Skip to content
OpenAdvisories

Archive

4 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /4 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-27283

    IBM Aspera Orchestrator information disclosure

    IBM Aspera Orchestrator 4.0.1 could allow a remote attacker to enumerate usernames due to observable response discrepancies. IBM X-Force ID: 248545.

    IBM Aspera Orchestrator
  • Medium 4.3
    CVE-2024-1050

    Import and export users and customers <= 1.26.5 - Missing Authorization

    The Import and export users and customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_force_reset_password_delete_metas() function in all versions up to, and including, 1.26.5. This mak…

    carazo Import and export users and customers Web / CMS
  • Medium 5.4
    CVE-2023-7065

    Stop Spammers Security | Block Spam Users, Comments, Forms <= 2024.4 - Cross-Site Request Forgery (CSRF) via sfs_process

    The Stop Spammers Security | Block Spam Users, Comments, Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2024.4. This is due to missing or incorrect nonce validation on the sfs_process AJAX action. …

    webguyio Stop Spammers Classic Web / CMS
  • Medium 5.4
    CVE-2024-3237

    ConvertPlug <= 3.5.25 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update

    The ConvertPlug plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cp_dismiss_notice() function in all versions up to, and including, 3.5.25. This makes it possible for authenticated attackers, wit…

    Brainstorm Force ConvertPlus Web / CMS
  • Medium 5.4
    CVE-2024-3868

    Folders Pro <= 3.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User First Name and Last Name

    The Folders Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's First Name and Last Name in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenti…

    Premio Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager Web / CMS
  • Medium 6.1
    CVE-2024-34468

    Rukovoditel before 3.5.3 allows XSS via user_photo to My Page.

  • Medium 5.3
    CVE-2024-34473

    An issue was discovered in appmgr in O-RAN Near-RT RIC I-Release. An attacker could register an unintended RMR message …

  • Medium 6.5
    CVE-2024-34460

    Zenario's Tree Explorer tool from Organizer affected by Cross-site Scripting

    The Tree Explorer tool from Organizer in Zenario before 9.5.60602 is affected by XSS. (This component was removed in 9.5.60602.)

    tribalsystems/zenario Packagist
  • Medium 6.1
    CVE-2024-34467

    ThinkPHP Cross-Site Scripting Vulnerability

    ThinkPHP 8.0.3 allows remote attackers to exploit XSS due to inadequate filtering of function argument values in think_exception.tpl.

    topthink/framework Packagist
  • Medium 5.3
    CVE-2024-34476

    Open5GS before 2.7.1 is vulnerable to a reachable assertion that can cause an AMF crash via NAS messages from a UE: ogs…

  • Medium 6.1
    CVE-2024-34462

    Alinto SOGo through 5.10.0 allows XSS during attachment preview.

    sogo sogo Debian Ubuntu