Skip to content
OpenAdvisories

Archive

13 March 2024

Vulnerabilities first published on this day (UTC), newest first.

← February 2024 2024 / March /13 April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

155 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-1176

    HT Easy GA4 – Google Analytics WordPress Plugin <= 1.1.5 - Missing Authorization to Unauthenticated GA4 Email Update

    The HT Easy GA4 – Google Analytics WordPress Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the login() function in all versions up to, and including, 1.1.5. This makes it possible for unaut…

    HT Plugins HT Easy GA4 – Google Analytics WordPress Plugin Web / CMS
  • Medium 6.4
    CVE-2024-2126

    Orbit Fox by ThemeIsle <= 2.10.32 - Authenticated (Contributor+) Stored Cross-Site Scripiting via Registration Form Widget

    The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Registration Form widget in all versions up to, and including, 2.10.32 due to insufficient input sanitization and output escaping. This makes it possible for …

    themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More Web / CMS
  • Medium 5.3
    CVE-2024-25154

    Path Traversal in FileCatalyst Direct 3.8.8 and Earlier

    Improper URL validation leads to path traversal in FileCatalyst Direct 3.8.8 and earlier allowing an encoded payload to cause the web server to return files located outside of the web root which may lead to data leakage.  

    Fortra FileCatalyst
  • Medium 6.4
    CVE-2024-1508

    Prime Slider – Addons For Elementor <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Mercury Widget

    The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'settings['title_tags']' attribute of the Mercury widget in all versions up to, and including, 3.13.2 due to insufficient input sanitization and …

    bdthemes Prime Slider – Addons For Elementor Web / CMS
  • Medium 6.4
    CVE-2024-1507

    Prime Slider – Addons For Elementor <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Rubix Widget

    The Prime Slider – Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title_tags' attribute of the Rubix widget in all versions up to, and including, 3.13.3 due to insufficient input sanitization and output escapin…

    bdthemes Prime Slider – Addons For Elementor Web / CMS
  • Medium 6.5
    CVE-2024-2416

    Cross-Site Request Forgery vulnerability in Movistar 4G router

    Cross-Site Request Forgery vulnerability in Movistar's 4G router affecting version ES_WLD71-T1_v2.0.201820. This vulnerability allows an attacker to force an end user to execute unwanted actions in a web application in which they are currently authenticated.

    Movistar Router Movistar 4G
  • Medium 5.1
    CVE-2023-43043

    IBM Maximo Application Suite information disclosure

    IBM Maximo Application Suite - Maximo Mobile for EAM 8.10 and 8.11 could disclose sensitive information to a local user. IBM X-Force ID: 266875.

    IBM Maximo Application Suite - Maximo Mobile for EAM
  • Medium 6.4
    CVE-2023-38723

    Maximo Asset Management cross-site scripting

    IBM Maximo Application Suite 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a…

    IBM Maximo Asset Management
  • Medium 5.4
    CVE-2023-28517

    IBM Sterling Partner Engagement Manager cross-site scripting

    IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials…

    IBM Sterling Partner Engagement Manager
  • Medium 5.4
    CVE-2018-25090

    Wago: Improper Neutralization of Input During Web Page Generation in multiple devices

    An unauthenticated remote attacker can use an XSS attack due to improper neutralization of input during web page generation. User interaction is required. This leads to a limited impact of confidentiality and integrity but no impact of availability.

    WAGO Controller BACnet MS/TP Fieldbus Coupler Ethernet 3rd Generation Controller BACnet/IP ICS / OT
  • Medium 4.8
    CVE-2024-27440

    The Toyoko Inn official App for iOS versions prior to 1.13.0 and Toyoko Inn official App for Android versions prior 1.3…

    Toyoko Inn IT Solution Toyoko Inn official App for Android Toyoko Inn official App for iOS Android iOS
  • Medium 5.3
    CVE-2015-10130

    The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version …

    nik00726 Team Circle Image Slider With Lightbox Web / CMS
  • Medium 5.3
    CVE-2024-2412

    Heimavista Rpage and Epage - Broken Access Control

    The disabling function of the user registration page for Heimavista Rpage and Epage is not properly implemented, allowing remote attackers to complete user registration on sites where user registration is supposed to be disabled.

    Heimavista Rpage Epage
  • Medium 4.4
    CVE-2023-4839

    WP Go Maps <= 9.0.32 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administ…

    WPGMaps WP Go Maps (formerly WP Google Maps)
  • Medium 6.4
    CVE-2024-1582

    WP Go Maps (formerly WP Google Maps) <= 9.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpgmza' shortcode in all versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping on user supp…

    WPGMaps WP Go Maps (formerly WP Google Maps) Web / CMS
  • Medium 6.5
    CVE-2023-36238

    Bagisto vulnerable to Insecure Direct Object Reference (IDOR)

    Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter.

    bagisto/bagisto Packagist
  • Medium 6.1
    CVE-2024-28680

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/diy_add.php.

  • Medium 6.3
    CVE-2024-28678

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/articl…

  • Medium 6.1
    CVE-2024-28623 Public exploit Scanner template

    RiteCMS v3.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component main_menu/edit_se…

  • Medium 6.1
    CVE-2024-28670

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_main.php.

  • Medium 6.1
    CVE-2024-28667

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/temple…

  • Medium 5.4
    CVE-2024-28662

    A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in create_ta…

  • Medium 6.1
    CVE-2024-28430

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/catalo…

  • Medium 5.4
    CVE-2024-28669

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/freelist_edit.php.

  • Medium 6.1
    CVE-2024-28677

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/article_keywords_mai…

  • Medium 6.1
    CVE-2024-28676

    DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via /dede/article_edit.php.

  • Medium 6.1
    CVE-2024-28679

    DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via Photo Collection.

  • Medium 5.5
    CVE-2024-28429

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/archiv…

  • Medium 6.3
    CVE-2024-28682

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/sys_cache_up.php.

  • Medium 6.1
    CVE-2024-28681

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/plus_edit.php.

  • Medium 6.1
    CVE-2024-28668

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/mychan…

  • Medium 6.1
    CVE-2024-28683

    DedeCMS v5.7 was discovered to contain a cross-site scripting (XSS) vulnerability via create file.

  • Medium 5.4
    CVE-2024-28672

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /dede/media_edit.php.

  • Medium 5.5
    CVE-2024-28666

    DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /dede/media_…

  • Medium 5.4
    CVE-2024-27703

    Cross Site Scripting vulnerability in Leantime 3.0.6 allows a remote attacker to execute arbitrary code via the to-do t…