# Vulnerabilities published in 2024


- [CVE-2024-12769](https://insights.sbomify.com/CVE-2024-12769/): Simple Banner < 3.0.4 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-12768](https://insights.sbomify.com/CVE-2024-12768/): Responsive iframe <= 1.2.0 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-12767](https://insights.sbomify.com/CVE-2024-12767/): BuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR (low 3.5)
- [CVE-2024-12766](https://insights.sbomify.com/CVE-2024-12766/): SSRF in parisneo/lollms-webui (high 7.5)
- [CVE-2024-12761](https://insights.sbomify.com/CVE-2024-12761/): Denial of Service in brycedrennan/imaginairy (high 7.5)
- [CVE-2024-1276](https://insights.sbomify.com/CVE-2024-1276/): Cross-site scripting in Essential Addons for Elementor – Popular Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-12757](https://insights.sbomify.com/CVE-2024-12757/): Nedap Librix Ecoreader Missing Authentication for Critical Function (high 8.8)
- [CVE-2024-12756](https://insights.sbomify.com/CVE-2024-12756/): Avaya Spaces HTML injection (HTMLi) Vulnerability (high 7.3)
- [CVE-2024-12755](https://insights.sbomify.com/CVE-2024-12755/): Avaya Spaces XSS Vulnerability (high 7.9)
- [CVE-2024-12754](https://insights.sbomify.com/CVE-2024-12754/): AnyDesk Link Following Information Disclosure Vulnerability (medium 5.5)
- [CVE-2024-12753](https://insights.sbomify.com/CVE-2024-12753/): Foxit PDF Reader Link Following Local Privilege Escalation Vulnerability (medium 6.7)
- [CVE-2024-12752](https://insights.sbomify.com/CVE-2024-12752/): Foxit PDF Reader AcroForm Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-12751](https://insights.sbomify.com/CVE-2024-12751/): Foxit PDF Reader AcroForm Out-Of-Bounds Read Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-12750](https://insights.sbomify.com/CVE-2024-12750/): Competition Form <= 2.0 - Competition Deletion via CSRF (medium 4.3)
- [CVE-2024-1275](https://insights.sbomify.com/CVE-2024-1275/): Vulnerability in Baxter Welch Allyn Connex Spot Monitor (critical 9.1)
- [CVE-2024-12749](https://insights.sbomify.com/CVE-2024-12749/): Competition Form <= 2.0 - Reflected XSS (high 7.1)
- [CVE-2024-12747](https://insights.sbomify.com/CVE-2024-12747/): Rsync: race condition in rsync handling symbolic links (medium 5.6)
- [CVE-2024-12746](https://insights.sbomify.com/CVE-2024-12746/): SQL Injection in the Amazon Redshift ODBC Driver affecting v2.1.5.0 (high 8.6)
- [CVE-2024-12745](https://insights.sbomify.com/CVE-2024-12745/): SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4 (high 8.6)
- [CVE-2024-12744](https://insights.sbomify.com/CVE-2024-12744/): SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31 (high 8.6)
- [CVE-2024-12743](https://insights.sbomify.com/CVE-2024-12743/): MailPoet < 5.5.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12742](https://insights.sbomify.com/CVE-2024-12742/): Deserialization of Untrusted Data Vulnerability in NI G Web Development Software (high 8.4)
- [CVE-2024-12741](https://insights.sbomify.com/CVE-2024-12741/): Deserialization Of Untrusted Data Vulnerability In NI DAQExpress Project File (high 8.4)
- [CVE-2024-12740](https://insights.sbomify.com/CVE-2024-12740/): Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software (high 7.0)
- [CVE-2024-1274](https://insights.sbomify.com/CVE-2024-1274/): My Calendar < 3.4.24 - Authenticated Stored XSS (medium 5.4)
- [CVE-2024-12739](https://insights.sbomify.com/CVE-2024-12739/): Mobile Contact Bar < 3.0.5 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12738](https://insights.sbomify.com/CVE-2024-12738/): Cross-site scripting in User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor (medium 6.1)
- [CVE-2024-12737](https://insights.sbomify.com/CVE-2024-12737/): WP BASE Booking of Appointments, Services and Events < 5.0.0 - Reflected XSS (medium 6.1)
- [CVE-2024-12736](https://insights.sbomify.com/CVE-2024-12736/): BU Section Editing <= 0.9.9 - Reflected XSS (medium 6.1)
- [CVE-2024-12735](https://insights.sbomify.com/CVE-2024-12735/): Advance Post Prefix <= 1.1.1 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-12734](https://insights.sbomify.com/CVE-2024-12734/): Advance Post Prefix <= 1.1.1 - Reflected XSS (medium 6.1)
- [CVE-2024-12733](https://insights.sbomify.com/CVE-2024-12733/): AffiliateImporterEb <= 1.0.6 - Reflected XSS via Search (medium 6.1)
- [CVE-2024-12732](https://insights.sbomify.com/CVE-2024-12732/): AffiliateImporterEb <= 1.0.6 - Reflected XSS (medium 6.1)
- [CVE-2024-12731](https://insights.sbomify.com/CVE-2024-12731/): aklamator-infeed <= 2.0.0 - Reflected XSS (medium 6.1)
- [CVE-2024-1273](https://insights.sbomify.com/CVE-2024-1273/): Starbox < 3.5.0 - Contributor+ Stored XSS (medium 6.1)
- [CVE-2024-12729](https://insights.sbomify.com/CVE-2024-12729/): Code injection in Sophos Firewall (high 8.8)
- [CVE-2024-12728](https://insights.sbomify.com/CVE-2024-12728/): Hardcoded credentials in Sophos Firewall (critical 9.8)
- [CVE-2024-12727](https://insights.sbomify.com/CVE-2024-12727/): SQL injection in Sophos Firewall (critical 9.8)
- [CVE-2024-12726](https://insights.sbomify.com/CVE-2024-12726/): ClipArt <= 0.2 - Reflected XSS (medium 6.1)
- [CVE-2024-12725](https://insights.sbomify.com/CVE-2024-12725/): Clasify Classified Listing <= 1.0.7 - Reflected XSS (medium 6.1)
- [CVE-2024-12724](https://insights.sbomify.com/CVE-2024-12724/): WP DeskLite <= 1.0.0 - Reflected XSS (medium 6.1)
- [CVE-2024-12723](https://insights.sbomify.com/CVE-2024-12723/): Infility Global <= 2.9.8 - Reflected XSS (medium 6.1)
- [CVE-2024-12722](https://insights.sbomify.com/CVE-2024-12722/): Twitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Stored XSS via Shortcode (medium 5.4)
- [CVE-2024-12721](https://insights.sbomify.com/CVE-2024-12721/): Custom Product Tabs For WooCommerce <= 1.2.4 - Authenticated (Shop Manager+) PHP Object Injection (high 7.2)
- [CVE-2024-12720](https://insights.sbomify.com/CVE-2024-12720/): Regular Expression Denial of Service (ReDoS) in huggingface/transformers (medium 5.3)
- [CVE-2024-1272](https://insights.sbomify.com/CVE-2024-1272/): Information Disclosure to Source Code in TNB Mobile Solutions' Cockpit Software (high 7.5)
- [CVE-2024-12719](https://insights.sbomify.com/CVE-2024-12719/): WordPress File Upload <= 4.24.15 - Missing Authorization to Authenticated (Subscriber+) Limited Path Traversal (medium 4.3)
- [CVE-2024-12718](https://insights.sbomify.com/CVE-2024-12718/): Bypass extraction filter to modify file metadata outside extraction directory (medium 5.3)
- [CVE-2024-12717](https://insights.sbomify.com/CVE-2024-12717/): aklamator-infeed <= 2.0.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12716](https://insights.sbomify.com/CVE-2024-12716/): Simple Basic Contact Form < 20250114 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12715](https://insights.sbomify.com/CVE-2024-12715/): Asgard Security Scanner <= 0.7 - Reflected XSS (medium 6.1)
- [CVE-2024-12714](https://insights.sbomify.com/CVE-2024-12714/): Backlink Monitoring Manager <= 0.1.3 - Reflected XSS (medium 6.1)
- [CVE-2024-12713](https://insights.sbomify.com/CVE-2024-12713/): Missing authorization in SureForms – Contact Form, Payment Form & Other Custom Form Builder (medium 5.3)
- [CVE-2024-12712](https://insights.sbomify.com/CVE-2024-12712/): Shopping Cart & eCommerce Store <= 5.7.8 - Missing Authorization to Order Updates (medium 5.3)
- [CVE-2024-12711](https://insights.sbomify.com/CVE-2024-12711/): RSVP and Event Management <= 2.7.13 - Missing Authorization (medium 5.3)
- [CVE-2024-12710](https://insights.sbomify.com/CVE-2024-12710/): WP-Appbox <= 4.5.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12709](https://insights.sbomify.com/CVE-2024-12709/): Bulk Me Now <= 2.0 - Message Deletion via CSRF (medium 4.3)
- [CVE-2024-12708](https://insights.sbomify.com/CVE-2024-12708/): Bulk Me Now <= 2.0 - Stored XSS via Shortcode (high 7.1)
- [CVE-2024-12706](https://insights.sbomify.com/CVE-2024-12706/): SQL Injection vulnerability discovered in OpenText™ Digital Asset Management. (low 2.1)
- [CVE-2024-12705](https://insights.sbomify.com/CVE-2024-12705/): DNS-over-HTTPS implementation suffers from multiple issues under heavy query load (high 7.5)
- [CVE-2024-12704](https://insights.sbomify.com/CVE-2024-12704/): Denial of Service (DoS) in run-llama/llama_index (high 7.5)
- [CVE-2024-12703](https://insights.sbomify.com/CVE-2024-12703/): Deserialization in RemoteConnect and SCADAPack x70 Utilities (high 8.5)
- [CVE-2024-12701](https://insights.sbomify.com/CVE-2024-12701/): WP Smart Import : Import any XML File to WordPress <= 1.1.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12700](https://insights.sbomify.com/CVE-2024-12700/): Tibbo AggreGate Network Manager Unrestricted Upload of File with Dangerous Type (high 8.7)
- [CVE-2024-12699](https://insights.sbomify.com/CVE-2024-12699/): Service Box <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12698](https://insights.sbomify.com/CVE-2024-12698/): Ose-olm-catalogd-container: incomplete fix for rapid reset (cve-2023-39325/cve-2023-44487) (medium 6.5)
- [CVE-2024-12697](https://insights.sbomify.com/CVE-2024-12697/): real.Kit <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12696](https://insights.sbomify.com/CVE-2024-12696/): Cross-site scripting in Picture Gallery – Frontend Image Uploads, AJAX Photo List (medium 6.4)
- [CVE-2024-12695](https://insights.sbomify.com/CVE-2024-12695/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-12694](https://insights.sbomify.com/CVE-2024-12694/): Use after free in Chrome (high 8.8)
- [CVE-2024-12693](https://insights.sbomify.com/CVE-2024-12693/): Memory corruption in Chrome (high 8.0)
- [CVE-2024-12692](https://insights.sbomify.com/CVE-2024-12692/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-1269](https://insights.sbomify.com/CVE-2024-1269/): SourceCodester Product Management System supplier.php cross site scripting (low 2.4)
- [CVE-2024-12687](https://insights.sbomify.com/CVE-2024-12687/): Insecure YAML Deserialization (high 8.6)
- [CVE-2024-12686](https://insights.sbomify.com/CVE-2024-12686/): BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection (medium 6.6, exploited in the wild)
- [CVE-2024-12683](https://insights.sbomify.com/CVE-2024-12683/): Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-12682](https://insights.sbomify.com/CVE-2024-12682/): Smart Maintenance Mode < 1.5.2 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-12680](https://insights.sbomify.com/CVE-2024-12680/): Prisna GWT < 1.4.14 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1268](https://insights.sbomify.com/CVE-2024-1268/): CodeAstro Restaurant POS System update_product.php unrestricted upload (medium 6.3)
- [CVE-2024-12679](https://insights.sbomify.com/CVE-2024-12679/): Prisna GWT < 1.4.14 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12678](https://insights.sbomify.com/CVE-2024-12678/): Nomad Allocations Vulnerable To Privilege Escalation Within A Namespace Using Unredacted Workload Identity Tokens (medium 6.5)
- [CVE-2024-12677](https://insights.sbomify.com/CVE-2024-12677/): Delta Electronics DTM Soft Deserialization of Untrusted Data (high 8.5)
- [CVE-2024-12673](https://insights.sbomify.com/CVE-2024-12673/): Privilege escalation in Vantage (high 8.5)
- [CVE-2024-12672](https://insights.sbomify.com/CVE-2024-12672/): Rockwell Automation Third Party Vulnerability in Arena® (high 8.5)
- [CVE-2024-12671](https://insights.sbomify.com/CVE-2024-12671/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12670](https://insights.sbomify.com/CVE-2024-12670/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-1267](https://insights.sbomify.com/CVE-2024-1267/): CodeAstro Restaurant POS System create_account.php cross site scripting (low 3.5)
- [CVE-2024-12669](https://insights.sbomify.com/CVE-2024-12669/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-12668](https://insights.sbomify.com/CVE-2024-12668/): Velocidex WinPmem Out of Bounds Write Vulnerability (high 8.2)
- [CVE-2024-12667](https://insights.sbomify.com/CVE-2024-12667/): InvoicePlane view session expiration (medium 6.3)
- [CVE-2024-12666](https://insights.sbomify.com/CVE-2024-12666/): ClassCMS User Management Page admin insufficient privileges (medium 5.1)
- [CVE-2024-12665](https://insights.sbomify.com/CVE-2024-12665/): ruifang-tech Rebuild Task Comment Attachment Upload cross site scripting (medium 5.3)
- [CVE-2024-12664](https://insights.sbomify.com/CVE-2024-12664/): ruifang-tech Rebuild Project Task Comment cross site scripting (medium 5.3)
- [CVE-2024-12663](https://insights.sbomify.com/CVE-2024-12663/): funnyzpc Mee-Admin Login login observable response discrepancy (medium 6.3)
- [CVE-2024-12662](https://insights.sbomify.com/CVE-2024-12662/): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E040 null pointer dereference (medium 6.8)
- [CVE-2024-12661](https://insights.sbomify.com/CVE-2024-12661/): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E024 null pointer dereference (medium 6.8)
- [CVE-2024-12660](https://insights.sbomify.com/CVE-2024-12660/): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E018 null pointer dereference (medium 6.8)
- [CVE-2024-1266](https://insights.sbomify.com/CVE-2024-1266/): CodeAstro University Management System Student Registration Form st_reg.php cross site scripting (low 2.4)
- [CVE-2024-12659](https://insights.sbomify.com/CVE-2024-12659/): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E004 null pointer dereference (medium 6.8)
- [CVE-2024-12658](https://insights.sbomify.com/CVE-2024-12658/): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E01C null pointer dereference (medium 6.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/484/