Skip to content
OpenAdvisories

Archive

20 June 2024

Vulnerabilities first published on this day (UTC), newest first.

← May 2024 2024 / June /20 July 2024 →
  1. 121
  2. 210
  3. 3117
  4. 4187
  5. 5116
  6. 6179
  7. 7136
  8. 878
  9. 9107
  10. 10149
  11. 11227
  12. 12113
  13. 13321
  14. 14156
  15. 1530
  16. 1626
  17. 1775
  18. 1865
  19. 19223
  20. 20159
  21. 21137
  22. 2222
  23. 239
  24. 2497
  25. 25144
  26. 2682
  27. 27111
  28. 2880
  29. 2916
  30. 3021
All Critical High Medium Low Exploited only Public exploit

59 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-5213

    Exposure of Sensitive Information in mintplex-labs/anything-llm

    In mintplex-labs/anything-llm versions up to and including 1.5.3, an issue was discovered where the password hash of a user is returned in the response after login (`POST /api/request-token`) and after account creations (`POST /api/admin/users/new`). This exp…

    Mintplex-Labs mintplex-labs/anything-llm
  • Medium 6.4
    CVE-2024-1168

    SEOPress – On-site SEO <= 7.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Social Image URL

    The SEOPress – On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's social image URL in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping on user supplied image URLs. Th…

    rainbowgeek SEOPress – On-site SEO & Analytics Web / CMS
  • Medium 6.5
    CVE-2023-3204

    Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update

    The Materialis theme for WordPress is vulnerable to limited arbitrary options updates in versions up to, and including, 1.1.24. This is due to missing authorization checks on the companion_disable_popup() function called via an AJAX action. This makes it poss…

    Extend Themes Materialis Web / CMS
  • Medium 6.4
    CVE-2024-3558

    Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via cfs[post_title]

    The Custom Field Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the 'cfs[post_title]' parameter versions up to, and including, 2.6.7 due to insufficient input sanitization and output escaping. This makes it possible for authen…

    mgibbs189 Custom Field Suite Web / CMS
  • Medium 6.4
    CVE-2024-4626

    JetWidgets For Elementor <= 1.0.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via layout_type and id Parameters

    The JetWidgets For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘layout_type’ and 'id' parameters in all versions up to, and including, 1.0.17 due to insufficient input sanitization and output escaping. This makes it pos…

    jetmonsters JetWidgets For Elementor Web / CMS
  • Medium 6.5
    CVE-2024-4742

    Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.2.5 - Authenticated (Contributor+) SQL Injection

    The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to SQL Injection via the order_by shortcode attribute in all versions up to, and including, 1.2.5 due to insufficient escapin…

    Youzify Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress Web / CMS
  • Medium 4.3
    CVE-2024-3602

    Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer <= 1.1.0 - Missing Authorization

    The Pop ups, Exit intent popups, email popups, banners, bars, countdowns and cart savers – Promolayer plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the disconnect_promolayer function in all vers…

    promolayerpopupbuilder Promolayer – Popup Builder & Abandonment Preventer Web / CMS
  • Medium 5.4
    CVE-2024-3627

    Wheel of Life: Coaching and Assessment Tool for Life Coach <= 1.1.7 - Missing Authorization on Several AJAX Endpoints

    The Wheel of Life: Coaching and Assessment Tool for Life Coach plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on several functions in the AjaxFunctions.php file in all versions up to, and inc…

    Kraft Plugins Wheel of Life: Coaching and Assessment Tool for Life Coach Web / CMS
  • Medium 4.8
    CVE-2024-6179

    XSS vulnerability in LG SuperSign CMS

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

    LG Electronics SuperSign CMS
  • Medium 4.8
    CVE-2024-6178

    XSS vulnerability in LG SuperSign CMS

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

    LG Electronics SuperSign CMS
  • Medium 4.8
    CVE-2024-6177

    XSS vulnerability in LG SuperSign CMS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in LG Electronics SuperSign CMS allows Reflected XSS. This issue affects SuperSign CMS: from 4.1.3 before < 4.3.1.

    LG Electronics SuperSign CMS
  • Medium 4.8
    CVE-2024-6176

    Port scanning vulnerability in LG SuperSign CMS

    Allocation of Resources Without Limits or Throttling vulnerability in LG Electronics LG SuperSign CMS allows Port Scanning.This issue affects LG SuperSign CMS: from 4.1.3 before < 4.3.1.

    LG Electronics LG SuperSign CMS
  • Medium 6.5
    CVE-2022-41324

    Northern.tech Mender 3.3.x before 3.3.2 and 3.4.x before 3.4.0 has Incorrect Access Control and allows low-privileged u…

  • Medium 6.3
    CVE-2024-33335

    SQL Injection vulnerability in H3C technology company SeaSQL DWS V2.0 allows a remote attacker to execute arbitrary cod…

  • Medium 5.3
    CVE-2024-28397 Public exploit Scanner template

    js2py allows remote code execution

    An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.

    kubeflow-pipelines-visualization-server js2py python-cloudscraper Ubuntu Wolfi PyPI
  • Medium 6.3
    CVE-2024-36071

    Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files …

  • Medium 6.1
    CVE-2024-31586

    A Cross Site Scripting (XSS) vulnerability exists in Computer Laboratory Management System version 1.0. This vulnerabil…

  • Medium 6.1
    CVE-2024-30848

    Cross-site scripting (XSS) vulnerability in SilverSky E-mail service version 5.0.3126 allows remote attackers to inject…

  • Medium 5.5
    CVE-2024-37674

    Cross Site Scripting vulnerability in Moodle CMS v3.10 allows a remote attacker to execute arbitrary code via the Field…

    moodle Ubuntu