Skip to content
OpenAdvisories

Archive

30 January 2024

Vulnerabilities first published on this day (UTC), newest first.

← December 2023 2024 / January /30 February 2024 →
  1. 115
  2. 2107
  3. 395
  4. 459
  5. 574
  6. 68
  7. 735
  8. 8197
  9. 9159
  10. 10178
  11. 11139
  12. 12129
  13. 1352
  14. 144
  15. 1566
  16. 16228
  17. 1785
  18. 1890
  19. 19108
  20. 2015
  21. 2114
  22. 2258
  23. 23147
  24. 2476
  25. 2574
  26. 26111
  27. 2717
  28. 2810
  29. 2994
  30. 3076
  31. 3192
All Critical High Medium Low Exploited only Public exploit

76 results · Feed

  • Medium 5.9
    CVE-2023-6374

    Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200…

    Mitsubishi Electric MELSEC WS Series WS0-GETH00200 ICS / OT
  • High 8.6
    CVE-2024-1061 Scanner template EPSS 11%

    The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerabili…

    Web / CMS
  • Medium 6.4
    CVE-2023-7225

    MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings

    The MapPress Maps for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the width and height parameters in all versions up to, and including, 2.88.16 due to insufficient input sanitization and output escaping. This makes it possi…

    chrisvrichardson MapPress Maps for WordPress Web / CMS
  • Low 3.5
    CVE-2024-21803

    Possible UAF in bt_accept_poll in Linux kernel

    Use After Free vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (bluetooth modules) allows Local Execution of Code. This vulnerability is associated with program files https://gitee.Com/anolis/cloud-kernel/blob/devel-5.10/net/bluetooth/af_bluetoo…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Low 3.5
    CVE-2024-1029

    Cogites eReserv tenancyDetail.php cross site scripting

    A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. Affected by this issue is some unknown functionality of the file /front/admin/tenancyDetail.php. The manipulation of the argument Nom with the input Dreux"><script>alert('XSS')…

    Cogites eReserv
  • High 7.3
    CVE-2024-21488

    network Arbitrary Command Injection vulnerability

    Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, i…

    network npm
  • Low 3.5
    CVE-2024-1028

    SourceCodester Facebook News Feed Like Post cross site scripting

    A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Post Handler. The manipulation of the argument Description with the input <…

    SourceCodester Facebook News Feed Like
  • Medium 6.3
    CVE-2024-1027

    SourceCodester Facebook News Feed Like Post unrestricted upload

    A vulnerability, which was classified as critical, was found in SourceCodester Facebook News Feed Like 1.0. Affected is an unknown function of the component Post Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remot…

    SourceCodester Facebook News Feed Like
  • High 7.9
    CVE-2024-21840

    Directory and File Permission Vulnerability in Hitachi Storage Plug-in for VMware vCenter

    Incorrect Default Permissions vulnerability in Hitachi Storage Plug-in for VMware vCenter allows local users to read and write specific files. This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.0.0 through 04.9.2.

    Hitachi Hitachi Storage Plug-in for VMware vCenter Virtualization
  • Low 3.5
    CVE-2024-1026

    Cogites eReserv config.php cross site scripting

    A vulnerability was found in Cogites eReserv 7.7.58 and classified as problematic. This issue affects some unknown processing of the file front/admin/config.php. The manipulation of the argument id with the input %22%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3…

    Cogites eReserv
  • High 7.2
    CVE-2023-5372 EPSS 28%

    The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and …

    Zyxel NAS326 firmware NAS542 firmware Network devices
  • Low 3.5
    CVE-2024-1024

    SourceCodester Facebook News Feed Like New Account cross site scripting

    A vulnerability has been found in SourceCodester Facebook News Feed Like 1.0 and classified as problematic. This vulnerability affects unknown code of the component New Account Handler. The manipulation of the argument First Name/Last Name with the input <scr…

    SourceCodester Facebook News Feed Like
  • High 7.5
    CVE-2023-36260

    Craft CMS Feed-Me

    An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS. It allows remote attackers to cause a denial of service (DoS) via crafted strings to Feed-Me Name and Feed-Me URL fields, due to saving a feed using an Asset element type with no volume select…

    craftcms/cms Packagist
  • Medium 5.4
    CVE-2023-36259

    Craft CMS Audit Plugin Cross Site Scripting vulnerability

    Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during user creation.

    superbig/craft-audit Packagist
  • Critical 9.8
    CVE-2023-51837

    Ylianst MeshCentral Missing SSL Certificate Validation

    Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.

    meshcentral npm
  • High 8.2
    CVE-2023-51843

    react-dashboard 1.4.0 is vulnerable to Cross Site Scripting (XSS) as httpOnly is not set.

  • Medium 6.5
    CVE-2023-51813

    Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote a…

  • Critical 9.8
    CVE-2023-51982

    CrateDB authentication bypass vulnerability

    CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component. After configuring password authentication and_ Local_ In the case of an address, identity authentication can be bypassed by setting the X-Real IP request header to a s…

    io.crate:crate Maven
  • Medium 6.1
    CVE-2023-37571

    Softing TH SCOPE through 3.70 allows XSS.

  • High 8.8
    CVE-2024-24328 Scanner template

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable para…

  • Critical 9.8
    CVE-2024-24324

    TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.

  • Critical 9.8
    CVE-2024-24325

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable para…

  • Critical 9.8
    CVE-2024-24330

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or ena…

  • Critical 9.8
    CVE-2024-24326

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable p…

  • Critical 9.8
    CVE-2024-24327

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass p…

  • Critical 9.8
    CVE-2024-24333

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parame…

  • Critical 9.8
    CVE-2024-24331

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable para…

  • Critical 9.8
    CVE-2024-24332

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url paramet…

  • Critical 9.8
    CVE-2024-24329 Scanner template

    TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable para…

  • Medium 6.8
    CVE-2024-22894 Public exploit

    An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Nove…

  • High 7.5
    CVE-2024-22523

    Directory Traversal vulnerability in Qiyu iFair version 23.8_ad0 and before, allows remote attackers to obtain sensitiv…

  • Medium 5.3
    CVE-2024-22648

    A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0. This makes it pos…

  • High 7.8
    CVE-2024-22938

    Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate pr…

  • Medium 5.3
    CVE-2024-22646

    An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0. This allo…

  • Medium 6.5
    CVE-2024-22643

    A Cross-Site Request Forgery (CSRF) vulnerability in SEO Panel version 4.10.0 allows remote attackers to perform unauth…

  • Medium 5.3
    CVE-2024-22647

    An user enumeration vulnerability was found in SEO Panel 4.10.0. This issue occurs during user authentication, where a …