# Vulnerabilities published in 2024


- [CVE-2024-11209](https://insights.sbomify.com/CVE-2024-11209/): Apereo CAS 2FA login improper authentication (medium 5.3)
- [CVE-2024-11208](https://insights.sbomify.com/CVE-2024-11208/): Apereo CAS login session expiration (medium 6.3)
- [CVE-2024-11207](https://insights.sbomify.com/CVE-2024-11207/): Apereo CAS login redirect (medium 5.3)
- [CVE-2024-11206](https://insights.sbomify.com/CVE-2024-11206/): Information disclosure in com.transsion.phoenix (high 7.5)
- [CVE-2024-11205](https://insights.sbomify.com/CVE-2024-11205/): Missing authorization in WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More (high 8.5)
- [CVE-2024-11204](https://insights.sbomify.com/CVE-2024-11204/): ForumWP – Forum & Discussion Board <= 2.1.2 - Reflected Cross-Site Scripting via url Parameter (medium 6.1)
- [CVE-2024-11203](https://insights.sbomify.com/CVE-2024-11203/): Cross-site scripting in EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more (medium 6.4)
- [CVE-2024-11202](https://insights.sbomify.com/CVE-2024-11202/): Multiple Plugins <= (Various Versions) - Reflected Cross-Site Scripting via cminds_free_guide Shortcode (medium 6.1)
- [CVE-2024-11201](https://insights.sbomify.com/CVE-2024-11201/): Cross-site scripting in Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred (medium 6.4)
- [CVE-2024-11200](https://insights.sbomify.com/CVE-2024-11200/): Goodlayers Core <= 2.0.7 - Reflected Cross-Site Scripting via 'font-family' (medium 6.1)
- [CVE-2024-1120](https://insights.sbomify.com/CVE-2024-1120/): Missing authorization in Finale Lite – Sales Countdown Timer & Discount for WooCommerce (medium 5.3)
- [CVE-2024-11199](https://insights.sbomify.com/CVE-2024-11199/): Rescue Shortcodes <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rescue_progressbar Shortcode (medium 6.4)
- [CVE-2024-11198](https://insights.sbomify.com/CVE-2024-11198/): GD Rating System <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via extra_class Parameter (medium 6.4)
- [CVE-2024-11197](https://insights.sbomify.com/CVE-2024-11197/): Lock User Account <= 1.0.5 - User Lock Bypass (medium 4.2)
- [CVE-2024-11196](https://insights.sbomify.com/CVE-2024-11196/): Multi-column Tag Map <= 17.0.33 - Authenticated (Contributor+) Stored Cross-Site Scripting via mctagmap Shortcode (medium 6.4)
- [CVE-2024-11195](https://insights.sbomify.com/CVE-2024-11195/): Cross-site scripting in Email Subscription Popup (medium 6.4)
- [CVE-2024-11194](https://insights.sbomify.com/CVE-2024-11194/): Missing authorization in Classified Listing – AI-Powered Classified ads & Business Directory Plugin (high 8.8)
- [CVE-2024-11193](https://insights.sbomify.com/CVE-2024-11193/): Information disclosure in YugabyteDB Anywhere (medium 5.0)
- [CVE-2024-11192](https://insights.sbomify.com/CVE-2024-11192/): Cross-site scripting in Sp*tify Play Button for WordPress (medium 6.4)
- [CVE-2024-11190](https://insights.sbomify.com/CVE-2024-11190/): jwp-a11y <= 4.1.7 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1119](https://insights.sbomify.com/CVE-2024-1119/): Order Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data Export (medium 5.3)
- [CVE-2024-11189](https://insights.sbomify.com/CVE-2024-11189/): Social Share And Social Locker – ARSocial < 1.4.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-11188](https://insights.sbomify.com/CVE-2024-11188/): Cross-site scripting in Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder (medium 6.1)
- [CVE-2024-11187](https://insights.sbomify.com/CVE-2024-11187/): Many records in the additional section cause CPU exhaustion (high 7.5)
- [CVE-2024-11186](https://insights.sbomify.com/CVE-2024-11186/): Missing authorization in CloudVision Portal (critical 10.0)
- [CVE-2024-11185](https://insights.sbomify.com/CVE-2024-11185/): Security feature bypass in EOS (medium 6.5)
- [CVE-2024-11184](https://insights.sbomify.com/CVE-2024-11184/): WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVG (medium 4.8)
- [CVE-2024-11183](https://insights.sbomify.com/CVE-2024-11183/): Simple Side Tab < 2.2.0 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-11182](https://insights.sbomify.com/CVE-2024-11182/): MDaemon Email Server Cross-Site Scripting (XSS) (medium 5.3, exploited in the wild)
- [CVE-2024-11181](https://insights.sbomify.com/CVE-2024-11181/): Greenshift – animation and page builder blocks <= 9.9.9.3 - Authenticated (Contributor+) Post Disclosure (medium 4.3)
- [CVE-2024-11180](https://insights.sbomify.com/CVE-2024-11180/): ElementsKit Elementor addons <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-1118](https://insights.sbomify.com/CVE-2024-1118/): Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection (high 8.8)
- [CVE-2024-11179](https://insights.sbomify.com/CVE-2024-11179/): MStore API <= 4.15.7 - Authenticated (Subscriber+) SQL Injection (medium 6.5)
- [CVE-2024-11178](https://insights.sbomify.com/CVE-2024-11178/): Login With OTP <= 1.4.2 - Authentication Bypass via Weak OTP (high 8.1)
- [CVE-2024-11176](https://insights.sbomify.com/CVE-2024-11176/): Incorrect evaluation of effective permissions in M-Files Aino (medium 5.3)
- [CVE-2024-11175](https://insights.sbomify.com/CVE-2024-11175/): Public CMS Voting Management save cross site scripting (medium 5.3)
- [CVE-2024-11173](https://insights.sbomify.com/CVE-2024-11173/): Unhandled Exception in danny-avila/librechat (medium 6.5)
- [CVE-2024-11172](https://insights.sbomify.com/CVE-2024-11172/): Denial of Service in danny-avila/librechat (high 7.5)
- [CVE-2024-11171](https://insights.sbomify.com/CVE-2024-11171/): Improper Input Validation in danny-avila/librechat (high 7.5)
- [CVE-2024-11170](https://insights.sbomify.com/CVE-2024-11170/): Path Traversal in danny-avila/librechat (high 8.8)
- [CVE-2024-1117](https://insights.sbomify.com/CVE-2024-1117/): openBI Screen.php index code injection (high 7.3)
- [CVE-2024-11169](https://insights.sbomify.com/CVE-2024-11169/): Unhandled Exception Leading to Server Crash in danny-avila/librechat (high 7.5)
- [CVE-2024-11168](https://insights.sbomify.com/CVE-2024-11168/): Improper validation of IPv6 and IPvFuture addresses (medium 6.3)
- [CVE-2024-11167](https://insights.sbomify.com/CVE-2024-11167/): Improper Access Control in danny-avila/librechat (critical 9.4)
- [CVE-2024-11166](https://insights.sbomify.com/CVE-2024-11166/): Missing authorization in Collision Avoidance Systems (high 7.1)
- [CVE-2024-11165](https://insights.sbomify.com/CVE-2024-11165/): Information disclosure in YugabyteDB Anywhere (medium 5.7)
- [CVE-2024-1116](https://insights.sbomify.com/CVE-2024-1116/): openBI Upload.php index unrestricted upload (high 7.3)
- [CVE-2024-11159](https://insights.sbomify.com/CVE-2024-11159/): Information disclosure in Thunderbird (medium 5.3)
- [CVE-2024-11158](https://insights.sbomify.com/CVE-2024-11158/): Rockwell Automation Arena® Uninitialized Vulnerability (high 8.5)
- [CVE-2024-11157](https://insights.sbomify.com/CVE-2024-11157/): Rockwell Automation Third Party Vulnerability in Arena (high 8.5)
- [CVE-2024-11156](https://insights.sbomify.com/CVE-2024-11156/): Rockwell Automation Arena® Out of Bounds Write Vulnerability (high 8.5)
- [CVE-2024-11155](https://insights.sbomify.com/CVE-2024-11155/): Rockwell Automation Arena® Use After Free Vulnerability (high 8.5)
- [CVE-2024-11154](https://insights.sbomify.com/CVE-2024-11154/): Missing authorization in PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes (medium 4.3)
- [CVE-2024-11153](https://insights.sbomify.com/CVE-2024-11153/): Information disclosure in Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More (medium 5.3)
- [CVE-2024-11150](https://insights.sbomify.com/CVE-2024-11150/): WordPress User Extra Fields <= 16.6 - Unauthenticated Arbitrary File Deletion (critical 9.8)
- [CVE-2024-1115](https://insights.sbomify.com/CVE-2024-1115/): openBI Setting.php dlfile os command injection (high 7.3)
- [CVE-2024-11149](https://insights.sbomify.com/CVE-2024-11149/): OpenBSD vmm GDTR limits (medium 6.2)
- [CVE-2024-11148](https://insights.sbomify.com/CVE-2024-11148/): OpenBSD httpd(8) null dereference (high 8.7)
- [CVE-2024-11147](https://insights.sbomify.com/CVE-2024-11147/): ECOVACS lawnmowers and vacuums deterministic root password (high 7.0)
- [CVE-2024-11146](https://insights.sbomify.com/CVE-2024-11146/): TrueFiling authorization bypass via user-controlled keys (medium 6.3)
- [CVE-2024-11145](https://insights.sbomify.com/CVE-2024-11145/): Easy Folder Listing Pro deserialization vulnerability (critical 9.3)
- [CVE-2024-11144](https://insights.sbomify.com/CVE-2024-11144/): Race Condition with LightFTP (critical 9.2)
- [CVE-2024-11143](https://insights.sbomify.com/CVE-2024-11143/): Cross-site request forgery in Kognetiks Chatbot for WordPress (medium 4.3)
- [CVE-2024-11142](https://insights.sbomify.com/CVE-2024-11142/): CSRF in Gosoft Software's Proticaret E-Commerce (high 8.8)
- [CVE-2024-11141](https://insights.sbomify.com/CVE-2024-11141/): Sailthru Triggermail < 1.1 - Subscriber+ Stored XSS (medium 6.1)
- [CVE-2024-11140](https://insights.sbomify.com/CVE-2024-11140/): Real WP Shop Lite Ajax eCommerce Shopping Cart <= 2.0.8 - Admin+ Stored XSS (low 3.5)
- [CVE-2024-1114](https://insights.sbomify.com/CVE-2024-1114/): openBI Screen.php dlfile access control (medium 6.5)
- [CVE-2024-11139](https://insights.sbomify.com/CVE-2024-11139/): Memory corruption in EcoStruxure™ Power Build Rapsody (medium 4.6)
- [CVE-2024-11138](https://insights.sbomify.com/CVE-2024-11138/): DedeCMS friendlink_add.php unrestricted upload (medium 5.1)
- [CVE-2024-11137](https://insights.sbomify.com/CVE-2024-11137/): IDOR Vulnerability in PATCH `/v1/runs/:id/score` Endpoint in lunary-ai/lunary (high 7.5)
- [CVE-2024-11136](https://insights.sbomify.com/CVE-2024-11136/): Arbitrary file removal via path traversal in TCL Camera (high 8.2)
- [CVE-2024-11135](https://insights.sbomify.com/CVE-2024-11135/): Eventer <= 3.9.8 - Unauthenticated SQL Injection via eventer_get_attendees (high 7.5)
- [CVE-2024-11134](https://insights.sbomify.com/CVE-2024-11134/): Eventer <= 3.9.9 - Missing Authorization to Authenticated (Subscriber+) Bookings Export (medium 4.3)
- [CVE-2024-11133](https://insights.sbomify.com/CVE-2024-11133/): Eventer <= 3.9.9.5 - Missing Authorization to Unauthenticated Event Ticket Download (medium 5.3)
- [CVE-2024-11132](https://insights.sbomify.com/CVE-2024-11132/): Eventer <= 3.9.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (medium 6.4)
- [CVE-2024-11131](https://insights.sbomify.com/CVE-2024-11131/): Memory corruption in Camera Firmware (critical 9.8)
- [CVE-2024-11130](https://insights.sbomify.com/CVE-2024-11130/): ZZCMS msg.php cross site scripting (medium 5.1)
- [CVE-2024-1113](https://insights.sbomify.com/CVE-2024-1113/): openBI Unity.php uploadUnity unrestricted upload (medium 6.3)
- [CVE-2024-11129](https://insights.sbomify.com/CVE-2024-11129/): Generation of Error Message Containing Sensitive Information in GitLab (medium 6.3)
- [CVE-2024-11128](https://insights.sbomify.com/CVE-2024-11128/): Insufficient Hardened Runtime or Library Validation signing in Bitdefender Virus Scanner for macOS (high 8.4)
- [CVE-2024-11127](https://insights.sbomify.com/CVE-2024-11127/): code-projects Job Recruitment admin.php sql injection (medium 5.3)
- [CVE-2024-11126](https://insights.sbomify.com/CVE-2024-11126/): Digistar AG-30 Plus Login Page excessive authentication (low 2.3)
- [CVE-2024-11125](https://insights.sbomify.com/CVE-2024-11125/): GetSimpleCMS profile.php cross-site request forgery (medium 6.9)
- [CVE-2024-11124](https://insights.sbomify.com/CVE-2024-11124/): TimGeyssens UIOMatic uioMaticObject.r sql injection (medium 5.1)
- [CVE-2024-11123](https://insights.sbomify.com/CVE-2024-11123/): 上海灵当信息科技有限公司 Lingdang CRM pdf.php path traversal (medium 5.3)
- [CVE-2024-11122](https://insights.sbomify.com/CVE-2024-11122/): 上海灵当信息科技有限公司 Lingdang CRM index.php unrestricted upload (medium 5.3)
- [CVE-2024-11121](https://insights.sbomify.com/CVE-2024-11121/): 上海灵当信息科技有限公司 Lingdang CRM index.php sql injection (medium 5.3)
- [CVE-2024-11120](https://insights.sbomify.com/CVE-2024-11120/): GeoVision Devices OS Command Injection (critical 9.8, exploited in the wild)
- [CVE-2024-1112](https://insights.sbomify.com/CVE-2024-1112/): Buffer Overflow Vulnerability in Resource Hacker (high 7.3)
- [CVE-2024-11119](https://insights.sbomify.com/CVE-2024-11119/): BNE Gallery Extended <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via gallery Shortcode (medium 6.4)
- [CVE-2024-11118](https://insights.sbomify.com/CVE-2024-11118/): 404 Error Monitor <= 1.1 - Cross-Site Request Forgery to Plugin Settings Update via updatePluginSettings Function (medium 5.3)
- [CVE-2024-11117](https://insights.sbomify.com/CVE-2024-11117/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2024-11116](https://insights.sbomify.com/CVE-2024-11116/): Other in Chrome (medium 4.3)
- [CVE-2024-11115](https://insights.sbomify.com/CVE-2024-11115/): Security feature bypass in Chrome (high 8.8)
- [CVE-2024-11114](https://insights.sbomify.com/CVE-2024-11114/): Security feature bypass in Chrome (high 8.3)
- [CVE-2024-11113](https://insights.sbomify.com/CVE-2024-11113/): Use after free in Chrome (high 8.8)
- [CVE-2024-11112](https://insights.sbomify.com/CVE-2024-11112/): Use after free in Chrome (high 7.5)
- [CVE-2024-11111](https://insights.sbomify.com/CVE-2024-11111/): Other in Chrome (medium 4.3)
- [CVE-2024-11110](https://insights.sbomify.com/CVE-2024-11110/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2024-1111](https://insights.sbomify.com/CVE-2024-1111/): SourceCodester QR Code Login System add-user.php cross site scripting (medium 4.3)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/500/