# Vulnerabilities published in 2024


- [CVE-2024-11691](https://insights.sbomify.com/CVE-2024-11691/): Memory corruption in Firefox (high 8.8)
- [CVE-2024-11690](https://insights.sbomify.com/CVE-2024-11690/): Financial Stocks & Crypto Market Data Plugin <= 1.10.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1169](https://insights.sbomify.com/CVE-2024-1169/): Missing authorization in Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) (high 7.5)
- [CVE-2024-11689](https://insights.sbomify.com/CVE-2024-11689/): HQ Rental Software <= 1.5.29 - Cross-Site Request Forgery to Arbitrary Options Update (high 8.8)
- [CVE-2024-11688](https://insights.sbomify.com/CVE-2024-11688/): LaTeX2HTML <= 2.5.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11687](https://insights.sbomify.com/CVE-2024-11687/): Next-Cart Store to WooCommerce Migration <= 3.9.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11686](https://insights.sbomify.com/CVE-2024-11686/): WhatsApp click to chat <= 3.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11685](https://insights.sbomify.com/CVE-2024-11685/): Kudos Donations – Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting via 'add_query_arg' (medium 6.1)
- [CVE-2024-11684](https://insights.sbomify.com/CVE-2024-11684/): Kudos Donations – Easy donations and payments with Mollie <= 3.2.9 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11683](https://insights.sbomify.com/CVE-2024-11683/): Newsletter Subscriptions <= 2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11682](https://insights.sbomify.com/CVE-2024-11682/): G Web Pro Store Locator <= 2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11681](https://insights.sbomify.com/CVE-2024-11681/): Remote Code Execution in MacPorts (medium 6.9)
- [CVE-2024-11680](https://insights.sbomify.com/CVE-2024-11680/): ProjectSend Improper Authentication (critical 9.8, exploited in the wild)
- [CVE-2024-1168](https://insights.sbomify.com/CVE-2024-1168/): SEOPress – On-site SEO <= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL (medium 6.4)
- [CVE-2024-11679](https://insights.sbomify.com/CVE-2024-11679/): Memory corruption in System x3550 M5 (medium 6.7)
- [CVE-2024-11678](https://insights.sbomify.com/CVE-2024-11678/): CodeAstro Hospital Management System his_doc_register_patient.php cross site scripting (medium 5.3)
- [CVE-2024-11677](https://insights.sbomify.com/CVE-2024-11677/): CodeAstro Hospital Management System Add Vendor Details Page his_admin_add_vendor.php cross site scripting (medium 5.3)
- [CVE-2024-11676](https://insights.sbomify.com/CVE-2024-11676/): CodeAstro Hospital Management System Add Laboratory Equipment Page his_admin_add_lab_equipment.php cross site scripting (medium 5.3)
- [CVE-2024-11675](https://insights.sbomify.com/CVE-2024-11675/): CodeAstro Hospital Management System Add Patient Details Page his_admin_register_patient.php cross site scripting (medium 5.3)
- [CVE-2024-11674](https://insights.sbomify.com/CVE-2024-11674/): CodeAstro Hospital Management System his_doc_update-account.php unrestricted upload (medium 5.3)
- [CVE-2024-11673](https://insights.sbomify.com/CVE-2024-11673/): 1000 Projects Bookstore Management System cross-site request forgery (medium 6.9)
- [CVE-2024-11672](https://insights.sbomify.com/CVE-2024-11672/): Missing authorization in Remote Desktop Manager (medium 4.3)
- [CVE-2024-11671](https://insights.sbomify.com/CVE-2024-11671/): Auth bypass in Remote Desktop Manager (medium 5.4)
- [CVE-2024-11670](https://insights.sbomify.com/CVE-2024-11670/): Missing authorization in Remote Desktop Manager (medium 5.4)
- [CVE-2024-1167](https://insights.sbomify.com/CVE-2024-1167/): SEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity Reference (medium 5.5)
- [CVE-2024-11669](https://insights.sbomify.com/CVE-2024-11669/): Incorrect Authorization in GitLab (medium 6.5)
- [CVE-2024-11668](https://insights.sbomify.com/CVE-2024-11668/): Insufficient Session Expiration in GitLab (medium 4.2)
- [CVE-2024-11667](https://insights.sbomify.com/CVE-2024-11667/): Zyxel Multiple Firewalls Path Traversal (high 7.5, exploited in the wild)
- [CVE-2024-11666](https://insights.sbomify.com/CVE-2024-11666/): Unauthenticated Remote Command Injection in eCharge Salia PLCC (critical 9.0)
- [CVE-2024-11665](https://insights.sbomify.com/CVE-2024-11665/): Unauthenticated Remote Command Injection (high 8.8)
- [CVE-2024-11664](https://insights.sbomify.com/CVE-2024-11664/): eNMS TGZ File controller.py multiselect_filtering path traversal (high 8.7)
- [CVE-2024-11663](https://insights.sbomify.com/CVE-2024-11663/): Codezips E-Commerce Site search.php sql injection (medium 6.9)
- [CVE-2024-11662](https://insights.sbomify.com/CVE-2024-11662/): welliamcao OpsManage API Endpoint deploy_api.py deploy_host_vars deserialization (medium 5.3)
- [CVE-2024-11661](https://insights.sbomify.com/CVE-2024-11661/): Codezips Free Exam Hall Seating Management System Profile Image profile.php unrestricted upload (medium 5.3)
- [CVE-2024-11660](https://insights.sbomify.com/CVE-2024-11660/): code-projects Farmacia usuario.php cross site scripting (medium 5.3)
- [CVE-2024-1166](https://insights.sbomify.com/CVE-2024-1166/): Cross-site scripting in Image Hover Effects – Elementor Addon (medium 6.4)
- [CVE-2024-11659](https://insights.sbomify.com/CVE-2024-11659/): EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_iperf command injection (medium 5.1)
- [CVE-2024-11658](https://insights.sbomify.com/CVE-2024-11658/): EnGenius ENH1350EXT/ENS500-AC/ENS620EXT ajax_getChannelList command injection (medium 5.1)
- [CVE-2024-11657](https://insights.sbomify.com/CVE-2024-11657/): EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_nslookup command injection (medium 5.1)
- [CVE-2024-11656](https://insights.sbomify.com/CVE-2024-11656/): EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_ping6 command injection (medium 5.1)
- [CVE-2024-11655](https://insights.sbomify.com/CVE-2024-11655/): EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_pinginterface command injection (medium 5.1)
- [CVE-2024-11654](https://insights.sbomify.com/CVE-2024-11654/): EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute6 command injection (medium 5.1)
- [CVE-2024-11653](https://insights.sbomify.com/CVE-2024-11653/): EnGenius ENH1350EXT/ENS500-AC/ENS620EXT diag_traceroute command injection (medium 5.1)
- [CVE-2024-11652](https://insights.sbomify.com/CVE-2024-11652/): EnGenius ENH1350EXT/ENS500-AC/ENS620EXT sn_https command injection (medium 5.1)
- [CVE-2024-11651](https://insights.sbomify.com/CVE-2024-11651/): EnGenius ENH1350EXT/ENS500-AC/ENS620EXT wifi_schedule command injection (medium 5.1)
- [CVE-2024-11650](https://insights.sbomify.com/CVE-2024-11650/): Tenda i9 GetIPTV websReadEvent null pointer dereference (high 7.1)
- [CVE-2024-1165](https://insights.sbomify.com/CVE-2024-1165/): Brizy – Page Builder <= 2.4.39 - Authenticated (Contributor+) Directory Traversal (medium 4.3)
- [CVE-2024-11649](https://insights.sbomify.com/CVE-2024-11649/): 1000 Projects Beauty Parlour Management System search-appointment.php sql injection (medium 6.9)
- [CVE-2024-11648](https://insights.sbomify.com/CVE-2024-11648/): 1000 Projects Beauty Parlour Management System add-customer.php sql injection (medium 6.9)
- [CVE-2024-11647](https://insights.sbomify.com/CVE-2024-11647/): 1000 Projects Beauty Parlour Management System view-appointment.php sql injection (medium 6.9)
- [CVE-2024-11646](https://insights.sbomify.com/CVE-2024-11646/): 1000 Projects Beauty Parlour Management System edit-services.php sql injection (medium 6.9)
- [CVE-2024-11645](https://insights.sbomify.com/CVE-2024-11645/): Float Block <= 1.7 - Admin+ Stored XSS via Widget (medium 4.8)
- [CVE-2024-11644](https://insights.sbomify.com/CVE-2024-11644/): WP-SVG <= 0.9 - Contributor+ Stored XSS via Shortcode (medium 5.9)
- [CVE-2024-11643](https://insights.sbomify.com/CVE-2024-11643/): Accessibility by AllAccessible <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Option Update (high 8.8)
- [CVE-2024-11642](https://insights.sbomify.com/CVE-2024-11642/): Post Grid Master <= 3.4.12 - Missing Authorization to Unauthenticated Local PHP File Inclusion (critical 9.8)
- [CVE-2024-11641](https://insights.sbomify.com/CVE-2024-11641/): Cross-site request forgery in VikBooking Hotel Booking Engine & PMS (high 8.8)
- [CVE-2024-11640](https://insights.sbomify.com/CVE-2024-11640/): Cross-site request forgery in VikRentCar Car Rental Management System (high 8.8)
- [CVE-2024-1164](https://insights.sbomify.com/CVE-2024-1164/): Brizy – Page Builder <= 2.4.43 - Authenticated(Contributor+) Stored Cross-Site Scripting via Form Functionality (medium 6.4)
- [CVE-2024-11639](https://insights.sbomify.com/CVE-2024-11639/): Auth bypass in Cloud Services Application (critical 10.0)
- [CVE-2024-11638](https://insights.sbomify.com/CVE-2024-11638/): Gtbabel < 6.6.9 - Unauthenticated Admin Account Takeover (high 8.8)
- [CVE-2024-11636](https://insights.sbomify.com/CVE-2024-11636/): Email Subscribers < 5.7.45 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-11635](https://insights.sbomify.com/CVE-2024-11635/): WordPress File Upload <= 4.24.12 - Unuathenticated Remote Code Execution (critical 9.8)
- [CVE-2024-11634](https://insights.sbomify.com/CVE-2024-11634/): Command injection in Connect Secure (critical 9.1)
- [CVE-2024-11633](https://insights.sbomify.com/CVE-2024-11633/): Command injection in Connect Secure (critical 9.1)
- [CVE-2024-11632](https://insights.sbomify.com/CVE-2024-11632/): code-projects Simple Car Rental System book_car.php sql injection (medium 6.9)
- [CVE-2024-11631](https://insights.sbomify.com/CVE-2024-11631/): itsourcecode Tailoring Management System expedit.php sql injection (medium 5.3)
- [CVE-2024-11630](https://insights.sbomify.com/CVE-2024-11630/): E-Lins H685/H685f/H700/H720/H750/H820/H820Q/H820Q0/H900 OEM Backend hard-coded credentials (medium 6.9)
- [CVE-2024-1163](https://insights.sbomify.com/CVE-2024-1163/): Path traversal vulnerability in mapshaper (high 7.7)
- [CVE-2024-11629](https://insights.sbomify.com/CVE-2024-11629/): Telerik Document Processing RTF Export of Arbitrary File Path (high 7.1)
- [CVE-2024-11628](https://insights.sbomify.com/CVE-2024-11628/): Prototype Pollution in Progress® Telerik® Kendo UI for Vue (medium 4.1)
- [CVE-2024-11627](https://insights.sbomify.com/CVE-2024-11627/): Auth bypass in Sitefinity (medium 6.8)
- [CVE-2024-11626](https://insights.sbomify.com/CVE-2024-11626/): Cross-site scripting in Sitefinity (high 8.4)
- [CVE-2024-11625](https://insights.sbomify.com/CVE-2024-11625/): Information disclosure in Sitefinity (high 7.7)
- [CVE-2024-11624](https://insights.sbomify.com/CVE-2024-11624/): Privilege escalation in Android (high 7.8)
- [CVE-2024-11623](https://insights.sbomify.com/CVE-2024-11623/): Stored XSS in authentik (medium 4.8)
- [CVE-2024-11622](https://insights.sbomify.com/CVE-2024-11622/): XML external entity in HPE Insight Remote Support (high 7.3)
- [CVE-2024-11621](https://insights.sbomify.com/CVE-2024-11621/): Security feature bypass in Remote Desktop Manager (high 8.8)
- [CVE-2024-11620](https://insights.sbomify.com/CVE-2024-11620/): WordPress Rank Math SEO plugin <= 1.0.231 - Arbitrary .htaccess Overwrite to Remote Code Execution (RCE) vulnerability (high 7.2)
- [CVE-2024-1162](https://insights.sbomify.com/CVE-2024-1162/): Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-11619](https://insights.sbomify.com/CVE-2024-11619/): macrozheng mall JWT Token default key (low 2.3)
- [CVE-2024-11618](https://insights.sbomify.com/CVE-2024-11618/): IPC Unigy Management System HTTP Request server-side request forgery (medium 6.9)
- [CVE-2024-11617](https://insights.sbomify.com/CVE-2024-11617/): Envolve Plugin <= 1.0 - Unauthenticated Arbitrary File Upload via language_file and fonts_file (critical 9.8)
- [CVE-2024-11616](https://insights.sbomify.com/CVE-2024-11616/): Double-fetch heap overflow (medium 5.6)
- [CVE-2024-11615](https://insights.sbomify.com/CVE-2024-11615/): Envolve Plugin <= 1.0 - Unauthenticated Language File Deletion (medium 5.3)
- [CVE-2024-11614](https://insights.sbomify.com/CVE-2024-11614/): Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library (high 7.4)
- [CVE-2024-11613](https://insights.sbomify.com/CVE-2024-11613/): Code injection in Iptanus File Upload (critical 9.8)
- [CVE-2024-11612](https://insights.sbomify.com/CVE-2024-11612/): 7-Zip CopyCoder Infinite Loop Denial-of-Service Vulnerability (medium 6.5)
- [CVE-2024-11611](https://insights.sbomify.com/CVE-2024-11611/): AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11610](https://insights.sbomify.com/CVE-2024-11610/): AutomationDirect C-More EA9 EAP9 File Parsing Memory Corruption Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-1161](https://insights.sbomify.com/CVE-2024-1161/): Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes (medium 6.4)
- [CVE-2024-11609](https://insights.sbomify.com/CVE-2024-11609/): AutomationDirect C-More EA9 EAP9 File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-11608](https://insights.sbomify.com/CVE-2024-11608/): Memory corruption in Revit (high 7.8)
- [CVE-2024-11607](https://insights.sbomify.com/CVE-2024-11607/): GTPayment Donations <= 1.0.0 - Stored XSS via CSRF (medium 6.1)
- [CVE-2024-11606](https://insights.sbomify.com/CVE-2024-11606/): Tabs Shortcode <= 2.0.2 - Contributor+ XSS via Shortcode (medium 5.3)
- [CVE-2024-11605](https://insights.sbomify.com/CVE-2024-11605/): WP Publications <= 1.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-11604](https://insights.sbomify.com/CVE-2024-11604/): Insertion of Sensitive Information into Log File (high 7.3)
- [CVE-2024-11603](https://insights.sbomify.com/CVE-2024-11603/): Server-Side Request Forgery in lm-sys/fastchat (high 7.5)
- [CVE-2024-11602](https://insights.sbomify.com/CVE-2024-11602/): CORS Vulnerability in feast-dev/feast (high 7.4)
- [CVE-2024-11601](https://insights.sbomify.com/CVE-2024-11601/): Cross-site request forgery in Sky Addons – Elementor Addons with Widgets & Templates (high 8.1)
- [CVE-2024-11600](https://insights.sbomify.com/CVE-2024-11600/): Code injection in Borderless – Addons and Templates for Elementor (high 7.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/495/