# Vulnerabilities published in 2024


- [CVE-2024-10524](https://insights.sbomify.com/CVE-2024-10524/): GNU Wget is vulnerable to an SSRF attack when accessing partially-user-controlled shorthand URLs (medium 6.5)
- [CVE-2024-10523](https://insights.sbomify.com/CVE-2024-10523/): Information Disclosure Vulnerability in TP-Link IoT Smart Hub (medium 4.4)
- [CVE-2024-10522](https://insights.sbomify.com/CVE-2024-10522/): Co-marquage service-public.fr <= 0.5.76 - Reflected Cross-Site Scripting via add_query_arg Parameter (medium 6.1)
- [CVE-2024-10521](https://insights.sbomify.com/CVE-2024-10521/): WordPress Contact Forms by Cimatti <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function (medium 4.3)
- [CVE-2024-10520](https://insights.sbomify.com/CVE-2024-10520/): WP Project Manager <= 2.6.14 - Missing Authorization to Project Milestone and Task Creation/Deletion (medium 5.3)
- [CVE-2024-1052](https://insights.sbomify.com/CVE-2024-1052/): Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering (high 8.0)
- [CVE-2024-10519](https://insights.sbomify.com/CVE-2024-10519/): Cross-site scripting in Wishlist for WooCommerce: Multi Wishlists Per Customer PRO (medium 6.1)
- [CVE-2024-10518](https://insights.sbomify.com/CVE-2024-10518/): ProfilePress < 4.15.15 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10517](https://insights.sbomify.com/CVE-2024-10517/): ProfilePress < 4.15.15 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10516](https://insights.sbomify.com/CVE-2024-10516/): Swift Performance Lite <= 2.3.7.1 - Unauthenticated Local PHP File Inclusion via 'ajaxify' (high 8.1)
- [CVE-2024-10515](https://insights.sbomify.com/CVE-2024-10515/): SEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSS (low 3.5)
- [CVE-2024-10513](https://insights.sbomify.com/CVE-2024-10513/): Path Traversal in mintplex-labs/anything-llm (high 7.2)
- [CVE-2024-10511](https://insights.sbomify.com/CVE-2024-10511/): Auth bypass in PowerChute Serial Shutdown (medium 6.3)
- [CVE-2024-10510](https://insights.sbomify.com/CVE-2024-10510/): adBuddy+ (AdBlocker Detection) by NetfunkDesign <= 1.1.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-1051](https://insights.sbomify.com/CVE-2024-1051/): List category posts <= 0.89.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10509](https://insights.sbomify.com/CVE-2024-10509/): Codezips Online Institute Management System login.php sql injection (medium 6.9)
- [CVE-2024-10508](https://insights.sbomify.com/CVE-2024-10508/): Auth bypass in RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login (critical 9.8)
- [CVE-2024-10507](https://insights.sbomify.com/CVE-2024-10507/): Codezips Free Exam Hall Seating Management System login.php sql injection (medium 6.9)
- [CVE-2024-10506](https://insights.sbomify.com/CVE-2024-10506/): code-projects Blood Bank System B-.php sql injection (medium 5.3)
- [CVE-2024-10505](https://insights.sbomify.com/CVE-2024-10505/): wuzhicms block.php edit code injection (medium 5.3)
- [CVE-2024-10504](https://insights.sbomify.com/CVE-2024-10504/): ARForms Builder < 1.7.1 - Unauthenticated Stored XSS (medium 5.4)
- [CVE-2024-10503](https://insights.sbomify.com/CVE-2024-10503/): Klokan MapTiler tileserver-gl URL cross site scripting (medium 5.3)
- [CVE-2024-10502](https://insights.sbomify.com/CVE-2024-10502/): ESAFENET CDG FileDirectoryService.java getOneFileDirectory sql injection (medium 5.3)
- [CVE-2024-10501](https://insights.sbomify.com/CVE-2024-10501/): ESAFENET CDG ExamCDGDocService.java findById sql injection (medium 5.3)
- [CVE-2024-10500](https://insights.sbomify.com/CVE-2024-10500/): ESAFENET CDG HookWhiteListService.java sql injection (medium 5.3)
- [CVE-2024-1050](https://insights.sbomify.com/CVE-2024-1050/): Import and export users and customers <= 1.26.5 - Missing Authorization (medium 4.3)
- [CVE-2024-10499](https://insights.sbomify.com/CVE-2024-10499/): AI-Engine < 2.6.5 - Admin+ SQLi (high 7.2)
- [CVE-2024-10498](https://insights.sbomify.com/CVE-2024-10498/): Memory corruption in PowerLogic HDPM6000 (medium 6.9)
- [CVE-2024-10497](https://insights.sbomify.com/CVE-2024-10497/): Missing authorization in PowerLogic HDPM6000 (high 8.7)
- [CVE-2024-10496](https://insights.sbomify.com/CVE-2024-10496/): Out of bounds read in BuildFontMap in fontmgr.cpp in NI LabVIEW (high 8.4)
- [CVE-2024-10495](https://insights.sbomify.com/CVE-2024-10495/): Out of bounds read when loading the font table in fontmgr.cpp in NI LabVIEW (high 8.4)
- [CVE-2024-10494](https://insights.sbomify.com/CVE-2024-10494/): Out of bounds read in HeapObjMapImpl.cpp in NI LabVIEW (high 8.4)
- [CVE-2024-10493](https://insights.sbomify.com/CVE-2024-10493/): Element Pack Elementor Addons < 5.10.3 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-10492](https://insights.sbomify.com/CVE-2024-10492/): Keycloak-quarkus-server: keycloak path trasversal (low 2.7)
- [CVE-2024-10491](https://insights.sbomify.com/CVE-2024-10491/): Preload arbitrary resources by injecting additional `Link` headers (medium 4.0)
- [CVE-2024-10490](https://insights.sbomify.com/CVE-2024-10490/): Authentication bypass flaw in several mapp components (high 8.4)
- [CVE-2024-1049](https://insights.sbomify.com/CVE-2024-1049/): Page Builder Gutenberg Blocks – CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-10488](https://insights.sbomify.com/CVE-2024-10488/): Use after free in Chrome (high 8.8)
- [CVE-2024-10487](https://insights.sbomify.com/CVE-2024-10487/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-10486](https://insights.sbomify.com/CVE-2024-10486/): Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File (medium 5.3)
- [CVE-2024-10484](https://insights.sbomify.com/CVE-2024-10484/): Cross-site scripting in Spectra Gutenberg Blocks – Website Builder for the Block Editor (medium 6.4)
- [CVE-2024-10483](https://insights.sbomify.com/CVE-2024-10483/): SimplePress Forum < 6.10.11 - Reflected XSS (high 7.1)
- [CVE-2024-10482](https://insights.sbomify.com/CVE-2024-10482/): Media Library Tools < 1.5.0 - Author+ Stored XSS via SVG (medium 5.4)
- [CVE-2024-10481](https://insights.sbomify.com/CVE-2024-10481/): Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui (medium 6.5)
- [CVE-2024-10480](https://insights.sbomify.com/CVE-2024-10480/): 3DPrint Lite < 2.1 - Settings Update via CSRF (medium 4.3)
- [CVE-2024-1048](https://insights.sbomify.com/CVE-2024-1048/): Grub2: grub2-set-bootflag can be abused by local (pseudo-)users (low 3.3)
- [CVE-2024-10479](https://insights.sbomify.com/CVE-2024-10479/): LinZhaoguan pb-cms Theme Management Module admin#themes cross site scripting (medium 5.1)
- [CVE-2024-10478](https://insights.sbomify.com/CVE-2024-10478/): LinZhaoguan pb-cms Edit Article edit cross site scripting (medium 5.1)
- [CVE-2024-10477](https://insights.sbomify.com/CVE-2024-10477/): LinZhaoguan pb-cms Permission Management Page admin#permissions cross site scripting (medium 5.1)
- [CVE-2024-10476](https://insights.sbomify.com/CVE-2024-10476/): Hardcoded credentials in BD BACTEC™ Blood Culture System (high 8.0)
- [CVE-2024-10475](https://insights.sbomify.com/CVE-2024-10475/): Lead Form Builder < 1.9.8 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10474](https://insights.sbomify.com/CVE-2024-10474/): Security feature bypass in Focus for iOS (critical 9.1)
- [CVE-2024-10473](https://insights.sbomify.com/CVE-2024-10473/): Logo Slider < 4.5.0 - Author+ Stored XSS (medium 5.4)
- [CVE-2024-10472](https://insights.sbomify.com/CVE-2024-10472/): Stylish Price List < 7.1.12 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-10471](https://insights.sbomify.com/CVE-2024-10471/): Everest Forms < 3.0.4.2 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10470](https://insights.sbomify.com/CVE-2024-10470/): WPLMS Learning Management System for WordPress <= 4.962 - Unauthenticated Arbitrary File Read and Deletion (critical 9.8)
- [CVE-2024-1047](https://insights.sbomify.com/CVE-2024-1047/): ThemeIsle SDK <= Various Versions - Missing Authorization (medium 5.3)
- [CVE-2024-10469](https://insights.sbomify.com/CVE-2024-10469/): CERT/CC VINCE versions before 3.0.9 allows authenticated user to access User Management view. (medium 4.4)
- [CVE-2024-10468](https://insights.sbomify.com/CVE-2024-10468/): Race condition in Firefox (critical 9.8)
- [CVE-2024-10467](https://insights.sbomify.com/CVE-2024-10467/): Memory corruption in Firefox (critical 9.8)
- [CVE-2024-10466](https://insights.sbomify.com/CVE-2024-10466/): Denial of service in Firefox (high 7.5)
- [CVE-2024-10465](https://insights.sbomify.com/CVE-2024-10465/): Security feature bypass in Firefox (high 7.5)
- [CVE-2024-10464](https://insights.sbomify.com/CVE-2024-10464/): Denial of service in Firefox (high 7.5)
- [CVE-2024-10463](https://insights.sbomify.com/CVE-2024-10463/): Information disclosure in Firefox (high 7.5)
- [CVE-2024-10462](https://insights.sbomify.com/CVE-2024-10462/): Security feature bypass in Firefox (high 7.5)
- [CVE-2024-10461](https://insights.sbomify.com/CVE-2024-10461/): Cross-site scripting in Firefox (medium 6.1)
- [CVE-2024-10460](https://insights.sbomify.com/CVE-2024-10460/): Security feature bypass in Firefox (medium 5.4)
- [CVE-2024-1046](https://insights.sbomify.com/CVE-2024-1046/): Cross-site scripting in Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress (medium 6.4)
- [CVE-2024-10459](https://insights.sbomify.com/CVE-2024-10459/): Use after free in Firefox (medium 6.5)
- [CVE-2024-10458](https://insights.sbomify.com/CVE-2024-10458/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2024-10457](https://insights.sbomify.com/CVE-2024-10457/): SSRF Vulnerabilities in significant-gravitas/autogpt (medium 6.5)
- [CVE-2024-10456](https://insights.sbomify.com/CVE-2024-10456/): Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data (critical 9.3)
- [CVE-2024-10455](https://insights.sbomify.com/CVE-2024-10455/): Reachable Assertion in µD3TN (high 7.5)
- [CVE-2024-10454](https://insights.sbomify.com/CVE-2024-10454/): Clickjacking vulnerability in Clibo Manager (medium 6.1)
- [CVE-2024-10453](https://insights.sbomify.com/CVE-2024-10453/): Cross-site scripting in Elementor Website Builder – more than just a page builder (medium 6.4)
- [CVE-2024-10452](https://insights.sbomify.com/CVE-2024-10452/): Grafana org admin can delete pending invites in different org (low 2.2)
- [CVE-2024-10451](https://insights.sbomify.com/CVE-2024-10451/): Org.keycloak:keycloak-quarkus-server: sensitive data exposure in keycloak build process (medium 5.9)
- [CVE-2024-10450](https://insights.sbomify.com/CVE-2024-10450/): SourceCodester Kortex Lite Advocate Office Management System POST Parameter edit_profile.php sql injection (medium 5.3)
- [CVE-2024-10449](https://insights.sbomify.com/CVE-2024-10449/): Codezips Hospital Appointment System loginAction.php sql injection (medium 6.9)
- [CVE-2024-10448](https://insights.sbomify.com/CVE-2024-10448/): code-projects Blood Bank Management System delete.php cross-site request forgery (medium 6.9)
- [CVE-2024-10447](https://insights.sbomify.com/CVE-2024-10447/): Project Worlds Online Time Table Generator staffdashboard.php sql injection (medium 5.3)
- [CVE-2024-10446](https://insights.sbomify.com/CVE-2024-10446/): Project Worlds Online Time Table Generator admindashboard.php sql injection (medium 5.3)
- [CVE-2024-10445](https://insights.sbomify.com/CVE-2024-10445/): Security feature bypass in BeeStation OS (BSM) (medium 4.3)
- [CVE-2024-10444](https://insights.sbomify.com/CVE-2024-10444/): Security feature bypass in DiskStation Manager (DSM) (high 7.5)
- [CVE-2024-10443](https://insights.sbomify.com/CVE-2024-10443/): Command injection in BeePhotos (critical 9.8)
- [CVE-2024-10442](https://insights.sbomify.com/CVE-2024-10442/): Memory corruption in Replication Service (critical 10.0)
- [CVE-2024-10441](https://insights.sbomify.com/CVE-2024-10441/): Code injection in BeeStation OS (BSM) (critical 9.8)
- [CVE-2024-10440](https://insights.sbomify.com/CVE-2024-10440/): Sunnet eHRD CTMS - SQL Injection (critical 9.8)
- [CVE-2024-1044](https://insights.sbomify.com/CVE-2024-1044/): Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_review (medium 5.3)
- [CVE-2024-10439](https://insights.sbomify.com/CVE-2024-10439/): Sunnet eHRD CTMS - Insecure Direct Object Reference (medium 5.3)
- [CVE-2024-10438](https://insights.sbomify.com/CVE-2024-10438/): Sunnet eHRD CTMS - Authentication Bypass (high 7.5)
- [CVE-2024-10437](https://insights.sbomify.com/CVE-2024-10437/): Missing authorization in WPC Smart Messages for WooCommerce (medium 4.3)
- [CVE-2024-10436](https://insights.sbomify.com/CVE-2024-10436/): WPC Smart Messages for WooCommerce <= 4.2.1 - Authenticated (Subscriber+) Local File Inclusion (high 8.8)
- [CVE-2024-10435](https://insights.sbomify.com/CVE-2024-10435/): didi Super-Jacoco triggerEnvCov command injection (medium 5.3)
- [CVE-2024-10434](https://insights.sbomify.com/CVE-2024-10434/): Tenda AC1206 ate ate_Tenda_mfg_check_usb3 stack-based overflow (high 8.7)
- [CVE-2024-10433](https://insights.sbomify.com/CVE-2024-10433/): Project Worlds Simple Web-Based Chat Application index.php cross site scripting (medium 5.3)
- [CVE-2024-10432](https://insights.sbomify.com/CVE-2024-10432/): Project Worlds Simple Web-Based Chat Application index.php sql injection (medium 6.9)
- [CVE-2024-10431](https://insights.sbomify.com/CVE-2024-10431/): Codezips Pet Shop Management System deletebird.php sql injection (medium 6.9)
- [CVE-2024-10430](https://insights.sbomify.com/CVE-2024-10430/): Codezips Pet Shop Management System animalsupdate.php sql injection (medium 6.9)
- [CVE-2024-1043](https://insights.sbomify.com/CVE-2024-1043/): AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_data (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/507/