# Vulnerabilities published in 2024


- [CVE-2024-1481](https://insights.sbomify.com/CVE-2024-1481/): Freeipa: specially crafted http requests potentially lead to denial of service (medium 5.3)
- [CVE-2024-1480](https://insights.sbomify.com/CVE-2024-1480/): Unitronics Vision Standard Unauthenticated Password Retrieval (high 7.5)
- [CVE-2024-1479](https://insights.sbomify.com/CVE-2024-1479/): WP Show Posts <= 1.1.4 - Information Exposure (medium 5.3)
- [CVE-2024-1478](https://insights.sbomify.com/CVE-2024-1478/): Maintenance Mode <= 3.0.1 - Information Exposure (medium 5.3)
- [CVE-2024-1477](https://insights.sbomify.com/CVE-2024-1477/): Easy Maintenance Mode <= 1.4.2 - Information Exposure (medium 5.3)
- [CVE-2024-1476](https://insights.sbomify.com/CVE-2024-1476/): Under Construction / Maintenance Mode from Acurax <= 2.6 - Information Exposure (medium 5.3)
- [CVE-2024-1475](https://insights.sbomify.com/CVE-2024-1475/): Coming Soon Maintenance Mode <= 1.0.5 - Information Exposure (medium 5.3)
- [CVE-2024-1474](https://insights.sbomify.com/CVE-2024-1474/): WS_FTP Server Reflected Cross-Site Scripting in Administrative Interface (high 7.5)
- [CVE-2024-1473](https://insights.sbomify.com/CVE-2024-1473/): Coming Soon & Maintenance Mode by Colorlib <= 1.0.99 - Information Exposure (medium 5.3)
- [CVE-2024-1472](https://insights.sbomify.com/CVE-2024-1472/): WP Maintenance <= 6.1.6 - Information Exposure (medium 5.3)
- [CVE-2024-1471](https://insights.sbomify.com/CVE-2024-1471/): HTML Injection Vulnerability (medium 5.9)
- [CVE-2024-1470](https://insights.sbomify.com/CVE-2024-1470/): Elevation of Privilege attack on NetIQ Client login extension (high 7.1)
- [CVE-2024-1468](https://insights.sbomify.com/CVE-2024-1468/): Avada | Website Builder For WordPress & WooCommerce <= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload (high 8.8)
- [CVE-2024-1467](https://insights.sbomify.com/CVE-2024-1467/): Server-side request forgery in Starter Templates – AI-Powered Templates for Elementor & Gutenberg (medium 4.3)
- [CVE-2024-1466](https://insights.sbomify.com/CVE-2024-1466/): Cross-site scripting in Livemesh Addons by Elementor (medium 6.4)
- [CVE-2024-1465](https://insights.sbomify.com/CVE-2024-1465/): Cross-site scripting in Livemesh Addons by Elementor (medium 6.4)
- [CVE-2024-1464](https://insights.sbomify.com/CVE-2024-1464/): Cross-site scripting in Livemesh Addons by Elementor (medium 6.4)
- [CVE-2024-1463](https://insights.sbomify.com/CVE-2024-1463/): LearnPress <= 4.2.6.3 - Authenticated(LP Instructor+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-1462](https://insights.sbomify.com/CVE-2024-1462/): Maintenance Page <= 1.0.8 - Security Mechanism Bypass via REST API (medium 5.3)
- [CVE-2024-1461](https://insights.sbomify.com/CVE-2024-1461/): Cross-site scripting in Livemesh Addons by Elementor (medium 6.4)
- [CVE-2024-1460](https://insights.sbomify.com/CVE-2024-1460/): MSI Afterburner v4.6.5.16370 - Kernel Memory Leak (medium 5.6)
- [CVE-2024-1459](https://insights.sbomify.com/CVE-2024-1459/): Undertow: directory traversal vulnerability (medium 5.3)
- [CVE-2024-1458](https://insights.sbomify.com/CVE-2024-1458/): Cross-site scripting in Livemesh Addons by Elementor (medium 6.4)
- [CVE-2024-1456](https://insights.sbomify.com/CVE-2024-1456/): S3 Bucket Takeover in h2oai/h2o-3 (high 7.1)
- [CVE-2024-1455](https://insights.sbomify.com/CVE-2024-1455/): Billion Laughs Attack leading to DoS in langchain-ai/langchain (medium 5.9)
- [CVE-2024-1454](https://insights.sbomify.com/CVE-2024-1454/): Opensc: memory use after free in authentic driver when updating token info (low 3.4)
- [CVE-2024-1453](https://insights.sbomify.com/CVE-2024-1453/): Santesoft Sante DICOM Viewer Pro Out-of-Bounds Read (high 7.8)
- [CVE-2024-1452](https://insights.sbomify.com/CVE-2024-1452/): GenerateBlocks <= 1.8.2 - Sensitive Information Exposure (medium 4.3)
- [CVE-2024-1451](https://insights.sbomify.com/CVE-2024-1451/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2024-1450](https://insights.sbomify.com/CVE-2024-1450/): Shariff Wrapper <= 4.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1449](https://insights.sbomify.com/CVE-2024-1449/): Master Slider – Responsive Touch Slider <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1448](https://insights.sbomify.com/CVE-2024-1448/): Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1447](https://insights.sbomify.com/CVE-2024-1447/): Sydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1446](https://insights.sbomify.com/CVE-2024-1446/): NextScripts: Social Networks Auto-Poster <= 4.4.3 - Cross-Site Request Forgery to Arbitrary Post Deletion (medium 5.4)
- [CVE-2024-1445](https://insights.sbomify.com/CVE-2024-1445/): Page scroll to id <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-1443](https://insights.sbomify.com/CVE-2024-1443/): MSI Afterburner v4.6.5.16370 - Denial of Service (medium 4.4)
- [CVE-2024-1442](https://insights.sbomify.com/CVE-2024-1442/): User with permissions to create a data source can CRUD all data sources (medium 6.0)
- [CVE-2024-1441](https://insights.sbomify.com/CVE-2024-1441/): Libvirt: off-by-one error in udevlistinterfacesbystatus() (medium 5.5)
- [CVE-2024-1440](https://insights.sbomify.com/CVE-2024-1440/): Open Redirection in Multiple WSO2 Products via Multi-Option Authentication Endpoint (medium 5.4)
- [CVE-2024-1439](https://insights.sbomify.com/CVE-2024-1439/): Inadequate access control vulnerability in Moodle (medium 6.5)
- [CVE-2024-1438](https://insights.sbomify.com/CVE-2024-1438/): WordPress Rolo Slider plugin <= 1.0.9 - Broken Access Control vulnerability (high 7.7)
- [CVE-2024-1437](https://insights.sbomify.com/CVE-2024-1437/): WordPress Adsmonetizer Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS) (high 7.1)
- [CVE-2024-1436](https://insights.sbomify.com/CVE-2024-1436/): Information disclosure in WooCommerce Coupon Popup, SmartBar, Slide In | MyShopKit (medium 5.3)
- [CVE-2024-1435](https://insights.sbomify.com/CVE-2024-1435/): WordPress Tainacan plugin <= 0.20.6 - Sensitive Data Exposure via Log File vulnerability (medium 5.3)
- [CVE-2024-1434](https://insights.sbomify.com/CVE-2024-1434/): WordPress Media Alt Renamer Plugin 0.0.1 is vulnerable to Cross Site Scripting (XSS) (medium 5.9)
- [CVE-2024-1433](https://insights.sbomify.com/CVE-2024-1433/): KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal (low 3.1)
- [CVE-2024-1432](https://insights.sbomify.com/CVE-2024-1432/): DeepFaceLab main.py apply_xseg deserialization (medium 5.0)
- [CVE-2024-1431](https://insights.sbomify.com/CVE-2024-1431/): Netgear R7000 Web Management Interface debuginfo.htm information disclosure (medium 4.3)
- [CVE-2024-1430](https://insights.sbomify.com/CVE-2024-1430/): Netgear R7000 Web Management Interface currentsetting.htm information disclosure (medium 5.3)
- [CVE-2024-1429](https://insights.sbomify.com/CVE-2024-1429/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-1428](https://insights.sbomify.com/CVE-2024-1428/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-1427](https://insights.sbomify.com/CVE-2024-1427/): The Post Grid <= 7.7.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via section title tag (medium 6.4)
- [CVE-2024-1426](https://insights.sbomify.com/CVE-2024-1426/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-1425](https://insights.sbomify.com/CVE-2024-1425/): EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Link (medium 6.4)
- [CVE-2024-1424](https://insights.sbomify.com/CVE-2024-1424/): GiveWP – Donation Plugin and Fundraising Platform <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1422](https://insights.sbomify.com/CVE-2024-1422/): Elementor Addon Elements <= 1.12.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Modal Popup effet (medium 6.4)
- [CVE-2024-1421](https://insights.sbomify.com/CVE-2024-1421/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 6.4)
- [CVE-2024-1419](https://insights.sbomify.com/CVE-2024-1419/): Cross-site scripting in The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce (medium 6.4)
- [CVE-2024-1418](https://insights.sbomify.com/CVE-2024-1418/): CGC Maintenance Mode <= 1.2 - Sensitive Information Exposure (medium 5.3)
- [CVE-2024-1417](https://insights.sbomify.com/CVE-2024-1417/): Local Code Injection Vulnerability in AuthPoint Password Manager App for macOS Safari (high 7.8)
- [CVE-2024-1416](https://insights.sbomify.com/CVE-2024-1416/): Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Missing Authorization (medium 4.3)
- [CVE-2024-1415](https://insights.sbomify.com/CVE-2024-1415/): Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-1414](https://insights.sbomify.com/CVE-2024-1414/): Cross-site scripting in Exclusive Addons for Elementor (medium 6.4)
- [CVE-2024-1413](https://insights.sbomify.com/CVE-2024-1413/): Cross-site scripting in Exclusive Addons for Elementor (medium 6.4)
- [CVE-2024-1412](https://insights.sbomify.com/CVE-2024-1412/): Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and error (medium 6.1)
- [CVE-2024-1411](https://insights.sbomify.com/CVE-2024-1411/): Cross-site scripting in PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) (medium 6.4)
- [CVE-2024-1410](https://insights.sbomify.com/CVE-2024-1410/): Unbounded storage of information related to connection ID retirement, in quiche (low 3.7)
- [CVE-2024-1409](https://insights.sbomify.com/CVE-2024-1409/): Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 6.4)
- [CVE-2024-1408](https://insights.sbomify.com/CVE-2024-1408/): ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcode (medium 6.4)
- [CVE-2024-1407](https://insights.sbomify.com/CVE-2024-1407/): Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery to Membership Modification (medium 5.4)
- [CVE-2024-1406](https://insights.sbomify.com/CVE-2024-1406/): Linksys WRT54GL Web Management Interface SysInfo1.htm information disclosure (medium 4.3)
- [CVE-2024-1405](https://insights.sbomify.com/CVE-2024-1405/): Linksys WRT54GL Web Management Interface wlaninfo.htm information disclosure (medium 4.3)
- [CVE-2024-14047](https://insights.sbomify.com/CVE-2024-14047/): Privilege escalation in Elastic Security (high 7.2)
- [CVE-2024-14046](https://insights.sbomify.com/CVE-2024-14046/): OpenBoxes Document Upload Controller DocumentController.groovy DocumentController unrestricted upload (medium 5.3)
- [CVE-2024-14045](https://insights.sbomify.com/CVE-2024-14045/): OpenBoxes Product Supplier Edit Controller RoleInterceptor.groovy improper authorization (medium 5.3)
- [CVE-2024-14044](https://insights.sbomify.com/CVE-2024-14044/): Open5GS Diameter Rx pcrf-rx-path.c pcrf_rx_aar_cb buffer overflow (medium 5.3)
- [CVE-2024-14043](https://insights.sbomify.com/CVE-2024-14043/): Open5GS Diameter S6a mme-fd-path.c mme_s6a_subscription_data_from_avp heap-based overflow (medium 5.3)
- [CVE-2024-14042](https://insights.sbomify.com/CVE-2024-14042/): Open5GS Diameter S6a hss-s6a-path.c hss_ogs_diam_s6a_ulr_cb stack-based overflow (medium 5.3)
- [CVE-2024-14041](https://insights.sbomify.com/CVE-2024-14041/): Weak cryptography in BC-JAVA (high 8.2)
- [CVE-2024-14040](https://insights.sbomify.com/CVE-2024-14040/): net: nexthop: Increase weight to u16 (high 7.8)
- [CVE-2024-1404](https://insights.sbomify.com/CVE-2024-1404/): Linksys WRT54GL Web Management Interface SysInfo.htm information disclosure (medium 4.3)
- [CVE-2024-14037](https://insights.sbomify.com/CVE-2024-14037/): Redsea Cloud eHR Unauthenticated File Upload RCE via PtFjk.mob (critical 9.3)
- [CVE-2024-14036](https://insights.sbomify.com/CVE-2024-14036/): Dräger Core 1.0.5 Denial of Service via Malformed SDC Message (high 8.7)
- [CVE-2024-14034](https://insights.sbomify.com/CVE-2024-14034/): Hirschmann HiEOS Authentication Bypass via HTTP Management Module (critical 9.3)
- [CVE-2024-14033](https://insights.sbomify.com/CVE-2024-14033/): Hirschmann EagleSDV Denial of Service via TLS (high 8.7)
- [CVE-2024-14032](https://insights.sbomify.com/CVE-2024-14032/): Twitch Studio LauncherHelper XPC Missing Authorization to Root File Write (high 8.5)
- [CVE-2024-14031](https://insights.sbomify.com/CVE-2024-14031/): Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library (high 8.1)
- [CVE-2024-14030](https://insights.sbomify.com/CVE-2024-14030/): Sereal::Decoder versions from 4.000 through 4.009_002 for Perl embeds a vulnerable version of the Zstandard library (high 8.1)
- [CVE-2024-1403](https://insights.sbomify.com/CVE-2024-1403/): Authentication Bypass in OpenEdge Authentication Gateway and AdminServer (critical 10.0)
- [CVE-2024-14029](https://insights.sbomify.com/CVE-2024-14029/): Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (critical 9.0)
- [CVE-2024-14028](https://insights.sbomify.com/CVE-2024-14028/): Multiple implicit reads in parallel can result in a crash or denial of service (medium 6.5)
- [CVE-2024-14027](https://insights.sbomify.com/CVE-2024-14027/): xattr: switch to CLASS(fd) (medium 5.5)
- [CVE-2024-14026](https://insights.sbomify.com/CVE-2024-14026/): QTS, QuTS hero (low 2.0)
- [CVE-2024-14025](https://insights.sbomify.com/CVE-2024-14025/): Video Station (low 0.1)
- [CVE-2024-14024](https://insights.sbomify.com/CVE-2024-14024/): Video Station (low 0.1)
- [CVE-2024-14021](https://insights.sbomify.com/CVE-2024-14021/): LlamaIndex <= 0.11.6 BGEM3Index Unsafe Deserialization (high 8.4)
- [CVE-2024-14020](https://insights.sbomify.com/CVE-2024-14020/): carboneio carbone Formatter input.js prototype pollution (low 2.3)
- [CVE-2024-1402](https://insights.sbomify.com/CVE-2024-1402/): Denial of service in mattermost mobile apps and server via emoji reactions (medium 4.3)
- [CVE-2024-14015](https://insights.sbomify.com/CVE-2024-14015/): Studiocart <= 2.9.0 - Reflected XSS (high 7.1)
- [CVE-2024-14012](https://insights.sbomify.com/CVE-2024-14012/): Potential Privilege Escalation in Revenera InstallShield 2023 R1 (high 7.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/470/