Skip to content
OpenAdvisories

Archive

15 March 2024

Vulnerabilities first published on this day (UTC), newest first.

← February 2024 2024 / March /15 April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-23298 Public exploit

    A logic issue was addressed with improved state management. This issue is fixed in Xcode 15.3. An app may bypass Gateke…

    Apple Xcode
  • Critical 9.8
    CVE-2024-28255 Public exploit Scanner template EPSS 73%

    Authentication Bypass in OpenMetadata

    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. …

    open-metadata OpenMetadata
  • High 8.8
    CVE-2024-28254 Public exploit EPSS 46%

    SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata

    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `‎AlertUtil::validateExpression` method evaluates an SpEL expression using `getVal…

    open-metadata OpenMetadata
  • Medium 5.7
    CVE-2024-2193 Public exploit

    Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.

    A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the …

    AMD Xen Xen CPU Virtualization Debian Ubuntu Alpine
  • Critical 9.3
    CVE-2024-28752 Public exploit

    Apache CXF SSRF Vulnerability using the Aegis databinding

    A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF before 4.0.4, 3.6.3 and 3.5.8 allows an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type. Users of other data bindings (including the …

    Apache Software Foundation Apache CXF opensearch-2 org.apache.cxf:cxf-rt-databinding-aegis Wolfi Maven
  • Medium 6.5
    CVE-2024-25227 Public exploit

    SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial o…