Skip to content
OpenAdvisories

Archive

13 March 2024

Vulnerabilities first published on this day (UTC), newest first.

← February 2024 2024 / March /13 April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.1
    CVE-2024-28175

    Cross-site scripting on application summary component in argo-cd

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Due to the improper URL protocols filtering of links specified in the `link.argocd.argoproj.io` annotations in the application summary component, an attacker can achieve cross-site scri…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Critical 10.0
    CVE-2024-27102

    Improper isolation of server file access in github.com/pterodactyl/wings

    Wings is the server control plane for Pterodactyl Panel. This vulnerability impacts anyone running the affected versions of Wings. The vulnerability can potentially be used to access files and directories on the host system. The full scope of impact is exactl…

    pterodactyl wings github.com/pterodactyl/wings Go
  • Critical 9.8
    CVE-2024-0799 Scanner template

    Authentication Bypass via wizardLogin in Arcserve Unified Data Protection

    An authentication bypass vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in the edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.EdgeLoginServiceImpl.doLogin() function within wizardLogin.

    Arcserve Unified Data Protection
  • Critical 9.1
    CVE-2024-28194

    Authentication Bypass Because of Hardcoded JWT Secret in your_spotify

    your_spotify is an open source, self hosted Spotify tracking dashboard. YourSpotify versions < 1.8.0 use a hardcoded JSON Web Token (JWT) secret to sign authentication tokens. Attackers can use this well-known value to forge valid authentication tokens for ar…

    Yooooomi your_spotify
  • Critical 9.9
    CVE-2023-6825 Scanner template

    File Manager And File Manager Pro (Multiple Versions) - Directory Traversal

    The File Manager and File Manager Pro plugins for WordPress are vulnerable to Directory Traversal in versions up to, and including version 7.2.1 (free version) and 8.3.4 (Pro version) via the target parameter in the mk_file_folder_manager_action_callback_shor…

    mndpsingh287 File Manager File Manager Pro File Manager
  • Critical 9.8
    CVE-2024-2172

    Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege Escalation

    The Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malw…

    cyberlord92 Web Application Firewall – website security Malware Scanner Web / CMS
  • Critical 9.8
    CVE-2024-1071 Public exploit Scanner template EPSS 89%

    The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plug…

    Ultimate Member Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Web / CMS
  • Critical 9.8
    CVE-2024-25153 Public exploit EPSS 42%

    Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114

    A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web …

    Fortra FileCatalyst
  • Critical 9.8
    CVE-2024-2413

    Intumit SmartRobot - Use of Hard-coded Cryptographic Key

    Intumit SmartRobot uses a fixed encryption key for authentication. Remote attackers can use this key to encrypt a string composed of the user's name and timestamp to generate an authentication code. With this authentication code, they can obtain administrator…

    INTUMIT SmartRobot
  • Critical 9.8
    CVE-2023-41505

    An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 …

  • Critical 9.8
    CVE-2024-25250

    SQL Injection vulnerability in code-projects Agro-School Management System 1.0 allows attackers to run arbitrary code v…