Skip to content
OpenAdvisories

Archive

1 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /1 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

66 results · Clear filters · Feed

  • Medium 5.9
    CVE-2023-50939

    IBM PowerSC information Disclosure

    IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275129.

    IBM PowerSC
  • Medium 5.3
    CVE-2024-21866

    Generation of Error Message Containing Sensitive Information in Rapid SCADA

    In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product responds back with an error message containing sensitive data if it receives a specific malformed request.

    Rapid Software Rapid SCADA
  • Medium 6.2
    CVE-2024-21869

    Plaintext Storage of a Password in Rapid SCADA

    In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an attacker with local access to see them.

    Rapid Software Rapid SCADA
  • Medium 5.4
    CVE-2024-21794

    Open Redirect in Rapid SCADA

    In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can redirect users to malicious pages through the login page.

    Rapid Software Rapid SCADA
  • Medium 6.5
    CVE-2024-22096

    Relative Path Traversal in Rapid SCADA

    In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, an attacker can append path traversal characters to the filename when using a specific command, allowing them to read arbitrary files from the system.

    Rapid Software Rapid SCADA
  • Medium 4.3
    CVE-2024-24755

    discourse-group-membership-ip-block is exposing potentially sensitive custom fields

    discourse-group-membership-ip-block is a discourse plugin that adds support for adding users to groups based on their IP address. discourse-group-membership-ip-block was sending all group custom fields to the client, including group custom fields from other p…

    Discourse discourse-group-membership-ip-block
  • Medium 4.4
    CVE-2024-1040

    Use of a Broken or Risky Cryptographic Algorithm in Gessler GmbH WEB-MASTER

    Gessler GmbH WEB-MASTER user account is stored using a weak hashing algorithm. The attacker can restore the passwords by breaking the hashes stored on the device.

    Gessler WEB-MASTER
  • Medium 5.4
    CVE-2024-24569

    `ZipSecurity#isBelowCurrentDirectory` is vulnerable to partial-path traversal vulnerability

    The Pixee Java Code Security Toolkit is a set of security APIs meant to help secure Java code. `ZipSecurity#isBelowCurrentDirectory` is vulnerable to a partial-path traversal bypass. To be vulnerable to the bypass, the application must use toolkit version <=1…

    pixee java-security-toolkit
  • Medium 5.5
    CVE-2024-1167

    SEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity Reference

    When SEW-EURODRIVE MOVITOOLS MotionStudio processes XML information unrestricted file access can occur.

    SEW-EURODRIVE MOVITOOLS MotionStudio
  • Medium 6.9
    CVE-2024-24557

    Moby classic builder cache poisoning

    Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poisoning if the image is built FROM scratch. Also, changes to some instructions (most important being HEALTHCHECK and ONB…

    moby moby katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.5
    CVE-2024-24752

    Bref Uploaded Files Not Deleted in Event-Driven Functions

    Bref enable serverless PHP on AWS Lambda. When Bref is used with the Event-Driven Function runtime and the handler is a `RequestHandlerInterface`, then the Lambda event is converted to a PSR7 object. During the conversion process, if the request is a MultiPar…

    brefphp bref bref/bref Packagist
  • Medium 4.8
    CVE-2024-24753

    Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2

    Bref enable serverless PHP on AWS Lambda. When Bref is used in combination with an API Gateway with the v2 format, it does not handle multiple values headers. If PHP generates a response with two headers having the same key but different values only the lates…

    brefphp bref bref/bref Packagist
  • Medium 5.9
    CVE-2023-51446

    GLPI LDAP Injection during authentication

    GLPI is a Free Asset and IT Management Software package. When authentication is made against a LDAP, the authentication form can be used to perform LDAP injection. Upgrade to 10.0.12.

    GLPI glpi glpi Ubuntu
  • Medium 6.5
    CVE-2024-23645

    GLPI reflected XSS in reports pages

    GLPI is a Free Asset and IT Management Software package. A malicious URL can be used to execute XSS on reports pages. Upgrade to 10.0.12.

    GLPI glpi glpi Ubuntu
  • Medium 5.5
    CVE-2024-1141

    Glance-store: glance store access key logged in debug log level

    A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.

    Red Hat Red Hat OpenStack Platform 18.0 Red Hat OpenStack Platform 16.2 Red Hat OpenStack Platform 16.1 Debian Ubuntu PyPI
  • Medium 4.4
    CVE-2024-0935

    Insertion of Sensitive Information into Log File vulnerabilities affecting DELMIA Apriso Release 2019 through Release 2024

    Insertion of Sensitive Information into Log File vulnerabilities are affecting DELMIA Apriso Release 2019 through Release 2024

    Dassault Systèmes DELMIA Apriso
  • Medium 5.5
    CVE-2023-51506

    WordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in realmag777 WPCS – WordPress Currency Switcher Professional allows Stored XSS.This issue affects WPCS – WordPress Currency Switcher Professional: from n/a thr…

    RealMag777 WPCS – WordPress Currency Switcher Professional Web / CMS
  • Medium 6.5
    CVE-2023-51514

    WordPress CBX Bookmark & Favorite Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr Team CBX Bookmark & Favorite allows Stored XSS.This issue affects CBX Bookmark & Favorite: from n/a through 1.7.13.

    Codeboxr CBX Bookmark & Favorite
  • Medium 6.5
    CVE-2023-51520

    WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPdevelop / Oplugins WP Booking Calendar allows Stored XSS.This issue affects WP Booking Calendar: from n/a before 9.7.4.

    WPdevelop/Oplugins WP Booking Calendar
  • Medium 5.9
    CVE-2023-51695

    WordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPEverest Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease! allows Stored XSS.This issue affects Everest Forms – Bu…

    WPEverest Everest Forms – Build Contact Forms, Surveys, Polls, Application Forms, and more with Ease!
  • Medium 6.5
    CVE-2023-51694

    WordPress Embed Privacy Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epiphyt Embed Privacy allows Stored XSS.This issue affects Embed Privacy: from n/a through 1.8.0.

    Epiphyt Embed Privacy
  • Medium 6.5
    CVE-2023-51693

    WordPress Themify Icons Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themify Icons allows Stored XSS.This issue affects Themify Icons: from n/a through 2.0.1.

    Themify Icons Themify Icons
  • Medium 6.5
    CVE-2023-51532

    WordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building allows Stored XSS.This issue affects Icegram Engage – …

    Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building Web / CMS
  • Medium 5.9
    CVE-2023-51691

    WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This issue affects Comments – wpDiscuz: from n/a through 7.6.12.

    gVectors Team Comments — wpDiscuz
  • Medium 6.5
    CVE-2023-51690

    WordPress Advanced iFrame Plugin <= 2023.8 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Advanced iFrame allows Stored XSS.This issue affects Advanced iFrame: from n/a through 2023.8.

    Advanced iFrame Advanced iFrame
  • Medium 6.5
    CVE-2023-51689

    WordPress Easy Video Player Plugin <= 1.2.2.10 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 Easy Video Player allows Stored XSS.This issue affects Easy Video Player: from n/a through 1.2.2.10.

    naa986 Easy Video Player
  • Medium 5.9
    CVE-2023-51685

    WordPress WP Review Slider Plugin <= 12.7 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LJ Apps WP Review Slider allows Stored XSS.This issue affects WP Review Slider: from n/a through 12.7.

    LJ Apps WP Review Slider
  • Medium 6.5
    CVE-2023-51684

    WordPress Easy Digital Downloads Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy) allows Stored XSS.This issue affects Easy Digital D…

    Easy Digital Downloads Easy Digital Downloads – Sell Digital Files (eCommerce Store & Payments Made Easy)
  • Medium 5.9
    CVE-2023-51534

    WordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brave Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content allows Stored XSS.This issue affects Brave – Create Popup,…

    Brave Brave – Create Popup, Optins, Lead Generation, Survey, Sticky Elements & Interactive Content
  • Medium 6.5
    CVE-2023-51677

    WordPress Schema & Structured Data for WP & AMP Plugin <= 1.23 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magazine3 Schema & Structured Data for WP & AMP allows Stored XSS.This issue affects Schema & Structured Data for WP & AMP: from n/a through 1.23.

    Magazine3 Schema & Structured Data for WP & AMP
  • Medium 5.9
    CVE-2023-51536

    WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks Forms – WordPress Form Builder allows Stored XSS.This issue affects CRM Perks Forms – WordPress Form Builder: from n/a through 1.1.2.

    CRM Perks CRM Perks Forms – WordPress Form Builder Web / CMS
  • Medium 6.5
    CVE-2023-51674

    WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS.This issue affects Advanced Access Manager – Re…

    AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More
  • Medium 6.5
    CVE-2023-51669

    WordPress Product Code for WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artios Media Product Code for WooCommerce allows Stored XSS.This issue affects Product Code for WooCommerce: from n/a through 1.4.4.

    Artios Media Product Code for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-51666

    WordPress Related Post Plugin <= 2.0.53 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Related Post allows Stored XSS.This issue affects Related Post: from n/a through 2.0.53.

    PickPlugins Related Post
  • Medium 5.9
    CVE-2023-51548

    WordPress SlickNav Mobile Menu Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Neil Gee SlickNav Mobile Menu allows Stored XSS.This issue affects SlickNav Mobile Menu: from n/a through 1.9.2.

    Neil Gee SlickNav Mobile Menu
  • Medium 6.5
    CVE-2023-52118

    WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Event Manager WP User Profile Avatar allows Stored XSS.This issue affects WP User Profile Avatar: from n/a through 1.0.

    WP Event Manager WP User Profile Avatar
  • Medium 6.5
    CVE-2023-52175

    WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Uno (miunosoft) Auto Amazon Links – Amazon Associates Affiliate Plugin allows Stored XSS.This issue affects Auto Amazon Links – Amazon Associates Aff…

    Michael Uno (miunosoft) Auto Amazon Links – Amazon Associates Affiliate Plugin
  • Medium 6.5
    CVE-2023-52188

    WordPress Footer Putter Plugin <= 1.17 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter allows Stored XSS.This issue affects Footer Putter: from n/a through 1.17.

    Russell Jamieson Footer Putter
  • Medium 6.5
    CVE-2023-52189

    WordPress Ideal Interactive Map Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jhayghost Ideal Interactive Map allows Stored XSS.This issue affects Ideal Interactive Map: from n/a through 1.2.4.

    Jhayghost Ideal Interactive Map
  • Medium 6.5
    CVE-2023-52191

    WordPress Infogram Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Torbjon Infogram – Add charts, maps and infographics allows Stored XSS.This issue affects Infogram – Add charts, maps and infographics: from n/a through 1.6.…

    Torbjon Infogram – Add charts, maps and infographics