Skip to content
OpenAdvisories

Archive

6 July 2024

Vulnerabilities first published on this day (UTC), newest first.

← June 2024 2024 / July /6 August 2024 →
  1. 1121
  2. 2135
  3. 360
  4. 438
  5. 566
  6. 624
  7. 74
  8. 866
  9. 9474
  10. 10122
  11. 1181
  12. 12201
  13. 1349
  14. 1411
  15. 1588
  16. 16255
  17. 1788
  18. 1849
  19. 1950
  20. 2083
  21. 2178
  22. 22136
  23. 2338
  24. 2485
  25. 2547
  26. 2672
  27. 2729
  28. 2827
  29. 29280
  30. 30171
  31. 31111
All Critical High Medium Low Exploited only Public exploit

24 results · Feed

  • Medium 5.8
    CVE-2024-6095 Public exploit Scanner template

    SSRF and Partial LFI in /models/apply Endpoint in mudler/localai

    A vulnerability in the /models/apply endpoint of mudler/localai versions 2.15.0 allows for Server-Side Request Forgery (SSRF) and partial Local File Inclusion (LFI). The endpoint supports both http(s):// and file:// schemes, where the latter can lead to LFI. …

    mudler mudler/localai
  • Medium 6.5
    CVE-2024-37554

    WordPress UltraAddons plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows DOM-Based XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.…

    Saiful Islam UltraAddons Elementor Lite
  • Medium 6.5
    CVE-2024-37553

    WordPress Testimonials Widget plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Axelerant Testimonials Widget allows Stored XSS.This issue affects Testimonials Widget: from n/a through 4.0.4.

    Axelerant Testimonials Widget
  • Medium 6.5
    CVE-2024-37547

    WordPress Elementor Addons by Livemesh plugin <= 8.4.0 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Livemesh Livemesh Addons for Elementor.This issue affects Livemesh Addons for Elementor: from n/a through 8.4.0.

    Livemesh Livemesh Addons for Elementor
  • Medium 6.5
    CVE-2024-37546

    WordPress Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in biplob018 Image Hover Effects - Caption Hover with Carousel allows Stored XSS.This issue affects Image Hover Effects - Caption Hover with Carousel: fr…

    biplob018 Image Hover Effects - Caption Hover with Carousel
  • Medium 5.4
    CVE-2024-37542

    WordPress Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WpDevArt Responsive Image Gallery, Gallery Album.This issue affects Responsive Image Gallery, Gallery Album: from n/a through 2.0.3.

    wpdevart Responsive Image Gallery, Gallery Album
  • Medium 6.5
    CVE-2024-37541

    WordPress Elementor Addons, Widgets and Enhancements – Stax plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StaxWP Elementor Addons, Widgets and Enhancements – Stax stax-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor Addons, Widgets and Enha…

    StaxWP Elementor Addons, Widgets and Enhancements – Stax
  • Medium 6.5
    CVE-2024-37539

    WordPress WP To Do plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Delower WP To Do allows Stored XSS.This issue affects WP To Do: from n/a through 1.3.0.

    Delower WP To Do
  • Low 3.5
    CVE-2024-37234

    WordPress Academy LMS plugin <= 2.0.4 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Kodezen Limited Academy LMS.This issue affects Academy LMS: from n/a through 2.0.4.

    kodezen Academy LMS
  • Medium 4.9
    CVE-2024-37208

    WordPress WP Scraper plugin <= 5.7 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Robert Macchi WP Scraper.This issue affects WP Scraper: from n/a through 5.7.

    Robert Macchi WP Scraper
  • High 7.2
    CVE-2024-37260

    WordPress Foxiz Theme theme <= 2.3.5 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Theme-Ruby Foxiz.This issue affects Foxiz: from n/a through 2.3.5.

    ThemeRuby Foxiz
  • High 7.8
    CVE-2024-39486

    drm/drm_file: Fix pid refcounting race

    In the Linux kernel, the following vulnerability has been resolved: drm/drm_file: Fix pid refcounting race <maarten.lankhorst@linux.intel.com>, Maxime Ripard <mripard@kernel.org>, Thomas Zimmermann <tzimmermann@suse.de> filp->pid is supposed to be a refcounte…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 4.3
    CVE-2024-5616

    CSRF Vulnerability in mudler/LocalAI

    A Cross-Site Request Forgery (CSRF) vulnerability exists in mudler/LocalAI versions up to and including 2.15.0, which allows attackers to trick victims into deleting installed models. By crafting a malicious HTML page, an attacker can cause the deletion of a …

    mudler mudler/localai
  • Medium 4.3
    CVE-2024-40598

    An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed informat…

  • Medium 6.3
    CVE-2024-40601

    An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules.

  • High 7.5
    CVE-2024-40597

    An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information f…

  • Medium 4.8
    CVE-2024-40605

    An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar …

  • Medium 6.1
    CVE-2024-40600

    An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar t…

  • Medium 4.3
    CVE-2024-40603

    An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF …

  • Low 2.3
    CVE-2024-40594

    The OpenAI ChatGPT app before 2024-07-05 for macOS opts out of the sandbox, and stores conversations in cleartext in a …

  • Medium 4.8
    CVE-2024-40599

    An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top…

  • Medium 4.3
    CVE-2024-40596

    An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can ex…

  • Medium 4.8
    CVE-2024-40604

    An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sideb…

  • Medium 6.1
    CVE-2024-40602

    An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-l…