Skip to content
OpenAdvisories

Archive

June 2024

Vulnerabilities first published in this month (UTC), newest first.

← May 2024 2024 / June July 2024 →
  1. 121
  2. 210
  3. 3117
  4. 4187
  5. 5116
  6. 6179
  7. 7136
  8. 878
  9. 9107
  10. 10149
  11. 11227
  12. 12113
  13. 13321
  14. 14156
  15. 1530
  16. 1626
  17. 1775
  18. 1865
  19. 19223
  20. 20159
  21. 21137
  22. 2222
  23. 239
  24. 2497
  25. 25144
  26. 2682
  27. 27111
  28. 2880
  29. 2916
  30. 3021
All Critical High Medium Low Exploited only Public exploit

1,633 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-51543

    WordPress RegistrationMagic plugin <= 5.2.5.0 - IP Limit Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in Metagauss RegistrationMagic allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects RegistrationMagic: from n/a through 5.2.5.0.

    Metagauss RegistrationMagic
  • Medium 5.3
    CVE-2023-51542

    WordPress Branda plugin <= 3.4.14 - IP Restriction Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in WPMU DEV Branda allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Branda: from n/a through 3.4.14.

    WPMU DEV Branda
  • Medium 6.5
    CVE-2023-51511

    WordPress Booster Elite for WooCommerce plugin < 7.1.3 - Authenticated Production Creation/Modification Vulnerability

    Improper Authentication vulnerability in Pluggabl LLC Booster Elite for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster Elite for WooCommerce: from n/a before 7.1.3.

    Pluggabl Booster Elite for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-49852

    WordPress Responsive Slick Slider WordPress plugin <= 1.4 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Vsourz Digital Responsive Slick Slider WordPress allows Code Injection.This issue affects Responsive Slick Slider WordPress: from n/a through 1.4.

    Vsourz Digital Responsive Slick Slider WordPress Web / CMS
  • Medium 5.3
    CVE-2023-49774

    WordPress WP Photo Album Plus plugin <= 8.5.02.005 - IP Bypass vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Photo Album Plus: from n/a through 8.5.02.005.

    J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
  • Medium 5.3
    CVE-2023-48753

    WordPress Restricted Site Access plugin <= 7.4.1 - IP Restriction Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in 10up Restricted Site Access allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Restricted Site Access: from n/a through 7.4.1.

    10up Restricted Site Access
  • Medium 6.5
    CVE-2023-48747

    WordPress Booster for WooCommerce plugin <= 7.1.2 - Authenticated Production Creation/Modification Vulnerability

    Improper Authentication vulnerability in Pluggabl LLC Booster for WooCommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Booster for WooCommerce: from n/a through 7.1.2.

    Pluggabl Booster for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2023-48745

    WordPress Captcha Code plugin <= 2.9 - Captcha Bypass vulnerability

    Improper Restriction of Excessive Authentication Attempts vulnerability in WebFactory Ltd Captcha Code allows Functionality Bypass.This issue affects Captcha Code: from n/a through 2.9.

    webfactory Captcha Code
  • Medium 5.3
    CVE-2023-48318

    WordPress Contact Form Email plugin <= 1.3.41 - Captcha Bypass vulnerability

    Improper Restriction of Excessive Authentication Attempts vulnerability in CodePeople Contact Form Email allows Functionality Bypass.This issue affects Contact Form Email: from n/a through 1.3.41.

    codepeople Contact Form Email
  • Medium 5.3
    CVE-2023-48290

    WordPress Form Maker by 10Web plugin <= 1.15.20 - Captcha Bypass Vulnerability vulnerability

    Improper Restriction of Excessive Authentication Attempts vulnerability in 10Web Form Builder Team Form Maker by 10Web allows Functionality Bypass.This issue affects Form Maker by 10Web: from n/a through 1.15.20.

    10Web Form Builder Team Form Maker by 10Web
  • Medium 5.3
    CVE-2023-48285

    WordPress Accept Stripe Payments plugin <= 2.0.79 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Tips and Tricks HQ Stripe Payments allows Code Injection.This issue affects Stripe Payments: from n/a through 2.0.79.

    Tips and Tricks HQ Stripe Payments
  • Medium 5.3
    CVE-2023-48276

    WordPress WP Forms Puzzle Captcha plugin <= 4.1 - Captcha Bypass vulnerability

    Improper Restriction of Excessive Authentication Attempts vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Functionality Bypass.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.

    Nitin Rathod WP Forms Puzzle Captcha
  • Medium 5.3
    CVE-2023-48271

    WordPress Maspik – Spam Blacklist plugin <= 0.10.3 - IP Filtering Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in yonifre Maspik – Spam blacklist allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Maspik – Spam blacklist: from n/a through 0.10.3.

    yonifre Maspik – Spam blacklist
  • Medium 5.4
    CVE-2023-47513

    WordPress ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.3.2 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ARI Soft ARI Stream Quiz allows Code Injection.This issue affects ARI Stream Quiz: from n/a through 1.3.2.

    ARI Soft ARI Stream Quiz
  • Medium 6.5
    CVE-2024-5463

    A vulnerability regarding buffer copy without checking the size of input ('Classic Buffer Overflow') has been found in …

    Synology Camera Firmware
  • Medium 6.4
    CVE-2024-4637

    Slider Revolution <= 6.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Elementor wrapperid and zindex

    The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 6.7.10 due to insufficient input sanitization and output escaping on the user supplied Elementor 'wrapperid' and 'zindex' display att…

    Revolution Slider Slider Revolution Web / CMS
  • Medium 5.3
    CVE-2023-47189

    WordPress Defender Security plugin <= 4.2.0 - Masked Login Area View Bypass vulnerability

    Improper Authentication vulnerability in WPMU DEV Defender Security allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Defender Security: from n/a through 4.2.0.

    WPMU DEV Defender Security
  • Medium 5.3
    CVE-2023-46310

    WordPress wpDiscuz plugin <= 7.6.10 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpDiscuz allows Code Injection.This issue affects wpDiscuz: from n/a through 7.6.10.

    gVectors Team wpDiscuz
  • Medium 5.4
    CVE-2023-45635

    WordPress Responsive Tabs plugin < 4.0.6 - HTML Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Darko Responsive Tabs allows Code Injection.This issue affects Responsive Tabs: from n/a before 4.0.6.

    WP Darko Responsive Tabs
  • Medium 4.3
    CVE-2023-45053

    WordPress WP Content Pilot plugin <= 1.3.3 - HTML Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in pluginever WP Content Pilot – Autoblogging & Affiliate Marketing Plugin allows Code Injection.This issue affects WP Content Pilot – Autoblogging & Affiliate Marketi…

    pluginever WP Content Pilot – Autoblogging & Affiliate Marketing Plugin
  • Medium 5.3
    CVE-2023-45009

    WordPress Captcha for Contact Form 7 plugin <= 1.11.3 - Capcha Bypass vulnerability

    Improper Restriction of Excessive Authentication Attempts vulnerability in Forge12 Interactive GmbH Captcha/Honeypot for Contact Form 7 allows Functionality Bypass.This issue affects Captcha/Honeypot for Contact Form 7: from n/a through 1.11.3.

    Forge12 Interactive Captcha/Honeypot for Contact Form 7
  • Medium 6.4
    CVE-2024-4581

    Slider Revolution <= 6.7.11 - Authenticated (Author+) Stored Cross-Site Scripting via Add Layer class, id, and title Attributes

    The Slider Revolution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Add Layer widget in all versions up to, and including, 6.7.11 due to insufficient input sanitization and output escaping on the user supplied 'class', 'id…

    Revolution Slider Slider Revolution Web / CMS
  • Medium 5.3
    CVE-2023-44235

    WordPress WP Captcha plugin <= 2.0.0 - Captcha Bypass vulnerability

    Improper Restriction of Excessive Authentication Attempts vulnerability in Devnath verma WP Captcha allows Functionality Bypass.This issue affects WP Captcha: from n/a through 2.0.0.

    Devnath verma WP Captcha
  • Medium 5.3
    CVE-2023-41134

    WordPress Antispam Bee plugin <= 2.11.3 - Country IP Restriction Bypass vulnerability

    Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Antispam Bee: from n/a through 2.11.3.

    pluginkollektiv Antispam Bee
  • Medium 6.5
    CVE-2023-40673

    WordPress Cartpauj Register Captcha plugin <= 1.0.02 - Captcha Bypass vulnerability

    : Improper Control of Interaction Frequency vulnerability in cartpauj Cartpauj Register Captcha allows Functionality Misuse.This issue affects Cartpauj Register Captcha: from n/a through 1.0.02.

    cartpauj Cartpauj Register Captcha
  • Medium 5.4
    CVE-2023-40557

    WordPress Tabs & Accordion plugin <= 1.3.10 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PickPlugins Tabs & Accordion allows Code Injection.This issue affects Tabs & Accordion: from n/a through 1.3.10.

    PickPlugins Tabs & Accordion
  • Medium 5.3
    CVE-2023-40332

    WordPress WP-PostRatings plugin <= 1.91 - Rating limit Bypass vulnerability

    Improper Control of Interaction Frequency vulnerability in Lester ‘GaMerZ’ Chan WP-PostRatings allows Functionality Misuse.This issue affects WP-PostRatings: from n/a through 1.91.

    Lester 'GaMerZ' Chan WP-PostRatings
  • Medium 5.4
    CVE-2023-39161

    WordPress Discussion Board plugin <= 2.4.8 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Discussion Board Discussion Board allows Content Spoofing, Cross-Site Scripting (XSS).This issue affects Discussion Board: from n/a through 2.4.8.

    WP Discussion Board Discussion Board
  • Medium 6.5
    CVE-2023-38520

    WordPress Pinpoint Booking System plugin <= 2.9.9.3.4 - Parameter Tampering

    External Control of Assumed-Immutable Web Parameter vulnerability in PINPOINT.WORLD Pinpoint Booking System allows Functionality Misuse.This issue affects Pinpoint Booking System: from n/a through 2.9.9.3.4.

    PINPOINT.WORLD Pinpoint Booking System
  • Medium 5.3
    CVE-2023-37865

    WordPress IP2Location Country Blocker plugin <= 2.29.1 - IP Bypass Vulnerability vulnerability

    Authentication Bypass by Spoofing vulnerability in IP2Location Download IP2Location Country Blocker allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Download IP2Location Country Blocker: from n/a through 2.29.1.

    IP2Location Download IP2Location Country Blocker
  • Medium 5.3
    CVE-2023-34001

    WordPress Hide My WP Ghost – Security Plugin plugin <= 5.0.25 - Captcha Bypass vulnerability

    Improper Restriction of Excessive Authentication Attempts vulnerability in WPPlugins – WordPress Security Plugins Hide My WP Ghost allows Functionality Bypass.This issue affects Hide My WP Ghost: from n/a through 5.0.25.

    WPPlugins – WordPress Security Plugins Hide My WP Ghost
  • Medium 4.3
    CVE-2023-28494

    WordPress Contact Form Email plugin <= 1.3.31 - Missing Authorization Leading To Feedback Submission Vulnerability

    Missing Authorization vulnerability in CodePeople Contact Form Email allows Functionality Misuse.This issue affects Contact Form Email: from n/a through 1.3.31.

    codepeople Contact Form Email
  • Medium 6.2
    CVE-2024-20887

    Arbitrary directory creation in GalaxyBudsManager PC prior to version 2.1.240315.51 allows attacker to create arbitrary…

    Samsung Mobile GalaxyBudsManager PC
  • Medium 6.2
    CVE-2024-20886

    Arbitrary directory creation in Samsung Live Wallpaper PC prior to version 3.3.8.0 allows attacker to create arbitrary …

    Samsung Mobile Samsung Live Wallpaper PC
  • Medium 5.1
    CVE-2024-20885

    Improper component protection vulnerability in Samsung Dialer prior to SMR May-2024 Release 1 allows local attackers to…

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.2
    CVE-2024-20884

    Incorrect use of privileged API vulnerability in getSemBatteryUsageStats in BatteryStatsService prior to SMR Jun-2024 R…

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.2
    CVE-2024-20883

    Incorrect use of privileged API vulnerability in registerBatteryStatsCallback in BatteryStatsService prior to SMR Jun-2…

    Samsung Mobile Samsung Mobile Devices
  • Medium 4.6
    CVE-2024-20882

    Out-of-bounds read vulnerability in bootloader prior to SMR June-2024 Release 1 allows physical attackers to arbitrary …

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.4
    CVE-2024-20881

    Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local privileged attacker…

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.4
    CVE-2024-20880

    Stack-based buffer overflow vulnerability in bootloader prior to SMR Jun-2024 Release 1 allows physical attackers to ov…

    Samsung Mobile Samsung Mobile Devices