Skip to content
OpenAdvisories

Archive

13 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /13 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

21 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-27810

    A path handling issue was addressed with improved validation. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Mo…

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • Critical 9.8
    CVE-2024-27841

    The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14…

    Apple macOS iOS and iPadOS macOS iOS
  • Critical 9.8
    CVE-2024-31810

    TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a hardcoded password for root at /etc/shadow.sample.

  • Critical 9.8
    CVE-2024-35099

    TOTOLINK LR350 V9.3.5u.6698_B20230810 was discovered to contain a stack overflow via the password parameter in the func…

  • Critical 9.8
    CVE-2024-28285

    A Fault Injection vulnerability in the SymmetricDecrypt function in cryptopp/elgamal.h of Cryptopp Crypto++ 8.9, allows…

    libcrypto++ libcrypto++ Debian Ubuntu
  • Critical 9.4
    CVE-2024-34226 Public exploit

    SQL injection vulnerability in /php-sqlite-vms/?page=manage_visitor&id=1 in SourceCodester Visitor Management System 1.…

  • Critical 9.8
    CVE-2024-34706

    @valtimo/components exposes access token to form.io

    Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token (JWT) of the user is exposed to `api.form.io` via the the `x-jwt-token` header. An attacker can retrieve personal information from this t…

    valtimo-platform valtimo-frontend-libraries @valtimo/components npm
  • Critical 9.1
    CVE-2024-34340

    Authentication Bypass when using using older password hashes

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, Cacti calls `compat_password_hash` when users set their password. `compat_password_hash` use `password_hash` if there is it, else use `md5`. When verifying passw…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Critical 10.0
    CVE-2024-29895 Public exploit Scanner template EPSS 99%

    Cacti command injection in cmd_realtime.php

    Cacti provides an operational monitoring and fault management framework. A command injection vulnerability on the 1.3.x DEV branch allows any unauthenticated user to execute arbitrary command on the server when `register_argc_argv` option of PHP is `On`. In `…

    Cacti cacti cacti Ubuntu
  • Critical 9.1
    CVE-2024-25641 Public exploit EPSS 86%

    Cacti RCE vulnerability when importing packages

    Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable through the "Package Import" feature, allows authenticated users having the "Import Templates" permission to e…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Critical 9.1
    CVE-2024-35049

    SurveyKing v1.3.1 was discovered to keep users' sessions active after logout. Related to an incomplete fix for CVE-2022…

  • Critical 9.8
    CVE-2024-4824

    SQL Injection in School ERP Pro+Responsive by AROX SOLUTION

    Vulnerability in School ERP Pro+Responsive 1.0 that allows SQL injection through the '/SchoolERP/office_admin/' index in the parameters groups_id, examname, classes_id, es_voucherid, es_class, etc. This vulnerability could allow a remote attacker to send a sp…

    AROX SOLUTION School ERP Pro+Responsive
  • Critical 9.8
    CVE-2024-4825

    Unrestricted Upload of File with Dangerous Type vulnerability on Cockpit CMS from Agentejo

    A vulnerability has been discovered in Agentejo Cockpit CMS v0.5.5 that consists in an arbitrary file upload in ‘/media/api’ parameter via post request. An attacker could upload files to the server, compromising the entire infrastructure.

    agentejo Cockpit CMS cockpit-hq/cockpit Packagist
  • Critical 9.8
    CVE-2024-3263

    Improper authentication in YMS VIS Pro

    YMS VIS Pro is an information system for veterinary and food administration, veterinarians and farm. Due to a combination of improper method for system credentials generation and weak password policy, passwords can be easily guessed and enumerated through bru…

    YMS VIS Pro
  • Critical 10.0
    CVE-2024-31377

    WordPress WP Photo Album Plus plugin <= 8.7.01.001 - Unauth. Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus.This issue affects WP Photo Album Plus: from n/a through 8.7.01.001.

    J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
  • Critical 9.9
    CVE-2024-34411

    WordPress canvasio3D Light plugin <= 2.5.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Thomas Scholl canvasio3D Light.This issue affects canvasio3D Light: from n/a through 2.5.0.

    Thomas Scholl canvasio3D Light
  • Critical 9.1
    CVE-2024-34416

    WordPress Pk Favicon Manager plugin <= 2.1 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Pk Favicon Manager.This issue affects Pk Favicon Manager: from n/a through 2.1.

  • Critical 9.1
    CVE-2024-34440

    WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.2.63.

    Jordy Meow AI Engine: ChatGPT Chatbot
  • Critical 9.1
    CVE-2024-34555

    WordPress Z-Downloads plugin <= 1.11.3 - Auth. Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in URBAN BASE Z-Downloads.This issue affects Z-Downloads: from n/a through 1.11.3.

    URBAN BASE Z-Downloads
  • Critical 10.0
    CVE-2024-32700 Public exploit

    WordPress Kognetiks Chatbot for WordPress plugin <= 2.0.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Kognetiks Kognetiks Chatbot for WordPress.This issue affects Kognetiks Chatbot for WordPress: from n/a through 2.0.0.

    kognetiks Kognetiks Chatbot for WordPress Web / CMS
  • Critical 9.9
    CVE-2024-29212

    Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication betwe…

    Veeam Service Provider Console