# Vulnerabilities published in 2024


- [CVE-2024-0913](https://insights.sbomify.com/CVE-2024-0913/): WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection (high 7.2)
- [CVE-2024-0912](https://insights.sbomify.com/CVE-2024-0912/): CCURE passwords exposed to administrators (high 8.5)
- [CVE-2024-0911](https://insights.sbomify.com/CVE-2024-0911/): Indent: heap-based buffer overflow in set_buf_break() (medium 5.5)
- [CVE-2024-0910](https://insights.sbomify.com/CVE-2024-0910/): Restrict for Elementor <= 1.0.7 - Protection Mechanism Bypass (medium 5.3)
- [CVE-2024-0909](https://insights.sbomify.com/CVE-2024-0909/): Anonymous Restricted Content <= 1.6.2 - Protection Mechanism Bypass (medium 5.3)
- [CVE-2024-0908](https://insights.sbomify.com/CVE-2024-0908/): Missing authorization in Advanced Post Block – Showcase Posts with Grid, List, Card Layouts and Filters (medium 5.3)
- [CVE-2024-0907](https://insights.sbomify.com/CVE-2024-0907/): NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records() (medium 5.3)
- [CVE-2024-0906](https://insights.sbomify.com/CVE-2024-0906/): f(x) Private Site <= 1.2.1 - Sensitive Information Exposure (medium 5.3)
- [CVE-2024-0905](https://insights.sbomify.com/CVE-2024-0905/): Fancy Product Designer < 6.1.8 - Reflected Cross Site Scripting (medium 6.3)
- [CVE-2024-0904](https://insights.sbomify.com/CVE-2024-0904/): Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting (medium 5.9)
- [CVE-2024-0903](https://insights.sbomify.com/CVE-2024-0903/): Cross-site scripting in UserFeedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds (medium 5.4)
- [CVE-2024-0902](https://insights.sbomify.com/CVE-2024-0902/): Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title (medium 4.3)
- [CVE-2024-0901](https://insights.sbomify.com/CVE-2024-0901/): SEGV and out of bounds memory read from malicious packet (high 7.5)
- [CVE-2024-0900](https://insights.sbomify.com/CVE-2024-0900/): Missing authorization in EleSpare – News, Magazine and Blog Addons for Elementor (medium 4.3)
- [CVE-2024-0899](https://insights.sbomify.com/CVE-2024-0899/): Information disclosure in s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions (medium 5.3)
- [CVE-2024-0898](https://insights.sbomify.com/CVE-2024-0898/): Chat Bubble <= 2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-0897](https://insights.sbomify.com/CVE-2024-0897/): Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0896](https://insights.sbomify.com/CVE-2024-0896/): Beaver Builder – WordPress Page Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0895](https://insights.sbomify.com/CVE-2024-0895/): PDF Flipbook, 3D Flipbook – DearFlip <= 2.2.26 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-0893](https://insights.sbomify.com/CVE-2024-0893/): Schema App Structured Data <= 2.2.0 - Missing Authorization (medium 4.3)
- [CVE-2024-0892](https://insights.sbomify.com/CVE-2024-0892/): Schema App Structured Data <= 2.2.0 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-0891](https://insights.sbomify.com/CVE-2024-0891/): hongmaple octopus cross site scripting (low 3.5)
- [CVE-2024-0890](https://insights.sbomify.com/CVE-2024-0890/): hongmaple octopus edit sql injection (medium 6.3)
- [CVE-2024-0889](https://insights.sbomify.com/CVE-2024-0889/): Kmint21 Golden FTP Server PASV Command denial of service (medium 5.3)
- [CVE-2024-0888](https://insights.sbomify.com/CVE-2024-0888/): BORGChat Service Port 7551 denial of service (medium 5.3)
- [CVE-2024-0887](https://insights.sbomify.com/CVE-2024-0887/): Mafiatic Blue Server Connection denial of service (medium 5.3)
- [CVE-2024-0886](https://insights.sbomify.com/CVE-2024-0886/): Poikosoft EZ CD Audio Converter Activation denial of service (low 3.3)
- [CVE-2024-0885](https://insights.sbomify.com/CVE-2024-0885/): SpyCamLizard HTTP GET Request denial of service (medium 5.3)
- [CVE-2024-0884](https://insights.sbomify.com/CVE-2024-0884/): SourceCodester Online Tours & Travels Management System payment.php exec sql injection (medium 4.7)
- [CVE-2024-0883](https://insights.sbomify.com/CVE-2024-0883/): SourceCodester Online Tours & Travels Management System pay.php prepare sql injection (medium 6.3)
- [CVE-2024-0882](https://insights.sbomify.com/CVE-2024-0882/): qwdigital LinkWechat Universal Download Interface resource path traversal (medium 4.3)
- [CVE-2024-0881](https://insights.sbomify.com/CVE-2024-0881/): Combo Blocks < 2.2.76 - Unauthenticated Password Protected Posts Access (medium 5.4)
- [CVE-2024-0880](https://insights.sbomify.com/CVE-2024-0880/): Qidianbang qdbcrm Password Reset cross-site request forgery (medium 4.3)
- [CVE-2024-0879](https://insights.sbomify.com/CVE-2024-0879/): Authentication bypass in vector-admin domain restriction (medium 6.5)
- [CVE-2024-0875](https://insights.sbomify.com/CVE-2024-0875/): Stored XSS in openemr/openemr (high 8.1)
- [CVE-2024-0874](https://insights.sbomify.com/CVE-2024-0874/): Coredns: cd bit response is cached and served later (medium 5.3)
- [CVE-2024-0873](https://insights.sbomify.com/CVE-2024-0873/): Watu Quiz <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0872](https://insights.sbomify.com/CVE-2024-0872/): Watu Quiz <= 3.4.1 - Sensitive Information Disclosure (medium 4.3)
- [CVE-2024-0871](https://insights.sbomify.com/CVE-2024-0871/): Beaver Builder <= 2.7.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Widget (medium 5.4)
- [CVE-2024-0870](https://insights.sbomify.com/CVE-2024-0870/): YITH WooCommerce Gift Cards <= 4.12.0 - Missing Authorization to Unauthenticated WooCommerce Settings Update (medium 5.3)
- [CVE-2024-0869](https://insights.sbomify.com/CVE-2024-0869/): Instant Images <= 6.1.0 - Authenticated (Author+) Arbitrary Options Update (high 8.8)
- [CVE-2024-0868](https://insights.sbomify.com/CVE-2024-0868/): coreActivity < 2.1 - Unauthenticated IP Spoofing (medium 5.3)
- [CVE-2024-0867](https://insights.sbomify.com/CVE-2024-0867/): Email Log <= 2.4.8 - Unauthenticated Hook Injection (high 8.1)
- [CVE-2024-0866](https://insights.sbomify.com/CVE-2024-0866/): Check & Log Email <= 1.0.9 - Unauthenticated Hook Injection (high 8.1)
- [CVE-2024-0865](https://insights.sbomify.com/CVE-2024-0865/): Hardcoded credentials in EcoStruxure IT Gateway (high 7.8)
- [CVE-2024-0864](https://insights.sbomify.com/CVE-2024-0864/): RCE in Laragon (critical 9.8)
- [CVE-2024-0862](https://insights.sbomify.com/CVE-2024-0862/): Server-side request forgery in Enterprise Protection (medium 5.0)
- [CVE-2024-0861](https://insights.sbomify.com/CVE-2024-0861/): Direct Request ('Forced Browsing') in GitLab (medium 4.3)
- [CVE-2024-0860](https://insights.sbomify.com/CVE-2024-0860/): Cleartext Transmission of Sensitive Information in Softing edgeConnector and edgeAggregator (high 8.0)
- [CVE-2024-0859](https://insights.sbomify.com/CVE-2024-0859/): Affiliates Manager <= 2.9.34 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-0858](https://insights.sbomify.com/CVE-2024-0858/): Innovs HR < 1.0.3.7.1 - Employee Creation via CSRF (high 8.8)
- [CVE-2024-0857](https://insights.sbomify.com/CVE-2024-0857/): SQLi in Universal Software's FlexWater Corporate Water Management (critical 9.8)
- [CVE-2024-0856](https://insights.sbomify.com/CVE-2024-0856/): Booking Calendar < 1.3.83 - CSRF appointment scheduling (high 8.8)
- [CVE-2024-0855](https://insights.sbomify.com/CVE-2024-0855/): Spiffy Calendar < 4.9.9 - Broken Access Control (medium 5.3)
- [CVE-2024-0854](https://insights.sbomify.com/CVE-2024-0854/): Open redirect in DiskStation Manager (DSM) (medium 5.4)
- [CVE-2024-0853](https://insights.sbomify.com/CVE-2024-0853/): OCSP verification bypass with TLS session reuse (medium 5.3)
- [CVE-2024-0852](https://insights.sbomify.com/CVE-2024-0852/): coreActivity < 1.8.1 - Unauthenticated Stored XSS (high 8.8)
- [CVE-2024-0851](https://insights.sbomify.com/CVE-2024-0851/): SQLi in Grup Arge Energy and Control Systems's Smartpower (critical 10.0)
- [CVE-2024-0849](https://insights.sbomify.com/CVE-2024-0849/): Leanote 2.7.0 - Local File Read (medium 5.0)
- [CVE-2024-0848](https://insights.sbomify.com/CVE-2024-0848/): AA Cash Calculator <= 1.0 - Reflected Cross-Site Scripting via invoice (medium 6.1)
- [CVE-2024-0847](https://insights.sbomify.com/CVE-2024-0847/): 5280 Bootstrap Modal Contact Form <= 1.0 - Cross-Site Request Forgery to Bulk Delete Messages (medium 4.3)
- [CVE-2024-0845](https://insights.sbomify.com/CVE-2024-0845/): PDF Viewer for Elementor <= 2.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via render (medium 6.4)
- [CVE-2024-0844](https://insights.sbomify.com/CVE-2024-0844/): Path traversal in Popup More Popups, Lightboxes, and more popup modules (medium 4.7)
- [CVE-2024-0842](https://insights.sbomify.com/CVE-2024-0842/): Backuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of Service (high 7.5)
- [CVE-2024-0841](https://insights.sbomify.com/CVE-2024-0841/): Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function (medium 6.6)
- [CVE-2024-0840](https://insights.sbomify.com/CVE-2024-0840/): Grandstream UCM Series IP PBX HTTP Parameter Injection (high 8.8)
- [CVE-2024-0839](https://insights.sbomify.com/CVE-2024-0839/): FeedWordPress <= 2022.0222 - Insecure Direct Object Referece (medium 5.3)
- [CVE-2024-0838](https://insights.sbomify.com/CVE-2024-0838/): Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0837](https://insights.sbomify.com/CVE-2024-0837/): Cross-site scripting in Element Pack – Widgets, Templates & Addons for Elementor (medium 6.4)
- [CVE-2024-0836](https://insights.sbomify.com/CVE-2024-0836/): Missing authorization in Review Schema – Review & Structure Data Schema Plugin (medium 4.3)
- [CVE-2024-0835](https://insights.sbomify.com/CVE-2024-0835/): Royal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update (medium 4.3)
- [CVE-2024-0834](https://insights.sbomify.com/CVE-2024-0834/): Cross-site scripting in Elementor Addon Elements (medium 6.4)
- [CVE-2024-0833](https://insights.sbomify.com/CVE-2024-0833/): Privilege Elevation via Telerik Test Studio (high 7.8)
- [CVE-2024-0832](https://insights.sbomify.com/CVE-2024-0832/): Privilege Elevation via Telerik Reporting Installer (high 7.8)
- [CVE-2024-0831](https://insights.sbomify.com/CVE-2024-0831/): Vault May Expose Sensitive Information When Configuring An Audit Log Device (medium 4.5)
- [CVE-2024-0830](https://insights.sbomify.com/CVE-2024-0830/): Comments Extra Fields For Post,Pages and CPT <= 5.0 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-0829](https://insights.sbomify.com/CVE-2024-0829/): Comments Extra Fields For Post,Pages and CPT <= 5.0 - Missing Authorization (medium 4.3)
- [CVE-2024-0828](https://insights.sbomify.com/CVE-2024-0828/): Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Missing Authorization (medium 5.4)
- [CVE-2024-0827](https://insights.sbomify.com/CVE-2024-0827/): Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio <= 3.6.4 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-0826](https://insights.sbomify.com/CVE-2024-0826/): Qi Addons For Elementor <= 1.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0825](https://insights.sbomify.com/CVE-2024-0825/): Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.3.2 - Authenticated (Contributor+) PHP Object Injection (high 8.8)
- [CVE-2024-0824](https://insights.sbomify.com/CVE-2024-0824/): Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything (medium 6.4)
- [CVE-2024-0823](https://insights.sbomify.com/CVE-2024-0823/): Exclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-0822](https://insights.sbomify.com/CVE-2024-0822/): Ovirt: authentication bypass (high 7.5)
- [CVE-2024-0821](https://insights.sbomify.com/CVE-2024-0821/): Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-0820](https://insights.sbomify.com/CVE-2024-0820/): Jobs for WordPress < 2.7.4 - Contributor+ Stored XSS (medium 5.4)
- [CVE-2024-0819](https://insights.sbomify.com/CVE-2024-0819/): Incomplete protection of personal password settings (high 7.3)
- [CVE-2024-0818](https://insights.sbomify.com/CVE-2024-0818/): PaddlePaddle Path Traversal vulnerability (critical 9.1)
- [CVE-2024-0817](https://insights.sbomify.com/CVE-2024-0817/): PaddlePaddle command injection vulnerability (critical 9.3)
- [CVE-2024-0816](https://insights.sbomify.com/CVE-2024-0816/): Memory corruption in DX3300-T1 firmware (medium 5.5)
- [CVE-2024-0815](https://insights.sbomify.com/CVE-2024-0815/): PaddlePaddle command injection in paddle.utils.download._wget_download (critical 9.3)
- [CVE-2024-0814](https://insights.sbomify.com/CVE-2024-0814/): Security feature bypass in Chrome (medium 6.5)
- [CVE-2024-0813](https://insights.sbomify.com/CVE-2024-0813/): Use after free in Chrome (high 8.8)
- [CVE-2024-0812](https://insights.sbomify.com/CVE-2024-0812/): Memory corruption in Chrome (high 8.8)
- [CVE-2024-0811](https://insights.sbomify.com/CVE-2024-0811/): Information disclosure in Chrome (medium 4.3)
- [CVE-2024-0810](https://insights.sbomify.com/CVE-2024-0810/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2024-0809](https://insights.sbomify.com/CVE-2024-0809/): Security feature bypass in Chrome (medium 4.3)
- [CVE-2024-0808](https://insights.sbomify.com/CVE-2024-0808/): Integer overflow in Chrome (critical 9.8)
- [CVE-2024-0807](https://insights.sbomify.com/CVE-2024-0807/): Use after free in Chrome (high 8.8)
- [CVE-2024-0806](https://insights.sbomify.com/CVE-2024-0806/): Use after free in Chrome (high 8.8)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/513/