# Vulnerabilities published in 2024


- [CVE-2024-10326](https://insights.sbomify.com/CVE-2024-10326/): RomethemeKit For Elementor <= 1.5.3 - Missing Authorization in save_options and reset_widgets (medium 4.3)
- [CVE-2024-10325](https://insights.sbomify.com/CVE-2024-10325/): Elementor Header & Footer Builder <= 1.6.45 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-10324](https://insights.sbomify.com/CVE-2024-10324/): Information disclosure in RTMKit (medium 4.3)
- [CVE-2024-10323](https://insights.sbomify.com/CVE-2024-10323/): JetWidgets For Elementor <= 1.0.18 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-10322](https://insights.sbomify.com/CVE-2024-10322/): Brizy – Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-10321](https://insights.sbomify.com/CVE-2024-10321/): Information disclosure in All-in-One Addons for Elementor – WidgetKit (medium 4.3)
- [CVE-2024-10320](https://insights.sbomify.com/CVE-2024-10320/): Cookielay <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via cookielay Shortcode (medium 6.4)
- [CVE-2024-1032](https://insights.sbomify.com/CVE-2024-1032/): openBI Test Connection Databasesource.php testConnection deserialization (high 7.3)
- [CVE-2024-10319](https://insights.sbomify.com/CVE-2024-10319/): Information disclosure in Xpro Addons — 140+ Widgets for Elementor (medium 4.3)
- [CVE-2024-10318](https://insights.sbomify.com/CVE-2024-10318/): NGINX OpenID Connect Vulnerability (medium 5.1)
- [CVE-2024-10316](https://insights.sbomify.com/CVE-2024-10316/): Information disclosure in Stratum Widgets for Elementor (medium 4.3)
- [CVE-2024-10315](https://insights.sbomify.com/CVE-2024-10315/): Insecure Configuration in Gliffy Online (medium 6.9)
- [CVE-2024-10314](https://insights.sbomify.com/CVE-2024-10314/): Unauthenticated Denial of Service via Auto Generation Function (high 8.7)
- [CVE-2024-10313](https://insights.sbomify.com/CVE-2024-10313/): iniNet Solutions SpiderControl SCADA PC HMI Editor Path Traversal (high 8.6)
- [CVE-2024-10312](https://insights.sbomify.com/CVE-2024-10312/): Information disclosure in Exclusive Addons for Elementor (medium 4.3)
- [CVE-2024-10311](https://insights.sbomify.com/CVE-2024-10311/): External Database Based Actions <= 0.1 - Authenticated (Subscriber+) Authentication Bypass (high 7.5)
- [CVE-2024-10310](https://insights.sbomify.com/CVE-2024-10310/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-1031](https://insights.sbomify.com/CVE-2024-1031/): CodeAstro Expense Management System Add Expenses Page 5-Add-Expenses.php cross site scripting (low 3.5)
- [CVE-2024-10309](https://insights.sbomify.com/CVE-2024-10309/): Tracking Code Manager < 2.4.0 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-10308](https://insights.sbomify.com/CVE-2024-10308/): Jeg Elementor Kit <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via JKit - Countdown Widget (medium 6.4)
- [CVE-2024-10307](https://insights.sbomify.com/CVE-2024-10307/): Allocation of Resources Without Limits or Throttling in GitLab (medium 4.3)
- [CVE-2024-10306](https://insights.sbomify.com/CVE-2024-10306/): Mod_proxy_cluster: mod_proxy_cluster unauthorized mcmp requests (medium 5.4)
- [CVE-2024-10302](https://insights.sbomify.com/CVE-2024-10302/): Improper Input Validation via Signup Process in Multiple WSO2 Products Enables Content Manipulation and Data Exposure (medium 4.0)
- [CVE-2024-10301](https://insights.sbomify.com/CVE-2024-10301/): PHPGurukul Medical Card Generation System Search search-medicalcard.php sql injection (medium 5.1)
- [CVE-2024-10300](https://insights.sbomify.com/CVE-2024-10300/): PHPGurukul Medical Card Generation System View Enquiry Page view-enquiry.php sql injection (medium 5.1)
- [CVE-2024-1030](https://insights.sbomify.com/CVE-2024-1030/): Cogites eReserv tenancyDetail.php cross site scripting (low 3.5)
- [CVE-2024-10299](https://insights.sbomify.com/CVE-2024-10299/): PHPGurukul Medical Card Generation System Managecard View Detail Page view-card-detail.php sql injection (medium 5.1)
- [CVE-2024-10298](https://insights.sbomify.com/CVE-2024-10298/): PHPGurukul Medical Card Generation System Managecard Edit Card Detail Page edit-card-detail.php sql injection (medium 5.1)
- [CVE-2024-10297](https://insights.sbomify.com/CVE-2024-10297/): PHPGurukul Medical Card Generation System Managecard Edit Image Page changeimage.php sql injection (medium 5.1)
- [CVE-2024-10296](https://insights.sbomify.com/CVE-2024-10296/): PHPGurukul Medical Card Generation System Report of Medical Card Page card-bwdates-reports-details.php sql injection (medium 5.1)
- [CVE-2024-10295](https://insights.sbomify.com/CVE-2024-10295/): Auth bypass in Red Hat 3scale API Management Platform 2 (high 7.5)
- [CVE-2024-10294](https://insights.sbomify.com/CVE-2024-10294/): CE21 Suite <= 2.2.0 - Missing Authorization to Unauthenticated Plugin Settings Change (medium 6.5)
- [CVE-2024-10293](https://insights.sbomify.com/CVE-2024-10293/): ZZCMS functions.php Ebak_SetGotoPak unrestricted upload (medium 5.3)
- [CVE-2024-10292](https://insights.sbomify.com/CVE-2024-10292/): ZZCMS ChangeTable.php unrestricted upload (medium 5.3)
- [CVE-2024-10291](https://insights.sbomify.com/CVE-2024-10291/): ZZCMS phome.php Ebak_DotranExecutSQL sql injection (medium 5.3)
- [CVE-2024-10290](https://insights.sbomify.com/CVE-2024-10290/): ZZCMS inc.php information disclosure (medium 6.9)
- [CVE-2024-1029](https://insights.sbomify.com/CVE-2024-1029/): Cogites eReserv tenancyDetail.php cross site scripting (low 3.5)
- [CVE-2024-10289](https://insights.sbomify.com/CVE-2024-10289/): Cross-Site Scripting (XSS) vulnerability in LocalServer (medium 6.1)
- [CVE-2024-10288](https://insights.sbomify.com/CVE-2024-10288/): Cross-Site Scripting (XSS) vulnerability in LocalServer (medium 6.1)
- [CVE-2024-10287](https://insights.sbomify.com/CVE-2024-10287/): Cross-Site Scripting (XSS) vulnerability in LocalServer (medium 6.1)
- [CVE-2024-10286](https://insights.sbomify.com/CVE-2024-10286/): Cross-Site Scripting (XSS) vulnerability in LocalServer (medium 6.1)
- [CVE-2024-10285](https://insights.sbomify.com/CVE-2024-10285/): CE21 Suite <= 2.2.0 - JWT Token Disclosure (critical 9.8)
- [CVE-2024-10284](https://insights.sbomify.com/CVE-2024-10284/): CE21 Suite <= 2.2.0 - Authentication Bypass (critical 9.8)
- [CVE-2024-10283](https://insights.sbomify.com/CVE-2024-10283/): Tenda RX9/RX9 Pro SetNetControlList sub_4337EC stack-based overflow (high 8.7)
- [CVE-2024-10282](https://insights.sbomify.com/CVE-2024-10282/): Tenda RX9/RX9 Pro SetVirtualServerCfg sub_42EA38 stack-based overflow (high 8.7)
- [CVE-2024-10281](https://insights.sbomify.com/CVE-2024-10281/): Tenda RX9/RX9 Pro SetStaticRouteCfg sub_42EEE0 stack-based overflow (high 8.7)
- [CVE-2024-10280](https://insights.sbomify.com/CVE-2024-10280/): Tenda AC6/AC7/AC8/AC9/AC10/AC10U/AC15/AC18/AC500/AC1206 GetIPTV websReadEvent null pointer dereference (high 7.1)
- [CVE-2024-1028](https://insights.sbomify.com/CVE-2024-1028/): SourceCodester Facebook News Feed Like Post cross site scripting (low 3.5)
- [CVE-2024-10279](https://insights.sbomify.com/CVE-2024-10279/): ESAFENET CDG PrintPolicyService.java sql injection (medium 5.3)
- [CVE-2024-10278](https://insights.sbomify.com/CVE-2024-10278/): ESAFENET CDG ReUserOrganiseService.java sql injection (medium 5.3)
- [CVE-2024-10277](https://insights.sbomify.com/CVE-2024-10277/): ESAFENET CDG UsbKeyAjax.java sql injection (medium 5.3)
- [CVE-2024-10276](https://insights.sbomify.com/CVE-2024-10276/): Telestream Sentry Reports Page page cross site scripting (medium 5.3)
- [CVE-2024-10275](https://insights.sbomify.com/CVE-2024-10275/): Improper Role Modification by Admins for Billing Permissions in lunary-ai/lunary (high 7.3)
- [CVE-2024-10274](https://insights.sbomify.com/CVE-2024-10274/): Improper Authorization in lunary-ai/lunary (medium 6.5)
- [CVE-2024-10273](https://insights.sbomify.com/CVE-2024-10273/): Improper Privilege Management in lunary-ai/lunary (medium 6.5)
- [CVE-2024-10272](https://insights.sbomify.com/CVE-2024-10272/): Broken Access Control in lunary-ai/lunary (high 7.5)
- [CVE-2024-10270](https://insights.sbomify.com/CVE-2024-10270/): Org.keycloak:keycloak-services: keycloak denial of service (medium 6.5)
- [CVE-2024-1027](https://insights.sbomify.com/CVE-2024-1027/): SourceCodester Facebook News Feed Like Post unrestricted upload (medium 6.3)
- [CVE-2024-10269](https://insights.sbomify.com/CVE-2024-10269/): Easy SVG Support <= 3.7 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-10268](https://insights.sbomify.com/CVE-2024-10268/): Cross-site scripting in MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar (medium 6.4)
- [CVE-2024-10267](https://insights.sbomify.com/CVE-2024-10267/): Information Disclosure in transformeroptimus/superagi (high 7.5)
- [CVE-2024-10266](https://insights.sbomify.com/CVE-2024-10266/): Cross-site scripting in Premium Addons for Elementor – Powerful Elementor Templates & Widgets (medium 6.4)
- [CVE-2024-10265](https://insights.sbomify.com/CVE-2024-10265/): Cross-site scripting in Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder (medium 6.1)
- [CVE-2024-10264](https://insights.sbomify.com/CVE-2024-10264/): HTTP Request Smuggling in netease-youdao/qanything (high 7.5)
- [CVE-2024-10263](https://insights.sbomify.com/CVE-2024-10263/): Tickera – WordPress Event Ticketing <= 3.5.4.4 - Unauthenticated Arbitrary Shortcode Execution (high 7.3)
- [CVE-2024-10262](https://insights.sbomify.com/CVE-2024-10262/): Drop Shadow Boxes <= 1.7.14 - Authenticated (Subscriber+) Arbitrary Shortcode Execution (medium 6.3)
- [CVE-2024-10261](https://insights.sbomify.com/CVE-2024-10261/): Code injection in Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction (high 7.3)
- [CVE-2024-10260](https://insights.sbomify.com/CVE-2024-10260/): Tripetto <= 8.0.11 - Unauthentiated Stored Cross-Site Scripting via Form File Upload (high 7.2)
- [CVE-2024-1026](https://insights.sbomify.com/CVE-2024-1026/): Cogites eReserv config.php cross site scripting (low 3.5)
- [CVE-2024-10256](https://insights.sbomify.com/CVE-2024-10256/): Misconfiguration in Endpoint Manager (high 7.1)
- [CVE-2024-10254](https://insights.sbomify.com/CVE-2024-10254/): Memory corruption in App Store (medium 4.7)
- [CVE-2024-10253](https://insights.sbomify.com/CVE-2024-10253/): Race condition in App Store (medium 4.7)
- [CVE-2024-10252](https://insights.sbomify.com/CVE-2024-10252/): Code Injection in langgenius/dify (high 8.8)
- [CVE-2024-10251](https://insights.sbomify.com/CVE-2024-10251/): Privilege escalation in Security Controls (high 7.8)
- [CVE-2024-10250](https://insights.sbomify.com/CVE-2024-10250/): Nioland <= 1.2.6 - Reflected Cross-Site Scripting via s (medium 6.1)
- [CVE-2024-10247](https://insights.sbomify.com/CVE-2024-10247/): YouTube Gallery and Vimeo Gallery Plugin <= 2.4.2 - Authenticated (Administrator+) SQL Injection (high 7.2)
- [CVE-2024-10245](https://insights.sbomify.com/CVE-2024-10245/): Relais 2FA <= 1.0 - Authentication Bypass (critical 9.8)
- [CVE-2024-10244](https://insights.sbomify.com/CVE-2024-10244/): SQLi in ISDO Software's Web Software (critical 9.8)
- [CVE-2024-10242](https://insights.sbomify.com/CVE-2024-10242/): Reflected Cross-Site Scripting via Authentication Endpoint in WSO2 API Manager Allows UI Modification and Redirection (medium 6.1)
- [CVE-2024-10241](https://insights.sbomify.com/CVE-2024-10241/): Private channel names leaked with Ctrl+K when ElasticSearch is enabled (medium 4.3)
- [CVE-2024-10240](https://insights.sbomify.com/CVE-2024-10240/): Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab (medium 5.3)
- [CVE-2024-1024](https://insights.sbomify.com/CVE-2024-1024/): SourceCodester Facebook News Feed Like New Account cross site scripting (low 3.5)
- [CVE-2024-10239](https://insights.sbomify.com/CVE-2024-10239/): fld->used_bytes without sanity check causes stack overflow (high 7.2)
- [CVE-2024-10238](https://insights.sbomify.com/CVE-2024-10238/): fld->used_bytes without sanity check causes stack overflow (high 7.2)
- [CVE-2024-10237](https://insights.sbomify.com/CVE-2024-10237/): SMC BMC Firmware Image Authentication Design Issue (high 7.2)
- [CVE-2024-10234](https://insights.sbomify.com/CVE-2024-10234/): Wildfly: wildfly vulnerable to cross-site scripting (xss) (medium 6.1)
- [CVE-2024-10233](https://insights.sbomify.com/CVE-2024-10233/): SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode (medium 6.4)
- [CVE-2024-10232](https://insights.sbomify.com/CVE-2024-10232/): AtomChat <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atomchat Shortcode (medium 6.4)
- [CVE-2024-10231](https://insights.sbomify.com/CVE-2024-10231/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-10230](https://insights.sbomify.com/CVE-2024-10230/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-1023](https://insights.sbomify.com/CVE-2024-1023/): Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx (medium 6.5)
- [CVE-2024-10229](https://insights.sbomify.com/CVE-2024-10229/): Security feature bypass in Chrome (high 8.1)
- [CVE-2024-10228](https://insights.sbomify.com/CVE-2024-10228/): Vagrant VMWare Utility installation files vulnerable to modification by unprivileged user (low 3.8)
- [CVE-2024-10227](https://insights.sbomify.com/CVE-2024-10227/): affiliate-toolkit <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via atkp_product Shortcode (medium 6.4)
- [CVE-2024-10226](https://insights.sbomify.com/CVE-2024-10226/): Arconix Shortcodes <= 2.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via box Shortcode (medium 6.4)
- [CVE-2024-10225](https://insights.sbomify.com/CVE-2024-10225/): Denial of Service in haotian-liu/llava (high 7.5)
- [CVE-2024-10224](https://insights.sbomify.com/CVE-2024-10224/): Command injection in Module::ScanDeps (medium 5.3)
- [CVE-2024-10223](https://insights.sbomify.com/CVE-2024-10223/): HT Team Member <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via htteamember Shortcode (medium 6.4)
- [CVE-2024-10222](https://insights.sbomify.com/CVE-2024-10222/): SVG Support <= 2.5.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload (medium 6.4)
- [CVE-2024-10220](https://insights.sbomify.com/CVE-2024-10220/): Arbitrary command execution through gitRepo volume (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/509/