# Vulnerabilities published in 2024


- [CVE-2024-0697](https://insights.sbomify.com/CVE-2024-0697/): Backuply – Backup, Restore, Migrate and Clone <= 1.2.3 - Authenticated (Administrator+) Directory Traversal (medium 6.5)
- [CVE-2024-0696](https://insights.sbomify.com/CVE-2024-0696/): AtroCore AtroPIM Product Series Overview cross site scripting (low 3.5)
- [CVE-2024-0695](https://insights.sbomify.com/CVE-2024-0695/): EFS Easy Chat Server HTTP GET Request denial of service (medium 4.3)
- [CVE-2024-0693](https://insights.sbomify.com/CVE-2024-0693/): EFS Easy File Sharing FTP denial of service (medium 5.3)
- [CVE-2024-0692](https://insights.sbomify.com/CVE-2024-0692/): SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-0691](https://insights.sbomify.com/CVE-2024-0691/): FileBird <= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import (medium 5.5)
- [CVE-2024-0690](https://insights.sbomify.com/CVE-2024-0690/): Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration (medium 5.0)
- [CVE-2024-0689](https://insights.sbomify.com/CVE-2024-0689/): Custom Field Suite <= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-0688](https://insights.sbomify.com/CVE-2024-0688/): WebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-0687](https://insights.sbomify.com/CVE-2024-0687/): Restrict User Access – Ultimate Membership & Content Protection <= 2.5 - Information Exposure (medium 5.3)
- [CVE-2024-0685](https://insights.sbomify.com/CVE-2024-0685/): Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection (medium 5.9)
- [CVE-2024-0684](https://insights.sbomify.com/CVE-2024-0684/): Coreutils: heap overflow in split --line-bytes with very long lines (medium 5.5)
- [CVE-2024-0683](https://insights.sbomify.com/CVE-2024-0683/): Bulgarisation for WooCommerce <= 3.0.14 - Missing Authorization (high 7.3)
- [CVE-2024-0682](https://insights.sbomify.com/CVE-2024-0682/): Page Restrict <= 2.5.5 - Protection Mechanism Bypass (medium 5.3)
- [CVE-2024-0681](https://insights.sbomify.com/CVE-2024-0681/): Page Restriction WordPress (WP) – Protect WP Pages/Post <= 1.3.4 - Protection Mechanism Bypass (medium 5.3)
- [CVE-2024-0680](https://insights.sbomify.com/CVE-2024-0680/): WP Private Content Plus <= 3.6 - Protection Mechanism Bypass (medium 5.3)
- [CVE-2024-0679](https://insights.sbomify.com/CVE-2024-0679/): ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation (medium 6.5)
- [CVE-2024-0678](https://insights.sbomify.com/CVE-2024-0678/): Order Delivery Date for WP e-Commerce <= 1.2 - Unauthenticated Stored Cross-Site Scripting (medium 6.5)
- [CVE-2024-0677](https://insights.sbomify.com/CVE-2024-0677/): Pz-LinkCard <= 2.5.1 - Contributor+ SSRF (medium 5.1)
- [CVE-2024-0676](https://insights.sbomify.com/CVE-2024-0676/): Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines (medium 5.6)
- [CVE-2024-0675](https://insights.sbomify.com/CVE-2024-0675/): Improper checking for unusual or exceptional conditions vulnerability in Lamassu Bitcoin ATM Douro machines (medium 6.3)
- [CVE-2024-0674](https://insights.sbomify.com/CVE-2024-0674/): Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines (medium 6.3)
- [CVE-2024-0673](https://insights.sbomify.com/CVE-2024-0673/): Pz-LinkCard <= 2.5.1 - Admin+ Stored XSS (medium 6.1)
- [CVE-2024-0672](https://insights.sbomify.com/CVE-2024-0672/): Pz-LinkCard <= 2.5.1 - Reflected XSS (high 7.1)
- [CVE-2024-0671](https://insights.sbomify.com/CVE-2024-0671/): Mali GPU Kernel Driver allows improper GPU memory processing operations (medium 6.8)
- [CVE-2024-0670](https://insights.sbomify.com/CVE-2024-0670/): Privilege escalation in windows agent (high 8.8)
- [CVE-2024-0669](https://insights.sbomify.com/CVE-2024-0669/): Cross-Frame Scripting (XFS) on Plone CMS (medium 6.3)
- [CVE-2024-0668](https://insights.sbomify.com/CVE-2024-0668/): Advanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action (medium 6.6)
- [CVE-2024-0667](https://insights.sbomify.com/CVE-2024-0667/): Form-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute (medium 5.4)
- [CVE-2024-0665](https://insights.sbomify.com/CVE-2024-0665/): WP Customer Area <= 8.2.2 - Reflected Cross-Site Scripting (medium 6.1)
- [CVE-2024-0664](https://insights.sbomify.com/CVE-2024-0664/): Meks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-0662](https://insights.sbomify.com/CVE-2024-0662/): Cross-site scripting in FancyBox for WordPress (medium 4.4)
- [CVE-2024-0660](https://insights.sbomify.com/CVE-2024-0660/): Formidable Forms <= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-0659](https://insights.sbomify.com/CVE-2024-0659/): Easy Digital Downloads <= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options (medium 5.5)
- [CVE-2024-0658](https://insights.sbomify.com/CVE-2024-0658/): Insert PHP Code Snippet <= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-0657](https://insights.sbomify.com/CVE-2024-0657/): Internal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-0656](https://insights.sbomify.com/CVE-2024-0656/): Password Protected <= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scripting (medium 4.4)
- [CVE-2024-0655](https://insights.sbomify.com/CVE-2024-0655/): Novel-Plus list sql injection (medium 5.5)
- [CVE-2024-0654](https://insights.sbomify.com/CVE-2024-0654/): DeepFaceLab Util.py deserialization (medium 5.3)
- [CVE-2024-0653](https://insights.sbomify.com/CVE-2024-0653/): Custom Field Template <= 2.6.1 - Authenticated (Admin+) Stored Cross-Site Scritping (medium 4.4)
- [CVE-2024-0652](https://insights.sbomify.com/CVE-2024-0652/): PHPGurukul Company Visitor Management System search-visitor.php cross site scripting (low 3.5)
- [CVE-2024-0651](https://insights.sbomify.com/CVE-2024-0651/): PHPGurukul Company Visitor Management System search-visitor.php sql injection (medium 6.3)
- [CVE-2024-0650](https://insights.sbomify.com/CVE-2024-0650/): Project Worlds Visitor Management System URL dataset.php cross site scripting (medium 4.3)
- [CVE-2024-0649](https://insights.sbomify.com/CVE-2024-0649/): ZhiHuiYun Search ImageController.php download_network_image server-side request forgery (medium 6.3)
- [CVE-2024-0648](https://insights.sbomify.com/CVE-2024-0648/): Yunyou CMS Common.php unrestricted upload (high 7.3)
- [CVE-2024-0647](https://insights.sbomify.com/CVE-2024-0647/): Sparksuite SimpleMDE iFrame cross site scripting (medium 4.3)
- [CVE-2024-0646](https://insights.sbomify.com/CVE-2024-0646/): Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (high 7.0)
- [CVE-2024-0645](https://insights.sbomify.com/CVE-2024-0645/): Buffer Overflow Vulnerability in Explorer++ (high 7.3)
- [CVE-2024-0643](https://insights.sbomify.com/CVE-2024-0643/): Unrestricted upload of dangerous file types in C21 Live Encoder and Live Mosaic (critical 10.0)
- [CVE-2024-0642](https://insights.sbomify.com/CVE-2024-0642/): Inadequate access control in C21 Live Encoder and Live Mosaic (critical 9.8)
- [CVE-2024-0641](https://insights.sbomify.com/CVE-2024-0641/): Kernel: deadlock leading to denial of service in tipc_crypto_key_revoke (medium 5.5)
- [CVE-2024-0640](https://insights.sbomify.com/CVE-2024-0640/): Stored XSS in chatwoot/chatwoot (medium 5.6)
- [CVE-2024-0639](https://insights.sbomify.com/CVE-2024-0639/): Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos (medium 5.5)
- [CVE-2024-0638](https://insights.sbomify.com/CVE-2024-0638/): Privilege escalation in mk_oracle plugins (high 8.2)
- [CVE-2024-0637](https://insights.sbomify.com/CVE-2024-0637/): Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability (high 8.8)
- [CVE-2024-0632](https://insights.sbomify.com/CVE-2024-0632/): Cross-site scripting in Automatic Translator with Google Translate (medium 4.4)
- [CVE-2024-0631](https://insights.sbomify.com/CVE-2024-0631/): Duitku Payment Gateway <= 2.11.6 - Missing Authorization via check_duitku_response (medium 5.3)
- [CVE-2024-0630](https://insights.sbomify.com/CVE-2024-0630/): WP RSS Aggregator <= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source (medium 4.4)
- [CVE-2024-0629](https://insights.sbomify.com/CVE-2024-0629/): 2Checkout Payment Gateway for WooCommerce <= 6.2 - Missing Authorization via sniff_ins (medium 5.3)
- [CVE-2024-0628](https://insights.sbomify.com/CVE-2024-0628/): Server-side request forgery in WP RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging (low 3.8)
- [CVE-2024-0627](https://insights.sbomify.com/CVE-2024-0627/): Custom Field Template <= 2.6.1 - Authenticated(Constibutor+) Stored Cross-Site Scripting via Custom Field Name (medium 6.4)
- [CVE-2024-0626](https://insights.sbomify.com/CVE-2024-0626/): WooCommerce Clover Payment Gateway <= 1.3.1 - Missing Authorization via callback_handler (medium 5.3)
- [CVE-2024-0625](https://insights.sbomify.com/CVE-2024-0625/): Cross-site scripting in WPFront Notification Bar (medium 4.4)
- [CVE-2024-0624](https://insights.sbomify.com/CVE-2024-0624/): Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update (medium 5.3)
- [CVE-2024-0623](https://insights.sbomify.com/CVE-2024-0623/): VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-0622](https://insights.sbomify.com/CVE-2024-0622/): Local privilege escalation vulnerability could affect OpenText Operations Agent on Non-Windows platforms. (high 8.8)
- [CVE-2024-0621](https://insights.sbomify.com/CVE-2024-0621/): Simple Share Buttons Adder <= 8.4.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settings (medium 4.4)
- [CVE-2024-0620](https://insights.sbomify.com/CVE-2024-0620/): PPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypass (medium 5.3)
- [CVE-2024-0619](https://insights.sbomify.com/CVE-2024-0619/): Payflex Payment Gateway <= 2.5.0 - Missing Authorization to Order Status Update (medium 5.3)
- [CVE-2024-0618](https://insights.sbomify.com/CVE-2024-0618/): Fluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title (medium 4.4)
- [CVE-2024-0617](https://insights.sbomify.com/CVE-2024-0617/): Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount() (medium 5.3)
- [CVE-2024-0616](https://insights.sbomify.com/CVE-2024-0616/): Passster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-0615](https://insights.sbomify.com/CVE-2024-0615/): Content Control <= 2.1.0 - Missing Authorization to Sensitive Information Exposure (medium 5.3)
- [CVE-2024-0614](https://insights.sbomify.com/CVE-2024-0614/): Events Manager <= 6.4.6.4 - Authenticated(Administator+) Stored Cross-Site Scripting via settings (medium 4.4)
- [CVE-2024-0613](https://insights.sbomify.com/CVE-2024-0613/): Delete Custom Fields <= 0.3.1 - Cross-Site Request Forgery to Post Meta Deletion (medium 6.1)
- [CVE-2024-0612](https://insights.sbomify.com/CVE-2024-0612/): Content Views <= 3.6.2 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings (medium 4.4)
- [CVE-2024-0611](https://insights.sbomify.com/CVE-2024-0611/): Cross-site scripting in Master Slider – Responsive Touch Slider (medium 4.4)
- [CVE-2024-0610](https://insights.sbomify.com/CVE-2024-0610/): Piraeus Bank WooCommerce Payment Gateway <= 1.6.5.1 - Unauthenticated SQL Injection (critical 9.8)
- [CVE-2024-0609](https://insights.sbomify.com/CVE-2024-0609/): Cross-site scripting in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support (high 7.2)
- [CVE-2024-0608](https://insights.sbomify.com/CVE-2024-0608/): SQL injection in ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support (medium 6.5)
- [CVE-2024-0607](https://insights.sbomify.com/CVE-2024-0607/): Kernel: nf_tables: pointer math issue in nft_byteorder_eval() (medium 6.6)
- [CVE-2024-0606](https://insights.sbomify.com/CVE-2024-0606/): Cross-site scripting in Focus for iOS (medium 6.1)
- [CVE-2024-0605](https://insights.sbomify.com/CVE-2024-0605/): Race condition in Focus for iOS (high 7.5)
- [CVE-2024-0604](https://insights.sbomify.com/CVE-2024-0604/): Cross-site scripting in Gallery by FooGallery (medium 4.4)
- [CVE-2024-0603](https://insights.sbomify.com/CVE-2024-0603/): ZhiCms giftcontroller.php deserialization (high 7.3)
- [CVE-2024-0602](https://insights.sbomify.com/CVE-2024-0602/): Cross-site scripting in YARPP – Yet Another Related Posts Plugin (medium 4.4)
- [CVE-2024-0601](https://insights.sbomify.com/CVE-2024-0601/): ZhongFuCheng3y Austin Email Message Template AustinFileUtils.java getRemoteUrl2File server-side request forgery (medium 6.3)
- [CVE-2024-0599](https://insights.sbomify.com/CVE-2024-0599/): Jspxcms Document Management Page InfoController.java cross site scripting (low 3.5)
- [CVE-2024-0598](https://insights.sbomify.com/CVE-2024-0598/): Cross-site scripting in Kadence Blocks — Page Builder Toolkit for Gutenberg Editor (medium 4.4)
- [CVE-2024-0597](https://insights.sbomify.com/CVE-2024-0597/): SEO Plugin by Squirrly SEO <= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings (medium 4.4)
- [CVE-2024-0596](https://insights.sbomify.com/CVE-2024-0596/): Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html() (medium 5.3)
- [CVE-2024-0595](https://insights.sbomify.com/CVE-2024-0595/): Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users() (medium 4.3)
- [CVE-2024-0594](https://insights.sbomify.com/CVE-2024-0594/): Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection (high 8.8)
- [CVE-2024-0593](https://insights.sbomify.com/CVE-2024-0593/): Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure (medium 5.3)
- [CVE-2024-0592](https://insights.sbomify.com/CVE-2024-0592/): Related Posts for WordPress <= 2.2.1 - Cross-Site Request Forgery (medium 5.4)
- [CVE-2024-0591](https://insights.sbomify.com/CVE-2024-0591/): wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin <= 3.4.2.2 - Reflected Cross-Site Scripting. (medium 6.1)
- [CVE-2024-0590](https://insights.sbomify.com/CVE-2024-0590/): Microsoft Clarity <= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting (medium 6.1)
- [CVE-2024-0589](https://insights.sbomify.com/CVE-2024-0589/): Cross-site scripting in Remote Desktop Manager (medium 5.4)
- [CVE-2024-0588](https://insights.sbomify.com/CVE-2024-0588/): Paid Memberships Pro <= 2.12.10 - Cross-Site Request Forgery (medium 4.3)
- [CVE-2024-0587](https://insights.sbomify.com/CVE-2024-0587/): Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scripting (medium 6.1)

---
From sbomify Insights: https://insights.sbomify.com/years/2024/page/515/