Skip to content
OpenAdvisories

Archive

9 June 2024

Vulnerabilities first published on this day (UTC), newest first.

← May 2024 2024 / June /9 July 2024 →
  1. 121
  2. 210
  3. 3117
  4. 4187
  5. 5116
  6. 6179
  7. 7136
  8. 878
  9. 9107
  10. 10149
  11. 11227
  12. 12113
  13. 13321
  14. 14156
  15. 1530
  16. 1626
  17. 1775
  18. 1865
  19. 19223
  20. 20159
  21. 21137
  22. 2222
  23. 239
  24. 2497
  25. 25144
  26. 2682
  27. 27111
  28. 2880
  29. 2916
  30. 3021
All Critical High Medium Low Exploited only Public exploit

26 results · Clear filters · Feed

  • High 7.7
    CVE-2024-5585 EPSS 29%

    Command injection via array-ish $command parameter of proc_open() (bypass CVE-2024-1874 fix)

    In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping,…

    PHP Group PHP php php83 Azure Linux Alpine Wolfi
  • High 8.2
    CVE-2024-31275

    WordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerability

    Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.4.

    Metagauss EventPrime
  • High 7.5
    CVE-2024-31283

    WordPress Advanced Local Pickup for WooCommerce plugin <=1.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.6.2.

    zorem Advanced Local Pickup for WooCommerce Web / CMS
  • High 7.1
    CVE-2024-31304

    WordPress MultiVendorX Marketplace <= 4.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MultiVendorX WC Marketplace.This issue affects WC Marketplace: from n/a through 4.1.3.

    MultiVendorX WC Marketplace
  • High 7.7
    CVE-2024-32703

    WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

    Repute InfoSystems ARForms
  • High 7.1
    CVE-2024-32704

    WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary WordPress Options Removal vulnerability

    Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

    Repute InfoSystems ARForms
  • High 7.1
    CVE-2024-32705

    WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary Plugin Activation/Deactivation Vulnerability

    Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

    Repute InfoSystems ARForms
  • High 7.5
    CVE-2024-32715

    WordPress Olive One Click Demo Import plugin <= 1.1.1 - Arbitrary File Download vulnerability

    Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.

    Olive Themes Olive One Click Demo Import
  • High 7.5
    CVE-2024-32777

    WordPress BizPrint plugin <= 4.3.39 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint.This issue affects BizPrint: from n/a through 4.3.39.

    BizSwoop a CPF Concepts, LLC Brand BizPrint
  • High 8.5
    CVE-2024-32778

    WordPress Contest Gallery plugin <= 21.3.4 - Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery.This issue affects Contest Gallery: from n/a through <= 21.3.4.

    Wasiliy Strecker / ContestGallery developer Contest Gallery
  • High 7.5
    CVE-2024-32798

    WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability

    Missing Authorization vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.8.0.

    WP Travel Engine WP Travel Engine
  • High 7.5
    CVE-2024-33543

    WordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.06.

    codepeople WP Time Slots Booking Form
  • High 8.3
    CVE-2024-33547

    WordPress WZone plugin <= 14.0.10 - Site Wide Broken Access Control vulnerability

    Missing Authorization vulnerability in AA-Team WZone.This issue affects WZone: from n/a through 14.0.10.

    AA-Team WZone
  • High 8.1
    CVE-2024-33555

    WordPress XStore Core plugin <= 5.3.8 - Multiple Authenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.

    8theme XStore Core
  • High 7.5
    CVE-2024-33561

    WordPress XStore theme <= 9.3.8 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

    8theme XStore
  • High 7.6
    CVE-2024-33563

    WordPress XStore theme <= 9.3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

    8theme XStore
  • High 8.8
    CVE-2024-33564

    WordPress XStore theme <= 9.3.8 - Arbitrary Option Update vulnerability

    Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.

    8theme XStore
  • High 7.5
    CVE-2024-31243

    WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Setting Deletion vulnerability

    Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.

    Bricksforge Bricksforge
  • High 8.8
    CVE-2024-30485 Public exploit

    WordPress Finale Lite plugin <= 2.18.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

    Missing Authorization vulnerability in XLPlugins Finale Lite.This issue affects Finale Lite: from n/a through 2.18.0.

    XLPlugins Finale Lite
  • High 8.8
    CVE-2024-25092 Public exploit

    WordPress NextMove Lite plugin <= 2.17.0 - Subscriber+ Arbitrary Plugin Installation/Activation vulnerability

    Missing Authorization vulnerability in XLPlugins NextMove Lite.This issue affects NextMove Lite: from n/a through 2.17.0.

    XLPlugins NextMove Lite
  • High 8.3
    CVE-2023-31080

    WordPress Unlimited Elements For Elementor plugin <= 1.5.65 - Multiple Broken Access Control vulnerability

    Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates).This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 1.5.65.

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
  • High 7.1
    CVE-2024-31098

    WordPress New Order Notification for Woocommerce plugin <= 2.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mr.Ebabi New Order Notification for Woocommerce.This issue affects New Order Notification for Woocommerce: from n/a through 2.0.2.

    Mr.Ebabi New Order Notification for Woocommerce Web / CMS
  • High 7.3
    CVE-2024-5774

    SourceCodester Stock Management System Login index.php sql injection

    A vulnerability has been found in SourceCodester Stock Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file index.php of the component Login. The manipulation of the argument username/passwor…

    SourceCodester Stock Management System
  • High 8.8
    CVE-2024-37570

    On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the us…

  • High 7.5
    CVE-2024-37568

    Authlib has algorithm confusion with asymmetric public keys

    lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys. Unless an algorithm is specified in a jwt.decode call, HMAC verification is allowed with any asymmetric public key. (This is similar to CVE-2022-29217 and CVE-2024-33663.)

    python-authlib python-authlib authlib Debian Ubuntu PyPI
  • High 8.3
    CVE-2024-37569

    An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnera…