Skip to content
OpenAdvisories

Archive

8 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /8 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-42343

    Loway - CWE-204: Observable Response Discrepancy

    Loway - CWE-204: Observable Response Discrepancy

    Loway QueueMetrics
  • Medium 4.3
    CVE-2024-42342

    Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

    Loway QueueMetrics
  • Medium 6.1
    CVE-2024-42341

    Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

    Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

    Loway QueueMetrics
  • Medium 6.3
    CVE-2024-8574

    TOTOLINK AC1200 T8 cstecgi.cgi setParentalRules os command injection

    A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument slaveIpList leads to os command …

    Toto Link AC1200 T8
  • Medium 6.3
    CVE-2024-8570

    itsourcecode Tailoring Management System inccatadd.php sql injection

    A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /inccatadd.php. The manipulation of the argument title leads to sql injection. The attack ma…

    itsourcecode Tailoring Management System
  • Medium 4.3
    CVE-2024-6925

    TrueBooker < 1.0.3 - Settings Update via CSRF

    The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

    Web / CMS
  • Medium 6.5
    CVE-2024-6855

    WP MultiTasking <= 0.1.12 - Exit Popup Update via CSRF

    The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack

    Web / CMS
  • Medium 6.5
    CVE-2024-6852

    WP MultiTasking <= 0.1.12 - Settings Update via CSRF

    The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

    Web / CMS
  • Medium 6.5
    CVE-2024-6853

    WP MultiTasking <= 0.1.12 - Welcome Popup Update via CSRF

    The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack

    Web / CMS
  • Medium 6.5
    CVE-2024-6856

    WP MultiTasking <= 0.1.12 - SMTP Settings Update via CSRF

    The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

    Web / CMS
  • Medium 5.4
    CVE-2024-6859

    WP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode

    The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform S…

    Web / CMS
  • Medium 6.3
    CVE-2024-8568

    Mini-Tmall 1 rewardMapper.select sql injection

    A vulnerability, which was classified as critical, was found in Mini-Tmall up to 20240901. Affected is the function rewardMapper.select of the file tmall/admin/order/1/1. The manipulation of the argument orderBy leads to sql injection. It is possible to launc…