# Vulnerabilities published in 2024


- [CVE-2024-11401](https://insights.sbomify.com/CVE-2024-11401/): Rapid7 Insight Platform Privilege Escalation Vulnerability (medium 5.3)
- [CVE-2024-11400](https://insights.sbomify.com/CVE-2024-11400/): HUSKY – Products Filter for WooCommerce <= 1.3.6.3 - Reflected Cross-Site Scripting via really_curr_tax Parameter (medium 6.1)
- [CVE-2024-1140](https://insights.sbomify.com/CVE-2024-1140/): Twister Antivirus v8.17 - Out-of-bounds Read (medium 6.1)
- [CVE-2024-11399](https://insights.sbomify.com/CVE-2024-11399/): Information disclosure in BeeDrive for desktop (medium 6.8)
- [CVE-2024-11398](https://insights.sbomify.com/CVE-2024-11398/): Path traversal in Synology Router Manager (SRM) (high 8.1)
- [CVE-2024-11396](https://insights.sbomify.com/CVE-2024-11396/): Event monster <= 1.4.3 - Information Exposure Via Visitors List Export (medium 5.3)
- [CVE-2024-11395](https://insights.sbomify.com/CVE-2024-11395/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-11394](https://insights.sbomify.com/CVE-2024-11394/): Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-11393](https://insights.sbomify.com/CVE-2024-11393/): Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-11392](https://insights.sbomify.com/CVE-2024-11392/): Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 7.5)
- [CVE-2024-11391](https://insights.sbomify.com/CVE-2024-11391/): Advanced File Manager <= 5.2.10 - Authenticated (Subscriber+) Arbitrary File Upload (high 7.5)
- [CVE-2024-11390](https://insights.sbomify.com/CVE-2024-11390/): Kibana Unrestricted Upload of File with Dangerous Type Can Lead to XSS (medium 5.4)
- [CVE-2024-1139](https://insights.sbomify.com/CVE-2024-1139/): Cluster-monitoring-operator: credentials leak (high 7.7)
- [CVE-2024-11388](https://insights.sbomify.com/CVE-2024-11388/): Cross-site scripting in Dino Game – Embed Google Chrome Dinosaur Game in your website (medium 6.4)
- [CVE-2024-11387](https://insights.sbomify.com/CVE-2024-11387/): Easy Liveblogs <= 2.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11386](https://insights.sbomify.com/CVE-2024-11386/): GatorMail SmartForms <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11385](https://insights.sbomify.com/CVE-2024-11385/): Pure CSS Circle Progress bar <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11384](https://insights.sbomify.com/CVE-2024-11384/): Arena.IM – Live Blogging for real-time events <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11383](https://insights.sbomify.com/CVE-2024-11383/): CC Canadian Mortgage Calculator <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11382](https://insights.sbomify.com/CVE-2024-11382/): Cross-site scripting in Common Ninja: Fully Customizable & Perfectly Responsive Free Widgets for WordPress Websites (medium 6.4)
- [CVE-2024-11381](https://insights.sbomify.com/CVE-2024-11381/): Control horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11380](https://insights.sbomify.com/CVE-2024-11380/): Mini Program API <= 1.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1138](https://insights.sbomify.com/CVE-2024-1138/): TIBCO FTL Privilege Escalation (high 8.8)
- [CVE-2024-11379](https://insights.sbomify.com/CVE-2024-11379/): Broadcast <= 51.01 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11378](https://insights.sbomify.com/CVE-2024-11378/): Bizapp for WooCommerce <= 2.0.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11377](https://insights.sbomify.com/CVE-2024-11377/): Automate Hub Free by Sperse.IO <= 1.7.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11376](https://insights.sbomify.com/CVE-2024-11376/): Cross-site scripting in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions (medium 6.1)
- [CVE-2024-11375](https://insights.sbomify.com/CVE-2024-11375/): WC1C <= 0.23.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11374](https://insights.sbomify.com/CVE-2024-11374/): TWChat – Send or receive messages from users <= 4.0.4 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11373](https://insights.sbomify.com/CVE-2024-11373/): Connexion Logs <= 3.0.2 - Log Deletion via CSRF (medium 4.3)
- [CVE-2024-11372](https://insights.sbomify.com/CVE-2024-11372/): Connexion Logs <= 3.0.2 - Admin+ SQL Injection (high 7.2)
- [CVE-2024-11371](https://insights.sbomify.com/CVE-2024-11371/): Theater for WordPress <= 0.18.6.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11370](https://insights.sbomify.com/CVE-2024-11370/): Subaccounts for WooCommerce <= 1.6.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1137](https://insights.sbomify.com/CVE-2024-1137/): TIBCO ActiveSpaces Information Leak Vulnerability (medium 4.3)
- [CVE-2024-11369](https://insights.sbomify.com/CVE-2024-11369/): Store credit / Gift cards for woocommerce <= 1.0.49.46 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11368](https://insights.sbomify.com/CVE-2024-11368/): Splash Sync <= 2.0.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11367](https://insights.sbomify.com/CVE-2024-11367/): Smoove connector for Elementor forms <= 4.1.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11366](https://insights.sbomify.com/CVE-2024-11366/): SEO Landing Page Generator <= 1.66.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11365](https://insights.sbomify.com/CVE-2024-11365/): Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes <= 1.1.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11364](https://insights.sbomify.com/CVE-2024-11364/): Rockwell Automation Third Party Vulnerability in Arena® (high 8.5)
- [CVE-2024-11363](https://insights.sbomify.com/CVE-2024-11363/): Same but Different – Related Posts by Taxonomy <= 1.0.16 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11362](https://insights.sbomify.com/CVE-2024-11362/): Cross-site scripting in PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) (medium 6.1)
- [CVE-2024-11361](https://insights.sbomify.com/CVE-2024-11361/): PDF Invoices & Packing Slips Generator for WooCommerce <= 2.2.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11360](https://insights.sbomify.com/CVE-2024-11360/): Page Parts <= 1.4.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1136](https://insights.sbomify.com/CVE-2024-1136/): Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypass (medium 5.3)
- [CVE-2024-11359](https://insights.sbomify.com/CVE-2024-11359/): Library Bookshelves <= 5.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11358](https://insights.sbomify.com/CVE-2024-11358/): Insecure Android File Provider Paths (medium 5.7)
- [CVE-2024-11357](https://insights.sbomify.com/CVE-2024-11357/): Goodlayers Core < 2.0.10 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-11356](https://insights.sbomify.com/CVE-2024-11356/): Tourmaster < 5.3.4 - Unauthenticated Stored XSS via Room Booking (medium 6.1)
- [CVE-2024-11355](https://insights.sbomify.com/CVE-2024-11355/): Missing authorization in Ultimate YouTube Video & Shorts Player With Vimeo (medium 4.3)
- [CVE-2024-11354](https://insights.sbomify.com/CVE-2024-11354/): Missing authorization in Ultimate YouTube Video & Shorts Player With Vimeo (medium 4.3)
- [CVE-2024-11353](https://insights.sbomify.com/CVE-2024-11353/): SMS for Lead Capture Forms <= 1.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Message Deletion (medium 4.3)
- [CVE-2024-11352](https://insights.sbomify.com/CVE-2024-11352/): TwentyTwenty <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11351](https://insights.sbomify.com/CVE-2024-11351/): Information disclosure in Restrict – membership, site, content and user access restrictions for WordPress (medium 5.3)
- [CVE-2024-11350](https://insights.sbomify.com/CVE-2024-11350/): AdForest <= 5.1.6 - Privilege Escalation via Password Reset/Account Takeover (critical 9.8)
- [CVE-2024-1135](https://insights.sbomify.com/CVE-2024-1135/): HTTP Request Smuggling in benoitc/gunicorn (high 7.5)
- [CVE-2024-11349](https://insights.sbomify.com/CVE-2024-11349/): AdForest <= 5.1.6 - Authentication Bypass (critical 9.8)
- [CVE-2024-11348](https://insights.sbomify.com/CVE-2024-11348/): Reflected XSS in Eura7 CMSmanager (medium 5.3)
- [CVE-2024-11347](https://insights.sbomify.com/CVE-2024-11347/): Access of Resource Using Incompatible Type in Postscript interpreter (high 7.3)
- [CVE-2024-11346](https://insights.sbomify.com/CVE-2024-11346/): Access of Resource Using Incompatible Type in Postscript interpreter (high 7.3)
- [CVE-2024-11345](https://insights.sbomify.com/CVE-2024-11345/): Heap-based memory vulnerability in the Postscript interpreter in various Lexmark devices (high 7.3)
- [CVE-2024-11344](https://insights.sbomify.com/CVE-2024-11344/): Type confusion vulnerability in the Postscript interpreter in various Lexmark devices (high 7.3)
- [CVE-2024-11343](https://insights.sbomify.com/CVE-2024-11343/): Telerik Document Processing Path Traversal (high 8.3)
- [CVE-2024-11342](https://insights.sbomify.com/CVE-2024-11342/): Skt NURCaptcha <= 3.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-11341](https://insights.sbomify.com/CVE-2024-11341/): Simple Redirection <= 1.5 - Cross-Site Request Forgery to Arbitrary Site Redirect (medium 4.3)
- [CVE-2024-1134](https://insights.sbomify.com/CVE-2024-1134/): SEOPress – On-site SEO <= 7.5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11339](https://insights.sbomify.com/CVE-2024-11339/): Smart PopUp Blaster <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11338](https://insights.sbomify.com/CVE-2024-11338/): PIXNET Plugin <= 2.9.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11337](https://insights.sbomify.com/CVE-2024-11337/): Horoscope And Tarot <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11336](https://insights.sbomify.com/CVE-2024-11336/): Clickbank WordPress Plugin (Storefront) <= 1.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-11335](https://insights.sbomify.com/CVE-2024-11335/): Cross-site scripting in UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included (medium 6.4)
- [CVE-2024-11334](https://insights.sbomify.com/CVE-2024-11334/): My Contador lesr <= 2.0 - Missing Authorization to Unauthenticated User Registration CSV Export (medium 4.3)
- [CVE-2024-11333](https://insights.sbomify.com/CVE-2024-11333/): HLS Player <= 1.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-11332](https://insights.sbomify.com/CVE-2024-11332/): Cross-site scripting in HIPAA Compliant Forms with Drag’n’Drop HIPAA Form Builder. Sign HIPAA documents (medium 6.4)
- [CVE-2024-11331](https://insights.sbomify.com/CVE-2024-11331/): isee-products-extractor <= 2.1.3 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11330](https://insights.sbomify.com/CVE-2024-11330/): Custom CSS, JS & PHP <= 2.3.0 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-1133](https://insights.sbomify.com/CVE-2024-1133/): Tutor LMS <= 2.6.0 - Missing Authorization (medium 4.3)
- [CVE-2024-11329](https://insights.sbomify.com/CVE-2024-11329/): Comfino Payment Gateway <= 4.1.1 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11328](https://insights.sbomify.com/CVE-2024-11328/): CLUEVO LMS, E-Learning Platform <= 1.13.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11327](https://insights.sbomify.com/CVE-2024-11327/): Cross-site scripting in ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages (medium 6.1)
- [CVE-2024-11326](https://insights.sbomify.com/CVE-2024-11326/): Campaign Monitor Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11325](https://insights.sbomify.com/CVE-2024-11325/): AWeber Forms by Optin Cat <= 2.5.7 - Reflected Cross-Site Scripting (medium 5.2)
- [CVE-2024-11324](https://insights.sbomify.com/CVE-2024-11324/): Accounting for WooCommerce <= 1.6.6 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-11323](https://insights.sbomify.com/CVE-2024-11323/): AI Quiz | Quiz Maker <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update (high 8.8)
- [CVE-2024-11322](https://insights.sbomify.com/CVE-2024-11322/): CyberPower PowerPanel Business Unauthenticated Restart DoS (high 7.5)
- [CVE-2024-11321](https://insights.sbomify.com/CVE-2024-11321/): Reflected XSS in Hi e-learning's Learning Management System (LMS) (medium 5.4)
- [CVE-2024-11320](https://insights.sbomify.com/CVE-2024-11320/): Command Injection leading to RCE via LDAP Misconfiguration (medium 6.9)
- [CVE-2024-1132](https://insights.sbomify.com/CVE-2024-1132/): Keycloak: path transversal in redirection validation (high 8.1)
- [CVE-2024-11319](https://insights.sbomify.com/CVE-2024-11319/): Stored XSS in Open Source Project "django-cms" (medium 4.8)
- [CVE-2024-11318](https://insights.sbomify.com/CVE-2024-11318/): IDOR vulnerability in AbsysNet (high 7.5)
- [CVE-2024-11317](https://insights.sbomify.com/CVE-2024-11317/): PHP Session Fixation (critical 9.3)
- [CVE-2024-11316](https://insights.sbomify.com/CVE-2024-11316/): Filesize Check (high 8.7)
- [CVE-2024-11315](https://insights.sbomify.com/CVE-2024-11315/): TRCore DVC - Arbitrary File Upload through Path Traversal (critical 9.8)
- [CVE-2024-11314](https://insights.sbomify.com/CVE-2024-11314/): TRCore DVC - Arbitrary File Upload through Path Traversal (critical 9.8)
- [CVE-2024-11313](https://insights.sbomify.com/CVE-2024-11313/): TRCore DVC - Arbitrary File Upload through Path Traversal (critical 9.8)
- [CVE-2024-11312](https://insights.sbomify.com/CVE-2024-11312/): TRCore DVC - Arbitrary File Upload through Path Traversal (critical 9.8)
- [CVE-2024-11311](https://insights.sbomify.com/CVE-2024-11311/): TRCore DVC - Arbitrary File Upload through Path Traversal (critical 9.8)
- [CVE-2024-11310](https://insights.sbomify.com/CVE-2024-11310/): TRCore DVC - Arbitrary File Read through Path Traversal (high 7.5)
- [CVE-2024-11309](https://insights.sbomify.com/CVE-2024-11309/): TRCore DVC - Arbitrary File Read through Path Traversal (high 7.5)
- [CVE-2024-11308](https://insights.sbomify.com/CVE-2024-11308/): TRCore DVC - Use of Hard-coded Cryptographic Key (medium 6.2)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/498/