Skip to content
OpenAdvisories

Archive

2 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /2 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

64 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-1162

    Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgery

    The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.29. This is due to missing or incorrect nonce validation on the register_reference() function. This makes it possible for un…

    themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More Web / CMS
  • Medium 5.3
    CVE-2024-1047

    ThemeIsle SDK <= Various Versions - Missing Authorization

    Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated atta…

    themeisle Optimole rsocial RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator Web / CMS
  • Medium 6.5
    CVE-2024-21485 Scanner template

    Dash apps vulnerable to Cross-site Scripting

    Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the package dash before 2.15.0; versions of the package dash-html-components before 2.0.0; versions of the package dash-html-com…

    dash-core-components dash-core-components dash-html-components dash-html-components npm PyPI
  • Medium 5.9
    CVE-2024-0685

    Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injection

    The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient es…

    kstover Ninja Forms – The Contact Form Builder That Grows With You Web / CMS
  • Medium 6.4
    CVE-2024-1073

    SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting

    The SlimStat Analytics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'filter_array' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authen…

    VeronaLabs Slimstat Analytics Web / CMS
  • Medium 4.3
    CVE-2023-38020

    IBM SOAR QRadar Plugin App log injection

    IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to manipulate output written to log files. IBM X-Force ID: 260576.

    IBM SOAR QRadar Plugin App
  • Medium 6.5
    CVE-2023-38263

    IBM SOAR QRadar Plugin App improper access controls

    IBM SOAR QRadar Plugin App 1.0 through 5.0.3 could allow an authenticated user to perform unauthorized actions due to improper access controls. IBM X-Force ID: 260577.

    IBM SOAR QRadar Plugin App
  • Medium 4.8
    CVE-2022-40744

    IBM Aspera Faspex cross-site scripting

    IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted sess…

    IBM Aspera Faspex
  • Medium 6.5
    CVE-2023-32333

    IBM Maximo Asset Management improper access control

    IBM Maximo Asset Management 7.6.1.3 could allow a remote attacker to log into the admin panel due to improper access controls. IBM X-Force ID: 255073.

    IBM Maximo Asset Management
  • Medium 5.9
    CVE-2023-50962

    IBM PowerSC information disclosure

    IBM PowerSC 1.3, 2.0, and 2.1 MFA does not implement the "HTTP Strict Transport Security" (HSTS) web security policy mechanism. IBM X-Force ID: 276004.

    IBM PowerSC
  • Medium 6.5
    CVE-2023-50938

    IBM PowerSC clickjacking

    IBM PowerSC 1.3, 2.0, and 2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly…

    IBM PowerSC
  • Medium 6.5
    CVE-2023-50935

    IBM PowerSC forced browsing

    IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to application functionality and/or resources. IBM X-Force ID: 275115.

    IBM PowerSC
  • Medium 6.3
    CVE-2023-50941

    IBM PowerSC session fixation

    IBM PowerSC 1.3, 2.0, and 2.1 does not provide logout functionality, which could allow an authenticated user to gain access to an unauthorized user using session fixation. IBM X-Force ID: 275131.

    IBM PowerSC
  • Medium 5.3
    CVE-2023-50934

    IBM PowerSC improper authentication

    IBM PowerSC 1.3, 2.0, and 2.1 uses single-factor authentication which can lead to unnecessary risk of compromise when compared with the benefits of a dual-factor authentication scheme. IBM X-Force ID: 275114.

    IBM PowerSC
  • Medium 5.3
    CVE-2023-50940

    IBM PowerSC cross-resource origin sharing

    IBM PowerSC 1.3, 2.0, and 2.1 uses Cross-Origin Resource Sharing (CORS) which could allow an attacker to carry out privileged actions and retrieve sensitive information as the domain name is not being limited to only trusted domains. IBM X-Force ID: 275130.

    IBM PowerSC
  • Medium 6.3
    CVE-2023-50936

    IBM PowerSC session fixation

    IBM PowerSC 1.3, 2.0, and 2.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 275116.

    IBM PowerSC
  • Medium 5.3
    CVE-2023-50327

    IBM PowerSC weak security

    IBM PowerSC 1.3, 2.0, and 2.1 uses insecure HTTP methods which could allow a remote attacker to perform unauthorized file request modification. IBM X-Force ID: 275109.

    IBM PowerSC
  • Medium 5.9
    CVE-2023-50937

    IBM PowerSC information disclosure

    IBM PowerSC 1.3, 2.0, and 2.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 275117.

    IBM PowerSC
  • Medium 6.1
    CVE-2023-50933

    IBM PowerSC HTML injection

    IBM PowerSC 1.3, 2.0, and 2.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. IBM X-Force ID: 275113.

    IBM PowerSC
  • Medium 5.4
    CVE-2023-46344 Public exploit

    A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an at…

  • Medium 5.4
    CVE-2023-51072

    A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 …

  • Medium 6.8
    CVE-2023-51820

    An issue in Blurams Lumi Security Camera (A31C) v.2.3.38.12558 allows a physically proximate attackers to execute arbit…

  • Medium 6.1
    CVE-2024-24388

    Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sen…

  • Medium 6.1
    CVE-2024-24160

    MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do.