Skip to content
OpenAdvisories

Archive

March 2024

Vulnerabilities first published in this month (UTC), newest first.

← February 2024 2024 / March April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

1,626 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-20278

    A vulnerability in the NETCONF feature of Cisco IOS XE Software could allow an authenticated, remote attacker to elevat…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.0
    CVE-2024-20306

    A vulnerability in the Unified Threat Defense (UTD) configuration CLI of Cisco IOS XE Software could allow an authentic…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 5.5
    CVE-2024-20324

    A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, low-privileged, local attacker to acc…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 5.8
    CVE-2024-20316

    A vulnerability in the data model interface (DMI) services of Cisco IOS XE Software could allow an unauthenticated, rem…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 4.7
    CVE-2024-20354

    A vulnerability in the handling of encrypted wireless frames of Cisco Aironet Access Point (AP) Software could allow an…

    Cisco Cisco Aironet Access Point Software Cisco Aironet Access Point Software (IOS XE Controller) iOS Network devices
  • Medium 4.3
    CVE-2024-20333

    A vulnerability in the web-based management interface of Cisco Catalyst Center, formerly Cisco DNA Center, could allow …

    Cisco Cisco Digital Network Architecture Center (DNA Center) Network devices
  • Medium 5.5
    CVE-2024-2982

    Tenda FH1202 WriteFacMac formWriteFacMac command injection

    A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The explo…

    Tenda FH1202
  • Medium 4.1
    CVE-2024-26652

    net: pds_core: Fix possible double free in error handling path

    In the Linux kernel, the following vulnerability has been resolved: net: pds_core: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), Callback function pdsc_auxbus_dev_release ca…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 6.1
    CVE-2022-45847

    WordPress Countdown Widget plugin <= 3.1.9.1 - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS)

    Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affects WordPress Countdown Widget: from n/a through 3.1.9.1.

    WPAssist.me WordPress Countdown Widget Web / CMS
  • Medium 4.3
    CVE-2024-23510

    WordPress Don't Muck My Markup plugin <= 1.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Martyn Chamberlin Don't Muck My Markup.This issue affects Don't Muck My Markup: from n/a through 1.8.

    Martyn Chamberlin Don't Muck My Markup
  • Medium 5.4
    CVE-2024-23515

    WordPress Cincopa video and media plugin <= 1.159 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Cincopa Post Video Players.This issue affects Post Video Players: from n/a through 1.159.

    Cincopa Post Video Players
  • Medium 5.4
    CVE-2023-44999

    WordPress WooCommerce Stripe Gateway plugin <= 7.6.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.0.

    woocommerce WooCommerce Stripe Payment Gateway Web / CMS
  • Medium 4.7
    CVE-2023-34020 Scanner template

    WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.6.4.3.

    Uncanny Owl Uncanny Toolkit for LearnDash
  • Medium 6.1
    CVE-2024-28852

    Ampache has multiple reflective XSS vulnerabilities

    Ampache is a web based audio/video streaming application and file manager. Ampache has multiple reflective XSS vulnerabilities,this means that all forms in the Ampache that use `rule` as a variable are not secure. For example, when querying a song, when query…

    ampache ampache ampache Ubuntu
  • Medium 6.5
    CVE-2024-29761

    WordPress WP Post Disclaimer plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Krunal Prajapati WP Post Disclaimer allows Stored XSS.This issue affects WP Post Disclaimer: from n/a through 1.0.3.

    Krunal Prajapati WP Post Disclaimer
  • Medium 6.5
    CVE-2024-29762

    WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) allows Stored XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): from n/a through 0.5.8.1.

    Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars)
  • Medium 6.5
    CVE-2024-29764

    WordPress Molongui plugin <= 4.7.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Molongui allows Stored XSS.This issue affects Molongui: from n/a through 4.7.7.

    molongui Molongui
  • Medium 6.5
    CVE-2024-29765

    WordPress Aparat for WordPress plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alireza Sedghi Aparat for WordPress allows Stored XSS.This issue affects Aparat for WordPress: from n/a through 2.2.0.

    Alireza Sedghi Aparat for WordPress Web / CMS
  • Medium 6.5
    CVE-2024-29766

    WordPress StreamWeasels Twitch Integration plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StreamWeasels StreamWeasels Twitch Integration allows Stored XSS.This issue affects StreamWeasels Twitch Integration: from n/a through 1.7.5.

    streamweasels StreamWeasels Twitch Integration
  • Medium 5.9
    CVE-2024-29768

    WordPress Astra theme <= 4.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra allows Stored XSS.This issue affects Astra: from n/a through 4.6.4.

    Brainstorm Force Astra
  • Medium 6.5
    CVE-2024-29769

    WordPress Portfolio Gallery plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portfolio Gallery – Image Gallery Plugin allows Stored XSS.This issue affects Portfolio Gallery – Image Gallery Plugin: from n/a through 1.5.6.

  • Medium 6.1
    CVE-2024-27091

    GeoNode stored XSS to full account takeover

    GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but …

    GeoNode GeoNode geonode PyPI
  • Medium 6.5
    CVE-2024-29771

    WordPress Dracula Dark Mode plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftLab Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress allows Stored XSS.This issue affects Dracula Dark Mode - The Revolutionary Dark …

    SoftLab Dracula Dark Mode - The Revolutionary Dark Mode Plugin For WordPress Web / CMS
  • Medium 6.5
    CVE-2024-29772

    WordPress MyBookTable Bookstore plugin <= 3.3.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stormhill Media MyBookTable Bookstore allows Stored XSS.This issue affects MyBookTable Bookstore: from n/a through 3.3.7.

    Stormhill Media MyBookTable Bookstore
  • Medium 6.5
    CVE-2024-29775

    WordPress Frontend Dashboard plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vinoth06. Frontend Dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through 2.2.1.

    vinoth06 Frontend Dashboard
  • Medium 5.9
    CVE-2024-29776

    WordPress EventPrime plugin <= 3.3.9 - Cross Site Scripting (XSS) vulnerability

    Cross Site Scripting (XSS) vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.9.

    Metagauss EventPrime
  • Medium 6.5
    CVE-2024-29788

    WordPress Podlove Web Player plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Podlove Podlove Web Player allows Stored XSS.This issue affects Podlove Web Player: from n/a through 5.7.1.

    Podlove Podlove Web Player
  • Medium 6.5
    CVE-2024-29789

    WordPress OneClick Chat to Order plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Walter Pinem OneClick Chat to Order allows Stored XSS.This issue affects OneClick Chat to Order: from n/a through 1.0.5.

    Walter Pinem OneClick Chat to Order
  • Medium 4.7
    CVE-2024-27270

    IBM WebSphere Application Server Liberty cross-site scripting

    IBM WebSphere Application Server Liberty 23.0.0.3 through 24.0.0.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in a specially crafted URI. IBM X-Force ID: 284576.

    IBM WebSphere Application Server - Liberty
  • Medium 6.5
    CVE-2024-29793

    WordPress MailChimp Forms by MailMunch plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MailMunch MailChimp Forms by MailMunch allows Stored XSS.This issue affects MailChimp Forms by MailMunch: from n/a through 3.2.2.

    mailmunch MailChimp Forms by MailMunch
  • Medium 4.8
    CVE-2023-50961

    IBM QRadar cross-site scripting

    IBM QRadar SIEM 7.5 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.…

    IBM QRadar SIEM
  • Medium 5.4
    CVE-2024-28784 Public exploit

    IBM QRadar cross-site scripting

    IBM QRadar SIEM 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-…

    IBM QRadar SIEM
  • Medium 6.5
    CVE-2024-29795

    WordPress Media Cloud for Amazon S3, Cloudflare R2, Google Cloud Storage, DigitalOcean Spaces and more plugin <= 4.5.24 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more allows Stored XSS.This issue affects Media Cloud for Amazon…

    Interfacelab Media Cloud for Amazon S3, Imgix, Google Cloud Storage, DigitalOcean Spaces and more
  • Medium 6.5
    CVE-2024-29796

    WordPress Hot Random Image plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hot Themes Hot Random Image allows Stored XSS.This issue affects Hot Random Image: from n/a through 1.8.1.

    Hot Themes Hot Random Image
  • Medium 6.5
    CVE-2024-29797

    WordPress Grid Shortcodes plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Darko Grid Shortcodes allows Stored XSS.This issue affects Grid Shortcodes: from n/a through 1.1.

    WP Darko Grid Shortcodes
  • Medium 6.5
    CVE-2024-29798

    WordPress Gratisfaction plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Appsmav Gratisfaction allows Stored XSS.This issue affects Gratisfaction: from n/a through 4.3.4.

    Apps Mav Gratisfaction
  • Medium 6.5
    CVE-2024-29799

    WordPress WP Fast Total Search plugin <= 1.59.211 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Epsiloncool WP Fast Total Search allows Stored XSS.This issue affects WP Fast Total Search: from n/a through 1.59.211.

    Epsiloncool WP Fast Total Search
  • Medium 6.5
    CVE-2024-29801

    WordPress Fullscreen Galleria plugin <= 1.6.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Petri Damstén Fullscreen Galleria allows Stored XSS.This issue affects Fullscreen Galleria: from n/a through 1.6.11.

    Petri Damstén Fullscreen Galleria
  • Medium 6.5
    CVE-2024-29802

    WordPress Football Pool plugin <= 2.11.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Antoine Hurkmans Football Pool allows Stored XSS.This issue affects Football Pool: from n/a through 2.11.3.

    Antoine Hurkmans Football Pool
  • Medium 6.5
    CVE-2024-29803

    WordPress FlatPM plugin < 3.1.05 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mehanoid.Pro FlatPM allows Stored XSS.This issue affects FlatPM: from n/a before 3.1.05.

    Mehanoid.pro FlatPM