Skip to content
OpenAdvisories

Archive

8 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /8 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

23 results · Clear filters · Feed

  • Critical 9.1
    CVE-2024-26517

    SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a…

  • Critical 9.8
    CVE-2024-27280

    StringIO buffer overread vulnerability

    A buffer-overread issue was discovered in StringIO 3.0.1, as distributed in Ruby 3.0.x through 3.0.6 and 3.1.x through 3.1.4. The ungetbyte and ungetc methods on a StringIO can read past the end of a string, and a subsequent call to StringIO.gets may return t…

    ruby2.3 ruby ruby2.5 ruby2.7 Debian Ubuntu Alpine Wolfi RubyGems
  • Critical 9.8
    CVE-2024-26579

    Apache Inlong JDBC Vulnerability

    Deserialization of Untrusted Data vulnerability in Apache InLong.This issue affects Apache InLong: from 1.7.0 through 1.11.0,  the attackers can bypass using malicious parameters. Users are advised to upgrade to Apache InLong's 1.12.0 or cherry-pick [1], [2] …

    Apache Software Foundation Apache InLong org.apache.inlong:manager-pojo Maven
  • Critical 9.1
    CVE-2024-32113 Exploited Public exploit Scanner template EPSS 100%

    Apache OFBiz: Path traversal leading to RCE

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue.

    Apache Software Foundation Apache OFBiz
    KEV Aug 7, 2024
  • Critical 9.1
    CVE-2024-32980

    Spin contains a potential network sandbox escape for specifically configured Spin applications

    Spin is the developer tool for building and running serverless applications powered by WebAssembly. Prior to 2.4.3, some specifically configured Spin applications that use `self` requests without a specified URL authority can be induced to make requests to ar…

    fermyon spin spin-sdk crates.io
  • Critical 9.8
    CVE-2024-4393

    Social Connect <= 1.2 - Authentication Bypass

    The Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.2. This is due to insufficient verification on the OpenID server being supplied during the social login through the plugin. This makes it possib…

    thenbrent Social Connect Web / CMS
  • Critical 9.8
    CVE-2024-34257 Scanner template

    TOTOLINK EX1800T V9.1.0cu.2112_B20220316 has a vulnerability in the apcliEncrypType parameter that allows unauthorized …

  • Critical 9.8
    CVE-2024-31961

    A SQL injection vulnerability in unit.php in Sonic Shopfloor.guide before 3.1.3 allows remote attackers to execute arbi…

  • Critical 9.4
    CVE-2024-25518

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the template_id parameter at /Wor…

  • Critical 9.4
    CVE-2024-25527

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /PersonalAffa…

  • Critical 9.8
    CVE-2024-25517

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the tbTable argument at /WebUtili…

  • Critical 9.8
    CVE-2024-25531

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtili…

  • Critical 9.4
    CVE-2024-25533

    Error messages in RuvarOA v6.01 and v12.01 were discovered to leak the physical path of the website (/WorkFlow/OfficeFi…

  • Critical 9.8
    CVE-2024-25529

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /WorkFlow/wf_…

  • Critical 9.8
    CVE-2024-25519

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the idlist parameter at /WorkFlow…

  • Critical 9.8
    CVE-2024-25525

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the filename parameter at /WorkFl…

  • Critical 9.8
    CVE-2024-25530

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the PageID parameter at /WebUtili…

  • Critical 9.4
    CVE-2024-25522

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the office_missive_id parameter a…

  • Critical 9.4
    CVE-2024-25524

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the sys_file_storage_id parameter…

  • Critical 9.8
    CVE-2024-25520

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the id parameter at /SysManage/sy…

  • Critical 9.8
    CVE-2024-25523

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the file_id parameter at /fileman…

  • Critical 9.4
    CVE-2024-25521

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the txt_keyword parameter at get_…

  • Critical 9.8
    CVE-2024-25532

    RuvarOA v6.01 and v12.01 were discovered to contain a SQL injection vulnerability via the bt_id parameter at /include/g…