Skip to content
OpenAdvisories

Archive

September 2024

Vulnerabilities first published in this month (UTC), newest first.

← August 2024 2024 / September October 2024 →
  1. 111
  2. 276
  3. 374
  4. 4176
  5. 568
  6. 674
  7. 751
  8. 827
  9. 957
  10. 10237
  11. 11115
  12. 12118
  13. 13152
  14. 1413
  15. 1529
  16. 16164
  17. 17107
  18. 18241
  19. 1961
  20. 2038
  21. 219
  22. 2220
  23. 2362
  24. 2474
  25. 25103
  26. 26119
  27. 27162
  28. 2829
  29. 299
  30. 3066
All Critical High Medium Low Exploited only Public exploit

1,072 results · Clear filters · Feed

  • Medium 4.5
    CVE-2022-39068

    Buffer Overflow Vulnerability in ZTE MF296R

    There is a buffer overflow vulnerability in ZTE MF296R. Due to insufficient validation of the SMS parameter length, an authenticated attacker could use the vulnerability to perform a denial of service attack.

    ZTE MF296R
  • Medium 6.5
    CVE-2023-41611

    Victure PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data.

  • Medium 4.2
    CVE-2024-39081 Public exploit

    An issue in SMART TYRE CAR & BIKE v4.2.0 allows attackers to perform a man-in-the-middle attack via Bluetooth communica…

  • Medium 6.1
    CVE-2024-46372

    DedeCMS 5.7.115 is vulnerable to Cross Site Scripting (XSS) via the advertisement code box in the advertisement managem…

  • Medium 6.5
    CVE-2024-46959

    runofast Indoor Security Camera for Baby Monitor has a default password of password for the root account. This allows a…

  • Medium 6.1
    CVE-2024-43025

    An HTML injection vulnerability in RWS MultiTrans v7.0.23324.2 and earlier allows attackers to alter the HTML-layout an…

  • Medium 6.1
    CVE-2024-43024

    Multiple stored cross-site scripting (XSS) vulnerabilities in RWS MultiTrans v7.0.23324.2 and earlier allow attackers t…

  • Medium 5.9
    CVE-2024-43972

    WordPress Page Builder: Pagelayer – Drag and Drop website builder plugin <= 1.8.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Pagelayer Team PageLayer allows Stored XSS.This issue affects PageLayer: from n/a through 1.8.7.

    Pagelayer Team PageLayer
  • Medium 6.5
    CVE-2024-43983

    WordPress Podlove Podcast Publisher plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Podlove Podlove Podcast Publisher allows Stored XSS.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.

    Podlove Podlove Podcast Publisher
  • Medium 6.5
    CVE-2024-43987

    WordPress Sliding Door theme <= 3.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wayneconnor Sliding Door allows Stored XSS.This issue affects Sliding Door: from n/a through 3.6.

    wayneconnor Sliding Door
  • Medium 6.5
    CVE-2024-43988

    WordPress Mystique theme <= 2.5.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in digitalnature Mystique allows Stored XSS.This issue affects Mystique: from n/a through 2.5.7.

    digitalnature Mystique
  • Medium 6.5
    CVE-2024-43991

    WordPress Hotel Galaxy theme <= 4.4.24 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in webdzier Hotel Galaxy allows Stored XSS.This issue affects Hotel Galaxy: from n/a through 4.4.24.

    webdzier Hotel Galaxy
  • Medium 6.5
    CVE-2024-43992

    WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Latepoint LatePoint allows Stored XSS.This issue affects LatePoint: from n/a through 4.9.91.

    latepoint LatePoint
  • Medium 6.5
    CVE-2024-43993

    WordPress Liquido theme <= 1.0.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Liquido allows Stored XSS.This issue affects Liquido: from n/a through 1.0.1.2.

    CryoutCreations Liquido
  • Medium 6.5
    CVE-2024-43994

    WordPress Kahuna theme <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CryoutCreations Kahuna allows Stored XSS.This issue affects Kahuna: from n/a through 1.7.0.

    CryoutCreations Kahuna
  • Medium 6.5
    CVE-2024-43995

    WordPress Posterity theme <= 3.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in sonalsinha21 Posterity allows Stored XSS.This issue affects Posterity: from n/a through 3.6.

    sonalsinha21 Posterity
  • Medium 5.9
    CVE-2024-43999

    WordPress Ninja Forms plugin <= 3.8.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11.

    Saturday Drive Ninja Forms
  • Medium 6.5
    CVE-2024-44001

    WordPress Royal Elementor Addons and Templates plugin <= 1.3.982 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons.This issue affects Royal Elementor Addons: from n/a through <= 1.3.982.

    WP Royal Royal Elementor Addons
  • Medium 6.5
    CVE-2024-44005

    WordPress Greenshift plugin <= 9.3.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 9.3.7.

    wpsoul Greenshift
  • Medium 6.5
    CVE-2024-44008

    WordPress Geo Mashup plugin <= 1.13.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through <= 1.13.12.

    Dylan Kuhn Geo Mashup
  • Medium 6.5
    CVE-2024-44047

    WordPress IMPress for IDX Broker plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through <= 3.2.2.

    IDX Broker IMPress for IDX Broker
  • Medium 6.5
    CVE-2024-44049

    WordPress Gutenberg Blocks – Unlimited blocks For Gutenberg plugin <= 1.2.8 - Authenticated Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.

    ThemeHunk Gutenberg Blocks
  • Medium 5.9
    CVE-2024-43985

    WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagePeople Team Bus Ticket Booking with Seat Reservation allows Stored XSS.This issue affects Bus Ticket Booking with Seat Reservation: from n/a throu…

    MagePeople Team Bus Ticket Booking with Seat Reservation
  • Medium 6.5
    CVE-2024-43977

    WordPress The Plus Addons for Elementor plugin <= 5.6.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for …

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • Medium 5.9
    CVE-2024-37985

    Windows Kernel Information Disclosure Vulnerability

    Windows Kernel Information Disclosure Vulnerability

    Microsoft Windows 11 version 22H2 Windows 11 version 22H3 Windows
  • Medium 6.5
    CVE-2024-44050

    WordPress Verbosa theme <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Verbosa verbosa allows Stored XSS.This issue affects Verbosa: from n/a through <= 1.2.3.

    CryoutCreations Verbosa
  • Medium 6.5
    CVE-2024-44051

    WordPress Content Blocks (Custom Post Widget) plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johan van der Wijk Content Blocks (Custom Post Widget) custom-post-widget allows Stored XSS.This issue affects Content Blocks (Custom Post Widget): from n/a …

    Johan van der Wijk Content Blocks (Custom Post Widget)
  • Medium 6.5
    CVE-2024-45451

    WordPress Roseta theme <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Roseta roseta allows Stored XSS.This issue affects Roseta: from n/a through <= 1.3.0.

    CryoutCreations Roseta
  • Medium 6.5
    CVE-2024-45452

    WordPress Septera theme <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cryout-creations Septera septera allows Stored XSS.This issue affects Septera: from n/a through <= 1.5.1.

    CryoutCreations Septera
  • Medium 6.1
    CVE-2024-8907

    Insufficient data validation in Omnibox in Google Chrome on Android prior to 129.0.6668.58 allowed a remote attacker wh…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 4.3
    CVE-2024-8909

    Inappropriate implementation in UI in Google Chrome on iOS prior to 129.0.6668.58 allowed a remote attacker to perform …

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 4.3
    CVE-2024-8906

    Incorrect security UI in Downloads in Google Chrome prior to 129.0.6668.58 allowed a remote attacker who convinced a us…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 4.3
    CVE-2024-8908

    Inappropriate implementation in Autofill in Google Chrome prior to 129.0.6668.58 allowed a remote attacker to perform U…

    Google Chrome chromium chromium Browsers Debian Wolfi
  • Medium 6.5
    CVE-2024-45815

    Prototype pollution in @backstage/plugin-catalog-backend

    Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. T…

    backstage backstage @backstage/plugin-catalog-backend npm
  • Medium 6.5
    CVE-2024-45816

    Storage bucket Directory Traversal in @backstage/plugin-techdocs-backend

    Backstage is an open framework for building developer portals. When using the AWS S3 or GCS storage provider for TechDocs it is possible to access content in the entire storage bucket. This can leak contents of the bucket that are not intended to be accessibl…

    backstage backstage @backstage/plugin-techdocs-backend npm
  • Medium 6.5
    CVE-2024-46976

    Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backend

    Backstage is an open framework for building developer portals. An attacker with control of the contents of the TechDocs storage buckets is able to inject executable scripts in the TechDocs content that will be executed in the victim's browser when browsing do…

    backstage backstage @backstage/plugin-techdocs-backend npm
  • Medium 6.4
    CVE-2024-45812

    DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite

    Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`/`iife`/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-si…

    vitejs vite vite vite Wolfi npm
  • Medium 4.8
    CVE-2024-45811

    server.fs.deny bypassed when using ?import&raw in vite

    Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitat…

    vitejs vite vite vite Wolfi npm
  • Medium 4.3
    CVE-2024-45604

    Directory traversal in the file selector widget in contao/core-bundle

    Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability.

    contao contao contao/core-bundle Packagist
  • Medium 6.5
    CVE-2024-45605

    Improper authorization on deletion of user issue alert notifications in sentry

    Sentry is a developer-first error tracking and performance monitoring platform. An authenticated user delete the user issue alert notifications for arbitrary users given a know alert ID. A patch was issued to ensure authorization checks are properly scoped on…

    getsentry sentry sentry PyPI