Skip to content
OpenAdvisories

Archive

13 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /13 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

138 results · Feed

  • Critical 9.1
    CVE-2024-34416

    WordPress Pk Favicon Manager plugin <= 2.1 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Pk Favicon Manager.This issue affects Pk Favicon Manager: from n/a through 2.1.

  • Critical 9.1
    CVE-2024-34440

    WordPress AI Engine plugin <= 2.2.63 - Auth. Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 2.2.63.

    Jordy Meow AI Engine: ChatGPT Chatbot
  • Critical 9.1
    CVE-2024-34555

    WordPress Z-Downloads plugin <= 1.11.3 - Auth. Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in URBAN BASE Z-Downloads.This issue affects Z-Downloads: from n/a through 1.11.3.

    URBAN BASE Z-Downloads
  • Medium 4.4
    CVE-2024-35172

    WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.

    ShortPixel ShortPixel Adaptive Images
  • Medium 5.9
    CVE-2024-34811

    WordPress WP SMS plugin <= 6.5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VeronaLabs WP SMS allows Stored XSS.This issue affects WP SMS: from n/a through 6.5.1.

    VeronaLabs WP SMS
  • Medium 5.4
    CVE-2024-3462

    Authorization bypass in Ant Media Server

    Ant Media Server Community Edition in a default configuration is vulnerable to an improper HTTP header based authorization, leading to a possible use of non-administrative API calls reserved only for authorized users.  All versions up to 2.9.0 (tested) and po…

    Ant Media Ant Media Server Community Edition io.antmedia:ant-media-server Maven
  • Medium 6.1
    CVE-2024-34749

    Phormer prior to version 3.35 contains a cross-site scripting vulnerability. If this vulnerability is exploited, a remo…

    Aidin Phormer
  • Critical 10.0
    CVE-2024-32700 Public exploit

    WordPress Kognetiks Chatbot for WordPress plugin <= 2.0.0 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Kognetiks Kognetiks Chatbot for WordPress.This issue affects Kognetiks Chatbot for WordPress: from n/a through 2.0.0.

    kognetiks Kognetiks Chatbot for WordPress Web / CMS
  • Medium 6.3
    CVE-2023-5052

    Cross Site Scripting (XSS) in Servidor Uniforme Zero

    vulnerability in Uniform Server Zero, version 10.2.5, consisting of an XSS through the /us_extra/phpinfo.php page. This vulnerability could allow a remote user to send a specially crafted query to an authenticated user and partially take over their session de…

    Uniform Server Zero Uniform Server Zero
  • Medium 5.4
    CVE-2024-3239

    PostX < 4.0.2 - Contributor+ Stored XSS

    The Post Grid Gutenberg Blocks and WordPress Blog Plugin WordPress plugin before 4.0.2 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor rol…

    Web / CMS
  • Medium 6.5
    CVE-2023-43040 Public exploit

    IBM Spectrum Fusion HCI improper access control

    IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

    IBM Spectrum Fusion HCI ceph ceph Debian Ubuntu Azure Linux
  • Critical 9.9
    CVE-2024-29212

    Due to an unsafe de-serialization method used by the Veeam Service Provider Console(VSPC) server in communication betwe…

    Veeam Service Provider Console
  • High 7.8
    CVE-2024-35205 Public exploit

    The WPS Office (aka cn.wps.moffice_eng) application before 17.0.0 for Android fails to properly sanitize file names bef…

  • Medium 6.3
    CVE-2024-4809

    SourceCodester Open Source Clinic Management System setting.php unrestricted upload

    A vulnerability has been found in SourceCodester Open Source Clinic Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file setting.php. The manipulation of the argument logo leads to unrestrict…

    SourceCodester Open Source Clinic Management System
  • Medium 6.3
    CVE-2024-4808

    Kashipara College Management System delete_faculty.php sql injection

    A vulnerability, which was classified as critical, was found in Kashipara College Management System 1.0. Affected is an unknown function of the file delete_faculty.php. The manipulation of the argument id leads to sql injection. It is possible to launch the a…

    Kashipara College Management System
  • High 7.5
    CVE-2024-34459

    An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages wit…

    libxml2 libxml2 libxml2 libxml2 Debian Ubuntu Azure Linux Alpine
  • High 8.4
    CVE-2024-35204

    Veritas System Recovery before 23.3_Hotfix has incorrect permissions for the Veritas System Recovery folder, and thus l…

  • Medium 5.9
    CVE-2024-26306

    iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side chann…

    iperf3 iperf3 iperf3 Debian Ubuntu Azure Linux