Skip to content
OpenAdvisories

Archive

25 June 2024

Vulnerabilities first published on this day (UTC), newest first.

← May 2024 2024 / June /25 July 2024 →
  1. 121
  2. 210
  3. 3117
  4. 4187
  5. 5116
  6. 6179
  7. 7136
  8. 878
  9. 9107
  10. 10149
  11. 11227
  12. 12113
  13. 13321
  14. 14156
  15. 1530
  16. 1626
  17. 1775
  18. 1865
  19. 19223
  20. 20159
  21. 21137
  22. 2222
  23. 239
  24. 2497
  25. 25144
  26. 2682
  27. 27111
  28. 2880
  29. 2916
  30. 3021
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • None 0.0
    CVE-2024-38526 Public exploit

    pdoc embeds link to malicious CDN if math mode is enabled

    pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code. This issue has been fixed in pdoc 14.5.1.

    mitmproxy pdoc pdoc PyPI
  • High 8.4
    CVE-2024-5009 Public exploit EPSS 17%

    WhatsUp Gold SetAdminPassword Improper Access Control Privilege Escalation Vulnerability

    In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password.

    Progress Software WhatsUp Gold
  • Critical 9.8
    CVE-2024-4885 Exploited Public exploit Scanner template EPSS 99%

    WhatsUp Gold GetFileWithoutZip Directory Traversal Remote Code Execution Vulnerability

    In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

    Progress Software WhatsUp Gold
    KEV Mar 3, 2025
  • Critical 9.8
    CVE-2024-4883 Public exploit EPSS 65%

    WhatsUp Gold WriteDataFile Directory Traversal Remote Code Execution Vulnerability

    In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.

    Progress Software WhatsUp Gold
  • Critical 9.8
    CVE-2024-5276 Public exploit Scanner template EPSS 90%

    SQL Injection Vulnerability in FileCatalyst Workflow 5.1.6 Build 135 (and earlier)

    A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.  Likely impacts include creation of administrative users and deletion or modification of data in the application database. Data exfiltration via SQL i…

    Fortra FileCatalyst Workflow
  • Critical 9.1
    CVE-2024-5806 Public exploit EPSS 81%

    MOVEit Transfer Authentication Bypass Vulnerability

    Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.

    Progress Software MOVEit Transfer
  • Medium 6.8
    CVE-2024-37085 Exploited · Ransomware Public exploit EPSS 27%

    VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) pe…

    Virtualization
    KEV Jul 30, 2024
  • Critical 9.8
    CVE-2024-6028 Public exploit Scanner template EPSS 12%

    Quiz Maker <= 6.5.8.3 - Unauthenticated SQL Injection via 'ays_questions' Parameter

    The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…

    Ays Pro Quiz Maker Web / CMS
  • Critical 10.0
    CVE-2024-6297 Public exploit

    Several WordPress.org Plugins <= Various Versions - Injected Backdoor

    Several plugins for WordPress hosted on WordPress.org have been compromised and injected with malicious PHP scripts. A malicious threat actor compromised the source code of various plugins and injected code that exfiltrates database credentials and is used to…

    ThemeREX Warfare Plugins stuartobrien pedrogusmao02
  • High 7.5
    CVE-2024-37843 Public exploit Scanner template EPSS 53%

    Craft CMS SQL injection vulnerability via the GraphQL API endpoint

    Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.

    craftcms/cms Packagist
  • High 8.2
    CVE-2024-37742 Public exploit

    Insecure Access Control in Safe Exam Browser (SEB) = 3.5.0 on Windows. The vulnerability allows an attacker to share cl…