# Vulnerabilities published in 2024


- [CVE-2024-10125](https://insights.sbomify.com/CVE-2024-10125/): Lack of JWT issuer and signer validation (medium 6.9)
- [CVE-2024-10124](https://insights.sbomify.com/CVE-2024-10124/): Missing authorization in Vayu Blocks – Website Builder for the Block Editor (critical 9.8)
- [CVE-2024-10123](https://insights.sbomify.com/CVE-2024-10123/): Tenda AC8 saveParentControlInfo compare_parentcontrol_time stack-based overflow (high 8.7)
- [CVE-2024-10122](https://insights.sbomify.com/CVE-2024-10122/): Topdata Inner Rep Plus WebServer Operator Details Form InnerRepPlus.html missing password field masking (medium 5.1)
- [CVE-2024-10121](https://insights.sbomify.com/CVE-2024-10121/): wfh45678 Radar Interface authorization (medium 6.9)
- [CVE-2024-10120](https://insights.sbomify.com/CVE-2024-10120/): wfh45678 Radar upload unrestricted upload (medium 6.9)
- [CVE-2024-1012](https://insights.sbomify.com/CVE-2024-1012/): Wanhu ezOFFICE wf_printnum.jsp sql injection (medium 6.3)
- [CVE-2024-10119](https://insights.sbomify.com/CVE-2024-10119/): SECOM WRTM326 - OS Command Injection (critical 9.8)
- [CVE-2024-10118](https://insights.sbomify.com/CVE-2024-10118/): SECOM WRTR-304GN-304TW-UPSC - OS Command Injection (critical 9.8)
- [CVE-2024-10117](https://insights.sbomify.com/CVE-2024-10117/): WP Crowdfunding <= 2.1.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpcf_donate Shortcode (medium 6.4)
- [CVE-2024-10116](https://insights.sbomify.com/CVE-2024-10116/): Twitter Follow Button <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via username Parameter (medium 6.4)
- [CVE-2024-10114](https://insights.sbomify.com/CVE-2024-10114/): Social Login - WordPress / WooCommerce Plugin <= 2.7.7 - Authentication Bypass via WordPress.com OAuth provider (high 8.1)
- [CVE-2024-10113](https://insights.sbomify.com/CVE-2024-10113/): Cross-site scripting in WP AdCenter – Ad Manager & Adsense Ads (medium 6.4)
- [CVE-2024-10112](https://insights.sbomify.com/CVE-2024-10112/): Simple News <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via news Shortcode (medium 6.4)
- [CVE-2024-10111](https://insights.sbomify.com/CVE-2024-10111/): OAuth Single Sign On – SSO (OAuth Client) <= 6.26.3 - Authentication Bypass (high 8.1)
- [CVE-2024-10110](https://insights.sbomify.com/CVE-2024-10110/): Denial of Service in aimhubio/aim (high 7.5)
- [CVE-2024-1011](https://insights.sbomify.com/CVE-2024-1011/): SourceCodester Employee Management System Leave delete-leave.php access control (medium 4.3)
- [CVE-2024-10109](https://insights.sbomify.com/CVE-2024-10109/): Incorrect Authorization in mintplex-labs/anything-llm (high 8.3)
- [CVE-2024-10108](https://insights.sbomify.com/CVE-2024-10108/): WPAdverts – Classifieds Plugin <= 2.1.6 - Unauthenticated Stored Cross-Site Scripting via adverts_add Shortcode (high 7.2)
- [CVE-2024-10107](https://insights.sbomify.com/CVE-2024-10107/): Giveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10106](https://insights.sbomify.com/CVE-2024-10106/): Ember ZNet buffer overflow in 'packet handoff' plugin (low 3.7)
- [CVE-2024-10105](https://insights.sbomify.com/CVE-2024-10105/): Jobs for WordPress < 2.7.11 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-10104](https://insights.sbomify.com/CVE-2024-10104/): Jobs for WordPress < 2.7.8 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-10103](https://insights.sbomify.com/CVE-2024-10103/): MailPoet < 5.3.2 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-10102](https://insights.sbomify.com/CVE-2024-10102/): Photo Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS (low 2.7)
- [CVE-2024-10101](https://insights.sbomify.com/CVE-2024-10101/): Stored XSS in binary-husky/gpt_academic (medium 5.4)
- [CVE-2024-10100](https://insights.sbomify.com/CVE-2024-10100/): Path Traversal in binary-husky/gpt_academic (medium 6.5)
- [CVE-2024-1010](https://insights.sbomify.com/CVE-2024-1010/): SourceCodester Employee Management System edit-profile.php cross site scripting (low 3.5)
- [CVE-2024-10099](https://insights.sbomify.com/CVE-2024-10099/): Stored XSS in comfyanonymous/comfyui (medium 6.1)
- [CVE-2024-10098](https://insights.sbomify.com/CVE-2024-10098/): ApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access (low 2.7)
- [CVE-2024-10097](https://insights.sbomify.com/CVE-2024-10097/): Loginizer Security and Loginizer <= 1.9.2 - Authentication Bypass via WordPress.com OAuth provider (high 8.1)
- [CVE-2024-10095](https://insights.sbomify.com/CVE-2024-10095/): Progress UI for WPF format provider unsafe deserialization vulnerability (high 8.4)
- [CVE-2024-10094](https://insights.sbomify.com/CVE-2024-10094/): Code injection in Pega Infinity (critical 9.1)
- [CVE-2024-10093](https://insights.sbomify.com/CVE-2024-10093/): VSO ConvertXtoDvd ConvertXtoDvd.exe uncontrolled search path (high 8.5)
- [CVE-2024-10092](https://insights.sbomify.com/CVE-2024-10092/): Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation (medium 4.3)
- [CVE-2024-10091](https://insights.sbomify.com/CVE-2024-10091/): Cross-site scripting in ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor (medium 6.4)
- [CVE-2024-10090](https://insights.sbomify.com/CVE-2024-10090/): XSS in iKSORIS (medium 5.1)
- [CVE-2024-1009](https://insights.sbomify.com/CVE-2024-1009/): SourceCodester Employee Management System login.php sql injection (high 7.3)
- [CVE-2024-10089](https://insights.sbomify.com/CVE-2024-10089/): XSS in iKSORIS (medium 5.1)
- [CVE-2024-10088](https://insights.sbomify.com/CVE-2024-10088/): XSS in iKSORIS (medium 5.1)
- [CVE-2024-10087](https://insights.sbomify.com/CVE-2024-10087/): XSS in iKSORIS (medium 5.3)
- [CVE-2024-10086](https://insights.sbomify.com/CVE-2024-10086/): Consul Vulnerable To Reflected XSS On Content-Type Error Manipulation (medium 6.1)
- [CVE-2024-10085](https://insights.sbomify.com/CVE-2024-10085/): Denial of service in EcoStruxure™ Modicon Communication Server (high 8.2)
- [CVE-2024-10084](https://insights.sbomify.com/CVE-2024-10084/): Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode (medium 4.3)
- [CVE-2024-10083](https://insights.sbomify.com/CVE-2024-10083/): Denial of service in Uni-Telway driver (medium 6.8)
- [CVE-2024-10082](https://insights.sbomify.com/CVE-2024-10082/): codechecker authentication method confusion vulnerability allows logging in as the built-in root user from an external service (high 8.7)
- [CVE-2024-10081](https://insights.sbomify.com/CVE-2024-10081/): codechecker vulnerable to authentication bypass when using specifically crafted URLs (critical 10.0)
- [CVE-2024-10080](https://insights.sbomify.com/CVE-2024-10080/): WP Easy Post Types <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta (medium 6.4)
- [CVE-2024-1008](https://insights.sbomify.com/CVE-2024-1008/): SourceCodester Employee Management System Profile Page edit-photo.php unrestricted upload (medium 4.7)
- [CVE-2024-10079](https://insights.sbomify.com/CVE-2024-10079/): WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) PHP Object Injection (high 8.8)
- [CVE-2024-10078](https://insights.sbomify.com/CVE-2024-10078/): WP Easy Post Types <= 1.4.4 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions (medium 6.3)
- [CVE-2024-10076](https://insights.sbomify.com/CVE-2024-10076/): Jetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS (medium 5.9)
- [CVE-2024-10075](https://insights.sbomify.com/CVE-2024-10075/): Jetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution (medium 5.6)
- [CVE-2024-10074](https://insights.sbomify.com/CVE-2024-10074/): Liteos_a has an use after free vulnerability (high 8.8)
- [CVE-2024-10073](https://insights.sbomify.com/CVE-2024-10073/): flairNLP flair Mode File Loader clustering.py ClusteringModel code injection (medium 6.3)
- [CVE-2024-10072](https://insights.sbomify.com/CVE-2024-10072/): ESAFENET CDG EncryptPolicyService.java actionAddEncryptPolicyGroup sql injection (medium 5.3)
- [CVE-2024-10071](https://insights.sbomify.com/CVE-2024-10071/): ESAFENET CDG EncryptPolicyService.java actionUpdateEncryptPolicyEdit sql injection (medium 5.3)
- [CVE-2024-10070](https://insights.sbomify.com/CVE-2024-10070/): ESAFENET CDG PolicyPushControlAction.java actionPolicyPush sql injection (medium 5.3)
- [CVE-2024-1007](https://insights.sbomify.com/CVE-2024-1007/): SourceCodester Employee Management System edit_profile.php sql injection (medium 6.3)
- [CVE-2024-10069](https://insights.sbomify.com/CVE-2024-10069/): ESAFENET CDG MailDecryptApplicationService.java actionPassMainApplication sql injection (medium 5.3)
- [CVE-2024-10068](https://insights.sbomify.com/CVE-2024-10068/): OpenSight Software FlashFXP FlashFXP.exe uncontrolled search path (high 8.5)
- [CVE-2024-1006](https://insights.sbomify.com/CVE-2024-1006/): Shanxi Diankeyun Technology NODERP Cookie common.php improper authentication (high 7.3)
- [CVE-2024-10057](https://insights.sbomify.com/CVE-2024-10057/): RSS Feed Widget <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via rfw-youtube-videos Shortcode (medium 6.4)
- [CVE-2024-10056](https://insights.sbomify.com/CVE-2024-10056/): Contact Form Builder <= 4.10.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via livesite-pay Shortcode (medium 6.4)
- [CVE-2024-10055](https://insights.sbomify.com/CVE-2024-10055/): Cross-site scripting in WP Click to Chat – Email, Live Chat, Call & Book Now Buttons (medium 6.4)
- [CVE-2024-10054](https://insights.sbomify.com/CVE-2024-10054/): Happyforms < 1.26.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10051](https://insights.sbomify.com/CVE-2024-10051/): Unauthenticated Denial of Service in shaunwei/realchar (high 7.5)
- [CVE-2024-10050](https://insights.sbomify.com/CVE-2024-10050/): Elementor Header & Footer Builder <= 1.6.43 - Authenticated (Contributor+) Information Disclosure via Shortcode (medium 4.3)
- [CVE-2024-1005](https://insights.sbomify.com/CVE-2024-1005/): Shanxi Diankeyun Technology NODERP log file access (medium 5.3)
- [CVE-2024-10049](https://insights.sbomify.com/CVE-2024-10049/): Edit WooCommerce Templates <= 1.1.2 - Reflected Cross-Site Scripting via page (medium 6.1)
- [CVE-2024-10048](https://insights.sbomify.com/CVE-2024-10048/): Post Status Notifier Lite and Premium <= 1.11.6 - Reflected Cross-Site Scripting via page (medium 6.1)
- [CVE-2024-10047](https://insights.sbomify.com/CVE-2024-10047/): Directory Listing Vulnerability in parisneo/lollms-webui (medium 5.3)
- [CVE-2024-10046](https://insights.sbomify.com/CVE-2024-10046/): افزونه پیامک ووکامرس Persian WooCommerce SMS <= 7.0.5 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-10045](https://insights.sbomify.com/CVE-2024-10045/): Transients Manager <= 2.0.6 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-10044](https://insights.sbomify.com/CVE-2024-10044/): SSRF in POST /worker_generate_stream API endpoint in lm-sys/fastchat (critical 9.3)
- [CVE-2024-10043](https://insights.sbomify.com/CVE-2024-10043/): Incorrect Authorization in GitLab (low 3.1)
- [CVE-2024-10041](https://insights.sbomify.com/CVE-2024-10041/): Pam: libpam: libpam vulnerable to read hashed password (medium 4.7)
- [CVE-2024-10040](https://insights.sbomify.com/CVE-2024-10040/): Infinite-Scroll <= 2.6.2 - Cross-Site Request Forgery to Plugin Settings Update (medium 5.3)
- [CVE-2024-1004](https://insights.sbomify.com/CVE-2024-1004/): Totolink N200RE cstecgi.cgi loginAuth stack-based overflow (high 7.2)
- [CVE-2024-10038](https://insights.sbomify.com/CVE-2024-10038/): WP-Strava <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-10037](https://insights.sbomify.com/CVE-2024-10037/): Null dereference in RTU500 (medium 5.9)
- [CVE-2024-10035](https://insights.sbomify.com/CVE-2024-10035/): Code Injection in BG-TEK's CoslatV3 (critical 9.2)
- [CVE-2024-10034](https://insights.sbomify.com/CVE-2024-10034/): Cross-site scripting in Mixed Media Gallery Blocks (medium 5.5)
- [CVE-2024-10033](https://insights.sbomify.com/CVE-2024-10033/): Aap-gateway: xss on aap-gateway (medium 6.1)
- [CVE-2024-10032](https://insights.sbomify.com/CVE-2024-10032/): Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console (medium 6.1)
- [CVE-2024-10031](https://insights.sbomify.com/CVE-2024-10031/): Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications (medium 5.8)
- [CVE-2024-1003](https://insights.sbomify.com/CVE-2024-1003/): Totolink N200RE cstecgi.cgi setLanguageCfg stack-based overflow (high 7.2)
- [CVE-2024-10029](https://insights.sbomify.com/CVE-2024-10029/): Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console (medium 4.5)
- [CVE-2024-10028](https://insights.sbomify.com/CVE-2024-10028/): Information disclosure in Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin (high 7.5)
- [CVE-2024-10027](https://insights.sbomify.com/CVE-2024-10027/): WP Booking Calendar < 10.6.3 - Admin+ Stored XSS (medium 4.8)
- [CVE-2024-10026](https://insights.sbomify.com/CVE-2024-10026/): Improved Seeding and Hashing In gVisor (medium 6.3)
- [CVE-2024-10025](https://insights.sbomify.com/CVE-2024-10025/): Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx (critical 9.1)
- [CVE-2024-10024](https://insights.sbomify.com/CVE-2024-10024/): code-projects Pharmacy Management System manage_medicine_stock.php sql injection (medium 5.3)
- [CVE-2024-10023](https://insights.sbomify.com/CVE-2024-10023/): code-projects Pharmacy Management System add_new_medicine.php sql injection (medium 5.3)
- [CVE-2024-10022](https://insights.sbomify.com/CVE-2024-10022/): code-projects Pharmacy Management System manage_supplier.php sql injection (medium 5.3)
- [CVE-2024-10021](https://insights.sbomify.com/CVE-2024-10021/): code-projects Pharmacy Management System manage_purchase.php sql injection (medium 5.3)
- [CVE-2024-10020](https://insights.sbomify.com/CVE-2024-10020/): Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider (high 8.1)
- [CVE-2024-1002](https://insights.sbomify.com/CVE-2024-1002/): Totolink N200RE cstecgi.cgi setIpPortFilterRules stack-based overflow (high 7.2)
- [CVE-2024-10019](https://insights.sbomify.com/CVE-2024-10019/): Path Traversal and OS Command Injection in parisneo/lollms-webui (medium 6.3)
- [CVE-2024-10018](https://insights.sbomify.com/CVE-2024-10018/): Missing authorization in com.transsion.aivoiceassistant (critical 9.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/511/