# Vulnerabilities published in 2024


- [CVE-2024-12175](https://insights.sbomify.com/CVE-2024-12175/): Rockwell Automation Code Execution Vulnerability in Arena (high 8.5)
- [CVE-2024-12174](https://insights.sbomify.com/CVE-2024-12174/): Security feature bypass in Security Center (low 2.7)
- [CVE-2024-12173](https://insights.sbomify.com/CVE-2024-12173/): Master Slider < 3.10.5 - Editor+ Stored XSS (low 3.5)
- [CVE-2024-12172](https://insights.sbomify.com/CVE-2024-12172/): Missing authorization in WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses (high 7.5)
- [CVE-2024-12171](https://insights.sbomify.com/CVE-2024-12171/): Missing authorization in ELEX WordPress HelpDesk & Customer Ticketing System (high 8.8)
- [CVE-2024-12170](https://insights.sbomify.com/CVE-2024-12170/): ViewMedica Embed <= 1.4.15 - Cross-Site Request Forgery to SQL Injection (medium 5.4)
- [CVE-2024-1217](https://insights.sbomify.com/CVE-2024-1217/): Missing authorization in Kali Forms — Contact Form & Drag-and-Drop Builder (high 7.6)
- [CVE-2024-12169](https://insights.sbomify.com/CVE-2024-12169/): Denial of service in RTU500 (high 8.7)
- [CVE-2024-12168](https://insights.sbomify.com/CVE-2024-12168/): DLL Hijacking in Yandex Telemost (high 8.4)
- [CVE-2024-12167](https://insights.sbomify.com/CVE-2024-12167/): Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via _wpnonce (medium 6.1)
- [CVE-2024-12166](https://insights.sbomify.com/CVE-2024-12166/): Shortcodes Blocks Creator Ultimate <= 2.2.0 - Reflected Cross-Site Scripting via 'page' (medium 6.1)
- [CVE-2024-12165](https://insights.sbomify.com/CVE-2024-12165/): Mollie for Contact Form 7 <= 5.0.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12164](https://insights.sbomify.com/CVE-2024-12164/): Missing authorization in WPSyncSheets For WPForms – Google Sheets Connector for WPForms & Real‑Time Data Export (medium 4.3)
- [CVE-2024-12163](https://insights.sbomify.com/CVE-2024-12163/): GoodLayers Core < 2.1.3 - Subscriber+ Stored XSS via SVG Upload (medium 6.5)
- [CVE-2024-12162](https://insights.sbomify.com/CVE-2024-12162/): Video & Photo Gallery for Ultimate Member <= 1.1.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12160](https://insights.sbomify.com/CVE-2024-12160/): Seraphinite Bulk Discounts for WooCommerce <= 2.4.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12159](https://insights.sbomify.com/CVE-2024-12159/): Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Information Exposure (medium 5.3)
- [CVE-2024-12158](https://insights.sbomify.com/CVE-2024-12158/): Missing authorization in Popup – MailChimp, GetResponse and ActiveCampaign Intergrations (medium 5.3)
- [CVE-2024-12157](https://insights.sbomify.com/CVE-2024-12157/): Popup – MailChimp, GetResponse and ActiveCampaign Intergrations <= 3.2.6 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-12156](https://insights.sbomify.com/CVE-2024-12156/): AI Content Writer, RSS Feed to Post, Autoblogging SEO Help <= 6.1.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12155](https://insights.sbomify.com/CVE-2024-12155/): SV100 Companion <= 2.0.02 - Missing Authorization to Unuathenticated Arbitrary Options Update (critical 9.8)
- [CVE-2024-12153](https://insights.sbomify.com/CVE-2024-12153/): GDY Modular Content <= 0.9.92 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12152](https://insights.sbomify.com/CVE-2024-12152/): MIPL WC Multisite Sync <= 1.1.5 - Unauthenticated Arbitrary File Download (high 7.5)
- [CVE-2024-12151](https://insights.sbomify.com/CVE-2024-12151/): Privilege escalation in Server (medium 5.0)
- [CVE-2024-12150](https://insights.sbomify.com/CVE-2024-12150/): SQLi in Eron Software's Wowwo CRM (critical 9.8)
- [CVE-2024-1215](https://insights.sbomify.com/CVE-2024-1215/): SourceCodester CRUD without Page Reload fetch_data.php cross site scripting (low 3.5)
- [CVE-2024-12149](https://insights.sbomify.com/CVE-2024-12149/): Privilege escalation in Remote Desktop Manager (high 8.1)
- [CVE-2024-12148](https://insights.sbomify.com/CVE-2024-12148/): Missing authorization in Server (medium 4.3)
- [CVE-2024-12147](https://insights.sbomify.com/CVE-2024-12147/): Netgear R6900 HTTP Header upgrade_check.cgi buffer overflow (high 7.1)
- [CVE-2024-12146](https://insights.sbomify.com/CVE-2024-12146/): SQLi in Finder Fire Safety's Finder ERP/CRM (New System) (high 7.5)
- [CVE-2024-12145](https://insights.sbomify.com/CVE-2024-12145/): BuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion (medium 4.3)
- [CVE-2024-12144](https://insights.sbomify.com/CVE-2024-12144/): SQLi in Finder Fire Safety's Finder ERP/CRM (Old System) (critical 9.8)
- [CVE-2024-12143](https://insights.sbomify.com/CVE-2024-12143/): SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDB (critical 9.8)
- [CVE-2024-12142](https://insights.sbomify.com/CVE-2024-12142/): Information disclosure in BMXNOE0100 (high 8.8)
- [CVE-2024-12140](https://insights.sbomify.com/CVE-2024-12140/): Information disclosure in Elementor Addons AI Addons – 70 Widgets, Premium Templates, Ultimate Elements (medium 4.3)
- [CVE-2024-1214](https://insights.sbomify.com/CVE-2024-1214/): Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-12138](https://insights.sbomify.com/CVE-2024-12138/): horilla create_skills deserialization (medium 5.3)
- [CVE-2024-12137](https://insights.sbomify.com/CVE-2024-12137/): Authentication Bypass in Elfatek Elektronics' ANKA JPD-00028 (high 7.6)
- [CVE-2024-12136](https://insights.sbomify.com/CVE-2024-12136/): Improper Access Control in Elfatek Elektronics' ANKA JPD-00028 (medium 6.9)
- [CVE-2024-12133](https://insights.sbomify.com/CVE-2024-12133/): Libtasn1: inefficient der decoding in libtasn1 leading to potential remote dos (medium 5.3)
- [CVE-2024-12132](https://insights.sbomify.com/CVE-2024-12132/): Missing authorization in WP Job Portal – AI-Powered Recruitment System for Company or Job Board website (medium 4.3)
- [CVE-2024-12131](https://insights.sbomify.com/CVE-2024-12131/): Missing authorization in WP Job Portal – AI-Powered Recruitment System for Company or Job Board website (medium 4.3)
- [CVE-2024-12130](https://insights.sbomify.com/CVE-2024-12130/): Rockwell Automation Arena® Out of Bounds Read Vulnerability (high 8.5)
- [CVE-2024-1213](https://insights.sbomify.com/CVE-2024-1213/): Easy Social Feed <= 6.5.4 - Cross-Site Request Forgery (medium 5.4)
- [CVE-2024-12129](https://insights.sbomify.com/CVE-2024-12129/): Royal Core <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2024-12128](https://insights.sbomify.com/CVE-2024-12128/): Cross-site scripting in Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal (medium 6.1)
- [CVE-2024-12127](https://insights.sbomify.com/CVE-2024-12127/): Cross-site scripting in Learning Management System, eLearning, Course Builder, WordPress LMS Plugin – Sikshya LMS (medium 6.1)
- [CVE-2024-12126](https://insights.sbomify.com/CVE-2024-12126/): SEO Keywords <= 1.1.3 - Reflected Cross-Site Scripting via google_error Parameter (medium 6.1)
- [CVE-2024-12125](https://insights.sbomify.com/CVE-2024-12125/): 3scale-porta: readonly fields not validated server-side (high 7.5)
- [CVE-2024-12123](https://insights.sbomify.com/CVE-2024-12123/): Unauthorized Modification of Ticket Requester (medium 5.3)
- [CVE-2024-12122](https://insights.sbomify.com/CVE-2024-12122/): ResAds <= 2.0.6 - Reflected Cross-Site Scripting via Multiple Parameters (medium 6.1)
- [CVE-2024-12121](https://insights.sbomify.com/CVE-2024-12121/): Broken Link Checker | Finder <= 2.5.0 - Authenticated (Author+) Blind Server-Side Request Forgery (medium 5.4)
- [CVE-2024-12120](https://insights.sbomify.com/CVE-2024-12120/): Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-1212](https://insights.sbomify.com/CVE-2024-1212/): Progress Kemp LoadMaster OS Command Injection (critical 10.0, exploited in the wild)
- [CVE-2024-12119](https://insights.sbomify.com/CVE-2024-12119/): Cross-site scripting in Gallery by FooGallery (medium 6.4)
- [CVE-2024-12118](https://insights.sbomify.com/CVE-2024-12118/): The Events Calendar <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12117](https://insights.sbomify.com/CVE-2024-12117/): Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12116](https://insights.sbomify.com/CVE-2024-12116/): Unlimited Theme Addon For Elementor and WooCommerce <= 1.2.2 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-12115](https://insights.sbomify.com/CVE-2024-12115/): Poll Maker <= 5.5.4 - Cross-Site Request Forgery to Poll Duplication (medium 4.3)
- [CVE-2024-12114](https://insights.sbomify.com/CVE-2024-12114/): Missing authorization in Gallery by FooGallery (medium 4.3)
- [CVE-2024-12113](https://insights.sbomify.com/CVE-2024-12113/): Missing authorization in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress (medium 4.3)
- [CVE-2024-12112](https://insights.sbomify.com/CVE-2024-12112/): Easy Form Builder <= 3.8.8 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-12111](https://insights.sbomify.com/CVE-2024-12111/): Potential LDAP injection vulnerability in OpenText Privileged Access Manager (high 8.0)
- [CVE-2024-12110](https://insights.sbomify.com/CVE-2024-12110/): Missing authorization in Gold Addons for Elementor (medium 4.3)
- [CVE-2024-1211](https://insights.sbomify.com/CVE-2024-1211/): Cross-Site Request Forgery (CSRF) in GitLab (medium 6.4)
- [CVE-2024-12109](https://insights.sbomify.com/CVE-2024-12109/): Product Labels For Woocommerce < 1.5.9 - Admin+ SQLi (medium 4.1)
- [CVE-2024-12108](https://insights.sbomify.com/CVE-2024-12108/): WhatsUp Gold - Public API signing key rotation issue (critical 9.6)
- [CVE-2024-12107](https://insights.sbomify.com/CVE-2024-12107/): Double Free in µD3TN (high 7.5)
- [CVE-2024-12106](https://insights.sbomify.com/CVE-2024-12106/): Missing authorization in WhatsUp Gold (critical 9.4)
- [CVE-2024-12105](https://insights.sbomify.com/CVE-2024-12105/): WhatsUp Gold - SnmpExtendedActiveMonitor path traversal (medium 6.5)
- [CVE-2024-12104](https://insights.sbomify.com/CVE-2024-12104/): Missing authorization in Atarim – Visual Feedback, Review & AI Collaboration (medium 5.3)
- [CVE-2024-12103](https://insights.sbomify.com/CVE-2024-12103/): Content No Cache: prevent specific content from being cached <= 0.1.2 - Unauthenticated Private Content Disclosure (medium 5.3)
- [CVE-2024-12102](https://insights.sbomify.com/CVE-2024-12102/): Typer Core <= 1.9.6 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-12100](https://insights.sbomify.com/CVE-2024-12100/): Bitcoin Lightning Publisher for WordPress <= 1.4.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1210](https://insights.sbomify.com/CVE-2024-1210/): LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API (medium 5.3)
- [CVE-2024-12099](https://insights.sbomify.com/CVE-2024-12099/): Dollie Hub – Build Your Own WordPress Cloud Platform <= 6.2.0 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-12098](https://insights.sbomify.com/CVE-2024-12098/): ARS Affiliate Page Plugin <= 2.0.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-12097](https://insights.sbomify.com/CVE-2024-12097/): SQLi in Boceksoft Informatics' E-Travel (critical 9.8)
- [CVE-2024-12096](https://insights.sbomify.com/CVE-2024-12096/): Exhibit to WP Gallery <= 0.0.2 - Reflected XSS (medium 6.1)
- [CVE-2024-12094](https://insights.sbomify.com/CVE-2024-12094/): Information Disclosure Vulnerability in Tinxy (medium 5.4)
- [CVE-2024-12093](https://insights.sbomify.com/CVE-2024-12093/): Improper Validation of Consistency within Input in GitLab (medium 6.8)
- [CVE-2024-12092](https://insights.sbomify.com/CVE-2024-12092/): Cross-site scripting in ENOVIA Collaborative Industry Innovator (high 8.7)
- [CVE-2024-12091](https://insights.sbomify.com/CVE-2024-12091/): Cross-site scripting in ENOVIA Collaborative Industry Innovator (high 8.7)
- [CVE-2024-12090](https://insights.sbomify.com/CVE-2024-12090/): Cross-site scripting in ENOVIA Collaborative Industry Innovator (high 8.7)
- [CVE-2024-1209](https://insights.sbomify.com/CVE-2024-1209/): LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments (medium 5.3)
- [CVE-2024-12089](https://insights.sbomify.com/CVE-2024-12089/): Cross-site scripting in ENOVIA Collaborative Industry Innovator (high 8.7)
- [CVE-2024-12088](https://insights.sbomify.com/CVE-2024-12088/): Rsync: --safe-links option bypass leads to path traversal (medium 6.5)
- [CVE-2024-12087](https://insights.sbomify.com/CVE-2024-12087/): Rsync: path traversal vulnerability in rsync (medium 6.5)
- [CVE-2024-12086](https://insights.sbomify.com/CVE-2024-12086/): Rsync: rsync server leaks arbitrary client files (medium 6.1)
- [CVE-2024-12085](https://insights.sbomify.com/CVE-2024-12085/): Rsync: info leak via uninitialized stack contents (high 7.5)
- [CVE-2024-12084](https://insights.sbomify.com/CVE-2024-12084/): Rsync: heap buffer overflow in rsync due to improper checksum length handling (critical 9.8)
- [CVE-2024-12083](https://insights.sbomify.com/CVE-2024-12083/): Path Traversal Vulnerabilities in NJ/NX-series Machine Automation Controllers (medium 6.6)
- [CVE-2024-12082](https://insights.sbomify.com/CVE-2024-12082/): Ability Runtime has an out-of-bounds read permission bypass vulnerability (medium 5.5)
- [CVE-2024-1208](https://insights.sbomify.com/CVE-2024-1208/): LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API (medium 5.3)
- [CVE-2024-12079](https://insights.sbomify.com/CVE-2024-12079/): ECOVACS lawnmowers cleartext storage of anti-theft PIN (medium 4.8)
- [CVE-2024-12078](https://insights.sbomify.com/CVE-2024-12078/): ECOVACS lawnmowers and vacuums static BLE GATT encryption key (medium 5.3)
- [CVE-2024-12077](https://insights.sbomify.com/CVE-2024-12077/): Booking Calendar and Booking Calendar Pro <= Multiple Versions - Reflected Cross-Site Scripting via 'calendar_id' (medium 6.1)
- [CVE-2024-12076](https://insights.sbomify.com/CVE-2024-12076/): Target Video Easy Publish <= 3.8.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-12074](https://insights.sbomify.com/CVE-2024-12074/): Denial of Service in automatic1111/stable-diffusion-webui (medium 6.5)
- [CVE-2024-12073](https://insights.sbomify.com/CVE-2024-12073/): Meteor Slides <= 1.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/490/