Skip to content
OpenAdvisories

Archive

March 2024

Vulnerabilities first published in this month (UTC), newest first.

← February 2024 2024 / March April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

1,130 results · Clear filters · Feed

  • High 7.1
    CVE-2024-30506

    WordPress All In One Redirection plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Stored XSS.This issue affects All In One Redirection: from n/a through 2.2.0.

    Vsourz Digital All In One Redirection
  • High 7.6
    CVE-2024-30504

    WordPress WP Travel Engine plugin <= 5.7.9 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.7.9.

    WP Travel Engine WP Travel Engine
  • High 7.6
    CVE-2024-30501

    WordPress Download Monitor theme <= 4.9.4 - Auth. SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.9.4.

    WP Chill Download Monitor
  • High 8.5
    CVE-2024-30499

    WordPress CRM Perks Forms plugin <= 1.1.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks CRM Perks Forms.This issue affects CRM Perks Forms: from n/a through 1.1.4.

    CRM Perks CRM Perks Forms
  • High 8.5
    CVE-2024-30497

    WordPress WP Responsive Tabs horizontal vertical and accordion Tabs plugin <= 1.1.17 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs.This issue affects WP Responsive Tabs horizontal vertical and accordion Tab…

    I Thirteen Web Solution WP Responsive Tabs horizontal vertical and accordion Tabs
  • High 8.5
    CVE-2024-30496

    WordPress Element Pack Lite plugin <= 5.5.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BdThemes Element Pack Elementor Addons.This issue affects Element Pack Elementor Addons: from n/a through 5.5.3.

    bdthemes Element Pack Elementor Addons
  • High 7.6
    CVE-2024-30495

    WordPress Falang multilanguage for WordPress plugin <= 1.3.47 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Faboba Falang multilanguage.This issue affects Falang multilanguage: from n/a through 1.3.47.

    Faboba Falang multilanguage Web / CMS
  • High 7.6
    CVE-2024-30494

    WordPress OSS Aliyun plugin <= 1.4.10 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 沈唁 OSS Aliyun.This issue affects OSS Aliyun: from n/a through 1.4.10.

  • High 8.5
    CVE-2024-30491 EPSS 32%

    WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.8 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8.

    Metagauss ProfileGrid
  • High 8.5
    CVE-2024-30488

    WordPress Zotpress plugin <= 7.3.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Katie Zotpress zotpress.This issue affects Zotpress: from n/a through <= 7.3.7.

    Katie Zotpress
  • High 7.6
    CVE-2024-30487

    WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar.This issue affects MP3 Audio Player for Music, Radio & Podcast by Sonaar: from n/a through 5.1.

    SONAAR MUSIC MP3 Audio Player for Music, Radio & Podcast by Sonaar
  • High 8.5
    CVE-2024-30486

    WordPress Media Library Folders plugin <= 8.1.7 - Auth. SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.7.

    Max Foundry Media Library Folders
  • High 7.6
    CVE-2024-30478

    WordPress Announcement & Notification Banner – Bulletin plugin <= 3.8.5 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bulletin WordPress Announcement & Notification Banner Plugin – Bulletin.This issue affects WordPress Announcement & Notification Banner Plugin – Bulletin: fr…

    Bulletin WordPress Announcement & Notification Banner Plugin – Bulletin Web / CMS
  • High 7.1
    CVE-2024-30428

    WordPress Contest Gallery plugin <= 24.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Reflected XSS.This issue affects Contest Gallery: from n/a through <= 24.0…

    Wasiliy Strecker / ContestGallery developer Contest Gallery
  • High 7.1
    CVE-2022-47153

    WordPress Jobeleon theme <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPJobBoard Jobeleon Theme allows Reflected XSS.This issue affects Jobeleon Theme: from n/a through 1.9.1.

    WPJobBoard Jobeleon Theme
  • High 7.1
    CVE-2024-30503

    WordPress Mailster plugin <= 4.0.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.This issue affects Mailster: from n/a through <= 4.0.6.

    EverPress Mailster
  • High 7.5
    CVE-2024-2848

    Responsive <= 5.0.2 - Missing Authorization to HTML Injection

    The Responsive theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_footer_text_callback function in all versions up to, and including, 5.0.2. This makes it possible for unauthenticated attackers…

    cyberchimps Responsive Web / CMS
  • High 7.2
    CVE-2024-3061

    HUSKY – Products Filter Professional for WooCommerce <= 1.3.5.2 - Authenticated (Admin+) Local File Inclusion

    The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.5.2 via the 'type' parameter. This makes it possible for authenticated attackers, with administrator-…

    RealMag777 HUSKY – Products Filter Professional for WooCommerce Web / CMS
  • High 8.4
    CVE-2023-52629

    sh: push-switch: Reorder cleanup operations to avoid use-after-free bug

    In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.8
    CVE-2024-1872

    Button <= 1.1.27 - Authenticated (Contributor+) PHP Object Injection in button_shortcode

    The Button plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.27 via deserialization of untrusted input in the button_shortcode function. This makes it possible for authenticated attackers, with contributor-le…

    burgersoftware Button Web / CMS
  • High 7.2
    CVE-2024-0609

    WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting <= 1.13.1 - Unauthenticated Stored Cross-Site Scripting

    The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in all versions up to, and including, 1.13.1 due to insufficient inp…

    wedevs ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Web / CMS
  • High 7.2
    CVE-2024-0913

    WP ERP <= 1.13.0 - Authenticated (Accounting Manager+) SQL Injection

    The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the erp/v1/accounting/v1/transactions/sales REST API endpoint in all versions up to, and includ…

    wedevs ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support Web / CMS
  • High 7.2
    CVE-2024-28405

    SEMCMS 4.8 is vulnerable to Incorrect Access Control. The code installs SEMCMS_Funtion.php before checking if the admin…

  • High 8.2
    CVE-2024-28960

    An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA …

    mbedtls mbedtls hvloader mbedtls Debian Ubuntu Azure Linux Alpine
  • High 7.2
    CVE-2024-29686

    Winter CMS Server-Side Template Injection (SSTI) vulnerability

    Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted payload to the CMS Pages field and Plugin components. NOTE: the vendor disputes this because the payload could only be e…

    wintercms/winter Packagist
  • High 7.3
    CVE-2024-27619 Public exploit

    Dlink Dir-3040us A1 1.20b03a hotfix is vulnerable to Buffer Overflow. Any user having read/write access to ftp server c…

  • High 8.0
    CVE-2024-30626

    Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the schedEndTime parameter from setSchedWifi function.

  • High 8.8
    CVE-2024-30627

    Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the deviceId parameter from saveParentControlInfo func…

  • High 8.8
    CVE-2024-30624

    Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the urls parameter from saveParentControlInfo function.

  • High 8.8
    CVE-2024-30637

    Tenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter.

  • High 8.0
    CVE-2024-30645

    Tenda AC15V1.0 V15.03.20_multi has a command injection vulnerability via the deviceName parameter.

  • High 8.0
    CVE-2024-30634

    Tenda F1202 v1.2.0.20(408) has a stack overflow vulnerability via the mitInterface parameter in the fromAddressNat func…

  • High 8.0
    CVE-2024-30625

    Tenda FH1205 v2.0.0.7(775) has a stack overflow vulnerability in the entrys parameter from fromAddressNat function.

  • High 7.2
    CVE-2024-25955

    Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could po…

    Dell Virtual Appliance (vApp) Manager
  • High 7.2
    CVE-2024-25946

    Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could po…

    Dell Virtual Appliance (vApp) Manager
  • High 8.8
    CVE-2024-3019

    Pcp: exposure of the redis server backend allows remote command execution via pmproxy

    A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pm…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • High 7.3
    CVE-2024-2947

    Cockpit: command injection when deleting a sosreport with a crafted name

    A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian
  • High 7.3
    CVE-2024-25960

    Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulne…

    Dell PowerScale OneFS
  • High 7.9
    CVE-2024-25959

    Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vul…

    Dell PowerScale OneFS
  • High 8.8
    CVE-2023-42950

    A use after free issue was addressed with improved memory management. This issue is fixed in Safari 17.2, iOS 17.2 and …

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu Wolfi