# Vulnerabilities published in 2024


- [CVE-2024-12657](https://insights.sbomify.com/CVE-2024-12657/): IObit Advanced SystemCare Utimate IOCTL AscRegistryFilter.sys 0x8001E000 null pointer dereference (medium 6.8)
- [CVE-2024-12656](https://insights.sbomify.com/CVE-2024-12656/): FabulaTech USB over Network IOCT ftusbbus2.sys 0x220448 null pointer dereference (medium 6.8)
- [CVE-2024-12655](https://insights.sbomify.com/CVE-2024-12655/): FabulaTech USB over Network IOCT ftusbbus2.sys 0x220420 null pointer dereference (medium 6.8)
- [CVE-2024-12654](https://insights.sbomify.com/CVE-2024-12654/): FabulaTech USB over Network IOCT ftusbbus2.sys 0x220408 null pointer dereference (medium 6.8)
- [CVE-2024-12653](https://insights.sbomify.com/CVE-2024-12653/): FabulaTech USB over Network IOCT ftusbbus2.sys 0x22040C null pointer dereference (medium 6.8)
- [CVE-2024-12652](https://insights.sbomify.com/CVE-2024-12652/): Intumit SmartRobot′s Conversational AI Platform - Improper Control of Generation of Code ('Code Injection') (critical 9.3)
- [CVE-2024-12651](https://insights.sbomify.com/CVE-2024-12651/): Sensitive Data Exposure in PTT Inc.'s HGS Mobile App (high 8.5)
- [CVE-2024-12650](https://insights.sbomify.com/CVE-2024-12650/): Wago: Vulnerability in libwagosnmp (medium 5.4)
- [CVE-2024-1265](https://insights.sbomify.com/CVE-2024-1265/): CodeAstro University Management System Attendance Management att_add.php cross site scripting (low 2.4)
- [CVE-2024-12649](https://insights.sbomify.com/CVE-2024-12649/): Memory corruption in Color imageCLASS LBP632Cdw (critical 9.8)
- [CVE-2024-12648](https://insights.sbomify.com/CVE-2024-12648/): Memory corruption in Color imageCLASS LBP632Cdw (critical 9.8)
- [CVE-2024-12647](https://insights.sbomify.com/CVE-2024-12647/): Memory corruption in Color imageCLASS LBP632Cdw (critical 9.8)
- [CVE-2024-12646](https://insights.sbomify.com/CVE-2024-12646/): Chunghwa Telecom topm-client - Arbitrary File Delete (high 8.1)
- [CVE-2024-12645](https://insights.sbomify.com/CVE-2024-12645/): Chunghwa Telecom topm-client - Arbitrary File Read (medium 6.5)
- [CVE-2024-12644](https://insights.sbomify.com/CVE-2024-12644/): Chunghwa Telecom tbm-client - Arbitrary File Copy and Paste (high 7.1)
- [CVE-2024-12643](https://insights.sbomify.com/CVE-2024-12643/): Chunghwa Telecom tbm-client - Arbitrary File Delete (high 8.1)
- [CVE-2024-12642](https://insights.sbomify.com/CVE-2024-12642/): Chunghwa Telecom TenderDocTransfer - Arbitrary File Write (high 8.1)
- [CVE-2024-12641](https://insights.sbomify.com/CVE-2024-12641/): Chunghwa Telecom TenderDocTransfer - Reflected Cross-site Scripting to RCE (critical 9.6)
- [CVE-2024-1264](https://insights.sbomify.com/CVE-2024-1264/): Juanpao JPShop UploadsController.php actionUpdate unrestricted upload (medium 6.3)
- [CVE-2024-12638](https://insights.sbomify.com/CVE-2024-12638/): Bulk Me Now <= 2.0 - Reflected XSS (high 7.1)
- [CVE-2024-12637](https://insights.sbomify.com/CVE-2024-12637/): Moving Users <= 1.05 - Unauthenticated Sensitive Information Exposure (medium 5.3)
- [CVE-2024-12636](https://insights.sbomify.com/CVE-2024-12636/): Cross-site request forgery in Privacy Policy Generator – WPLP Legal Pages (medium 4.3)
- [CVE-2024-12635](https://insights.sbomify.com/CVE-2024-12635/): WP Docs <= 2.2.0 - Authenticated (Subscriber+) Time-Based SQL Injection via 'dir_id' (medium 6.5)
- [CVE-2024-12634](https://insights.sbomify.com/CVE-2024-12634/): Cross-site request forgery in Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins (medium 6.1)
- [CVE-2024-12633](https://insights.sbomify.com/CVE-2024-12633/): JoomSport <= 5.6.17 - Reflected Cross-Site Scripting via page (high 7.1)
- [CVE-2024-1263](https://insights.sbomify.com/CVE-2024-1263/): Juanpao JPShop API PosterController.php actionUpdate unrestricted upload (medium 6.3)
- [CVE-2024-12629](https://insights.sbomify.com/CVE-2024-12629/): Prototype Pollution in Progress® Telerik® KendoReact (medium 4.1)
- [CVE-2024-12628](https://insights.sbomify.com/CVE-2024-12628/): bodi0’s Easy Cache <= 0.8 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-12627](https://insights.sbomify.com/CVE-2024-12627/): Deserialization in Coupon X – Discount Popups & Promo Codes Pop Ups for WooCommerce (high 7.5)
- [CVE-2024-12626](https://insights.sbomify.com/CVE-2024-12626/): AutomatorWP <= 5.0.9 - Reflected Cross-Site Scripting via a-0-o-search_field_value (critical 9.6)
- [CVE-2024-12624](https://insights.sbomify.com/CVE-2024-12624/): Cross-site scripting in Sina Extension for Elementor (medium 6.4)
- [CVE-2024-12623](https://insights.sbomify.com/CVE-2024-12623/): DICOM Support <= 0.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12622](https://insights.sbomify.com/CVE-2024-12622/): WordPress Simple Shopping Cart <= 5.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12621](https://insights.sbomify.com/CVE-2024-12621/): Yumpu E-Paper publishing <= 3.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12620](https://insights.sbomify.com/CVE-2024-12620/): Missing authorization in AnimateGL Animations for WordPress – Elementor & Gutenberg Blocks Animations (medium 5.3)
- [CVE-2024-1262](https://insights.sbomify.com/CVE-2024-1262/): Juanpao JPShop API MaterialController.php actionUpdate unrestricted upload (medium 6.3)
- [CVE-2024-12619](https://insights.sbomify.com/CVE-2024-12619/): Insufficient Granularity of Access Control in GitLab (medium 5.2)
- [CVE-2024-12618](https://insights.sbomify.com/CVE-2024-12618/): Newsletter2Go <= 4.0.14 - Missing Authorization to Authenticated (Subscriber+) Style Reset (medium 4.3)
- [CVE-2024-12617](https://insights.sbomify.com/CVE-2024-12617/): WC Price History for Omnibus <= 2.1.3 - Missing Authorization (medium 5.4)
- [CVE-2024-12616](https://insights.sbomify.com/CVE-2024-12616/): Bitly's WordPress Plugin <= 2.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update (medium 4.3)
- [CVE-2024-12615](https://insights.sbomify.com/CVE-2024-12615/): Passwords Manager <= 1.4.8 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-12614](https://insights.sbomify.com/CVE-2024-12614/): Passwords Manager <= 1.4.8 - Missing Authorization to Authenticated (Subscriber+) Add Password + Update Encryption Key (high 7.5)
- [CVE-2024-12613](https://insights.sbomify.com/CVE-2024-12613/): Passwords Manager <= 1.4.8 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-12612](https://insights.sbomify.com/CVE-2024-12612/): School Management System for Wordpress <= 93.2.0 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-12611](https://insights.sbomify.com/CVE-2024-12611/): School Management System for Wordpress <= 93.0.0 - Reflected Cross-Site Scripting (medium 5.3)
- [CVE-2024-12610](https://insights.sbomify.com/CVE-2024-12610/): School Management System for Wordpress <= 93.0.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion (medium 5.3)
- [CVE-2024-1261](https://insights.sbomify.com/CVE-2024-1261/): Juanpao JPShop API ComboController.php actionIndex unrestricted upload (medium 6.3)
- [CVE-2024-12609](https://insights.sbomify.com/CVE-2024-12609/): School Management System for Wordpress <= 92.0.0 - Authenticated (Student+) SQL Injection via 'view-attendance' (medium 6.5)
- [CVE-2024-12607](https://insights.sbomify.com/CVE-2024-12607/): SQL injection in School Management System for Wordpress (medium 6.5)
- [CVE-2024-12606](https://insights.sbomify.com/CVE-2024-12606/): Missing authorization in Opace AI Scribe: SEO Content Creator & Humaizer for OpenAI & Anthropic (medium 4.3)
- [CVE-2024-12605](https://insights.sbomify.com/CVE-2024-12605/): Cross-site request forgery in Opace AI Scribe: SEO Content Creator & Humaizer for OpenAI & Anthropic (medium 4.3)
- [CVE-2024-12604](https://insights.sbomify.com/CVE-2024-12604/): Improper Authentication in Tapandsign Technologies Tap and Sign App (medium 6.5)
- [CVE-2024-12603](https://insights.sbomify.com/CVE-2024-12603/): Auth bypass in com.transsion.applock (critical 9.8)
- [CVE-2024-12602](https://insights.sbomify.com/CVE-2024-12602/): Auth bypass in HarmonyOS (medium 6.2)
- [CVE-2024-12601](https://insights.sbomify.com/CVE-2024-12601/): Calculated Fields Form <= 5.2.63 - Denial of Service (medium 5.3)
- [CVE-2024-12600](https://insights.sbomify.com/CVE-2024-12600/): Custom Product Tabs Lite for WooCommerce <= 1.9.0 - Authenticated (Shop Manager+) PHP Object Injection (high 7.2)
- [CVE-2024-1260](https://insights.sbomify.com/CVE-2024-1260/): Juanpao JPShop API ComboController.php actionIndex unrestricted upload (medium 6.3)
- [CVE-2024-12599](https://insights.sbomify.com/CVE-2024-12599/): Cross-site scripting in HT Mega Addons for Elementor – Elementor Widgets & Template Builder (medium 6.4)
- [CVE-2024-12598](https://insights.sbomify.com/CVE-2024-12598/): Cross-site scripting in MyBookProgress by Stormhill Media (medium 6.4)
- [CVE-2024-12597](https://insights.sbomify.com/CVE-2024-12597/): HT Mega <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via block_css and inner_css (medium 6.4)
- [CVE-2024-12596](https://insights.sbomify.com/CVE-2024-12596/): Missing authorization in LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes (medium 4.3)
- [CVE-2024-12595](https://insights.sbomify.com/CVE-2024-12595/): AHAthat Plugin <= 1.6 - Reflected XSS via REQUEST_URI (medium 4.7)
- [CVE-2024-12594](https://insights.sbomify.com/CVE-2024-12594/): ALL In One Custom Login Page <= 7.1.1 - Missing Authorization to Authenticated (Subscriber+)Privilege Escalation (high 8.8)
- [CVE-2024-12593](https://insights.sbomify.com/CVE-2024-12593/): Cross-site scripting in PDF for WPForms + Drag and Drop Template Builder (medium 6.4)
- [CVE-2024-12592](https://insights.sbomify.com/CVE-2024-12592/): Sellsy <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12591](https://insights.sbomify.com/CVE-2024-12591/): MagicPost <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wb_share_social Shortcode (medium 6.4)
- [CVE-2024-12590](https://insights.sbomify.com/CVE-2024-12590/): WP Youtube Gallery <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (medium 6.4)
- [CVE-2024-1259](https://insights.sbomify.com/CVE-2024-1259/): Juanpao JPShop API AppController.php unrestricted upload (medium 6.3)
- [CVE-2024-12589](https://insights.sbomify.com/CVE-2024-12589/): Cross-site scripting in Finale Lite – Sales Countdown Timer & Discount for WooCommerce (medium 6.4)
- [CVE-2024-12588](https://insights.sbomify.com/CVE-2024-12588/): Cross-site scripting in Shortcodes and extra features for Phlox theme (medium 6.4)
- [CVE-2024-12587](https://insights.sbomify.com/CVE-2024-12587/): Contact Form Master <= 1.0.7 - Reflected XSS (medium 6.1)
- [CVE-2024-12586](https://insights.sbomify.com/CVE-2024-12586/): Chalet Montagne Com Tools <= 2.7.8 - Reflected XSS (medium 6.1)
- [CVE-2024-12585](https://insights.sbomify.com/CVE-2024-12585/): PropertyHive < 2.1.1 - Reflected XSS (medium 6.1)
- [CVE-2024-12584](https://insights.sbomify.com/CVE-2024-12584/): Information disclosure in Xpro Addons — 140+ Widgets for Elementor (medium 4.3)
- [CVE-2024-12583](https://insights.sbomify.com/CVE-2024-12583/): Code injection in Dynamics 365 Integration (critical 9.9)
- [CVE-2024-12582](https://insights.sbomify.com/CVE-2024-12582/): Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service (high 7.1)
- [CVE-2024-12581](https://insights.sbomify.com/CVE-2024-12581/): Kadence Blocks <= 3.2.53 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-12580](https://insights.sbomify.com/CVE-2024-12580/): Logs Debug Injection in danny-avila/librechat (medium 4.3)
- [CVE-2024-1258](https://insights.sbomify.com/CVE-2024-1258/): Juanpao JPShop API params.php hard-coded key (low 3.1)
- [CVE-2024-12579](https://insights.sbomify.com/CVE-2024-12579/): Minify HTML <= 2.1.10 - - Regular Expressions Denial of Service (medium 5.3)
- [CVE-2024-12578](https://insights.sbomify.com/CVE-2024-12578/): Tickera – WordPress Event Ticketing <= 3.5.4.8 - Unauthenticated Customer Data Exposure (medium 5.3)
- [CVE-2024-12577](https://insights.sbomify.com/CVE-2024-12577/): GPU DDK - rgxfw_pcset_ungrab OOB write via psFWMemContext->uiPageCatBaseRegSet (high 7.3)
- [CVE-2024-12576](https://insights.sbomify.com/CVE-2024-12576/): GPU DDK - Untrusted app can crash firmware by forcing MCU access to non-aligned address (medium 5.5)
- [CVE-2024-12575](https://insights.sbomify.com/CVE-2024-12575/): Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposure (medium 5.3)
- [CVE-2024-12574](https://insights.sbomify.com/CVE-2024-12574/): SVG Shortcode <= 1.0.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload (medium 5.4)
- [CVE-2024-12572](https://insights.sbomify.com/CVE-2024-12572/): Hello in All Languages <= 1.0.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-12571](https://insights.sbomify.com/CVE-2024-12571/): Store Locator <= 3.98.10 - Unauthenticated Local File Inclusion (critical 9.8)
- [CVE-2024-12570](https://insights.sbomify.com/CVE-2024-12570/): Privilege Context Switching Error in GitLab (medium 6.7)
- [CVE-2024-1257](https://insights.sbomify.com/CVE-2024-1257/): Jspxcms find_text.do cross site scripting (low 3.5)
- [CVE-2024-12569](https://insights.sbomify.com/CVE-2024-12569/): Sensitive Information in Driver’s Log File (medium 5.2)
- [CVE-2024-12568](https://insights.sbomify.com/CVE-2024-12568/): Email Subscribers < 5.7.45 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12567](https://insights.sbomify.com/CVE-2024-12567/): Email Subscribers < 5.7.45 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12566](https://insights.sbomify.com/CVE-2024-12566/): Email Subscribers < 5.7.45 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-12564](https://insights.sbomify.com/CVE-2024-12564/): Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ODA CDE inWEB SDK before 2025.3 (medium 6.9)
- [CVE-2024-12563](https://insights.sbomify.com/CVE-2024-12563/): s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode (high 8.8)
- [CVE-2024-12562](https://insights.sbomify.com/CVE-2024-12562/): s2Member Pro <= 241216 - Unauthenticated PHP Object Injection (critical 9.8)
- [CVE-2024-12561](https://insights.sbomify.com/CVE-2024-12561/): Affiliate Sales in Google Analytics and other tools <= 2.0.0 - Open Redirect (medium 6.1)
- [CVE-2024-12560](https://insights.sbomify.com/CVE-2024-12560/): Information disclosure in Button Block – Design Stylish, Interactive, and Multi-Functional Buttons (medium 4.3)
- [CVE-2024-1256](https://insights.sbomify.com/CVE-2024-1256/): Jspxcms filter_text.do cross site scripting (low 3.5)
- [CVE-2024-12559](https://insights.sbomify.com/CVE-2024-12559/): ClickDesigns <= 1.8.0 - Missing Authorization to API Key Modification or Removal (medium 5.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/485/