Skip to content
OpenAdvisories

Archive

21 May 2024

Vulnerabilities first published on this day (UTC), newest first.

← April 2024 2024 / May /21 June 2024 →
  1. 1253
  2. 2243
  3. 3847
  4. 417
  5. 537
  6. 6151
  7. 7186
  8. 8114
  9. 9227
  10. 10104
  11. 1128
  12. 1218
  13. 13138
  14. 14285
  15. 15242
  16. 16227
  17. 17335
  18. 1826
  19. 19101
  20. 20137
  21. 21445
  22. 22178
  23. 23142
  24. 24129
  25. 2512
  26. 2647
  27. 2782
  28. 28143
  29. 2967
  30. 30235
  31. 3176
All Critical High Medium Low Exploited only Public exploit

129 results · Clear filters · Feed

  • High 7.5
    CVE-2023-3940

    Multiple arbitrary file reads in ZkTeco-based OEM devices

    Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-…

    ZKTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
  • High 7.5
    CVE-2024-4988

    Improper permission control in com.transsion.videocallenhancer

    The mobile application (com.transsion.videocallenhancer) interface has improper permission control, which can lead to the risk of private file leakage.

    TECNO com.transsion.videocallenhancer
  • High 7.1
    CVE-2024-4566

    ShopLentor <= 2.8.8 - Missing Authorization to WordPress Option Modification

    The ShopLentor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_dismiss function in all versions up to, and including, 2.8.8. This makes it possible for authenticated attackers, with contrib…

    devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin Web / CMS
  • High 7.1
    CVE-2024-4290

    Sailthru Triggermail <= 1.1 - Admin+ Stored XSS

    The Sailthru Triggermail WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed…

    Web / CMS
  • High 7.5
    CVE-2024-35059

    NASA AIT-Core vulnerable to remote code execution

    An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands.

    ait-core PyPI
  • High 7.5
    CVE-2024-35057

    NASA AIT-Core vulnerable to remote code execution

    An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet.

    ait-core PyPI
  • High 7.3
    CVE-2024-35061

    NASA AIT-Core uses unencrypted channels to exchange data over the network

    NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. When chained with CVE-2024-35059, the CVE in subject leads to an unauthenticated, fully remote code ex…

    ait-core PyPI
  • High 7.5
    CVE-2024-35058

    NASA AIT-Core vulnerable to remote code execution

    An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string.

    ait-core PyPI
  • High 7.5
    CVE-2024-35060

    An issue in the YAML Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands via supplyin…