Skip to content
OpenAdvisories

Archive

21 March 2024

Vulnerabilities first published on this day (UTC), newest first.

← February 2024 2024 / March /21 April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

127 results · Feed

  • Medium 5.4
    CVE-2023-27607

    WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerability

    Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0.

    WP Swings Points and Rewards for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2022-44595

    WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability

    Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.

    melapress WP 2FA
  • Medium 6.2
    CVE-2024-27277

    IBM Storage Protect Plus Server information disclosure

    The private key for the IBM Storage Protect Plus Server 10.1.0 through 10.1.16 certificate can be disclosed, undermining the security of the certificate. IBM X-Force ID: 285205.

    IBM Storage Protect Plus Server
  • Medium 6.5
    CVE-2023-49837

    WordPress embed-code plugin <= 2.3.6 - Denial of Service Attack vulnerability

    Uncontrolled Resource Consumption vulnerability in David Artiss Code Embed.This issue affects Code Embed: from n/a through 2.3.6.

    David Artiss Code Embed
  • Medium 4.3
    CVE-2024-27190

    WordPress Download Media plugin <= 1.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jean-David Daviet Download Media.This issue affects Download Media: from n/a through 1.4.2.

    Jean-David Daviet Download Media
  • Critical 9.9
    CVE-2024-27956 Public exploit Scanner template EPSS 94%

    WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0.

    ValvePress Automatic
  • High 7.1
    CVE-2024-27968

    WordPress Super Page Cache for Cloudflare plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.This issue affects Super Page Cache for Cloudflare: from n/a through 4.7.5.

    Optimole Super Page Cache for Cloudflare
  • Medium 5.9
    CVE-2024-2578

    WordPress WP Coder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPCoder WP Coder allows Stored XSS.This issue affects WP Coder: from n/a through 3.5.

    WPCoder WP Coder
  • Medium 5.9
    CVE-2024-2579

    WordPress Tracking Code Manager plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Tracking Code Manager.This issue affects Tracking Code Manager: from n/a through 2.0.16.

    data443 Tracking Code Manager
  • Medium 6.5
    CVE-2024-2580

    WordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Automation By Autonami allows Stored XSS.This issue affects Automation By Autonami: from n/a through 2.8.2.

    FunnelKit Automation By Autonami
  • High 7.4
    CVE-2024-29180

    webpack-dev-middleware Path Traversal vulnerability

    Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The…

    webpack webpack-dev-middleware katib-suggestion-hyperopt katib-earlystopping Wolfi npm
  • High 7.1
    CVE-2024-27962

    WordPress wp-mpdf plugin <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Florian 'fkrauthan' Krauthan allows Reflected XSS.This issue affects wp-mpdf: from n/a through 3.7.1.

    Florian 'fkrauthan' Krauthan wp-mpdf
  • Medium 6.5
    CVE-2024-27963

    WordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crisp allows Stored XSS.This issue affects Crisp: from n/a through 0.44.

    Crisp Crisp
  • High 8.8
    CVE-2024-27964

    WordPress Zippy plugin <= 1.6.9 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.9.

    Gesundheit Bewegt Zippy
  • Medium 5.9
    CVE-2024-27965

    WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels WPFunnels wpfunnels.This issue affects WPFunnels: from n/a through <= 3.0.6.

    WPFunnels WPFunnels
  • High 8.1
    CVE-2024-29019

    ESPHome vulnerable to Authentication bypass via Cross site request forgery

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attacke…

    esphome esphome esphome PyPI
  • Medium 5.9
    CVE-2024-27966

    WordPress Quiz And Survey Master plugin <= 8.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 8.2.2.

    ExpressTech Systems Quiz And Survey Master
  • Medium 4.3
    CVE-2024-27967

    WordPress DSGVO All in one for WP plugin <= 4.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Michael Leithold DSGVO All in one for WP.This issue affects DSGVO All in one for WP: from n/a through 4.3.

    Michael Leithold DSGVO All in one for WP
  • Medium 6.5
    CVE-2024-27969

    WordPress Free Downloads WooCommerce plugin <= 3.5.8.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Enhanced Free Downloads WooCommerce allows Stored XSS.This issue affects Free Downloads WooCommerce: from n/a through 3.5.8.2.

    Wp Enhanced Free Downloads WooCommerce Web / CMS
  • Medium 5.4
    CVE-2024-27970

    WordPress WP SendFox plugin <= 1.3.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BogdanFix WP SendFox.This issue affects WP SendFox: from n/a through 1.3.0.

    BogdanFix WP SendFox
  • Medium 5.4
    CVE-2024-27985

    WordPress PropertyHive plugin <= 2.0.9 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in PropertyHive.This issue affects PropertyHive: from n/a through 2.0.9.

    Property Hive PropertyHive
  • Medium 6.5
    CVE-2024-27988

    WordPress WEN Responsive Columns plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Responsive Columns allows Stored XSS.This issue affects WEN Responsive Columns: from n/a through 1.3.2.

    WEN Themes WEN Responsive Columns
  • Medium 6.5
    CVE-2024-27989

    WordPress WP Responsive Tabs horizontal vertical and accordion Tabs plugin <= 1.1.17 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs allows Stored XSS.This issue affects WP Responsive Tabs horizontal vertical…

    I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs
  • Medium 6.5
    CVE-2024-27990

    WordPress The Moneytizer plugin <= 9.5.20 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Moneytizer allows Stored XSS.This issue affects The Moneytizer: from n/a through 9.5.20.

    The Moneytizer The Moneytizer
  • Medium 6.5
    CVE-2024-27991

    WordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SupportCandy allows Stored XSS.This issue affects SupportCandy: from n/a through 3.2.3.

    SupportCandy SupportCandy
  • High 7.1
    CVE-2024-27992

    WordPress Link Whisper Free plugin <= 0.6.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper Link Whisper Free allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.6.8.

    Link Whisper Link Whisper Free
  • High 7.1
    CVE-2024-27993

    WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in typps Calendarista Basic Edition calendarista-basic-edition.This issue affects Calendarista Basic Edition: from n/a through <= 3.0.2.

    Typps Calendarista Basic Edition
  • High 7.1
    CVE-2024-27994

    WordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITHEMES YITH WooCommerce Product Add-Ons yith-woocommerce-product-add-ons.This issue affects YITH WooCommerce Product Add-Ons: from n/a through <= 4.5.0.

    YITHEMES YITH WooCommerce Product Add-Ons Web / CMS
  • Medium 5.9
    CVE-2024-27995

    WordPress ARMember plugin <= 4.0.23 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Repute Infosystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup allows Stored XSS.This issue affects ARMember…

    Repute InfoSystems ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup
  • High 7.1
    CVE-2024-2465

    Open redirection in CDeX

    Open redirection vulnerability in CDeX application allows to redirect users to arbitrary websites via a specially crafted URL.This issue affects CDeX application versions through 5.7.1.

    CDeX PSA CDeX
  • Medium 6.3
    CVE-2024-2464

    Application users enumeration in CDeX

    This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1.

    CDeX PSA CDeX
  • High 8.0
    CVE-2024-2463

    Weak password recovery mechanism in CDeX

    Weak password recovery mechanism in CDeX application allows to retrieve password reset token.This issue affects CDeX application versions through 5.7.1.

    CDeX PSA CDeX
  • Medium 4.3
    CVE-2023-47715

    IBM Storage Protect Plus Server improper access control

    IBM Storage Protect Plus Server 10.1.0 through 10.1.16 could allow an authenticated user with read-only permissions to add or delete entries from an existing HyperVisor configuration. IBM X-Force ID: 271538.

    IBM Storage Protect Plus Server
  • Medium 4.2
    CVE-2024-29880

    In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user runnin…

    JetBrains TeamCity
  • High 7.1
    CVE-2024-29879

    Cross-Site Scripting (XSS) vulnerability in Sentrifugo

    Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/index/getdepartments/format/html, 'business_id' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victi…

    Sentrifugo Sentrifugo
  • High 7.1
    CVE-2024-29878

    Cross-Site Scripting (XSS) vulnerability in Sentrifugo

    Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/sitepreference/add, 'description' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to the victim and steal th…

    Sentrifugo Sentrifugo
  • High 7.1
    CVE-2024-29877

    Cross-Site Scripting (XSS) vulnerability in Sentrifugo

    Cross-Site Scripting (XSS) vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/expenses/expensecategories/edit, 'expense_category_name' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted URL to …

    Sentrifugo Sentrifugo
  • Critical 9.8
    CVE-2024-29876

    SQL injection vulnerability in Sentrifugo

    SQL injection vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/reports/activitylogreport, 'sortby' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract all the d…

    Sentrifugo Sentrifugo
  • Critical 9.8
    CVE-2024-29875

    SQL injection vulnerability in Sentrifugo

    SQL injection vulnerability in Sentrifugo 3.2, through  /sentrifugo/index.php/default/reports/exportactiveuserrpt, 'sort_name' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extr…

    Sentrifugo Sentrifugo
  • Critical 9.8
    CVE-2024-29874

    SQL injection vulnerability in Sentrifugo

    SQL injection vulnerability in Sentrifugo 3.2, through /sentrifugo/index.php/default/reports/activeuserrptpdf, 'sort_name' parameter. The exploitation of this vulnerability could allow a remote user to send a specially crafted query to the server and extract …

    Sentrifugo Sentrifugo