# Vulnerabilities published in 2024


- [CVE-2024-11010](https://insights.sbomify.com/CVE-2024-11010/): FileOrganizer <= 1.1.4 - Authenticated (Administrator+) Local JavaScript File Inclusion (high 7.2)
- [CVE-2024-11009](https://insights.sbomify.com/CVE-2024-11009/): SQL injection in Automatic Internal Links for SEO by Pagup (medium 4.9)
- [CVE-2024-11008](https://insights.sbomify.com/CVE-2024-11008/): Members <= 3.2.10 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-11007](https://insights.sbomify.com/CVE-2024-11007/): Command injection in Connect Secure (critical 9.1)
- [CVE-2024-11006](https://insights.sbomify.com/CVE-2024-11006/): Command injection in Connect Secure (critical 9.1)
- [CVE-2024-11005](https://insights.sbomify.com/CVE-2024-11005/): Command injection in Connect Secure (critical 9.1)
- [CVE-2024-11004](https://insights.sbomify.com/CVE-2024-11004/): Cross-site scripting in Connect Secure (medium 6.1)
- [CVE-2024-11003](https://insights.sbomify.com/CVE-2024-11003/): Command injection in needrestart (high 7.8)
- [CVE-2024-11002](https://insights.sbomify.com/CVE-2024-11002/): Code injection in InPost Gallery (medium 6.3)
- [CVE-2024-11000](https://insights.sbomify.com/CVE-2024-11000/): CodeAstro Real Estate Management System About Us Page aboutedit.php unrestricted upload (medium 5.1)
- [CVE-2024-1100](https://insights.sbomify.com/CVE-2024-1100/): SQLi in Vadi Corporate Information Systems' DIGIKENT GIS (critical 10.0)
- [CVE-2024-10999](https://insights.sbomify.com/CVE-2024-10999/): CodeAstro Real Estate Management System About Us Page aboutadd.php unrestricted upload (medium 5.1)
- [CVE-2024-10998](https://insights.sbomify.com/CVE-2024-10998/): 1000 Projects Bookstore Management System process_category_add.php sql injection (medium 6.9)
- [CVE-2024-10997](https://insights.sbomify.com/CVE-2024-10997/): 1000 Projects Bookstore Management System book_list.php sql injection (medium 5.3)
- [CVE-2024-10996](https://insights.sbomify.com/CVE-2024-10996/): 1000 Projects Bookstore Management System process_category_edit.php sql injection (medium 6.9)
- [CVE-2024-10995](https://insights.sbomify.com/CVE-2024-10995/): Codezips Hospital Appointment System removeDoctorResult.php sql injection (medium 6.9)
- [CVE-2024-10994](https://insights.sbomify.com/CVE-2024-10994/): Codezips Online Institute Management System edit_user.php unrestricted upload (medium 5.3)
- [CVE-2024-10993](https://insights.sbomify.com/CVE-2024-10993/): Codezips Online Institute Management System manage_website.php unrestricted upload (medium 5.3)
- [CVE-2024-10991](https://insights.sbomify.com/CVE-2024-10991/): Codezips Hospital Appointment System editBranchResult.php sql injection (medium 6.9)
- [CVE-2024-10990](https://insights.sbomify.com/CVE-2024-10990/): SourceCodester Online Veterinary Appointment System view_service.php sql injection (medium 5.3)
- [CVE-2024-1099](https://insights.sbomify.com/CVE-2024-1099/): Rebuild read-raw getFileOfData cross site scripting (low 3.5)
- [CVE-2024-10989](https://insights.sbomify.com/CVE-2024-10989/): code-projects E-Health Care System detail.php sql injection (medium 5.3)
- [CVE-2024-10988](https://insights.sbomify.com/CVE-2024-10988/): code-projects E-Health Care System doctor_login.php sql injection (medium 6.9)
- [CVE-2024-10987](https://insights.sbomify.com/CVE-2024-10987/): code-projects E-Health Care System user_appointment.php sql injection (medium 5.3)
- [CVE-2024-10986](https://insights.sbomify.com/CVE-2024-10986/): Local File Read (LFI) by Tarslip Symlink via arxiv_download() API in binary-husky/gpt_academic (high 8.8)
- [CVE-2024-10980](https://insights.sbomify.com/CVE-2024-10980/): Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-1098](https://insights.sbomify.com/CVE-2024-1098/): Rebuild proxy-download QiniuCloud.getStorageFile information disclosure (medium 4.3)
- [CVE-2024-10979](https://insights.sbomify.com/CVE-2024-10979/): PostgreSQL PL/Perl environment variable changes execute arbitrary code (high 8.8)
- [CVE-2024-10978](https://insights.sbomify.com/CVE-2024-10978/): PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (medium 4.2)
- [CVE-2024-10977](https://insights.sbomify.com/CVE-2024-10977/): PostgreSQL libpq retains an error message from man-in-the-middle (low 3.1)
- [CVE-2024-10976](https://insights.sbomify.com/CVE-2024-10976/): PostgreSQL row security below e.g. subqueries disregards user ID changes (medium 4.2)
- [CVE-2024-10975](https://insights.sbomify.com/CVE-2024-10975/): Nomad Vulnerable To Cross-Namespace Volume Creation Abusing CSI Write Permission (high 7.7)
- [CVE-2024-10973](https://insights.sbomify.com/CVE-2024-10973/): Keycloak: cli option for encrypted jgroups ignored (medium 5.7)
- [CVE-2024-10972](https://insights.sbomify.com/CVE-2024-10972/): WinPmem Improper Input Validation vulnerability (high 7.3)
- [CVE-2024-10971](https://insights.sbomify.com/CVE-2024-10971/): Missing authorization in DVLS (Devolutions Server) (medium 4.3)
- [CVE-2024-10970](https://insights.sbomify.com/CVE-2024-10970/): Code injection in Motors – Car Dealership & Classified Listings Plugin (medium 5.4)
- [CVE-2024-1097](https://insights.sbomify.com/CVE-2024-1097/): Stored XSS in craigk5n/webcalendar (high 7.6)
- [CVE-2024-10969](https://insights.sbomify.com/CVE-2024-10969/): 1000 Projects Bookstore Management System Login login_process.php sql injection (medium 6.9)
- [CVE-2024-10968](https://insights.sbomify.com/CVE-2024-10968/): 1000 Projects Bookstore Management System contact_process.php sql injection (medium 6.9)
- [CVE-2024-10967](https://insights.sbomify.com/CVE-2024-10967/): code-projects E-Health Care System delete_user_appointment_request.php sql injection (medium 6.9)
- [CVE-2024-10966](https://insights.sbomify.com/CVE-2024-10966/): TOTOLINK X18 cstecgi.cgi os command injection (medium 5.3)
- [CVE-2024-10965](https://insights.sbomify.com/CVE-2024-10965/): emqx neuron JSON File schema information disclosure (medium 5.3)
- [CVE-2024-10964](https://insights.sbomify.com/CVE-2024-10964/): emqx neuron plugin_handle.c handle_add_plugin buffer overflow (medium 5.3)
- [CVE-2024-10963](https://insights.sbomify.com/CVE-2024-10963/): Pam: improper hostname interpretation in pam_access leads to access control bypass (high 7.4)
- [CVE-2024-10962](https://insights.sbomify.com/CVE-2024-10962/): Migration, Backup, Staging – WPvivid <= 0.9.107 - Unauthenticated PHP Object Injection (high 8.8)
- [CVE-2024-10961](https://insights.sbomify.com/CVE-2024-10961/): Social Login <= 5.9.0 - Authentication Bypass via Disqus OAuth provider (critical 9.8)
- [CVE-2024-10960](https://insights.sbomify.com/CVE-2024-10960/): Brizy – Page Builder <= 2.6.4 - Authenticated (Contributor+) Arbitrary File Upload via storeUploads (critical 9.9)
- [CVE-2024-1096](https://insights.sbomify.com/CVE-2024-1096/): Twister Antivirus v8.17 - Denial of Service (medium 5.5)
- [CVE-2024-10959](https://insights.sbomify.com/CVE-2024-10959/): Code injection in Active Products Tables for WooCommerce. Use constructor to create tables (high 7.3)
- [CVE-2024-10958](https://insights.sbomify.com/CVE-2024-10958/): WP Photo Album Plus <= 8.8.08.007 - Unauthenticated Arbitrary Shortcode Execution via getshortcodedrenderedfenodelay (high 7.3)
- [CVE-2024-10957](https://insights.sbomify.com/CVE-2024-10957/): UpdraftPlus: WP Backup & Migration Plugin 1.23.8 - 1.24.11 - Unauthenticated PHP Object Injection (high 8.8)
- [CVE-2024-10956](https://insights.sbomify.com/CVE-2024-10956/): Cross-Site WebSocket Hijacking in binary-husky/gpt_academic (high 7.6)
- [CVE-2024-10955](https://insights.sbomify.com/CVE-2024-10955/): ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgpt (medium 6.5)
- [CVE-2024-10954](https://insights.sbomify.com/CVE-2024-10954/): Prompt Injection Leading to RCE in binary-husky/gpt_academic Plugin `manim` (high 8.8)
- [CVE-2024-10953](https://insights.sbomify.com/CVE-2024-10953/): data.all authenticated users can perform mutating update operations on persisted notification records (medium 5.3)
- [CVE-2024-10952](https://insights.sbomify.com/CVE-2024-10952/): Authors List <= 2.0.4 - Unauthenticated Arbitrary Shortcode Execution via update_authors_list_ajax (high 7.3)
- [CVE-2024-10950](https://insights.sbomify.com/CVE-2024-10950/): Code Injection in binary-husky/gpt_academic (high 8.8)
- [CVE-2024-1095](https://insights.sbomify.com/CVE-2024-1095/): Build & Control Block Patterns – Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorization (medium 5.3)
- [CVE-2024-10948](https://insights.sbomify.com/CVE-2024-10948/): Arbitrary File Read via Upload Function in binary-husky/gpt_academic (medium 6.5)
- [CVE-2024-10947](https://insights.sbomify.com/CVE-2024-10947/): SQL injection in Interlib Library Cluster Automation Management System (medium 5.1)
- [CVE-2024-10946](https://insights.sbomify.com/CVE-2024-10946/): SQL injection in Interlib Library Cluster Automation Management System (medium 5.1)
- [CVE-2024-10945](https://insights.sbomify.com/CVE-2024-10945/): FactoryTalk® Updater Local Privilege Escalation (high 7.0)
- [CVE-2024-10944](https://insights.sbomify.com/CVE-2024-10944/): FactoryTalk® Updater Remote Code Execution (high 7.1)
- [CVE-2024-10943](https://insights.sbomify.com/CVE-2024-10943/): FactoryTalk® Updater Authentication Bypass (critical 9.1)
- [CVE-2024-10942](https://insights.sbomify.com/CVE-2024-10942/): All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection (high 7.5)
- [CVE-2024-10941](https://insights.sbomify.com/CVE-2024-10941/): Denial of service in Firefox (medium 4.3)
- [CVE-2024-10940](https://insights.sbomify.com/CVE-2024-10940/): Exposure of Sensitive System Information via ImagePromptTemplate in langchain-ai/langchain (medium 5.3)
- [CVE-2024-1094](https://insights.sbomify.com/CVE-2024-1094/): Missing authorization in Timetics – Appointment Booking & Scheduling (high 7.3)
- [CVE-2024-10939](https://insights.sbomify.com/CVE-2024-10939/): Image Widget < 4.4.11 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10938](https://insights.sbomify.com/CVE-2024-10938/): OVRI Payment 1.7.0 - Malicious .htaccess directive (medium 6.5)
- [CVE-2024-10937](https://insights.sbomify.com/CVE-2024-10937/): Information disclosure in Related Posts By PickPlugins (medium 5.3)
- [CVE-2024-10936](https://insights.sbomify.com/CVE-2024-10936/): String Locator <= 2.6.6 - Unauthenticated PHP Object Injection (high 8.8)
- [CVE-2024-10935](https://insights.sbomify.com/CVE-2024-10935/): Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui (high 7.5)
- [CVE-2024-10934](https://insights.sbomify.com/CVE-2024-10934/): OpenBSD NFS double-free vulnerability (critical 9.2)
- [CVE-2024-10933](https://insights.sbomify.com/CVE-2024-10933/): OpenBSD readdir directory traversal (medium 4.1)
- [CVE-2024-10932](https://insights.sbomify.com/CVE-2024-10932/): Backup Migration <= 1.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialize_replace' (high 8.8)
- [CVE-2024-10930](https://insights.sbomify.com/CVE-2024-10930/): Carrier Block Load Privilege Escalation (high 7.1)
- [CVE-2024-1093](https://insights.sbomify.com/CVE-2024-1093/): Change Memory Limit <= 1.0 - Missing Authorization via admin_logic() (medium 5.3)
- [CVE-2024-10929](https://insights.sbomify.com/CVE-2024-10929/): Spectre-BSE (medium 5.1)
- [CVE-2024-10928](https://insights.sbomify.com/CVE-2024-10928/): MonoCMS Posts Page opensaved.php cross site scripting (medium 5.3)
- [CVE-2024-10927](https://insights.sbomify.com/CVE-2024-10927/): MonoCMS Account Information Page account.php cross site scripting (medium 5.3)
- [CVE-2024-10926](https://insights.sbomify.com/CVE-2024-10926/): IBPhoenix ibWebAdmin Tabelas Section toggle_fold_panel.php cross site scripting (medium 5.3)
- [CVE-2024-10925](https://insights.sbomify.com/CVE-2024-10925/): Authorization Bypass Through User-Controlled Key in GitLab (medium 5.3)
- [CVE-2024-10924](https://insights.sbomify.com/CVE-2024-10924/): Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass (critical 9.8)
- [CVE-2024-10923](https://insights.sbomify.com/CVE-2024-10923/): Improper Neutralization vulnerability has been discovered in OpenText™ ALM Octane Management. (high 8.6)
- [CVE-2024-10921](https://insights.sbomify.com/CVE-2024-10921/): Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server (medium 6.8)
- [CVE-2024-10920](https://insights.sbomify.com/CVE-2024-10920/): mariazevedo88 travels-java-api JWT Secret JwtAuthenticationTokenFilter.java doFilterInternal hard-coded key (low 2.3)
- [CVE-2024-1092](https://insights.sbomify.com/CVE-2024-1092/): Missing authorization in RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator (medium 4.3)
- [CVE-2024-10919](https://insights.sbomify.com/CVE-2024-10919/): didi Super-Jacoco triggerUnitCover os command injection (medium 5.3)
- [CVE-2024-10918](https://insights.sbomify.com/CVE-2024-10918/): Stack-based Buffer Overflow in libmodbus library (medium 4.8)
- [CVE-2024-10917](https://insights.sbomify.com/CVE-2024-10917/): Eclipse OpenJ9 might return an incorrect value in JNI function GetStringUTFLength (low 3.7)
- [CVE-2024-10916](https://insights.sbomify.com/CVE-2024-10916/): D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L HTTP GET Request info.xml information disclosure (medium 6.9)
- [CVE-2024-10915](https://insights.sbomify.com/CVE-2024-10915/): D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection (critical 9.2)
- [CVE-2024-10914](https://insights.sbomify.com/CVE-2024-10914/): D-Link DNS-320/DNS-320LW/DNS-325/DNS-340L account_mgr.cgi cgi_user_add os command injection (critical 9.2)
- [CVE-2024-10913](https://insights.sbomify.com/CVE-2024-10913/): Clone <= 2.4.6 - Unauthenticated PHP Object Injection via 'recursive_unserialized_replace' (high 8.8)
- [CVE-2024-10912](https://insights.sbomify.com/CVE-2024-10912/): Denial of Service in lm-sys/fastchat (high 7.5)
- [CVE-2024-10910](https://insights.sbomify.com/CVE-2024-10910/): Code injection in Grid Plus – Unlimited grid layout (high 7.3)
- [CVE-2024-1091](https://insights.sbomify.com/CVE-2024-1091/): ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Plugin Data Removal in reinitialize (medium 4.3)
- [CVE-2024-10909](https://insights.sbomify.com/CVE-2024-10909/): Pojo Forms <= 1.4.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via form_preview_shortcode (medium 6.3)
- [CVE-2024-10908](https://insights.sbomify.com/CVE-2024-10908/): Open Redirect in lm-sys/fastchat (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/502/