Skip to content
OpenAdvisories

Archive

1 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /1 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

66 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-52192

    WordPress Keap Official Opt-in Forms Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Keap Keap Official Opt-in Forms allows Stored XSS.This issue affects Keap Official Opt-in Forms: from n/a through 1.0.11.

    Keap Keap Official Opt-in Forms
  • Medium 5.5
    CVE-2024-22430

    Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. A local l…

    Dell PowerScale OneFS
  • Medium 6.5
    CVE-2023-52193

    WordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Live Composer Team Page Builder: Live Composer allows Stored XSS.This issue affects Page Builder: Live Composer: from n/a through 1.5.23.

    Live Composer Team Page Builder: Live Composer
  • Medium 6.6
    CVE-2024-22449

    Dell PowerScale OneFS versions 9.0.0.x through 9.6.0.x contains a missing authentication for critical function vulnerab…

    Dell PowerScale OneFS
  • Medium 6.5
    CVE-2023-52194

    WordPress oEmbed Gist Plugin <= 4.9.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takayuki Miyauchi oEmbed Gist allows Stored XSS.This issue affects oEmbed Gist: from n/a through 4.9.1.

    Takayuki Miyauchi oEmbed Gist
  • Medium 6.5
    CVE-2023-52195

    WordPress Posts to Page Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Posts to Page Kerry James allows Stored XSS.This issue affects Kerry James: from n/a through 1.7.

    Posts to Page Kerry James
  • Medium 5.3
    CVE-2024-1130

    NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()

    The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_read() function in all versions up to, and including, 8.5.6. This makes it possible for …

    webaways NEX-Forms – Ultimate Forms Plugin for WordPress Web / CMS
  • Medium 5.3
    CVE-2024-0907

    NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()

    The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the restore_records() function in all versions up to, and including, 8.5.6. This makes it possib…

    webaways NEX-Forms – Ultimate Forms Plugin for WordPress Web / CMS
  • Medium 5.3
    CVE-2024-1129

    NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()

    The NEX-Forms – Ultimate Form Builder – Contact forms and much more plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the set_starred() function in all versions up to, and including, 8.5.6. This makes it possible f…

    webaways NEX-Forms – Ultimate Forms Plugin for WordPress Web / CMS
  • Medium 5.4
    CVE-2024-23941

    Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, whi…

    Intermesh Group-Office
  • Medium 6.4
    CVE-2023-7069

    Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and including, 2023.10 due to insufficient input sanitization and output escaping on user supplied attrib…

    mdempfle Advanced iFrame Web / CMS
  • Medium 4.5
    CVE-2024-0831

    Vault May Expose Sensitive Information When Configuring An Audit Log Device

    Vault and Vault Enterprise (“Vault”) may expose sensitive information when enabling an audit device which specifies the `log_raw` option, which may log sensitive information to other audit devices, regardless of whether they are configured to use `log_raw`.

    HashiCorp Vault Enterprise Vault github.com/hashicorp/vault Go
  • Medium 6.8
    CVE-2023-51835

    An issue in TRENDnet TEW-822DRE v.1.03B02 allows a local attacker to execute arbitrary code via the parameters ipv4_pin…

  • Medium 5.5
    CVE-2023-47256

    ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of…

  • Medium 5.4
    CVE-2024-24062

    springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.

  • Medium 6.1
    CVE-2024-24059

    springboot-manager v1.6 is vulnerable to Arbitrary File Upload. The system does not filter the suffixes of uploaded fil…

  • Medium 5.4
    CVE-2024-24061

    springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add.

  • Medium 6.1
    CVE-2024-24041

    A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows at…

  • Medium 5.4
    CVE-2024-24060

    springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user.

  • Medium 6.1
    CVE-2024-24945 Public exploit

    A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows at…

  • Medium 6.1
    CVE-2024-23031

    Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbit…

  • Medium 6.1
    CVE-2024-23034

    Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary …

  • Medium 6.1
    CVE-2024-23033

    Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary c…

  • Medium 6.1
    CVE-2024-23032

    Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code v…

  • Medium 6.1
    CVE-2024-22927 Scanner template

    Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbit…

  • Medium 6.1
    CVE-2024-22936

    Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AI…