbomify.com/CVE-2024-1541/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 6.4)
- [CVE-2024-1540](https://insights.sbomify.com/CVE-2024-1540/): Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow (high 8.6)
- [CVE-2024-1539](https://insights.sbomify.com/CVE-2024-1539/): Missing Authorization in GitLab (medium 4.3)
- [CVE-2024-1538](https://insights.sbomify.com/CVE-2024-1538/): File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion (high 8.8)
- [CVE-2024-1537](https://insights.sbomify.com/CVE-2024-1537/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-1536](https://insights.sbomify.com/CVE-2024-1536/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (high 7.4)
- [CVE-2024-1535](https://insights.sbomify.com/CVE-2024-1535/): ProfilePress <= 4.15.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-1534](https://insights.sbomify.com/CVE-2024-1534/): Booster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde (medium 6.4)
- [CVE-2024-1533](https://insights.sbomify.com/CVE-2024-1533/): Shortcodes and extra features for Phlox theme <= 2.15.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1532](https://insights.sbomify.com/CVE-2024-1532/): Other in RTU500 series CMU firmware (medium 6.8)
- [CVE-2024-1531](https://insights.sbomify.com/CVE-2024-1531/): Information disclosure in RTU500 series CMU firmware (high 8.2)
- [CVE-2024-1530](https://insights.sbomify.com/CVE-2024-1530/): ECshop view_sendlist.php sql injection (medium 6.3)
- [CVE-2024-1529](https://insights.sbomify.com/CVE-2024-1529/): Cross-site Scripting in CMS Made Simple (high 7.4)
- [CVE-2024-1528](https://insights.sbomify.com/CVE-2024-1528/): Cross-site Scripting in CMS Made Simple (high 7.4)
- [CVE-2024-1527](https://insights.sbomify.com/CVE-2024-1527/): Unrestricted Upload of File with Dangerous Type in CMS Made Simple (critical 9.8)
- [CVE-2024-1526](https://insights.sbomify.com/CVE-2024-1526/): Hubbub Lite < 1.33.1 - Unauthenticated Password Protected Posts Access (medium 5.3)
- [CVE-2024-1525](https://insights.sbomify.com/CVE-2024-1525/): Authentication Bypass Using an Alternate Path or Channel in GitLab (medium 5.3)
- [CVE-2024-1524](https://insights.sbomify.com/CVE-2024-1524/): A local user can be impersonated when using federated authentication with Silent JIT Provisioning. (high 7.7)
- [CVE-2024-1523](https://insights.sbomify.com/CVE-2024-1523/): EC-WEB FS-EZViewer(Web) - SQL Injection (high 8.8)
- [CVE-2024-1522](https://insights.sbomify.com/CVE-2024-1522/): Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui (high 8.8)
- [CVE-2024-1521](https://insights.sbomify.com/CVE-2024-1521/): Cross-site scripting in Elementor Website Builder Pro (medium 6.4)
- [CVE-2024-1520](https://insights.sbomify.com/CVE-2024-1520/): OS Command Injection in parisneo/lollms-webui (critical 9.8)
- [CVE-2024-1519](https://insights.sbomify.com/CVE-2024-1519/): Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 6.5)
- [CVE-2024-1516](https://insights.sbomify.com/CVE-2024-1516/): WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation (medium 5.3)
- [CVE-2024-1514](https://insights.sbomify.com/CVE-2024-1514/): WP eCommerce <= 3.15.1 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-1512](https://insights.sbomify.com/CVE-2024-1512/): MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-1511](https://insights.sbomify.com/CVE-2024-1511/): Path Traversal Vulnerability in parisneo/lollms-webui (critical 9.8)
- [CVE-2024-1510](https://insights.sbomify.com/CVE-2024-1510/): Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (medium 6.4)
- [CVE-2024-1509](https://insights.sbomify.com/CVE-2024-1509/): Brocade ASCG 3.2.0 web interface does not enforce HSTS, as defined by RFC 6797 for ports 8030 and 8100 (high 7.6)
- [CVE-2024-1508](https://insights.sbomify.com/CVE-2024-1508/): Cross-site scripting in Prime Slider – Addons for Elementor (medium 6.4)
- [CVE-2024-1507](https://insights.sbomify.com/CVE-2024-1507/): Cross-site scripting in Prime Slider – Addons for Elementor (medium 6.4)
- [CVE-2024-1506](https://insights.sbomify.com/CVE-2024-1506/): Cross-site scripting in Prime Slider – Addons for Elementor (medium 6.4)
- [CVE-2024-1505](https://insights.sbomify.com/CVE-2024-1505/): Privilege escalation in Academy LMS – WordPress LMS Plugin for Complete eLearning Solution (high 8.8)
- [CVE-2024-1504](https://insights.sbomify.com/CVE-2024-1504/): SecuPress Free — WordPress Security <= 2.2.5.1 - Cross-Site Request Forgery to Banned IP Address (medium 4.3)
- [CVE-2024-1503](https://insights.sbomify.com/CVE-2024-1503/): Cross-site request forgery in Tutor LMS – eLearning and online course solution (medium 4.3)
- [CVE-2024-1502](https://insights.sbomify.com/CVE-2024-1502/): Missing authorization in Tutor LMS – eLearning and online course solution (medium 5.4)
- [CVE-2024-1501](https://insights.sbomify.com/CVE-2024-1501/): Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation (medium 4.7)
- [CVE-2024-1500](https://insights.sbomify.com/CVE-2024-1500/): Cross-site scripting in Royal Addons for Elementor – Addons and Templates Kit for Elementor (medium 5.4)
- [CVE-2024-1499](https://insights.sbomify.com/CVE-2024-1499/): Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1498](https://insights.sbomify.com/CVE-2024-1498/): Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Stack Widget (medium 6.4)
- [CVE-2024-1497](https://insights.sbomify.com/CVE-2024-1497/): Cross-site scripting in Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More (medium 6.4)
- [CVE-2024-1496](https://insights.sbomify.com/CVE-2024-1496/): Featured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_url (medium 6.4)
- [CVE-2024-1495](https://insights.sbomify.com/CVE-2024-1495/): Uncontrolled Resource Consumption in GitLab (medium 6.5)
- [CVE-2024-1493](https://insights.sbomify.com/CVE-2024-1493/): Uncontrolled Resource Consumption in GitLab (medium 6.5)
- [CVE-2024-1492](https://insights.sbomify.com/CVE-2024-1492/): WPify Woo Czech <= 4.0.8 - Missing Authorization (medium 5.3)
- [CVE-2024-1491](https://insights.sbomify.com/CVE-2024-1491/): Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function (high 8.7)
- [CVE-2024-1490](https://insights.sbomify.com/CVE-2024-1490/): Wago: Vulnerability in WBM through Open VPN (high 7.2)
- [CVE-2024-1489](https://insights.sbomify.com/CVE-2024-1489/): SMS Alert Order Notifications – WooCommerce <= 3.6.9 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-1488](https://insights.sbomify.com/CVE-2024-1488/): Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation (high 8.0)
- [CVE-2024-1487](https://insights.sbomify.com/CVE-2024-1487/): Photos and Files Contest Gallery < 21.3.1 - Author+ Stored Cross Site Scripting (medium 5.4)
- [CVE-2024-1486](https://insights.sbomify.com/CVE-2024-1486/): Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices (high 7.4)
- [CVE-2024-1485](https://insights.sbomify.com/CVE-2024-1485/): Registry-support: decompress can delete files outside scope via relative paths (high 8.0)
- [CVE-2024-1484](https://insights.sbomify.com/CVE-2024-1484/): Booking for Appointments and Events Calendar – Amelia <= 1.0.98 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1483](https://insights.sbomify.com/CVE-2024-1483/): Path Traversal Vulnerability in mlflow/mlflow (high 7.5)
- [CVE-2024-1482](https://insights.sbomify.com/CVE-2024-1482/): Improper Authorization in GitHub Enterprise Server allowed unauthorized workflow execution (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/469/