Skip to content
OpenAdvisories

Archive

6 June 2024

Vulnerabilities first published on this day (UTC), newest first.

← May 2024 2024 / June /6 July 2024 →
  1. 121
  2. 210
  3. 3117
  4. 4187
  5. 5116
  6. 6179
  7. 7136
  8. 878
  9. 9107
  10. 10149
  11. 11227
  12. 12113
  13. 13321
  14. 14156
  15. 1530
  16. 1626
  17. 1775
  18. 1865
  19. 19223
  20. 20159
  21. 21137
  22. 2222
  23. 239
  24. 2497
  25. 25144
  26. 2682
  27. 27111
  28. 2880
  29. 2916
  30. 3021
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 8.0
    CVE-2024-36774 Public exploit

    An arbitrary file upload vulnerability in Monstra CMS v3.0.4 allows attackers to execute arbitrary code via uploading a…

  • High 7.5
    CVE-2024-36823 Public exploit

    Weak encryption in Ninja Core

    The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitive information.

    org.ninjaframework:ninja-core Maven
  • Critical 9.8
    CVE-2024-3408 Public exploit Scanner template EPSS 78%

    Authentication Bypass and RCE in man-group/dtale

    man-group/dtale version 3.10.0 is vulnerable to an authentication bypass and remote code execution (RCE) due to improper input validation. The vulnerability arises from a hardcoded `SECRET_KEY` in the flask configuration, allowing attackers to forge a session…

    man-group man-group/dtale dtale PyPI
  • High 7.5
    CVE-2024-5124 Public exploit

    Timing Attack Vulnerability in gaizhenbiao/chuanhuchatgpt

    A timing attack vulnerability exists in the gaizhenbiao/chuanhuchatgpt repository, specifically within the password comparison logic. The vulnerability is present in version 20240310 of the software, where passwords are compared using the '=' operator in Pyth…

    gaizhenbiao gaizhenbiao/chuanhuchatgpt
  • High 7.5
    CVE-2024-2928 Public exploit Scanner template EPSS 22%

    Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflow

    A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerability arises from the application's failure to properly validate URI fragments for directory traversal s…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.8
    CVE-2024-4320 Public exploit EPSS 34%

    Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui

    A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of …

    parisneo parisneo/lollms-webui
  • Critical 10.0
    CVE-2024-0520 Public exploit

    Remote Code Execution due to Full Controlled File Write in mlflow/mlflow

    A vulnerability in mlflow/mlflow version 8.2.1 allows for remote code execution due to improper neutralization of special elements used in an OS command ('Command Injection') within the `mlflow.data.http_dataset_source.py` module. Specifically, when loading a…

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.8
    CVE-2024-5452 Public exploit EPSS 27%

    RCE via Property/Class Pollution in lightning-ai/pytorch-lightning

    A remote code execution (RCE) vulnerability exists in the lightning-ai/pytorch-lightning library version 2.2.1 due to improper handling of deserialized user input and mismanagement of dunder attributes by the `deepdiff` library. The library uses `deepdiff.Del…

    Lightning-AI lightning-ai/pytorch-lightning lightning pytorch-lightning PyPI
  • Critical 9.8
    CVE-2024-34832 Public exploit

    Directory Traversal vulnerability in CubeCart v.6.5.5 and before allows an attacker to execute arbitrary code via a cra…

  • Critical 9.8
    CVE-2024-36779 Public exploit

    Sourcecodester Stock Management System v1.0 is vulnerable to SQL Injection via editCategories.php.

  • High 8.6
    CVE-2024-28995 Exploited Public exploit Scanner template EPSS 100%

    SolarWinds Serv-U L Directory Transversal Vulnerability

    SolarWinds Serv-U was susceptible to a directory transversal vulnerability that would allow access to read sensitive files on the host machine.

    SolarWinds SolarWinds Serv-U
    KEV Jul 17, 2024
  • Critical 9.1
    CVE-2024-5153 Public exploit

    Startklar Elementor Addons <= 1.7.15 - Unauthenticated Path Traversal to Arbitrary Directory Deletion

    The Startklar Elementor Addons plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.15 via the 'dropzone_hash' parameter. This makes it possible for unauthenticated attackers to copy the contents of arbitrary fil…

    wshberlin Startklar Elementor Addons Web / CMS
  • High 8.8
    CVE-2024-5324 Public exploit

    XootiX Framework <= Various Plugin Versions - Missing Authorization to Arbitrary Options Update

    Multiple plugins for WordPress utilizing the XootiX Framework are vulnerable to unauthorized modification of data due to a missing capability check on the 'import_settings' function in various versions. This makes it possible for authenticated attackers, with…

    xootix Waitlist Woocommerce ( Back in stock notifier ) OTP Login & Register Woocommerce Login & Register Customizer – Popup | Slider | Inline | WooCommerce Web / CMS