Skip to content
OpenAdvisories

Archive

25 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /25 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

103 results · Feed

  • Medium 5.4
    GHSA-75j2-9gmc-m855

    Camaleon CMS vulnerable to stored XSS through user file upload (GHSL-2024-184)

    A stored cross-site scripting has been found in the image upload functionality that can be used by normal registered users: It is possible to upload a SVG image containing JavaScript and it's also possible to upload a HTML document when the format parameter i…

    camaleon_cms RubyGems
  • High 8.8
    CVE-2024-47083

    Power Platform Terraform Provider has Improper Masking of Secrets in Logs

    Power Platform Terraform Provider allows managing environments and other resources within Power Platform. Versions prior to 3.0.0 have an issue in the Power Platform Terraform Provider where sensitive information, specifically the `client_secret` used in the …

    Microsoft terraform-provider-power-platform
  • Medium 4.6
    CVE-2024-47082

    Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerability

    Strawberry GraphQL is a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support as defined in the GraphQL multipart request specification was enabled by default in all Strawberry HTTP view integrations. This made all Strawbe…

    strawberry-graphql strawberry strawberry-graphql PyPI
  • Medium 4.3
    CVE-2024-47305

    WordPress Use Any Font plugin <= 6.3.08 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Dnesscarkey Use Any Font use-any-font allows Cross Site Request Forgery.This issue affects Use Any Font: from n/a through <= 6.3.08.

    Dnesscarkey Use Any Font
  • Medium 5.4
    CVE-2024-47315

    WordPress GiveWP – Donation Plugin and Fundraising Platform plugin <= 3.15.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give.This issue affects GiveWP: from n/a through <= 3.15.1.

    stellarwp GiveWP
  • High 7.3
    CVE-2024-8996

    Grafana Agent Flow on Windows Unquoted service path

    Unquoted Search Path or Element vulnerability in Grafana Agent (Flow mode) on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Agent Flow: before 0.43.2

    Grafana Agent Flow github.com/grafana/agent Go
  • High 7.3
    CVE-2024-8975

    Grafana Alloy on Windows Unquoted service path

    Unquoted Search Path or Element vulnerability in Grafana Alloy on Windows allows Privilege Escalation from Local User to SYSTEM This issue affects Alloy: before 1.3.3, from 1.4.0-rc.0 through 1.4.0-rc.1.

    Grafana Alloy github.com/grafana/alloy Go
  • Medium 4.3
    CVE-2024-20434

    A vulnerability in Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service…

    Cisco Cisco IOS XE Software iOS Network devices
  • Medium 6.5
    CVE-2024-20414

    A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, r…

    Cisco Cisco IOS XE Software IOS iOS Network devices
  • Medium 5.8
    CVE-2024-20465

    A vulnerability in the access control list (ACL) programming of Cisco IOS Software running on Cisco Industrial Ethernet…

    Cisco IOS iOS Network devices
  • Medium 4.7
    CVE-2024-20510

    A vulnerability in the Central Web Authentication (CWA) feature of Cisco IOS XE Software for Wireless Controllers could…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.6
    CVE-2024-20467 Public exploit

    A vulnerability in the implementation of the IPv4 fragmentation reassembly code in Cisco IOS XE Software could allow an…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.6
    CVE-2024-20464

    A vulnerability in the Protocol Independent Multicast (PIM) feature of Cisco IOS XE Software could allow an unauthentic…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.6
    CVE-2024-20480

    A vulnerability in the DHCP Snooping feature of Cisco IOS XE Software on Software-Defined Access (SD-Access) fabric edg…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.1
    CVE-2024-20437

    A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote a…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.6
    CVE-2024-20436

    A vulnerability in the HTTP Server feature of Cisco IOS XE Software when the Telephony Service feature is enabled could…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.6
    CVE-2024-20433

    A vulnerability in the Resource Reservation Protocol (RSVP) feature of Cisco IOS Software and Cisco IOS XE Software cou…

    Cisco Cisco IOS XE Software IOS iOS Network devices
  • Medium 6.1
    CVE-2024-20496

    Cisco SD-WAN vEdge Routers Denial of Service Vulnerability

    A vulnerability in the UDP packet validation code of Cisco SD-WAN vEdge Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition on an affected system. This vulnerability is due to incorrect handling of a specifi…

    Cisco Cisco SD-WAN vEdge Router Cisco SD-WAN vEdge Cloud Network devices
  • Medium 6.4
    CVE-2024-20475

    Cisco SD-WAN vManage Cross-Site Scripting Vulnerability

    A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerabi…

    Cisco Cisco Catalyst SD-WAN Manager Network devices
  • Medium 5.8
    CVE-2024-20508

    Cisco UTD Snort IPS Engine Software for Cisco IOS XE Software Security Policy Bypass and Denial of Service Vulnerability

    A vulnerability in Cisco Unified Threat Defense (UTD) Snort Intrusion Prevention System (IPS) Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service (DoS) condition …

    Cisco Cisco UTD SNORT IPS Engine Software Network devices
  • High 7.5
    CVE-2024-20350

    Cisco Catalyst Center Static SSH Host Key Vulnerability

    A vulnerability in the SSH server of Cisco Catalyst Center, formerly Cisco DNA Center, could allow an unauthenticated, remote attacker to impersonate a Cisco Catalyst Center appliance. This vulnerability is due to the presence of a static SSH host key. An att…

    Cisco Cisco Digital Network Architecture Center (DNA Center) Network devices
  • High 8.6
    CVE-2024-20455

    A vulnerability in the process that classifies traffic that is going to the Unified Threat Defense (UTD) component of C…

    Cisco Cisco IOS XE Software Cisco IOS XE Catalyst SD-WAN iOS Network devices
  • High 8.1
    CVE-2024-47078

    Meshtastic firmware Authentication/Authorization Bypass via MQTT

    Meshtastic is an open source, off-grid, decentralized, mesh network. Meshtastic uses MQTT to communicate over an internet connection to a shared or private MQTT Server. Nodes can communicate directly via an internet connection or proxied through a connected p…

    meshtastic firmware
  • Medium 5.5
    CVE-2024-7421

    An information exposure in Devolutions Remote Desktop Manager 2024.2.20.0 and earlier on Windows allows local attackers…

    Devolutions Remote Desktop Manager
  • Medium 5.3
    CVE-2024-43237

    WordPress Tag Groups plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Steve Burge WordPress Tag Cloud Plugin – Tag Groups tag-groups.This issue affects WordPress Tag Cloud Plugin – Tag Groups: from n/a through <= 2.0.3.

    Steve Burge WordPress Tag Cloud Plugin – Tag Groups Web / CMS
  • Medium 5.3
    CVE-2024-43990

    WordPress Masterstudy LMS Starter theme <= 1.1.8 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information into Log File vulnerability in StylemixThemes Masterstudy LMS Starter.This issue affects Masterstudy LMS Starter: from n/a through 1.1.8.

    StylemixThemes Masterstudy LMS Starter
  • High 7.1
    CVE-2024-43959

    WordPress Super Testimonials plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Testimonials super-testimonial allows Reflected XSS.This issue affects Testimonials: from n/a through <= 4.0.1.

    Themepoints Testimonials
  • High 8.6
    CVE-2024-30128

    An open proxy vulnerability affects HCL Nomad server on Domino

    HCL Nomad server on Domino is affected by an open proxy vulnerability in which an unauthenticated attacker can mask their original source IP address. This may enable an attacker to trick the user into exposing sensitive information.

    HCL Software Nomad server on Domino
  • High 7.8
    CVE-2024-8316

    Progress UI for WPF format provider unsafe deserialization vulnerability

    In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.

    Progress Software Telerik UI for WPF
  • High 7.8
    CVE-2024-7576

    Progress UI for WPF format provider unsafe deserialization vulnerability

    In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a code execution attack is possible through an insecure deserialization vulnerability.

    Progress Software Telerik UI for WPF
  • High 7.8
    CVE-2024-7575

    Improper neutralization special element in hyperlinks

    In Progress Telerik UI for WPF versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.

    Progress Software Telerik UI for WPF
  • Medium 6.5
    CVE-2024-6512

    Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows au…

    Devolutions Devolutions Server
  • High 7.8
    CVE-2024-7679

    Improper neutralization special element in hyperlinks

    In Progress Telerik UI for WinForms versions prior to 2024 Q3 (2024.3.924), a command injection attack is possible through improper neutralization of hyperlink elements.

    Progress Software Telerik UI for WinForms
  • Medium 5.1
    CVE-2024-45613

    CKEditor 5 has Cross-site Scripting vulnerability in the clipboard package

    CKEditor 5 is a JavaScript rich-text editor. Starting in version 40.0.0 and prior to version 43.1.1, a Cross-Site Scripting (XSS) vulnerability is present in the CKEditor 5 clipboard package. This vulnerability could be triggered by a specific user action, le…

    ckeditor ckeditor5 request-tracker4 ldap-account-manager Ubuntu npm
  • Medium 6.4
    CVE-2024-8546

    ElementsKit Elementor addons <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Video Widget

    The ElementsKit Elementor addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Video widget in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping on user supplied attributes…

    roxnor ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor Web / CMS
  • Critical 9.3
    CVE-2024-4657

    Strored XSS in Talent Software's BAP Automation

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software BAP Automation allows Stored XSS. This issue affects BAP Automation: before 30840.

    Talent Software BAP Automation
  • Unscored —
    RUSTSEC-2024-0375

    `atty` is unmaintained

    The maintainer of `atty` has [published](https://github.com/softprops/atty/commit/5bfdbe9e48c6ca6a4909e8d5b04f5e843a257e93) an official notice that the crate is no longer under development, and that users should instead rely on the functionality in the standa…

    atty crates.io
  • High 8.7
    CVE-2024-6594

    WatchGuard Firebox Single Sign-On Client Denial-of-Service

    Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition…

    WatchGuard SSO Client
  • Critical 9.3
    CVE-2024-6593

    WatchGuard Firebox Single Sign-On Agent Management Interface Authentication Bypass

    Incorrect Authorization vulnerability in WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows allows an attacker with network access to execute restricted management commands. An attacker that has already gained network access could exploit…

    WatchGuard SSO Agent
  • Critical 9.3
    CVE-2024-6592 Public exploit

    WatchGuard Firebox Single Sign-On Agent Protocol Authorization Bypass

    An incorrect authorization vulnerability in the protocol communication between the WatchGuard Authentication Gateway (aka Single Sign-On Agent) on Windows and the WatchGuard Single Sign-On Client on Windows and MacOS allows an attacker with network access to …

    WatchGuard SSO Agent SSO Client