Skip to content
OpenAdvisories

Archive

2 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /2 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

177 results · Clear filters · Feed

  • Medium 4.7
    CVE-2024-33930

    WordPress Share This Image plugin <= 1.97 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ILLID Share This Image.This issue affects Share This Image: from n/a through 1.97.

    ILLID Share This Image
  • Medium 6.3
    CVE-2024-32638

    Apache APISIX: Forward-Auth Request Smuggling

    Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Apache APISIX when using `forward-auth` plugin.This issue affects Apache APISIX: from 3.8.0, 3.9.0. Users are recommended to upgrade to version 3.8.1, 3.9.1 or higher, wh…

    Apache Software Foundation Apache APISIX
  • Medium 6.4
    CVE-2024-3883

    3D FlipBook <= 1.15.4 - Authenticated (Author+) Stored Cross-Site Scritping via Bookmark URL

    The 3D FlipBook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Bookmark URL field in all versions up to, and including, 1.15.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated atta…

    iberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery Web / CMS
  • Medium 6.4
    CVE-2024-3280

    Follow Us Badges <= 3.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsite_follow_us_badges Shortcode

    The Follow Us Badges plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsite_follow_us_badges shortcode in all versions up to, and including, 3.1.10 due to insufficient input sanitization and output escaping on user supplied …

    DraftPress Team Follow Us Badges Web / CMS
  • Medium 6.4
    CVE-2024-3490

    WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode

    The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in all versions up to, and including, 9.3.1 due to insufficient input sanitization and output escaping on user supplied a…

    brechtvds WP Recipe Maker Web / CMS
  • Medium 5.2
    CVE-2024-3481

    Counter Box < 1.2.4 - Counter Deletion via CSRF

    The Counter Box WordPress plugin before 1.2.4 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such deleting counters via CSRF attacks

    Web / CMS
  • Medium 4.3
    CVE-2024-3477

    Popup Box < 2.2.7 - Popup Deletion via CSRF

    The Popup Box WordPress plugin before 2.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting popups via CSRF attacks

    Web / CMS
  • Medium 6.1
    CVE-2024-3478

    Herd Effects < 5.2.7 - Effect Deletion via CSRF

    The Herd Effects WordPress plugin before 5.2.7 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting effects via CSRF attacks

    Web / CMS
  • Medium 5.9
    CVE-2024-3472

    Modal Window < 5.3.10 - Modal Deletion via CSRF

    The Modal Window WordPress plugin before 5.3.10 does not have CSRF check in place when bulk deleting modals, which could allow attackers to make a logged in admin delete them via a CSRF attack

    Web / CMS
  • Medium 4.5
    CVE-2024-2405

    Float menu < 6.0.1 - Menu Deletion via CSRF

    The Float menu WordPress plugin before 6.0.1 does not have CSRF check in its bulk actions, which could allow attackers to make logged in admin delete arbitrary menu via a CSRF attack.

    Web / CMS
  • Medium 6.1
    CVE-2024-33305

    SourceCodester Laboratory Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via "Middle Name" parameter…

  • Medium 5.3
    CVE-2024-33302

    SourceCodester Product Show Room 1.0 and before is vulnerable to Cross Site Scripting (XSS) via "Middle Name" under Add…

  • Medium 5.9
    CVE-2024-33394

    kubevirt allows a local attacker to execute arbitrary code via a crafted command

    An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.

    kubevirt kubevirt.io/kubevirt Azure Linux Go
  • Medium 6.9
    CVE-2024-32359

    CVE-2024-32359 in github.com/carina-io/carina

    An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of the entire cluster and further take over the cluster.

    github.com/carina-io/carina Go
  • Medium 6.2
    CVE-2024-31966

    A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3…

  • Medium 6.4
    CVE-2024-31963

    A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3…

  • Medium 4.2
    CVE-2024-31965

    A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3…