# Vulnerabilities published in 2024


- [CVE-2024-11504](https://insights.sbomify.com/CVE-2024-11504/): SQL Injection in Streamsoft Prestiż (high 8.6)
- [CVE-2024-11503](https://insights.sbomify.com/CVE-2024-11503/): WP Tabs < 2.2.7 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-11502](https://insights.sbomify.com/CVE-2024-11502/): Planning Center Online Giving <= 1.0.0 - Contributor+ XSS via Shortcode (medium 5.4)
- [CVE-2024-11501](https://insights.sbomify.com/CVE-2024-11501/): Gallery <= 1.3 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-1150](https://insights.sbomify.com/CVE-2024-1150/): Improper validation of update packages (high 7.8)
- [CVE-2024-11499](https://insights.sbomify.com/CVE-2024-11499/): Null dereference in RTU500 (medium 6.9)
- [CVE-2024-11498](https://insights.sbomify.com/CVE-2024-11498/): Resource exhaustion via Stack overflow in libjxl (medium 6.9)
- [CVE-2024-11497](https://insights.sbomify.com/CVE-2024-11497/): Phoenix Contact: CHARX-SEC3xxx Charge controllers vulnerable to privilege escalation (high 8.8)
- [CVE-2024-11496](https://insights.sbomify.com/CVE-2024-11496/): Infility Global <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Plugin Options Update (medium 6.5)
- [CVE-2024-11495](https://insights.sbomify.com/CVE-2024-11495/): Buffer overflow in OllyDbg (high 7.5)
- [CVE-2024-11494](https://insights.sbomify.com/CVE-2024-11494/): Auth bypass in P-6101C firmware (high 7.5)
- [CVE-2024-11493](https://insights.sbomify.com/CVE-2024-11493/): 115cms pageAE.html cross site scripting (medium 5.3)
- [CVE-2024-11492](https://insights.sbomify.com/CVE-2024-11492/): 115cms appurladd.html cross site scripting (medium 5.3)
- [CVE-2024-11491](https://insights.sbomify.com/CVE-2024-11491/): 115cms useradmin.html cross site scripting (medium 5.3)
- [CVE-2024-11490](https://insights.sbomify.com/CVE-2024-11490/): 115cms set.html cross site scripting (medium 5.3)
- [CVE-2024-1149](https://insights.sbomify.com/CVE-2024-1149/): Improper validation of update packages (high 7.8)
- [CVE-2024-11489](https://insights.sbomify.com/CVE-2024-11489/): 115cms file.html cross site scripting (medium 5.3)
- [CVE-2024-11488](https://insights.sbomify.com/CVE-2024-11488/): 115cms web_user.html cross site scripting (medium 5.3)
- [CVE-2024-11487](https://insights.sbomify.com/CVE-2024-11487/): Code4Berry Decoration Management System Between Dates Reports btndates_report.php sql injection (medium 5.3)
- [CVE-2024-11486](https://insights.sbomify.com/CVE-2024-11486/): Code4Berry Decoration Management System User Permission user_permission.php (medium 5.3)
- [CVE-2024-11485](https://insights.sbomify.com/CVE-2024-11485/): Code4Berry Decoration Management System User userregister.php permission (medium 5.3)
- [CVE-2024-11484](https://insights.sbomify.com/CVE-2024-11484/): Code4Berry Decoration Management System User Image update_image.php access control (medium 5.3)
- [CVE-2024-11483](https://insights.sbomify.com/CVE-2024-11483/): Automation-gateway: aap-gateway: improper scope handling in oauth2 tokens for aap 2.5 (medium 5.0)
- [CVE-2024-11482](https://insights.sbomify.com/CVE-2024-11482/): Command injection in Trellix Enterprise Security Manager (ESM) (critical 9.8)
- [CVE-2024-11481](https://insights.sbomify.com/CVE-2024-11481/): Path traversal in Trellix Enterprise Security Manager (ESM) (high 8.2)
- [CVE-2024-1148](https://insights.sbomify.com/CVE-2024-1148/): Weak Access Control - Arbitrary file upload (critical 9.8)
- [CVE-2024-11479](https://insights.sbomify.com/CVE-2024-11479/): Authenticated HTML Injection in Issuetrak Ticket Comment Function (medium 5.1)
- [CVE-2024-11477](https://insights.sbomify.com/CVE-2024-11477/): 7-Zip Zstandard Decompression Integer Underflow Remote Code Execution Vulnerability (high 7.8)
- [CVE-2024-1147](https://insights.sbomify.com/CVE-2024-1147/): Weak Access Control - Arbitrary file download (critical 9.8)
- [CVE-2024-11468](https://insights.sbomify.com/CVE-2024-11468/): Privilege escalation in Omnissa Horizon Client for MacOS (high 7.8)
- [CVE-2024-11467](https://insights.sbomify.com/CVE-2024-11467/): Privilege escalation in Omnissa Horizon Client for MacOS (high 7.8)
- [CVE-2024-11466](https://insights.sbomify.com/CVE-2024-11466/): Intro Tour Tutorial DeepPresentation <= 6.5.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11465](https://insights.sbomify.com/CVE-2024-11465/): Custom Product Tabs for WooCommerce <= 1.8.5 - Authenticated (Shop Manager+) PHP Object Injection (high 7.2)
- [CVE-2024-11464](https://insights.sbomify.com/CVE-2024-11464/): Easy Code Snippets <= 1.0.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11463](https://insights.sbomify.com/CVE-2024-11463/): DeBounce Email Validator <= 5.6.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11462](https://insights.sbomify.com/CVE-2024-11462/): Filestack Official <= 2.1.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11461](https://insights.sbomify.com/CVE-2024-11461/): Form Data Collector <= 2.2.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11460](https://insights.sbomify.com/CVE-2024-11460/): Verowa Connect <= 3.0.1 - Unauthenticated SQL Injection (high 7.5)
- [CVE-2024-1146](https://insights.sbomify.com/CVE-2024-1146/): Cross-site Scripting at Alma Devklan Blog (medium 5.8)
- [CVE-2024-11459](https://insights.sbomify.com/CVE-2024-11459/): Country Blocker <= 3.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11458](https://insights.sbomify.com/CVE-2024-11458/): FAQ Builder AYS <= 1.7.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11457](https://insights.sbomify.com/CVE-2024-11457/): Feedpress Generator – External RSS Frontend Customizer <= 1.2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11456](https://insights.sbomify.com/CVE-2024-11456/): Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11455](https://insights.sbomify.com/CVE-2024-11455/): Include Mastodon Feed <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11454](https://insights.sbomify.com/CVE-2024-11454/): Untrusted Search Path vulnerability in Autodesk Revit (high 7.8)
- [CVE-2024-11453](https://insights.sbomify.com/CVE-2024-11453/): Cross-site scripting in GS Pinterest Portfolio – Pins Grid, Masonry, User Profile, Popup & Board Widgets (medium 6.4)
- [CVE-2024-11452](https://insights.sbomify.com/CVE-2024-11452/): Chamber Dashboard Business Directory <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11451](https://insights.sbomify.com/CVE-2024-11451/): Zooom <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11450](https://insights.sbomify.com/CVE-2024-11450/): ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1145](https://insights.sbomify.com/CVE-2024-1145/): Observable Response Discrepancy at Alma Devklan Blog (medium 5.3)
- [CVE-2024-11449](https://insights.sbomify.com/CVE-2024-11449/): Server-Side Request Forgery in haotian-liu/llava (high 7.5)
- [CVE-2024-11447](https://insights.sbomify.com/CVE-2024-11447/): Cross-site scripting in Community by PeepSo – Download from PeepSo.com (medium 6.1)
- [CVE-2024-11446](https://insights.sbomify.com/CVE-2024-11446/): Chessgame Shizzle <= 1.3.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11445](https://insights.sbomify.com/CVE-2024-11445/): Image Magnify <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11444](https://insights.sbomify.com/CVE-2024-11444/): CLUEVO LMS, E-Learning Platform <= 1.13.2 - Cross-Site Request Forgery to Module Deletion (medium 4.3)
- [CVE-2024-11443](https://insights.sbomify.com/CVE-2024-11443/): de:branding <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2024-11442](https://insights.sbomify.com/CVE-2024-11442/): Horizontal scroll image slideshow <= 10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11441](https://insights.sbomify.com/CVE-2024-11441/): Stored XSS in Serge in serge-chat/serge (medium 6.1)
- [CVE-2024-11440](https://insights.sbomify.com/CVE-2024-11440/): Grey Owl Lightbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1144](https://insights.sbomify.com/CVE-2024-1144/): Improper Access Control at Alma Devklan Blog (medium 6.5)
- [CVE-2024-11439](https://insights.sbomify.com/CVE-2024-11439/): ScanCircle <= 2.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11438](https://insights.sbomify.com/CVE-2024-11438/): StreamWeasels Online Status Bar <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11437](https://insights.sbomify.com/CVE-2024-11437/): Timeline Designer <= 1.4 - Authenticated (Admin+) SQL Injection (medium 4.9)
- [CVE-2024-11436](https://insights.sbomify.com/CVE-2024-11436/): Cross-site scripting in Pie Forms — Drag & Drop Form Builder (medium 6.1)
- [CVE-2024-11435](https://insights.sbomify.com/CVE-2024-11435/): salavat counter Plugin <= 0.9.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11434](https://insights.sbomify.com/CVE-2024-11434/): WP – Bulk SMS – by SMS.to <= 1.0.12 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11433](https://insights.sbomify.com/CVE-2024-11433/): Surbma | SalesAutopilot Shortcode <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11432](https://insights.sbomify.com/CVE-2024-11432/): SuevaFree Essential Kit <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11431](https://insights.sbomify.com/CVE-2024-11431/): Ragic Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11430](https://insights.sbomify.com/CVE-2024-11430/): SQL Chart Builder <= 2.3.6 - Authenticated (Contributor+) SQL Injection (medium 6.5)
- [CVE-2024-1143](https://insights.sbomify.com/CVE-2024-1143/): Central Dogma Authentication Bypass Vulnerability via Session Leakage (critical 9.3)
- [CVE-2024-11429](https://insights.sbomify.com/CVE-2024-11429/): Path traversal in Stars Testimonials — Responsive Reviews & Star Ratings (high 8.8)
- [CVE-2024-11428](https://insights.sbomify.com/CVE-2024-11428/): Lazy load videos and sticky control <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11427](https://insights.sbomify.com/CVE-2024-11427/): Catch Popup <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11426](https://insights.sbomify.com/CVE-2024-11426/): Cross-site scripting in AutoListicle: Automatically Update Numbered List Articles (medium 6.4)
- [CVE-2024-11425](https://insights.sbomify.com/CVE-2024-11425/): Denial of service in BMENOR2200H (high 8.7)
- [CVE-2024-11424](https://insights.sbomify.com/CVE-2024-11424/): Slick Sitemap <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11423](https://insights.sbomify.com/CVE-2024-11423/): Ultimate Gift Cards for WooCommerce <= 3.0.6 - Missing Authorization to Infinite Money Glitch (high 7.5)
- [CVE-2024-11422](https://insights.sbomify.com/CVE-2024-11422/): DWFX File Parsing Vulnerabilities in Autodesk Navisworks Desktop Software (high 7.8)
- [CVE-2024-11420](https://insights.sbomify.com/CVE-2024-11420/): Blocksy <= 2.0.77 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1142](https://insights.sbomify.com/CVE-2024-1142/): Sonatype IQ Server - Path Traversal (medium 5.4)
- [CVE-2024-11419](https://insights.sbomify.com/CVE-2024-11419/): Password for WP <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-11418](https://insights.sbomify.com/CVE-2024-11418/): Additional Order Filters for WooCommerce <= 1.21 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11417](https://insights.sbomify.com/CVE-2024-11417/): dejure.org Vernetzungsfunktion <= 1.97.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-11416](https://insights.sbomify.com/CVE-2024-11416/): WIP Incoming Lite <= 1.1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-11415](https://insights.sbomify.com/CVE-2024-11415/): WP-Orphanage Extended <= 1.2 - Cross-Site Request Forgery to Orphan Account Privilege Escalation (high 8.8)
- [CVE-2024-11414](https://insights.sbomify.com/CVE-2024-11414/): RecipePress Reloaded <= 2.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11413](https://insights.sbomify.com/CVE-2024-11413/): HostFact bestelformulier integratie <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11412](https://insights.sbomify.com/CVE-2024-11412/): Shine PDF Embeder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11411](https://insights.sbomify.com/CVE-2024-11411/): Spotlightr <= 0.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11410](https://insights.sbomify.com/CVE-2024-11410/): Cross-site scripting in Yoo Bar – Floating Notification & Promo Bar for Website (medium 6.4)
- [CVE-2024-1141](https://insights.sbomify.com/CVE-2024-1141/): Glance-store: glance store access key logged in debug log level (medium 5.5)
- [CVE-2024-11409](https://insights.sbomify.com/CVE-2024-11409/): Grid View Gallery <= 1.0 - Authenticated (Editor+) PHP Object Injection (high 7.2)
- [CVE-2024-11408](https://insights.sbomify.com/CVE-2024-11408/): Slotti Ajanvaraus <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11407](https://insights.sbomify.com/CVE-2024-11407/): Denial of Service through Data corruption in gRPC-C++ (medium 6.9)
- [CVE-2024-11406](https://insights.sbomify.com/CVE-2024-11406/): Stored XSS in django CMS Attributes Fields (medium 6.9)
- [CVE-2024-11405](https://insights.sbomify.com/CVE-2024-11405/): WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11404](https://insights.sbomify.com/CVE-2024-11404/): File Upload Bypass in django Filer (medium 5.5)
- [CVE-2024-11403](https://insights.sbomify.com/CVE-2024-11403/): Out of Bounds Memory Read/Write in libjxl (medium 6.9)
- [CVE-2024-11402](https://insights.sbomify.com/CVE-2024-11402/): WordPress Block Editor Bootstrap Blocks plugin <= 6.6.1 - Reflected Cross Site Scripting (XSS) vulnerability (high 7.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/497/