Skip to content
OpenAdvisories

Archive

2 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /2 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-2667 Public exploit Scanner template

    InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

    The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. T…

    InstaWP InstaWP Connect – 1-click WP Staging & Migration Web / CMS
  • Critical 9.8
    CVE-2024-2876 Public exploit Scanner template EPSS 81%

    Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

    The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and includ…

    Icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Web / CMS
  • Critical 9.8
    CVE-2024-3729

    Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation

    The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling on the 'fea_encrypt' function in all versions up to, and including, 3.19.4. This makes it possible for unauthenticated attackers to manipulat…

    shabti Frontend Admin by DynamiApps Web / CMS
  • Critical 9.8
    CVE-2024-34144 Public exploit EPSS 48%

    Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

    A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection a…

    Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  • Critical 9.6
    CVE-2024-33913

    WordPress Xserver Migrator plugin <= 1.6.1 - CSRF to Arbitrary File Upload vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary File Upload in Xserver Migrator.This issue affects Xserver Migrator: from n/a through 1.6.1.

    Xserver Migrator Xserver Migrator
  • Critical 9.8
    CVE-2024-3955

    Arbitrary code execution in CraftBeerPi 4

    URL GET parameter "logtime" utilized within the "downloadlog" function from "cbpi/http_endpoints/http_system.py" is subsequently passed to the "os.system" function in "cbpi/controller/system_controller.py" without prior validation allowing to execute arbitrar…

    PiBrewing CraftBeerPi - Brewing Controller CraftBeerPi 4 CraftBeerPi 4 PyPI
  • Critical 10.0
    CVE-2024-32962 Public exploit

    XML signature verification bypass due improper verification of signature / signature spoofing

    xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-2008061…

    node-saml xml-crypto xml-crypto npm
  • Critical 9.1
    CVE-2024-32971

    Defect in query plan cache may cause incorrect operations to be executed in Apollo Router

    Apollo Router is a configurable, graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. The affected versions of Apollo Router contain a bug that in limited circumstances, could lead to unexpected operations being executed w…

    apollographql router apollo-router crates.io
  • Critical 9.1
    CVE-2024-31967

    A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3…