# Vulnerabilities published in 2024


- [CVE-2024-0805](https://insights.sbomify.com/CVE-2024-0805/): Other in Chrome (medium 4.3)
- [CVE-2024-0804](https://insights.sbomify.com/CVE-2024-0804/): Security feature bypass in Chrome (high 7.5)
- [CVE-2024-0803](https://insights.sbomify.com/CVE-2024-0803/): Integer overflow in MELSEC-L Series L02CPU (critical 9.8)
- [CVE-2024-0802](https://insights.sbomify.com/CVE-2024-0802/): Memory corruption in MELSEC-L Series L02CPU (critical 9.8)
- [CVE-2024-0801](https://insights.sbomify.com/CVE-2024-0801/): Unauthenticated DoS in Arcserve Unified Data Protection (high 7.5)
- [CVE-2024-0800](https://insights.sbomify.com/CVE-2024-0800/): Authentication Bypass via wizardLogin in Arcserve Unified Data Protection (high 8.8)
- [CVE-2024-0799](https://insights.sbomify.com/CVE-2024-0799/): Authentication Bypass via wizardLogin in Arcserve Unified Data Protection (critical 9.8)
- [CVE-2024-0798](https://insights.sbomify.com/CVE-2024-0798/): Privilege Escalation in mintplex-labs/anything-llm (high 8.1)
- [CVE-2024-0797](https://insights.sbomify.com/CVE-2024-0797/): Missing authorization in Active Products Tables for WooCommerce. Use constructor to create tables (medium 4.3)
- [CVE-2024-0796](https://insights.sbomify.com/CVE-2024-0796/): Cross-site request forgery in Active Products Tables for WooCommerce. Use constructor to create tables (medium 4.3)
- [CVE-2024-0795](https://insights.sbomify.com/CVE-2024-0795/): Create user API role not enforced (high 7.2)
- [CVE-2024-0794](https://insights.sbomify.com/CVE-2024-0794/): Memory corruption in Certain LaserJet Pro, HP Enterprise LaserJet, HP LaserJet Managed Printers (critical 9.8)
- [CVE-2024-0793](https://insights.sbomify.com/CVE-2024-0793/): Kube-controller-manager: malformed hpa v1 manifest causes crash (high 7.7)
- [CVE-2024-0792](https://insights.sbomify.com/CVE-2024-0792/): Cross-site scripting in WP Shortcodes Plugin — Shortcodes Ultimate (medium 6.4)
- [CVE-2024-0791](https://insights.sbomify.com/CVE-2024-0791/): WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Missing Authorization (medium 4.3)
- [CVE-2024-0790](https://insights.sbomify.com/CVE-2024-0790/): WOLF – WordPress Posts Bulk Editor and Manager Professional <= 1.0.8.1 - Cross-Site Request Forgery (medium 5.4)
- [CVE-2024-0789](https://insights.sbomify.com/CVE-2024-0789/): WP Maintenance <= 6.1.9.2 - IP Spoofing to Maintenance Mode Bypass (medium 5.3)
- [CVE-2024-0788](https://insights.sbomify.com/CVE-2024-0788/): SUPERAntiSpyware Pro X v10.0.1260 - Kernel-level API parameters manipulation (medium 6.6)
- [CVE-2024-0787](https://insights.sbomify.com/CVE-2024-0787/): Improper Restriction of Excessive Authentication Attempts in phpipam/phpipam (medium 5.3)
- [CVE-2024-0786](https://insights.sbomify.com/CVE-2024-0786/): Conversios <= 7.0.7 - Authenticated (Subscriber+) SQL Injection via ee_syncProductCategory (high 8.8)
- [CVE-2024-0784](https://insights.sbomify.com/CVE-2024-0784/): hongmaple octopus list sql injection (medium 6.3)
- [CVE-2024-0783](https://insights.sbomify.com/CVE-2024-0783/): Project Worlds Online Admission System documents.php unrestricted upload (medium 6.3)
- [CVE-2024-0782](https://insights.sbomify.com/CVE-2024-0782/): CodeAstro Online Railway Reservation System pass-profile.php cross site scripting (low 3.5)
- [CVE-2024-0781](https://insights.sbomify.com/CVE-2024-0781/): CodeAstro Internet Banking System pages_client_signup.php redirect (low 3.5)
- [CVE-2024-0780](https://insights.sbomify.com/CVE-2024-0780/): Enjoy Social Feed <= 6.2.2 - Subscriber+ Plugin Database Reset (high 8.8)
- [CVE-2024-0779](https://insights.sbomify.com/CVE-2024-0779/): Enjoy Social Feed <= 6.2.2 - Unauthenticated Arbitrary Instagram Account Unlinking (high 8.8)
- [CVE-2024-0778](https://insights.sbomify.com/CVE-2024-0778/): Uniview ISC 2500-S VM.php setNatConfig os command injection (high 8.0)
- [CVE-2024-0776](https://insights.sbomify.com/CVE-2024-0776/): LinZhaoguan pb-cms Comment cross site scripting (low 3.5)
- [CVE-2024-0775](https://insights.sbomify.com/CVE-2024-0775/): Kernel: use-after-free while changing the mount option in __ext4_remount leading (medium 6.7)
- [CVE-2024-0774](https://insights.sbomify.com/CVE-2024-0774/): Any-Capture Any Sound Recorder Registration memory corruption (medium 5.3)
- [CVE-2024-0773](https://insights.sbomify.com/CVE-2024-0773/): CodeAstro Internet Banking System pages_client_signup.php cross site scripting (low 3.5)
- [CVE-2024-0772](https://insights.sbomify.com/CVE-2024-0772/): Nsasoft ShareAlarmPro Registration memory corruption (medium 5.3)
- [CVE-2024-0771](https://insights.sbomify.com/CVE-2024-0771/): Nsasoft Product Key Explorer Registration memory corruption (medium 5.3)
- [CVE-2024-0770](https://insights.sbomify.com/CVE-2024-0770/): European Chemicals Agency IUCLID Desktop Installer iuclid6.exe default permission (medium 4.4)
- [CVE-2024-0769](https://insights.sbomify.com/CVE-2024-0769/): D-Link DIR-859 Router Path Traversal (medium 5.3, exploited in the wild)
- [CVE-2024-0768](https://insights.sbomify.com/CVE-2024-0768/): Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation (medium 4.3)
- [CVE-2024-0767](https://insights.sbomify.com/CVE-2024-0767/): Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation (medium 4.3)
- [CVE-2024-0766](https://insights.sbomify.com/CVE-2024-0766/): Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request (medium 4.3)
- [CVE-2024-0765](https://insights.sbomify.com/CVE-2024-0765/): Default user role exporting save state of instance (critical 9.6)
- [CVE-2024-0763](https://insights.sbomify.com/CVE-2024-0763/): Improper validation of document removal parameter (high 8.1)
- [CVE-2024-0762](https://insights.sbomify.com/CVE-2024-0762/): Potential buffer overflow when handling UEFI variables (high 7.5)
- [CVE-2024-0761](https://insights.sbomify.com/CVE-2024-0761/): File Manager <= 7.2.1 - Sensitive Information Exposure via Backup Filenames (high 8.1)
- [CVE-2024-0760](https://insights.sbomify.com/CVE-2024-0760/): A flood of DNS messages over TCP may make the server unstable (high 7.5)
- [CVE-2024-0759](https://insights.sbomify.com/CVE-2024-0759/): Collection of internally resolving IPs (high 7.7)
- [CVE-2024-0758](https://insights.sbomify.com/CVE-2024-0758/): MolecularFaces XSS (medium 6.1)
- [CVE-2024-0757](https://insights.sbomify.com/CVE-2024-0757/): Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Author+ Upload to RCE (medium 5.4)
- [CVE-2024-0756](https://insights.sbomify.com/CVE-2024-0756/): Insert or Embed Articulate Content into WordPress <= 4.3000000023 - Iframe Injection (low 3.5)
- [CVE-2024-0755](https://insights.sbomify.com/CVE-2024-0755/): Memory corruption in Firefox (high 8.8)
- [CVE-2024-0754](https://insights.sbomify.com/CVE-2024-0754/): Denial of service in Firefox (medium 6.5)
- [CVE-2024-0753](https://insights.sbomify.com/CVE-2024-0753/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2024-0752](https://insights.sbomify.com/CVE-2024-0752/): Use after free in Firefox (medium 6.5)
- [CVE-2024-0751](https://insights.sbomify.com/CVE-2024-0751/): Privilege escalation in Firefox (high 8.8)
- [CVE-2024-0750](https://insights.sbomify.com/CVE-2024-0750/): Security feature bypass in Firefox (high 8.8)
- [CVE-2024-0749](https://insights.sbomify.com/CVE-2024-0749/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2024-0748](https://insights.sbomify.com/CVE-2024-0748/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2024-0747](https://insights.sbomify.com/CVE-2024-0747/): Security feature bypass in Firefox (medium 6.5)
- [CVE-2024-0746](https://insights.sbomify.com/CVE-2024-0746/): Use after free in Firefox (medium 6.5)
- [CVE-2024-0745](https://insights.sbomify.com/CVE-2024-0745/): Memory corruption in Firefox (high 8.8)
- [CVE-2024-0744](https://insights.sbomify.com/CVE-2024-0744/): Memory corruption in Firefox (high 7.5)
- [CVE-2024-0743](https://insights.sbomify.com/CVE-2024-0743/): Memory corruption in Firefox (high 7.5)
- [CVE-2024-0742](https://insights.sbomify.com/CVE-2024-0742/): Security feature bypass in Firefox (medium 4.3)
- [CVE-2024-0741](https://insights.sbomify.com/CVE-2024-0741/): Memory corruption in Firefox (medium 6.5)
- [CVE-2024-0740](https://insights.sbomify.com/CVE-2024-0740/): Eclipse Target Management <= 4.5.500 Command Injection (critical 9.8)
- [CVE-2024-0739](https://insights.sbomify.com/CVE-2024-0739/): Hecheng Leadshop leadshop.php deserialization (high 7.3)
- [CVE-2024-0738](https://insights.sbomify.com/CVE-2024-0738/): 个人开源 mldong DecisionModel.java ExpressionEngine code injection (medium 6.3)
- [CVE-2024-0737](https://insights.sbomify.com/CVE-2024-0737/): Xlightftpd Xlight FTP Server Login denial of service (medium 5.3)
- [CVE-2024-0736](https://insights.sbomify.com/CVE-2024-0736/): EFS Easy File Sharing FTP Login denial of service (medium 5.3)
- [CVE-2024-0735](https://insights.sbomify.com/CVE-2024-0735/): SourceCodester Online Tours & Travels Management System expense.php exec sql injection (medium 6.3)
- [CVE-2024-0734](https://insights.sbomify.com/CVE-2024-0734/): Smsot get.php sql injection (medium 6.3)
- [CVE-2024-0733](https://insights.sbomify.com/CVE-2024-0733/): Smsot HTTP POST Request api.php sql injection (medium 6.3)
- [CVE-2024-0732](https://insights.sbomify.com/CVE-2024-0732/): PCMan FTP Server STOR Command denial of service (medium 5.3)
- [CVE-2024-0731](https://insights.sbomify.com/CVE-2024-0731/): PCMan FTP Server PUT Command denial of service (medium 5.3)
- [CVE-2024-0730](https://insights.sbomify.com/CVE-2024-0730/): Project Worlds Online Time Table Generator course_ajax.php sql injection (medium 6.3)
- [CVE-2024-0729](https://insights.sbomify.com/CVE-2024-0729/): ForU CMS cms_admin.php sql injection (medium 5.5)
- [CVE-2024-0728](https://insights.sbomify.com/CVE-2024-0728/): ForU CMS channel.php file inclusion (medium 4.7)
- [CVE-2024-0727](https://insights.sbomify.com/CVE-2024-0727/): PKCS12 Decoding crashes (medium 5.5)
- [CVE-2024-0726](https://insights.sbomify.com/CVE-2024-0726/): Project Worlds Student Project Allocation System Admin Login Module admin_login.php cross site scripting (medium 4.3)
- [CVE-2024-0725](https://insights.sbomify.com/CVE-2024-0725/): ProSSHD denial of service (medium 5.3)
- [CVE-2024-0723](https://insights.sbomify.com/CVE-2024-0723/): freeSSHd denial of service (medium 5.3)
- [CVE-2024-0722](https://insights.sbomify.com/CVE-2024-0722/): code-projects Social Networking Site Message Page message.php cross site scripting (low 3.5)
- [CVE-2024-0721](https://insights.sbomify.com/CVE-2024-0721/): Jspxcms Survey Label cross site scripting (low 3.5)
- [CVE-2024-0720](https://insights.sbomify.com/CVE-2024-0720/): FactoMineR FactoInvestigate HTML Report Generator cross site scripting (low 3.5)
- [CVE-2024-0719](https://insights.sbomify.com/CVE-2024-0719/): Tabs Shortcode and Widget <= 1.17 - Contributor+ Stored Cross-Site Scripting (medium 5.4)
- [CVE-2024-0718](https://insights.sbomify.com/CVE-2024-0718/): liuwy-dlsdys zhglxt HTTP POST Request edit cross site scripting (low 2.4)
- [CVE-2024-0717](https://insights.sbomify.com/CVE-2024-0717/): D-Link Good Line Router v2 HTTP GET Request devinfo information disclosure (medium 5.3)
- [CVE-2024-0716](https://insights.sbomify.com/CVE-2024-0716/): Byzoro Smart S150 Management Platform Backup File download.php information disclosure (low 3.1)
- [CVE-2024-0715](https://insights.sbomify.com/CVE-2024-0715/): EL Injection Vulnerability in Hitachi Global Link Manager (high 7.6)
- [CVE-2024-0714](https://insights.sbomify.com/CVE-2024-0714/): MiczFlor RPi-Jukebox-RFID HTTP Request userScripts.php os command injection (medium 6.3)
- [CVE-2024-0712](https://insights.sbomify.com/CVE-2024-0712/): Byzoro Smart S150 Management Platform userattea.php access control (high 7.3)
- [CVE-2024-0711](https://insights.sbomify.com/CVE-2024-0711/): Buttons Shortcode and Widget <= 1.16 - Stored XSS via shortcode (medium 6.1)
- [CVE-2024-0710](https://insights.sbomify.com/CVE-2024-0710/): GP Unique ID <= 1.5.5 - Unauthenticated Form Submission Unique ID Modification (medium 5.3)
- [CVE-2024-0709](https://insights.sbomify.com/CVE-2024-0709/): SQL injection in Cryptocurrency Widgets – Price Ticker & Coins List (critical 9.8)
- [CVE-2024-0708](https://insights.sbomify.com/CVE-2024-0708/): Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.2 - Unauthenticated Information Exposure (medium 5.3)
- [CVE-2024-0705](https://insights.sbomify.com/CVE-2024-0705/): Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-0703](https://insights.sbomify.com/CVE-2024-0703/): Sticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-0702](https://insights.sbomify.com/CVE-2024-0702/): Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorization (high 7.3)
- [CVE-2024-0701](https://insights.sbomify.com/CVE-2024-0701/): UserPro <= 5.1.6 - Disabled Membership Registration Bypass (medium 5.3)
- [CVE-2024-0700](https://insights.sbomify.com/CVE-2024-0700/): Simple Tweet <= 1.4.0.2 - Authenticated (Author+) Stored Cross-Site Scripting (medium 6.4)
- [CVE-2024-0699](https://insights.sbomify.com/CVE-2024-0699/): AI Engine <= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add_image_from_url (medium 6.6)
- [CVE-2024-0698](https://insights.sbomify.com/CVE-2024-0698/): Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (medium 6.4)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/514/