Skip to content
OpenAdvisories

Archive

18 April 2024

Vulnerabilities first published on this day (UTC), newest first.

← March 2024 2024 / April /18 May 2024 →
  1. 1103
  2. 2173
  3. 3232
  4. 4139
  5. 5102
  6. 640
  7. 762
  8. 8119
  9. 9387
  10. 10218
  11. 1181
  12. 12128
  13. 1316
  14. 1414
  15. 15221
  16. 16243
  17. 17298
  18. 18124
  19. 19115
  20. 206
  21. 215
  22. 2281
  23. 2364
  24. 24131
  25. 2595
  26. 26138
  27. 2727
  28. 2844
  29. 29150
  30. 3074
All Critical High Medium Low Exploited only Public exploit

67 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-21846

    Electrolink FM/DAB/TV Transmitter Missing Authentication for Critical Function

    An unauthenticated attacker can reset the board and stop transmitter operations by sending a specially-crafted GET request to the command.cgi gateway, resulting in a denial-of-service scenario.

    Electrolink VHF TV Transmitter Medium DAB Transmitter Compact FM Transmitter
  • Medium 4.7
    CVE-2024-32473

    Moby IPv6 enabled on IPv4-only network interfaces

    Moby is an open source container framework that is a key component of Docker Engine, Docker Desktop, and other distributions of container tooling or runtimes. In 26.0.0, IPv6 is not disabled on network interfaces, including those belonging to networks where `…

    moby moby k3d k3d-proxy Debian Ubuntu Alpine Wolfi Go
  • Medium 6.5
    CVE-2024-29987

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

    Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 5.4
    CVE-2024-29986

    Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability

    Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 6.5
    CVE-2024-32470

    Tolgee' API keys created by server admin users bypass the permission check

    Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.

    tolgee tolgee-platform
  • Medium 6.1
    CVE-2024-27306

    aiohttp vulnerable to XSS on index pages for static file handling

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. A XSS vulnerability exists on index pages for static file handling. This vulnerability is fixed in 3.9.4. We have always recommended using a reverse proxy server (e.g. nginx) for …

    aio-libs aiohttp kserve-storage-controller py3-cassandra-medusa Debian Ubuntu Azure Linux Wolfi PyPI
  • Medium 6.4
    CVE-2023-6892

    EAN for WooCommerce <= 4.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via alg_wc_ean_product_meta Shortcode

    The EAN for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'alg_wc_ean_product_meta' shortcode in all versions up to, and including, 4.8.7 due to insufficient input sanitization and output escaping on user suppl…

    wpcodefactory EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory Web / CMS
  • Medium 4.3
    CVE-2023-6897

    EAN for WooCommerce <= 4.9.2 - Insecure Direct Object Reference to Sensitve Information Exposure via Shortcode

    The EAN for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.9.2 via the the 'alg_wc_ean_product_meta' shortcode due to missing validation on a user controlled key. This makes it possib…

    wpcodefactory EAN Barcode Generator for WooCommerce: UPC, ISBN & GTIN Inventory Web / CMS
  • Medium 6.8
    CVE-2023-50885

    WordPress Store Locator WordPress Plugin <= 1.4.14 is vulnerable to Arbitrary File Deletion

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AGILELOGIX Store Locator WordPress.This issue affects Store Locator WordPress: from n/a through 1.4.14.

    Agile Logix Store Locator WordPress Web / CMS
  • Medium 6.3
    CVE-2024-3948

    SourceCodester Home Clean Service System Photo student.add.php unrestricted upload

    A vulnerability was found in SourceCodester Home Clean Service System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file \admin\student.add.php of the component Photo Handler. The manipulation leads to unrestr…

    SourceCodester Home Clean Service System
  • Medium 6.5
    CVE-2023-3675

    Insufficient input validation when downloading certain file types.

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Secomea GateManager (Web GUI) allows Reading Data from System Resources.This issue affects GateManager: from 11.0.623074018 before 11.0.623373051.

    Secomea GateManager
  • Medium 4.3
    CVE-2024-32689

    WordPress WP Social Comments plugin <= 1.7.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in GenialSouls WP Social Comments.This issue affects WP Social Comments: from n/a through 1.7.3.

    GenialSouls WP Social Comments
  • Medium 5.3
    CVE-2024-32686

    WordPress Backup Migration plugin <= 1.4.3 - Sensitive Data Exposure via Log vulnerability

    Insertion of Sensitive Information into Log File vulnerability in Inisev Backup Migration.This issue affects Backup Migration: from n/a through 1.4.3.

    Inisev Backup Migration
  • Medium 5.5
    CVE-2024-31229

    WordPress Really Simple SSL plugin <= 7.2.3 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Really Simple Plugins Really Simple SSL.This issue affects Really Simple SSL: from n/a through 7.2.3.

    Really Simple Plugins Really Simple SSL
  • Medium 6.5
    CVE-2023-49768

    WordPress WP-FormAssembly plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Stored XSS.This issue affects WP-FormAssembly: from n/a through 2.0.10.

    FormAssembly / Drew Buschhorn WP-FormAssembly
  • Medium 5.9
    CVE-2024-32126

    WordPress Navigation menu as dropdown Widget plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Navigation menu as Dropdown Widget navigation-menu-as-dropdown-widget.This issue affects Navigation menu as Dropdown Widget: from n/a through <…

    Jeroen Peters Navigation menu as Dropdown Widget
  • Medium 6.5
    CVE-2024-32552

    WordPress Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tagbox Taggbox allows Stored XSS.This issue affects Taggbox: from n/a through 3.2.

    Tagbox Taggbox
  • Medium 6.5
    CVE-2024-32554

    WordPress Knight Lab Timeline plugin <= 3.9.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Knight Lab Knight Lab Timeline allows Stored XSS.This issue affects Knight Lab Timeline: from n/a through 3.9.3.4.

    Knight Lab Knight Lab Timeline
  • Medium 6.5
    CVE-2024-32556

    WordPress HurryTimer plugin <=2.9.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nabil Lemsieh HurryTimer allows Stored XSS.This issue affects HurryTimer: from n/a through 2.9.2.

    Nabil Lemsieh HurryTimer
  • Medium 6.5
    CVE-2024-32560

    WordPress QR Code Composer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sharabindu QR Code Composer allows Stored XSS.This issue affects QR Code Composer: from n/a through 2.0.3.

    Sharabindu QR Code Composer
  • Medium 6.5
    CVE-2024-32561

    WordPress Tagembed plugin <= 4.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tagembed allows Stored XSS.This issue affects Tagembed: from n/a through 4.7.

    Tagembed Tagembed
  • Medium 6.5
    CVE-2024-32564

    WordPress PostX plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPXPO PostX ultimate-post allows DOM-Based XSS.This issue affects PostX: from n/a through <= 4.0.1.

    wpxpo PostX
  • Medium 6.5
    CVE-2024-32565

    WordPress App Builder plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Appcheap.Io App Builder allows Stored XSS.This issue affects App Builder: from n/a through 3.8.8.

    Appcheap.io App Builder
  • Medium 6.5
    CVE-2024-32566

    WordPress WP Club Manager plugin <= 2.2.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Club Manager WP Club Manager wp-club-manager.This issue affects WP Club Manager: from n/a through <= 2.2.11.

    WP Club Manager WP Club Manager
  • Medium 6.5
    CVE-2024-32569

    WordPress Ditty plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metaphor Creations Ditty allows Stored XSS.This issue affects Ditty: from n/a through 3.1.31.

    Metaphor Creations Ditty
  • Medium 6.5
    CVE-2024-32571

    WordPress WP Stripe Checkout plugin <= 1.2.2.41 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 WP Stripe Checkout allows Stored XSS.This issue affects WP Stripe Checkout: from n/a through 1.2.2.41.

    naa986 WP Stripe Checkout
  • Medium 6.5
    CVE-2024-32572

    WordPress Element Pack Elementor Addons plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 5.6.0.

    bdthemes Element Pack Elementor Addons
  • Medium 5.9
    CVE-2024-32573

    WordPress WP-Lister Lite for eBay plugin <=3.5.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay.This issue affects WP-Lister Lite for eBay: from n/a through <= 3.5.11.

    WP Lab WP-Lister Lite for eBay
  • Medium 6.5
    CVE-2024-32575

    WordPress Mega Elements plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kraftplugins Mega Elements allows Stored XSS.This issue affects Mega Elements: from n/a through 1.1.9.

    Kraft Plugins Mega Elements
  • Medium 6.5
    CVE-2024-32576

    WordPress BA Book Everything plugin <= 1.6.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Booking Algorithms BA Book Everything allows Stored XSS.This issue affects BA Book Everything: from n/a through 1.6.8.

    Booking Algorithms BA Book Everything
  • Medium 6.5
    CVE-2024-32577

    WordPress CBX Bookmark & Favorite plugin <= 1.7.20 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeboxr Team CBX Bookmark & Favorite cbxwpbookmark allows Stored XSS.This issue affects CBX Bookmark & Favorite: from n/a through 1.7.20.

    Codeboxr CBX Bookmark & Favorite
  • Medium 6.1
    CVE-2024-2833

    Jobs for WordPress <= 2.7.5 - Reflected Cross-Site Scripting via job-search

    The Jobs for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘job-search’ parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unaut…

    blueglassch Job Postings Web / CMS
  • Medium 6.5
    CVE-2024-32579

    WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GloriaFood Restaurant Menu – Food Ordering System – Table Reservation allows Stored XSS.This issue affects Restaurant Menu – Food Ordering System – Table Res…

    Gloriafood Restaurant Menu – Food Ordering System – Table Reservation
  • Medium 6.5
    CVE-2024-32580

    WordPress Master Slider plugin <= 3.9.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider allows Stored XSS.This issue affects Master Slider: from n/a through 3.9.8.

    Averta Master Slider
  • Medium 6.5
    CVE-2024-32581

    WordPress Mortgage Calculators WP plugin <= 1.56 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lenderd Mortgage Calculators WP allows Stored XSS.This issue affects Mortgage Calculators WP: from n/a through 1.56.

    Lenderd Mortgage Calculators WP
  • Medium 5.9
    CVE-2024-32584

    WordPress TeraWallet plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StandaloneTech TeraWallet – For WooCommerce allows Stored XSS.This issue affects TeraWallet – For WooCommerce: from n/a through 1.5.0.

    StandaloneTech TeraWallet – For WooCommerce Web / CMS
  • Medium 5.9
    CVE-2024-32585

    WordPress Import Content in WordPress & WooCommerce with Excel plugin <= 4.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendWP Import Content in WordPress & WooCommerce with Excel allows Reflected XSS.This issue affects Import Content in WordPress & WooCommerce with Excel: f…

    extendWP Import Content in WordPress & WooCommerce with Excel Web / CMS
  • Medium 6.5
    CVE-2024-32586

    WordPress Gutenberg Block Editor Toolkit plugin <= 1.40.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munir Kamal Gutenberg Block Editor Toolkit allows Stored XSS.This issue affects Gutenberg Block Editor Toolkit: from n/a through 1.40.4.

    Munir Kamal Gutenberg Block Editor Toolkit
  • Medium 5.8
    CVE-2024-32587

    WordPress EnvíaloSimple plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvialoSimple EnvíaloSimple allows Reflected XSS.This issue affects EnvíaloSimple: from n/a through 2.2.

    EnvialoSimple EnvíaloSimple
  • Medium 6.5
    CVE-2024-32590

    WordPress Kattene plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webfood Kattene allows Stored XSS.This issue affects Kattene: from n/a through 1.7.

    Webfood Kattene