Skip to content
OpenAdvisories

Archive

13 March 2024

Vulnerabilities first published on this day (UTC), newest first.

← February 2024 2024 / March /13 April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Medium 6.1
    CVE-2024-2242 Public exploit

    Contact Form 7 <= 5.9 - Reflected Cross-Site Scripting

    The Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘active-tab’ parameter in all versions up to, and including, 5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthentic…

    rocklobsterinc Contact Form 7 Web / CMS
  • Medium 4.5
    CVE-2024-2432 Public exploit

    GlobalProtect App: Local Privilege Escalation (PE) Vulnerability

    A privilege escalation (PE) vulnerability in the Palo Alto Networks GlobalProtect app on Windows devices enables a local user to execute programs with elevated privileges. However, execution requires that the local user is able to successfully exploit a race …

    Palo Alto Networks GlobalProtect App Network devices
  • High 7.5
    CVE-2024-24549 Public exploit EPSS 23%

    Apache Tomcat: HTTP/2 header handling DoS

    Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after …

    Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  • High 8.6
    CVE-2024-0368 Public exploit

    Hustle <= 7.8.3 - Sensitive Information Exposure via Exposed Hubspot API Keys

    The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.8.3 via hardcoded API Keys. This makes it possible for unauthenticated attackers to extr…

    WPMU DEV Hustle – Email Marketing, Lead Generation, Optins, Popups Web / CMS
  • Medium 5.3
    CVE-2024-1380 Public exploit Scanner template EPSS 50%

    Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export

    The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_log_check() function in all versions up to, and including, 4.22.0 (Free) and 2.25.0 (Premium). This m…

    comesio Relevanssi Relevanssi – A Better Search Relevanssi Premium Web / CMS
  • Medium 6.4
    CVE-2024-1234 Public exploit

    Exclusive Addons for Elementor <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenti…

    Tim Strifler Exclusive Addons for Elementor Web / CMS
  • Critical 9.8
    CVE-2024-1071 Public exploit Scanner template EPSS 89%

    The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plug…

    Ultimate Member Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Web / CMS
  • Critical 9.8
    CVE-2024-25153 Public exploit EPSS 42%

    Remote Code Execution in FileCatalyst Workflow 5.x prior to 5.1.6 Build 114

    A directory traversal within the ‘ftpservlet’ of the FileCatalyst Workflow Web Portal allows files to be uploaded outside of the intended ‘uploadtemp’ directory with a specially crafted POST request. In situations where a file is successfully uploaded to web …

    Fortra FileCatalyst
  • Medium 6.1
    CVE-2024-28623 Public exploit Scanner template

    RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_se…