Skip to content
OpenAdvisories

Archive

6 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /6 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-8517 Public exploit Scanner template EPSS 95%

    SPIP Bigup Multipart File Upload OS Command Injection

    SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request.

    SPIP SPIP spip spip Debian Ubuntu
  • Critical 9.8
    CVE-2024-7493

    WPCOM Member <= 1.5.2.1 - Unauthenticated Privilege Escalation via User Meta

    The WPCOM Member plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.5.2.1. This is due to the plugin allowing arbitrary data to be passed to wp_insert_user() during registration. This makes it possible for unaut…

    whyun WPCOM Member Web / CMS
  • Critical 10.0
    CVE-2024-6445

    Authenticated Local File Inclusion (LFI) in DataFlowX's DataDiodeX

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in DataFlowX Technology DataDiodeX allows Path Traversal. This issue affects DataDiodeX: from v3.0.0 before v3.1.7.

    DataFlowX Technology DataDiodeX
  • Critical 9.2
    CVE-2024-1744

    IDOR in Ariva Computer's Accord ORS

    Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Ariva Computer Accord ORS allows Retrieve Embedded Sensitive Data. This issue affects Accord ORS: before 7.3.2.1.

    Ariva Computer Accord ORS
  • Critical 9.8
    CVE-2024-8292

    WP-Recall – Registration, Profile, Commerce & More <= 16.26.8 - Insecure Direct Object Reference to Unauthenticated Arbitrary Password Update

    The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to privilege escalation/account takeover in all versions up to, and including, 16.26.8. This is due to to plugin not properly verifying a user's identity during new orde…

    wppost WP-Recall – Registration, Profile, Commerce & More Web / CMS
  • Critical 9.1
    CVE-2024-45758

    H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

    H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document cont…

    h2o ai.h2o:h2o-core Maven PyPI
  • Critical 9.8
    CVE-2024-45771

    RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the password parameter at /resource/runlogi…

  • Critical 9.8
    CVE-2024-44402

    D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via msp_info.htm.

  • Critical 9.8
    CVE-2024-44401

    D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file

  • Critical 9.8
    CVE-2024-44839

    RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the articleid parameter at /default/article…

  • Critical 9.8
    CVE-2024-44838

    RapidCMS v1.3.1 was discovered to contain a SQL injection vulnerability via the username parameter at /resource/runlogi…