Skip to content
OpenAdvisories

Archive

17 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /17 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

57 results · Clear filters · Feed

  • Medium 5.9
    CVE-2024-43972

    WordPress Page Builder: Pagelayer – Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pagelayer Team PageLayer allows Stored XSS.This issue affects PageLayer: from n/a through 1.8.7.

    Pagelayer Team PageLayer
  • Medium 6.5
    CVE-2024-43983

    WordPress Podlove Podcast Publisher plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.

    Podlove Podlove Podcast Publisher
  • Medium 6.5
    CVE-2024-43987

    WordPress Sliding Door theme <= 3.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wayneconnor Sliding Door allows Stored XSS.This issue affects Sliding Door: from n/a through 3.6.

    wayneconnor Sliding Door
  • Medium 6.5
    CVE-2024-43988

    WordPress Mystique theme <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in digitalnature Mystique allows Stored XSS.This issue affects Mystique: from n/a through 2.5.7.

    digitalnature Mystique
  • Medium 6.5
    CVE-2024-43991

    WordPress Hotel Galaxy theme <= 4.4.24 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in webdzier Hotel Galaxy allows Stored XSS.This issue affects Hotel Galaxy: from n/a through 4.4.24.

    webdzier Hotel Galaxy
  • Medium 6.5
    CVE-2024-43992

    WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Latepoint LatePoint allows Stored XSS.This issue affects LatePoint: from n/a through 4.9.91.

    latepoint LatePoint
  • Medium 6.5
    CVE-2024-43993

    WordPress Liquido theme <= 1.0.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Liquido allows Stored XSS.This issue affects Liquido: from n/a through 1.0.1.2.

    CryoutCreations Liquido
  • Medium 6.5
    CVE-2024-43994

    WordPress Kahuna theme <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Kahuna allows Stored XSS.This issue affects Kahuna: from n/a through 1.7.0.

    CryoutCreations Kahuna
  • Medium 6.5
    CVE-2024-43995

    WordPress Posterity theme <= 3.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sonalsinha21 Posterity allows Stored XSS.This issue affects Posterity: from n/a through 3.6.

    sonalsinha21 Posterity
  • Medium 5.9
    CVE-2024-43999

    WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.

    Saturday Drive Ninja Forms
  • Medium 6.5
    CVE-2024-44001

    WordPress Royal Elementor Addons and Templates plugin <= 1.3.982 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons.This issue affects Royal Elementor Addons: from n/a through <= 1.3.982.

    WP Royal Royal Elementor Addons
  • Medium 6.5
    CVE-2024-44005

    WordPress Greenshift plugin <= 9.3.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 9.3.7.

    wpsoul Greenshift
  • Medium 6.5
    CVE-2024-44008

    WordPress Geo Mashup plugin <= 1.13.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through <= 1.13.12.

    Dylan Kuhn Geo Mashup
  • Medium 6.5
    CVE-2024-44047

    WordPress IMPress for IDX Broker plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through <= 3.2.2.

    IDX Broker IMPress for IDX Broker
  • Medium 6.5
    CVE-2024-44049

    WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.

    ThemeHunk Gutenberg Blocks
  • Medium 5.9
    CVE-2024-43985

    WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagePeople Team Bus Ticket Booking with Seat Reservation allows Stored XSS.This issue affects Bus Ticket Booking with Seat Reservation: from n/a throu…

    MagePeople Team Bus Ticket Booking with Seat Reservation
  • Medium 6.5
    CVE-2024-43977

    WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for …

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • Medium 5.9
    CVE-2024-37985

    Windows Kernel Information Disclosure Vulnerability

    Windows Kernel Information Disclosure Vulnerability

    Microsoft Windows 11 version 22H2 Windows 11 version 22H3 Windows
  • Medium 6.5
    CVE-2024-44050

    WordPress Verbosa theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Verbosa verbosa allows Stored XSS.This issue affects Verbosa: from n/a through <= 1.2.3.

    CryoutCreations Verbosa
  • Medium 6.5
    CVE-2024-44051

    WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) custom-post-widget allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a …

    Johan van der Wijk Content Blocks (Custom Post Widget)
  • Medium 6.5
    CVE-2024-45451

    WordPress Roseta theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Roseta roseta allows Stored XSS.This issue affects Roseta: from n/a through <= 1.3.0.

    CryoutCreations Roseta
  • Medium 6.5
    CVE-2024-45452

    WordPress Septera theme <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Septera septera allows Stored XSS.This issue affects Septera: from n/a through <= 1.5.1.

    CryoutCreations Septera
  • Medium 6.1
    CVE-2024-8907

    Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker wh…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 4.3
    CVE-2024-8909

    Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform …

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 4.3
    CVE-2024-8906

    Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a us…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 4.3
    CVE-2024-8908

    Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform U…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 6.5
    CVE-2024-45815

    Prototype pollution in @backstage/plugin-catalog-backend

    Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. T…

    backstage backstage @backstage/plugin-catalog-backend npm
  • Medium 6.5
    CVE-2024-45816

    Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

    Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessibl…

    backstage backstage @backstage/plugin-techdocs-backend npm
  • Medium 6.5
    CVE-2024-46976

    Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend

    Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing do…

    backstage backstage @backstage/plugin-techdocs-backend npm
  • Medium 6.4
    CVE-2024-45812

    DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite

    Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`/`iife`/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-si…

    vitejs vite vite vite Wolfi npm
  • Medium 4.8
    CVE-2024-45811

    server.fs.deny bypassed when using ?import&raw in vite

    Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitat…

    vitejs vite vite vite Wolfi npm
  • Medium 4.3
    CVE-2024-45604

    Directory traversal in the file selector widget in contao/core-bundle

    Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

    contao contao contao/core-bundle Packagist
  • Medium 6.5
    CVE-2024-45605

    Improper authorization on deletion of user issue alert notifications in sentry

    Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on…

    getsentry sentry sentry PyPI
  • Medium 6.3
    CVE-2024-8949 Public exploit

    SourceCodester Online Eyewear Shop Cart Content Master.php improper ownership management

    A vulnerability classified as critical has been found in SourceCodester Online Eyewear Shop 1.0. This affects an unknown part of the file /classes/Master.php of the component Cart Content Handler. The manipulation of the argument cart_id/id leads to improper …

    SourceCodester Online Eyewear Shop
  • Medium 6.5
    CVE-2024-45537

    Apache Druid: Users can provide MySQL JDBC properties not on allow list

    Apache Druid allows users with certain permissions to read data from other database systems using JDBC. This functionality allows trusted users to set up Druid lookups or run ingestion tasks. Druid also allows administrators to configure a list of allowed pro…

    Apache Software Foundation Apache Druid org.apache.druid:druid Maven
  • Medium 6.5
    GHSA-534c-hcr7-67jg

    Kimai has an XXE Leading to Local File Read

    ### Summary Kimai uses [PHPSpreadsheet](https://github.com/PHPOffice/PhpSpreadsheet) for importing and exporting invoices. Recently, a [CVE](https://github.com/PHPOffice/PhpSpreadsheet/security/advisories/GHSA-ghg6-32f9-2jp7) was identified in PHPSpreadsheet,…

    kimai/kimai Packagist
  • Medium 5.3
    CVE-2024-45384

    Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack

    Padding Oracle vulnerability in Apache Druid extension, druid-pac4j. This could allow an attacker to manipulate a pac4j session cookie. This issue affects Apache Druid versions 0.18.0 through 30.0.0. Since the druid-pac4j extension is optional and disabled by…

    Apache Software Foundation Apache Druid druid org.apache.druid.extensions:druid-pac4j Wolfi Maven
  • Medium 5.6
    CVE-2024-8947

    MicroPython objarray.c use after free

    A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complex…

    micropython micropython-io micropython micropython-copy Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2024-45612

    Insert tag injection via canonical URL in Contao

    Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade sh…

    contao contao contao/core-bundle Packagist
  • Medium 5.1
    CVE-2024-45803

    Cross site scripting (XSS) Vulnerability on route /wireui/button?label=Content in wireui

    Wire UI is a library of components and resources to empower Laravel and Livewire application development. A potential Cross-Site Scripting (XSS) vulnerability has been identified in the `/wireui/button` endpoint, specifically through the `label` query paramet…

    wireui wireui wireui/wireui Packagist