Skip to content
OpenAdvisories

Archive

24 August 2024

Vulnerabilities first published on this day (UTC), newest first.

← July 2024 2024 / August /24 September 2024 →
  1. 1129
  2. 266
  3. 321
  4. 413
  5. 5103
  6. 6160
  7. 7118
  8. 8112
  9. 966
  10. 1016
  11. 1122
  12. 12119
  13. 13226
  14. 14206
  15. 15122
  16. 1656
  17. 17135
  18. 1866
  19. 1972
  20. 20147
  21. 21177
  22. 22129
  23. 2378
  24. 2428
  25. 2524
  26. 26142
  27. 2767
  28. 2875
  29. 29135
  30. 3070
  31. 3118
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium 6.3
    CVE-2024-8135

    Go-Tribe gotribe token.go Sign hard-coded credentials

    A vulnerability classified as critical has been found in Go-Tribe gotribe up to cd3ccd32cd77852c9ea73f986eaf8c301cfb6310. Affected is the function Sign of the file pkg/token/token.go. The manipulation of the argument config.key leads to hard-coded credentials…

    Go-Tribe gotribe
  • Medium 6.3
    CVE-2024-8134

    D-Link DNS-1550-04 HTTP POST Request hd_config.cgi cgi_FMT_Std2R5_1st_DiskMGR command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It h…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8133

    D-Link DNS-1550-04 HTTP POST Request hd_config.cgi cgi_FMT_R5_SpareDsk_DiskMGR command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It h…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8132 EPSS 24%

    D-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It h…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8131

    D-Link DNS-1550-04 HTTP POST Request apkg_mgr.cgi module_enable_disable command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and c…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8130

    D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3 command injection

    A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 …

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8129 EPSS 24%

    D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injection

    A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 a…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8128

    D-Link DNS-1550-04 HTTP POST Request webfile_mgr.cgi cgi_add_zip command injection

    A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.8
    CVE-2022-43915

    IBM App Connect Enterprise Certified Container

    IBM App Connect Enterprise Certified Container 5.0, 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, and 12.1 does not limit calls to unshare in running Pods. This can allow a user with privileged access to e…

    IBM App Connect Enterprise Certified Container
  • Medium 6.3
    CVE-2024-8127

    D-Link DNS-1550-04 HTTP POST Request webfile_mgr.cgi cgi_unzip command injection

    A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 5.3
    CVE-2024-6499

    WordPress Button Plugin MaxButtons <= 9.7.8 - Full Path Disclosure

    The WordPress Button Plugin MaxButtons plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 9.7.8. This makes it possible for unauthenticated attackers to obtain the full path to instances, which they may be able to…

    Max Foundry MaxButtons – Create buttons Web / CMS
  • Medium 5.0
    CVE-2024-6631

    ImageRecycle pdf & image compression <= 3.1.14 - Missing Authorization in Several AJAX Actions

    The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX actions in all versions up to, and including, 3.1.14. This makes it possible for authenticated a…

    ImageRecycle ImageRecycle pdf & image compression Web / CMS
  • Medium 6.4
    CVE-2024-2254

    RT Easy Builder – Advanced addons for Elementor <= 2.3 - Authenticated (Contributor+) Stored Cross-site Scripting

    The RT Easy Builder – Advanced addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widgets in all versions up to, and including, 2.3 due to insufficient input sanitization and output escaping on user supplie…

    risetheme RT Easy Builder – Advanced addons for Elementor Web / CMS
  • Medium 4.7
    CVE-2024-8120

    ImageRecycle pdf & image compression <= 3.1.14 - Cross-Site Request in Several AJAX Actions

    The ImageRecycle pdf & image compression plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.14. This is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer…

    ImageRecycle ImageRecycle pdf & image compression Web / CMS
  • Medium 4.4
    CVE-2023-0926

    Custom Permalinks <= 2.6.0 - Authenticated(Editor+) Stored Cross-Site Scripting

    The Custom Permalinks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping on tag names. This allows authenticated users, with editor-level permiss…

    sasiddiqui Custom Permalinks Web / CMS
  • Medium 6.1
    CVE-2023-6987

    String Locator <= 2.6.5 - Reflected Cross-Site Scripting

    The String locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sql-column' parameter in all versions up to, and including, 2.6.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthent…

    InstaWP String locator Web / CMS