Skip to content
OpenAdvisories

Archive

2 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /2 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-0710 Public exploit

    GP Unique ID <= 1.5.5 - Unauthenticated Form Submission Unique ID Modification

    The GP Unique ID plugin for WordPress is vulnerable to Unique ID Modification in all versions up to, and including, 1.5.5. This is due to insufficient input validation. This makes it possible for unauthenticated attackers to tamper with the generation of a un…

    Gravity Wiz GP Unique ID Web / CMS
  • Medium 6.5
    CVE-2024-3553 Public exploit

    Tutor LMS <= 2.6.2 - Missing Authorization to Unauthenticated Limited Options Update

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the hide_notices function in all versions up to, and including, 2.6.2. This makes it possible for…

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • Critical 9.8
    CVE-2024-2667 Public exploit Scanner template

    InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.22 - Unauthenticated Arbitrary File Upload

    The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. T…

    InstaWP InstaWP Connect – 1-click WP Staging & Migration Web / CMS
  • Critical 9.8
    CVE-2024-2876 Public exploit Scanner template EPSS 81%

    Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection

    The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and includ…

    Icegram Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress Web / CMS
  • High 8.8
    CVE-2024-4406 Public exploit

    Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability

    Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to e…

    Xiaomi Pro 13
  • Critical 9.8
    CVE-2024-34144 Public exploit EPSS 48%

    Jenkins Script Security Plugin has sandbox bypass vulnerability involving crafted constructor bodies

    A sandbox bypass vulnerability involving crafted constructor bodies in Jenkins Script Security Plugin 1335.vf07d9ce377a_e and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection a…

    Jenkins Project Jenkins Script Security Plugin org.jenkins-ci.plugins:script-security Web / CMS Maven
  • High 7.6
    CVE-2024-33911 Public exploit

    WordPress The School Management Pro plugin <= 10.3.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar School Management Pro.This issue affects School Management Pro: from n/a through 10.3.4.

    weblizar School Management Pro
  • High 8.5
    CVE-2024-32114 Public exploit Scanner template

    Apache ActiveMQ: Jolokia and REST API were not secured with default configuration

    In Apache ActiveMQ 6.x, the default configuration doesn't secure the API web context (where the Jolokia JMX REST API and the Message REST API are located). It means that anyone can use these layers without any required authentication. Potentially, anyone can …

    Apache Software Foundation Apache ActiveMQ org.apache.activemq:apache-activemq Maven
  • Critical 10.0
    CVE-2024-32962 Public exploit

    XML signature verification bypass due improper verification of signature / signature spoofing

    xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-2008061…

    node-saml xml-crypto xml-crypto npm
  • High 7.5
    CVE-2023-50685 Public exploit

    An issue in Hipcam Cameras RealServer v.1.0 allows a remote attacker to cause a denial of service via a crafted script …

  • High 7.5
    CVE-2024-31964 Public exploit

    A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3…