Skip to content
OpenAdvisories

Archive

22 July 2024

Vulnerabilities first published on this day (UTC), newest first.

← June 2024 2024 / July /22 August 2024 →
  1. 1121
  2. 2135
  3. 360
  4. 438
  5. 566
  6. 624
  7. 74
  8. 866
  9. 9474
  10. 10122
  11. 1181
  12. 12201
  13. 1349
  14. 1411
  15. 1588
  16. 16255
  17. 1788
  18. 1849
  19. 1950
  20. 2083
  21. 2178
  22. 22136
  23. 2338
  24. 2485
  25. 2547
  26. 2672
  27. 2729
  28. 2827
  29. 29280
  30. 30171
  31. 31111
All Critical High Medium Low Exploited only Public exploit

46 results · Clear filters · Feed

  • High 7.5
    CVE-2024-6805

    Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources

    The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in information disclosure or remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.

    NI VeriStand
  • High 8.7
    CVE-2024-6911 Scanner template

    Unauthenticated Local File Inclusion

    Files on the Windows system are accessible without authentication to external parties due to a local file inclusion in PerkinElmer ProcessPlus.This issue affects ProcessPlus: through 1.11.6507.0.

    PerkinElmer ProcessPlus
  • High 7.8
    CVE-2024-6791

    Directory Path Traversal Vulnerability in NI VeriStand with vsmodel Files

    A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file. This vulnerability affe…

    NI VeriStand
  • High 7.8
    CVE-2024-6675

    Deserialization of Untrusted Data Vulnerability in NI VeriStand Project File

    A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q…

    NI VeriStand
  • High 7.8
    CVE-2024-6121

    NI SystemLink Server Ships Out of Date Redis Version

    An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions whic…

    NI FlexLogger SystemLink Server
  • High 7.5
    CVE-2024-40634

    Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessiv…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • High 7.4
    CVE-2024-41827

    In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration

    JetBrains TeamCity
  • High 7.5
    CVE-2024-41131

    Out-of-bounds Write in SixLabors ImageSharp

    ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a specially crafted gif. This can potentially lead to denial of service. All users are advised to upg…

    SixLabors ImageSharp SixLabors.ImageSharp NuGet
  • High 7.4
    CVE-2024-32484 EPSS 21%

    An reflected XSS vulnerability exists in the handling of invalid paths in the Flask server in Ankitects Anki 24.04. A s…

    ankitects anki anki anki Debian Ubuntu
  • High 8.9
    CVE-2024-25638

    DNSJava DNSSEC Bypass

    dnsjava is an implementation of DNS in Java. Records in DNS replies are not checked for their relevance to the query, allowing an attacker to respond with RRs from different zones. This vulnerability is fixed in 3.6.0.

    dnsjava dnsjava druid tez Debian Ubuntu Wolfi Maven
  • High 7.2
    CVE-2024-37942

    WordPress BerqWP plugin <= 1.7.5 - Unauthenticated Non-Blind Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Berqier Ltd BerqWP.This issue affects BerqWP: from n/a through 1.7.5.

    Berqier BerqWP
  • High 7.1
    CVE-2024-38728

    WordPress Seraphinite Post .DOCX Source plugin <= 2.16.9 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source.This issue affects Seraphinite Post .DOCX Source: from n/a through 2.16.9.

    Seraphinite Solutions Seraphinite Post .DOCX Source
  • High 7.6
    CVE-2024-38692

    WordPress spiffy-calendar plugin <= 4.9.11 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.11.

    Spiffy Plugins Spiffy Calendar
  • High 8.5
    CVE-2024-38708

    WordPress Barcode Scanner and Inventory manager plugin <= 1.6.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue …

    Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager
  • High 8.5
    CVE-2024-38755

    WordPress DirectoryPress plugin <= 3.6.10 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Designinvento DirectoryPress allows SQL Injection.This issue affects DirectoryPress: from n/a through 3.6.10.

    Designinvento DirectoryPress
  • High 7.6
    CVE-2024-38788

    WordPress UiPress lite plugin <= 3.4.06 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bởi Admin 2020 UiPress lite allows SQL Injection.This issue affects UiPress lite: from n/a through 3.4.06.

    Bởi Admin 2020 UiPress lite
  • High 7.1
    CVE-2024-35656

    WordPress Elementor Pro <= 3.21.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Elementor Elementor Pro allows Reflected XSS.This issue affects Elementor Pro: from n/a through 3.21.2.

    Elementor Elementor Pro
  • High 7.1
    CVE-2024-37097

    WordPress Shortcodes by United Themes plugin < 5.0.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in UnitedThemes Shortcodes by United Themes allows Reflected XSS.This issue affects Shortcodes by United Themes: from n/a before 5.0.5.

    United Themes Shortcodes by United Themes
  • High 7.1
    CVE-2024-37117

    WordPress Uncanny Automator Pro plugin <= 5.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Automator Pro allows Reflected XSS.This issue affects Uncanny Automator Pro: from n/a through 5.3.

    Uncanny Owl Uncanny Automator Pro
  • High 7.1
    CVE-2024-37199

    WordPress Enfold theme <= 5.6.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Kriesi.At Enfold allows Reflected XSS.This issue affects Enfold: from n/a through 5.6.9.

    Kriesi.at Enfold
  • High 7.1
    CVE-2024-37206

    WordPress Demo Awesome plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Theme4Press Demo Awesome allows Reflected XSS.This issue affects Demo Awesome: from n/a through 1.0.1.

    Theme4Press Demo Awesome
  • High 7.1
    CVE-2024-37211

    WordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ali2Woo Team Ali2Woo Lite allows Reflected XSS.This issue affects Ali2Woo Lite: from n/a through 3.3.5.

    Ali2Woo Ali2Woo Lite
  • High 7.5
    CVE-2024-23321

    Apache RocketMQ: Unauthorized Exposure of Sensitive Data

    For RocketMQ versions 5.2.0 and below, under certain conditions, there is a risk of exposure of sensitive Information to an unauthorized actor even if RocketMQ is enabled with authentication and authorization functions. An attacker, possessing regular user pr…

    Apache Software Foundation Apache RocketMQ org.apache.rocketmq:rocketmq-all Maven
  • High 7.1
    CVE-2024-37245

    WordPress All In One Redirection plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Vsourz Digital All In One Redirection allows Reflected XSS.This issue affects All In One Redirection: from n/a through 2.2.0.

    Vsourz Digital All In One Redirection
  • High 7.1
    CVE-2024-37257

    WordPress Permalink Manager Lite plugin <= 2.4.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Maciej Bis Permalink Manager Lite allows Reflected XSS.This issue affects Permalink Manager Lite: from n/a through 2.4.3.3.

    Maciej Bis Permalink Manager Lite
  • High 7.1
    CVE-2024-37258

    WordPress Social Rocket plugin <= 1.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Social Rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.3.

    Social Rocket Social Rocket
  • High 7.1
    CVE-2024-37259 Scanner template

    WordPress WP Extended plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through <= 2.4.…

    WP Extended The Ultimate WordPress Toolkit – WP Extended Web / CMS
  • High 7.1
    CVE-2024-37261 Scanner template

    WordPress WP-Lister Lite for Amazon plugin <= 2.6.16 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon.This issue affects WP-Lister Lite for Amazon: from n/a through <= 2.6.16.

    WP Lab WP-Lister Lite for Amazon
  • High 7.1
    CVE-2024-37262

    WordPress Online Booking & Scheduling Calendar plugin <= 4.4.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in vCita.Com Online Booking & Scheduling Calendar for WordPress by vcita allows Reflected XSS.This issue affects Online Booking & Scheduling Calendar for…

    vCita.com Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • High 7.1
    CVE-2024-37264

    WordPress Groundhogg plugin <= 3.4.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Groundhogg Inc. Groundhogg allows Reflected XSS.This issue affects Groundhogg: from n/a through 3.4.2.3.

    Groundhogg Groundhogg
  • High 7.1
    CVE-2024-37267

    WordPress Striking theme <= 2.3.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in kaptinlin Striking allows Reflected XSS.This issue affects Striking: from n/a through 2.3.4.

    kaptinlin Striking
  • High 7.1
    CVE-2024-37275

    WordPress NextScripts plugin <= 4.4.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows DOM-Based XSS.This issue affects NextScripts: from n/a through <= 4.4.7.

    nextscripts NextScripts
  • High 7.1
    CVE-2024-37416

    WordPress WP Photo Album Plus plugin <= 8.8.00.002 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in J.N. Breetvelt a.K.A. OpaJaap WP Photo Album Plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 8.8.00.002.

    J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
  • High 7.1
    CVE-2024-37433

    WordPress Mailster plugin <= 4.0.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress Mailster mailster.This issue affects Mailster: from n/a through <= 4.0.9.

    EverPress Mailster
  • High 7.1
    CVE-2024-37436

    WordPress Uncanny Toolkit Pro for LearnDash plugin < 4.1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit Pro for LearnDash allows Reflected XSS.This issue affects Uncanny Toolkit Pro for LearnDash: from n/a before 4.1.4.1.

    Uncanny Owl Uncanny Toolkit Pro for LearnDash
  • High 8.8
    CVE-2024-6244 Public exploit

    pz-frontend-manager < 1.0.6 - CSRF change user profile picture

    The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks

    Web / CMS
  • High 7.3
    CVE-2024-6966

    itsourcecode Online Blood Bank Management System Login login.php sql injection

    A vulnerability was found in itsourcecode Online Blood Bank Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file login.php of the component Login. The manipulation of the argument user/pass leads t…

    itsourcecode Online Blood Bank Management System
  • High 8.8
    CVE-2024-6965

    Tenda O3 fromVirtualSet stack-based overflow

    A vulnerability has been found in Tenda O3 1.0.0.10 and classified as critical. Affected by this vulnerability is the function fromVirtualSet. The manipulation of the argument ip/localPort/publicPort/app leads to stack-based buffer overflow. The attack can be…

    Tenda O3
  • High 8.8
    CVE-2024-6964

    Tenda O3 fromDhcpSetSer stack-based overflow

    A vulnerability, which was classified as critical, was found in Tenda O3 1.0.0.10. Affected is the function fromDhcpSetSer. The manipulation of the argument dhcpEn/startIP/endIP/preDNS/altDNS/mask/gateway leads to stack-based buffer overflow. It is possible t…

    Tenda O3
  • High 8.8
    CVE-2024-6963

    Tenda O3 formexeCommand stack-based overflow

    A vulnerability, which was classified as critical, has been found in Tenda O3 1.0.0.10. This issue affects the function formexeCommand. The manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be initiated remotely. The e…

    Tenda O3