Skip to content
OpenAdvisories

Archive

6 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /6 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

151 results · Feed

  • Medium 6.5
    CVE-2024-2913

    Race Condition Vulnerability in mintplex-labs/anything-llm

    A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowi…

    Mintplex-Labs mintplex-labs/anything-llm
  • High 8.0
    CVE-2024-29941

    Credential Cloning

    Insecure storage of the ICT MIFARE and DESFire encryption keys in the firmware binary allows malicious actors to create credentials for any site code and card number that is using the default ICT encryption.

    Integrated Control Technology TSEC
  • Medium 5.7
    CVE-2024-1695

    A potential security vulnerability has been identified in the HP Application Enabling Software Driver for certain HP PC…

    HP HP Application Enabling Software Driver
  • Medium 5.9
    CVE-2024-34413

    WordPress SliceWP Affiliates plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SliceWP allows Stored XSS.This issue affects SliceWP: from n/a through 1.1.10.

    SliceWP SliceWP
  • Low 2.9
    CVE-2024-4568

    Stack overflow in Xpdf 4.05 due to object loop in PDF resources

    In Xpdf 4.05 (and earlier), a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow.

    Xpdf Xpdf ipe xpdf Ubuntu
  • Medium 4.3
    CVE-2024-33570

    WordPress MetForm plugin <= 3.8.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Roxnor Metform metform.This issue affects Metform: from n/a through <= 3.8.3.

    roxnor Metform
  • Medium 6.5
    CVE-2024-33576

    WordPress WPPizza plugin <= 3.18.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10.

    ollybach WPPizza
  • High 7.4
    CVE-2024-33602

    nscd: netgroup cache assumes NSS callback uses in-buffer strings

    nscd: netgroup cache assumes NSS callback uses in-buffer strings The Name Service Cache Daemon's (nscd) netgroup cache can corrupt memory when the NSS callback does not store all strings in the provided buffer. The flaw was introduced in glibc 2.15 when the c…

    The GNU C Library glibc glibc eglibc Debian Ubuntu Azure Linux Wolfi
  • High 7.3
    CVE-2024-33601

    nscd: netgroup cache may terminate daemon on memory allocation failure

    nscd: netgroup cache may terminate daemon on memory allocation failure The Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or xrealloc and these functions may terminate the process due to a memory allocation failure resulting in a denial of ser…

    The GNU C Library glibc glibc eglibc Debian Ubuntu Azure Linux Wolfi
  • Medium 5.9
    CVE-2024-33600

    nscd: Null pointer crashes after notfound response

    nscd: Null pointer crashes after notfound response If the Name Service Cache Daemon's (nscd) cache fails to add a not-found netgroup response to the cache, the client request can result in a null pointer dereference. This flaw was introduced in glibc 2.15 whe…

    The GNU C Library glibc glibc eglibc Debian Ubuntu Azure Linux Wolfi
  • High 8.1
    CVE-2024-33599

    nscd: Stack-based buffer overflow in netgroup cache

    nscd: Stack-based buffer overflow in netgroup cache If the Name Service Cache Daemon's (nscd) fixed size cache is exhausted by client requests then a subsequent client request for netgroup data may result in a stack-based buffer overflow. This flaw was introd…

    The GNU C Library glibc glibc eglibc Debian Ubuntu Azure Linux Wolfi
  • Medium 5.3
    CVE-2024-33907

    WordPress Print My Blog plugin <= 3.26.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Michael Nelson Print My Blog print-my-blog.This issue affects Print My Blog: from n/a through <= 3.26.2.

    Michael Nelson Print My Blog
  • Medium 5.3
    CVE-2024-33908

    WordPress WidgetKit plugin <= 2.5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themesgrove WidgetKit.This issue affects WidgetKit: from n/a through 2.5.0.

    Themesgrove WidgetKit
  • Medium 5.3
    CVE-2024-33910

    WordPress Digital Publications by Supsystic plugin <= 1.7.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Supsystic Digital Publications by Supsystic.This issue affects Digital Publications by Supsystic: from n/a through 1.7.7.

    supsystic Digital Publications by Supsystic
  • High 7.1
    CVE-2024-33912

    WordPress Academy LMS plugin <= 1.9.16 - Broken Access Control on Paid Courses vulnerability

    Missing Authorization vulnerability in Academy LMS.This issue affects Academy LMS: from n/a through 1.9.16.

    Academy LMS Academy LMS
  • Medium 4.3
    CVE-2024-34371

    WordPress Login with phone number plugin <= 1.7.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.7.18.

    Hamid Alinia Login with phone number
  • Medium 5.3
    CVE-2024-34372

    WordPress Post Grid Master plugin <= 3.4.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AddonMaster Post Grid Master.This issue affects Post Grid Master: from n/a through 3.4.7.

    AddonMaster Post Grid Master
  • Medium 4.3
    CVE-2024-34377

    WordPress Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery plugin <= 1.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery.This issue affects Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery: from n/a through 1.5.3.

    A WP Life Video Gallery – Api Gallery, YouTube and Vimeo, Link Gallery
  • High 8.6
    CVE-2024-34378

    WordPress LeadConnector plugin <= 1.7 - API Broken Access Control vulnerability

    Missing Authorization vulnerability in LeadConnector.This issue affects LeadConnector: from n/a through 1.7.

    LeadConnector LeadConnector
  • Medium 4.3
    CVE-2024-34387

    WordPress WP Post Author plugin <= 3.6.4 - Rating Value Manipulation vulnerability

    Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.

    AF themes WP Post Author
  • Medium 4.3
    CVE-2024-34389

    WordPress WP Post Author plugin <= 3.6.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AF themes WP Post Author.This issue affects WP Post Author: from n/a through 3.6.4.

    AF themes WP Post Author
  • Medium 5.9
    CVE-2024-34366

    WordPress AltText.ai plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AltText.Ai Download Alt Text AI allows Stored XSS.This issue affects Download Alt Text AI: from n/a through 1.3.4.

    AltText.ai Download Alt Text AI
  • High 7.1
    CVE-2024-34369

    WordPress Web Push Notifications – Webpushr plugin <= 4.35.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webpushr Web Push Notifications Webpushr allows Reflected XSS.This issue affects Webpushr: from n/a through 4.35.0.

    Webpushr Web Push Notifications Webpushr
  • High 7.6
    CVE-2024-3661 Public exploit

    DHCP routing options can manipulate interface-based VPN traffic

    DHCP can add routes to a client’s routing table via the classless static route option (121). VPN-based security solutions that rely on routes to redirect traffic can be forced to leak traffic over the physical interface. An attacker on the same local network …

    IETF DHCP openvpn libreswan Ubuntu
  • Medium 6.5
    CVE-2024-34373

    WordPress The Plus Addons for Elementor plugin <= 5.4.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder.This issue affects The Plus Addons for Elementor Page Bui…

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • Medium 6.5
    CVE-2024-34374

    WordPress ElementsReady Addons for Elementor plugin <= 5.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuomodoSoft ElementsReady Addons for Elementor allows Stored XSS.This issue affects ElementsReady Addons for Elementor: from n/a through 5.8.0.

    quomodosoft ElementsReady Addons for Elementor
  • Medium 5.9
    CVE-2024-34375

    WordPress Sheets to WP Table Live Sync plugin <= 3.7.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPPOOL Sheets To WP Table Live Sync allows Stored XSS.This issue affects Sheets To WP Table Live Sync: from n/a through 3.7.0.

    WPPOOL Sheets To WP Table Live Sync
  • Medium 6.5
    CVE-2024-34376

    WordPress Edge theme <= 2.0.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme Freesia Edge allows Stored XSS.This issue affects Edge: from n/a through 2.0.9.

    Theme Freesia Edge Browsers
  • Medium 5.9
    CVE-2024-34380

    WordPress ChatBot Conversational Forms plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through 1.2.0.

    Quantum Cloud Conversational Forms for ChatBot
  • Medium 6.5
    CVE-2024-34381

    WordPress PropertyHive plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PropertyHive allows Stored XSS.This issue affects PropertyHive: from n/a through 2.0.10.

    Property Hive PropertyHive
  • Medium 6.5
    CVE-2024-34390

    WordPress Post Grid Master plugin <= 3.4.8 - Auth. Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AddonMaster Post Grid Master allows Stored XSS.This issue affects Post Grid Master: from n/a through 3.4.8.

    AddonMaster Post Grid Master
  • Medium 4.3
    CVE-2024-34379

    WordPress Restaurant and Cafe theme <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rara Theme Restaurant and Cafe.This issue affects Restaurant and Cafe: from n/a through 1.2.1.

    Rara Theme Restaurant and Cafe
  • High 7.1
    CVE-2024-34367

    WordPress Popup Box plugin <= 4.1.2 - CSRF to XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Popup Box Team Popup box allows Cross-Site Scripting (XSS).This issue affects Popup box: from n/a through 4.1.2.

    Popup Box Team Popup box
  • High 7.6
    CVE-2024-34386

    WordPress Auto Affiliate Links plugin <= 6.4.3.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Lucian Apostol Auto Affiliate Links.This issue affects Auto Affiliate Links: from n/a through 6.4.3.1.

    Lucian Apostol Auto Affiliate Links
  • High 8.5
    CVE-2024-34412

    WordPress ParcelPanel plugin <= 3.8.1 - Auth. SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Parcel Panel ParcelPanel.This issue affects ParcelPanel: from n/a through 3.8.1.

    Parcel Panel ParcelPanel
  • Medium 5.3
    CVE-2024-34368

    WordPress Mooberry Book Manager plugin <= 4.15.12 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Mooberry Dreams Mooberry Book Manager.This issue affects Mooberry Book Manager: from n/a through 4.15.12.

    Mooberry Dreams Mooberry Book Manager
  • Medium 5.3
    CVE-2024-34382

    WordPress Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.18 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in RoboSoft Robo Gallery.This issue affects Robo Gallery: from n/a through 3.2.18.

    Robosoft Robo Gallery
  • Medium 5.3
    CVE-2024-34383

    WordPress SEOPress plugin <= 7.7.1 - Sensitive Data Exposure vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in The SEO Guys at SEOPress SEOPress.This issue affects SEOPress: from n/a through 7.7.1.

    The SEO Guys at SEOPress SEOPress
  • High 7.5
    CVE-2024-34388

    WordPress GDPR Compliance plugin <= 1.2.5 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Scribit GDPR Compliance.This issue affects GDPR Compliance: from n/a through 1.2.5.

    Scribit GDPR Compliance
  • High 8.5
    CVE-2024-32807

    WordPress Brevo for WooCommerce plugin <= 4.0.17 - Arbitrary File Download and Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brevo Sendinblue for WooCommerce allows Relative Path Traversal, Manipulating Web Input to File System Calls.This issue affects Sendinblue for WooCommerce: from n/…

    Brevo Sendinblue for WooCommerce Web / CMS