Skip to content
OpenAdvisories

Archive

29 April 2024

Vulnerabilities first published on this day (UTC), newest first.

← March 2024 2024 / April /29 May 2024 →
  1. 1103
  2. 2173
  3. 3232
  4. 4139
  5. 5102
  6. 640
  7. 762
  8. 8119
  9. 9387
  10. 10218
  11. 1181
  12. 12128
  13. 1316
  14. 1414
  15. 15221
  16. 16243
  17. 17298
  18. 18124
  19. 19115
  20. 206
  21. 215
  22. 2281
  23. 2364
  24. 24131
  25. 2595
  26. 26138
  27. 2727
  28. 2844
  29. 29150
  30. 3074
All Critical High Medium Low Exploited only Public exploit

150 results · Feed

  • Medium 6.7
    CVE-2024-33522

    Privilege escalation in Calico CNI install binary

    In vulnerable versions of Calico (v3.27.2 and below), Calico Enterprise (v3.19.0-1, v3.18.1, v3.17.3 and below), and Calico Cloud (v19.2.0 and below), an attacker who has local access to the Kubernetes node, can escalate their privileges by exploiting a vulne…

    Tigera Calico Calico Enterprise Calico Cloud Go
  • High 8.8
    CVE-2024-0840

    Grandstream UCM Series IP PBX HTTP Parameter Injection

    The Grandstream UCM Series IP PBX before firmware version 1.0.20.52 is affected by a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP request. Authentication may …

    Grandstream UCM Series
  • Medium 6.8
    CVE-2024-34011

    Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Prote…

    Acronis Acronis Cyber Protect Cloud Agent
  • High 8.2
    CVE-2024-34010

    Local privilege escalation due to unquoted search path vulnerability. The following products are affected: Acronis Cybe…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 16 Acronis True Image OEM
  • High 7.1
    CVE-2023-48684

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 17
  • High 7.1
    CVE-2023-48683

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 16
  • High 8.2
    CVE-2024-1969

    Heap buffer overflow

    Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Secomea GateManager (webserver modules) allows crash of GateManager.This issue affects GateManager: from 9.7 before 11.2.624095033.

    Secomea GateManager
  • High 8.1
    CVE-2024-1579

    Insufficient seeding of random number generator

    Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Secomea GateManager (Webserver modules) allows Session Hijacking.This issue affects GateManager: before 11.2.624071020.

    Secomea GateManager
  • High 8.8
    CVE-2024-27322 EPSS 23%

    Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0…

    The R Project R r-base r-base Debian Ubuntu Azure Linux
  • Medium 4.3
    CVE-2024-33585

    WordPress Payment Gateway Based Fees and Discounts for WooCommerce plugin <= 2.12.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce.This issue affects Payment Gateway Based Fees and Discounts for WooCommerce: from n/a through 2.12.1.

    Tyche Softwares Payment Gateway Based Fees and Discounts for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2024-33586

    WordPress Photo Gallery by 10Web plugin <= 1.8.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Photo Gallery Team Photo Gallery by 10Web.This issue affects Photo Gallery by 10Web: from n/a through 1.8.20.

    Photo Gallery Team Photo Gallery by 10Web
  • Medium 5.3
    CVE-2024-33587

    WordPress Secure Copy Content Protection and Content Locking plugin <= 3.9.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content Protection and Content Locking: from n/a through 3.9.0.

    Copy Content Protection Team Secure Copy Content Protection and Content Locking
  • Medium 5.4
    CVE-2024-33588

    WordPress basepress plugin <= 2.16.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.

    codesavory Knowledge Base documentation & wiki plugin – BasePress
  • Medium 6.3
    CVE-2024-4310

    Cross-site Scripting (XSS) vulnerability in HubBank

    Cross-site Scripting (XSS) vulnerability in HubBank affecting version 1.0.2. This vulnerability allows an attacker to send a specially crafted JavaScript payload to registration and profile forms and trigger the payload when any authenticated user loads the p…

    Ofofonobs HubBank
  • High 8.1
    CVE-2024-4309 Public exploit

    SQL injection vulnerability in HubBank

    SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints (/user/transaction.php?id=1, /user/credit-debit_transaction.php?id=1,/…

    Ofofonobs HubBank
  • High 8.1
    CVE-2024-4307

    SQL injection vulnerability in HubBank

    SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints (/accounts/activities.php?id=1, /accounts/view-deposit.php?id=1, /acco…

    Ofofonobs HubBank
  • High 8.1
    CVE-2024-4308

    SQL injection vulnerability in HubBank

    SQL injection vulnerability in HubBank affecting version 1.0.2. This vulnerability could allow an attacker to send a specially crafted SQL query to the database through different endpoints (/admin/view_users.php?id=1,/admin/viewloan-trans.php?id=1,/admin/view…

    Ofofonobs HubBank
  • Critical 9.9
    CVE-2024-4306

    Unrestricted Upload of File with Dangerous Type vulnerability in HubBank

    Critical unrestricted file upload vulnerability in HubBank affecting version 1.0.2. This vulnerability allows a registered user to upload malicious PHP files via upload document fields, resulting in webshell execution.

    Ofofonobs HubBank
  • Medium 5.4
    CVE-2024-4304

    Vulnerability on SWAL platform from GT3 Soluciones

    A Cross-Site Scripting XSS vulnerability has been detected on GT3 Soluciones SWAL. This vulnerability consists in a reflected XSS in the Titular parameter inside Gestion 'Documental > Seguimiento de Expedientes > Alta de Expedientes'.

    GT3 Soluciones SWAL
  • Medium 6.5
    CVE-2024-33589

    WordPress KB Support plugin <= 1.6.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.6.0.

    WPOmnia KB Support
  • Medium 5.0
    CVE-2024-33590

    WordPress basepress plugin <= 2.16.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.

    codesavory Knowledge Base documentation & wiki plugin – BasePress
  • High 7.5
    CVE-2024-33591

    WordPress Easy Accept Payments for PayPal plugin <= 4.9.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tips and Tricks HQ Easy Accept Payments.This issue affects Easy Accept Payments: from n/a through 4.9.10.

    Tips and Tricks HQ Easy Accept Payments
  • Medium 4.3
    CVE-2024-33593

    WordPress Smart Forms plugin <= 2.6.91 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RedNao Smart Forms.This issue affects Smart Forms: from n/a through 2.6.91.

    RedNao Smart Forms
  • High 7.5
    CVE-2024-33594

    WordPress Leaky Paywall plugin <= 4.20.8 - Price Manipulation vulnerability

    Missing Authorization vulnerability in Leaky Paywall.This issue affects Leaky Paywall: from n/a through 4.20.8.

    Leaky Paywall Leaky Paywall
  • Medium 4.3
    CVE-2024-33595

    WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on Duplicate Post vulnerability

    Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1.

    Jewel Theme Master Addons for Elementor
  • Critical 9.4
    CVE-2024-3375

    Broken Access Control in Havelsan's Dialogue

    Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.

    HAVELSAN Dialogue
  • Medium 5.3
    CVE-2024-33596

    WordPress Five Star Restaurant Reservations plugin <= 2.6.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Five Star Plugins Five Star Restaurant Reservations.This issue affects Five Star Restaurant Reservations: from n/a through 2.6.16.

    Five Star Plugins Five Star Restaurant Reservations
  • Medium 6.3
    CVE-2024-28961

    Dell OpenManage Enterprise, versions 4.0.0 and 4.0.1, contains a sensitive information disclosure vulnerability. A loca…

    Dell Dell OpenManage Enterprise
  • High 7.5
    CVE-2024-33597

    WordPress SSU plugin <= 1.5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ProFaceOff SSU.This issue affects SSU: from n/a through 1.5.0.

    ProFaceOff SSU
  • High 7.5
    CVE-2024-33635

    WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Arbitrary Post/Page Deletion vulnerability

    Missing Authorization vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

    Piotnet Piotnet Addons For Elementor Pro
  • Medium 5.4
    CVE-2024-33636

    WordPress WP Page Post Widget Clone plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mahesh Vora WP Page Post Widget Clone.This issue affects WP Page Post Widget Clone: from n/a through 1.0.1.

    Mahesh Vora WP Page Post Widget Clone
  • Medium 6.5
    CVE-2024-33684

    WordPress Save as PDF plugin by Pdfcrowd plugin <= 3.2.0 - Broken Access Control to Stored XSS vulnerability

    Missing Authorization vulnerability in Pdfcrowd Save as PDF plugin by Pdfcrowd allows Stored XSS.This issue affects Save as PDF plugin by Pdfcrowd: from n/a through 3.2.0.

    pdfcrowd Save as PDF Plugin by PDFCrowd
  • Medium 6.5
    CVE-2024-33558

    WordPress XStore Core plugin <= 5.3.5 - Limited Arbitrary File Download vulnerability

    Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.5.

    8theme XStore Core
  • Medium 5.3
    CVE-2024-33652

    WordPress Client Dash plugin <= 2.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Real Big Plugins Client Dash.This issue affects Client Dash: from n/a through 2.2.1.

    Real Big Plugins Client Dash
  • Critical 10.0
    CVE-2024-33566

    WordPress OrderConvo plugin <= 12.4 - Unauthenticated API Access to Arbitrary File Upload vulnerability

    Missing Authorization vulnerability in N-Media OrderConvo allows OS Command Injection.This issue affects OrderConvo: from n/a through 12.4.

    N-Media OrderConvo
  • Medium 5.3
    CVE-2024-33538

    WordPress Assistant – Every Day Productivity Apps plugin <= 1.4.9.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Fastline Media LLC Assistant – Every Day Productivity Apps.This issue affects Assistant – Every Day Productivity Apps: from n/a through 1.4.9.1.

    Fastline Media Assistant – Every Day Productivity Apps
  • Medium 5.3
    CVE-2024-33575 Scanner template

    WordPress User Meta plugin <= 3.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in User Meta user-meta.This issue affects User Meta: from n/a through 3.0.

    User Meta User Meta
  • High 7.5
    CVE-2024-33637

    WordPress Solid Affiliate plugin <= 1.9.1 - Sensitive Data Exposure via Log File vulnerability

    Insertion of Sensitive Information into Log File vulnerability in Solid Plugins Solid Affiliate.This issue affects Solid Affiliate: from n/a through 1.9.1.

    Solid Plugins Solid Affiliate
  • Medium 5.4
    CVE-2024-33634

    WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Unauthenticated Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Piotnet Piotnet Addons For Elementor Pro.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

    Piotnet Piotnet Addons For Elementor Pro
  • Medium 4.4
    CVE-2024-33629

    WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 4.0.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Creative Motion Auto Featured Image (Auto Post Thumbnail).This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through 4.0.0.

    Creative Motion Auto Featured Image (Auto Post Thumbnail)