Skip to content
OpenAdvisories

Archive

30 September 2024

Vulnerabilities first published on this day (UTC), newest first.

← August 2024 2024 / September /30 October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

66 results · Feed

  • Medium 5.4
    CVE-2024-8536

    Ultimate Blocks < 3.2.2 - Contributor+ Stored XSS

    The Ultimate Blocks WordPress plugin before 3.2.2 does not validate and escape some of its block attributes before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cros…

    Web / CMS
  • Medium 4.8
    CVE-2024-8283

    Slider by 10Web < 1.2.59 - Admin+ Stored XSS

    The Slider by 10Web WordPress plugin before 1.2.59 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (f…

    Web / CMS
  • Medium 5.4
    CVE-2024-8239

    Starbox < 3.5.3 - Contributor+ Stored XSS

    The Starbox WordPress plugin before 3.5.3 does not properly render social media profiles URLs in certain contexts, like the malicious user's profile or pages where the starbox shortcode is used, which may be abused by users with at least the contributor role …

    Web / CMS
  • Medium 4.8
    CVE-2024-3635

    The Post Grid < 7.5.0 - Editor+ Stored XSS via Grid Creation

    The Post Grid WordPress plugin before 7.5.0 does not sanitise and escape some of its Grid settings, which could allow high privilege users such as Editor and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disa…

    Web / CMS
  • Medium 4.3
    CVE-2024-35495

    An Information Disclosure vulnerability in the Telemetry component in TP-Link Kasa KP125M V1.0.0 and Tapo P125M 1.0.0 B…

  • Medium 6.6
    CVE-2024-28810

    An issue was discovered in Infinera hiT 7300 5.60.50. Sensitive information inside diagnostic files (exported by the @C…

  • Medium 6.5
    CVE-2024-28807

    An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive information in the memory of the @…

  • Low 2.7
    CVE-2024-28808

    An issue was discovered in Infinera hiT 7300 5.60.50. Hidden functionality in the web interface allows a remote authent…

  • High 8.8
    CVE-2024-28812

    An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service (on the local management network interface) …

  • Low 3.3
    CVE-2024-28811

    An issue was discovered in Infinera hiT 7300 5.60.50. A web application allows a remote privileged attacker to execute …

  • High 8.4
    CVE-2024-28813

    An issue was discovered in Infinera hiT 7300 5.60.50. Undocumented privileged functions in the @CT management applicati…

  • High 8.8
    CVE-2024-28809

    An issue was discovered in Infinera hiT 7300 5.60.50. Cleartext storage of sensitive password in firmware update packag…

  • Critical 9.8
    CVE-2024-46293

    Sourcecodester Online Medicine Ordering System 1.0 is vulnerable to Incorrect Access Control. There is a lack of author…

  • High 7.6
    CVE-2024-46549

    An issue in the TP-Link MQTT Broker and API gateway of TP-Link Kasa KP125M v1.0.3 allows attackers to establish connect…

  • High 7.5
    CVE-2024-46511

    LoadZilla LLC LoadLogic v1.4.3 was discovered to contain insecure permissions vulnerability which allows a remote attac…

  • High 8.8
    CVE-2024-46280

    PIX-LINK LV-WR22 RE3002-P1-01_V117.0 is vulnerable to Improper Access Control. The TELNET service is enabled with weak …

  • Medium 4.8
    CVE-2024-46475

    A reflected cross-site scripting (XSS) vulnerability on the homepage of Metronic Admin Dashboard Template v2.0 allows a…

  • Medium 6.3
    CVE-2024-46540

    A remote code execution (RCE) vulnerability in the component /admin/store.php of Emlog Pro before v2.3.15 allows attack…

  • Medium 5.9
    CVE-2024-46635 Public exploit

    An issue in the API endpoint /AccountMaster/GetCurrentUserInfo of INROAD before v202402060 allows attackers to access s…

  • High 8.0
    CVE-2024-46313

    TP-Link WR941ND V6 has a stack overflow vulnerability in the ssid parameter in /userRpm/popupSiteSurveyRpm.htm.

  • Medium 6.3
    CVE-2024-46548

    TP-Link Tapo P125M and Kasa KP125M v1.0.3 was discovered to improperly validate certificates, allowing attackers to eav…

  • High 7.6
    CVE-2024-46510

    ESAFENET CDG v5 was discovered to contain a SQL injection vulnerability via the id parameter in the NavigationAjax inte…

  • Medium 6.5
    CVE-2024-45993

    Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.

    giflib giflib-utils giflib-dev giflib-doc Debian Wolfi
  • Medium 6.3
    CVE-2024-45200 Public exploit

    In Nintendo Mario Kart 8 Deluxe before 3.0.3, the LAN/LDN local multiplayer implementation allows a remote attacker to …

  • Medium 5.4
    CVE-2024-45920

    A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts…

  • Critical 10.0
    CVE-2024-42017

    An issue was discovered in Atos Eviden iCare 2.7.1 through 2.7.11. The application exposes a web interface locally. In …