Skip to content
OpenAdvisories

Archive

6 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /6 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

85 results · Feed

  • High 8.8
    CVE-2024-9563

    D-Link DIR-605L formWlanSetup_Wizard buffer overflow

    A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. This issue affects the function formWlanSetup_Wizard of the file /goform/formWlanSetup_Wizard. The manipulation of the argument webpage leads to buffer overflow…

    D-Link DIR-605L Network devices
  • High 8.8
    CVE-2024-9562

    D-Link DIR-605L formSetWizard2 buffer overflow

    A vulnerability classified as critical was found in D-Link DIR-605L 2.13B01 BETA. This vulnerability affects the function formSetWizard1/formSetWizard2. The manipulation of the argument curTime leads to buffer overflow. The attack can be initiated remotely. T…

    D-Link DIR-605L Network devices
  • High 8.8
    CVE-2024-9561

    D-Link DIR-605L formSetWAN_Wizard52 buffer overflow

    A vulnerability classified as critical has been found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetWAN_Wizard51/formSetWAN_Wizard52. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack …

    D-Link DIR-605L Network devices
  • Medium 6.3
    CVE-2024-9560

    ESAFENET CDG Catelogs;logindojojs delCatelogs sql injection

    A vulnerability was found in ESAFENET CDG V5. It has been rated as critical. Affected by this issue is the function delCatelogs of the file /CDGServer3/document/Catelogs;logindojojs?command=DelCatelogs. The manipulation of the argument id leads to sql injecti…

    ESAFENET CDG
  • High 8.8
    CVE-2024-9559

    D-Link DIR-605L formWlanSetup buffer overflow

    A vulnerability was found in D-Link DIR-605L 2.13B01 BETA. It has been classified as critical. Affected is the function formWlanSetup of the file /goform/formWlanSetup. The manipulation of the argument webpage leads to buffer overflow. It is possible to launc…

    D-Link DIR-605L Network devices
  • High 8.8
    CVE-2024-9558

    D-Link DIR-605L formSetWanPPTP buffer overflow

    A vulnerability was found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This issue affects the function formSetWanPPTP of the file /goform/formSetWanPPTP. The manipulation of the argument webpage leads to buffer overflow. The attack may be initi…

    D-Link DIR-605L Network devices
  • High 8.8
    CVE-2024-9557

    D-Link DIR-605L formSetWanPPPoE buffer overflow

    A vulnerability has been found in D-Link DIR-605L 2.13B01 BETA and classified as critical. This vulnerability affects the function formSetWanPPPoE of the file /goform/formSetWanPPPoE. The manipulation of the argument webpage leads to buffer overflow. The atta…

    D-Link DIR-605L Network devices
  • High 8.8
    CVE-2024-9556

    D-Link DIR-605L formSetEnableWizard buffer overflow

    A vulnerability, which was classified as critical, was found in D-Link DIR-605L 2.13B01 BETA. This affects the function formSetEnableWizard of the file /goform/formSetEnableWizard. The manipulation of the argument curTime leads to buffer overflow. It is possi…

    D-Link DIR-605L Network devices
  • High 8.8
    CVE-2024-9555

    D-Link DIR-605L formSetEasy_Wizard buffer overflow

    A vulnerability, which was classified as critical, has been found in D-Link DIR-605L 2.13B01 BETA. Affected by this issue is the function formSetEasy_Wizard of the file /goform/formSetEasy_Wizard. The manipulation of the argument curTime leads to buffer overf…

    D-Link DIR-605L Network devices
  • High 8.5
    CVE-2024-47338

    WordPress WPExperts Square For GiveWP plugin <= 1.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal WPExperts Square For GiveWP wpexperts-square-for-give allows SQL Injection.This issue affects WPExperts Square For GiveWP: from n/a through <= 1.3.

    Saad Iqbal WPExperts Square For GiveWP
  • Critical 9.3
    CVE-2024-47350

    WordPress YITH WooCommerce Ajax Search plugin <= 2.8.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YITHEMES YITH WooCommerce Ajax Search yith-woocommerce-ajax-search.This issue affects YITH WooCommerce Ajax Search: from n/a through <= 2.8.0.

    YITHEMES YITH WooCommerce Ajax Search Web / CMS
  • Medium 6.5
    CVE-2024-47650

    WordPress WP-WebAuthn plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Axton WP-WebAuthn wp-webauthn allows Stored XSS.This issue affects WP-WebAuthn: from n/a through <= 1.3.1.

    axton WP-WebAuthn
  • Medium 5.1
    CVE-2024-44010

    WordPress Full frame theme <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchthemes Full frame full-frame allows Stored XSS.This issue affects Full frame: from n/a through <= 2.7.2.

    Catch Themes Full frame
  • Medium 6.5
    CVE-2024-44022

    WordPress Review & testimonial widgets plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Trustmary Review & testimonial widgets trustmary allows Stored XSS.This issue affects Review & testimonial widgets: from n/a through <= 1.0.5.

    Trustmary Review & testimonial widgets
  • Medium 6.5
    CVE-2024-44024

    WordPress Medical Addon for Elementor plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Medical Addon for Elementor medical-addon-for-elementor allows Stored XSS.This issue affects Medical Addon for Elementor: from n/a through <= 1.6…

    nicheaddons Medical Addon for Elementor
  • Medium 6.5
    CVE-2024-44025

    WordPress NiceJob plugin < 3.6.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through < 3.6.5.

    nicejob NiceJob
  • Medium 6.5
    CVE-2024-44026

    WordPress Charity Addon for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Charity Addon for Elementor charity-addon-for-elementor allows Stored XSS.This issue affects Charity Addon for Elementor: from n/a through <= 1.3…

    nicheaddons Charity Addon for Elementor
  • Medium 6.5
    CVE-2024-44027

    WordPress Gum Elementor Addon plugin <= 1.3.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.6.

    Atawai Gum Elementor Addon
  • High 7.1
    CVE-2024-44028

    WordPress NiceJob plugin < 3.6.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in nicejob NiceJob nicejob allows Stored XSS.This issue affects NiceJob: from n/a through < 3.6.5.

    nicejob NiceJob
  • High 7.1
    CVE-2024-44029

    WordPress Viala theme <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in David Garlitz viala allows Reflected XSS.This issue affects viala: from n/a through 1.3.1.

    David Garlitz viala
  • Medium 6.5
    CVE-2024-44032

    WordPress Restaurant & Cafe Addon for Elementor plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Restaurant & Cafe Addon for Elementor restaurant-cafe-addon-for-elementor allows Stored XSS.This issue affects Restaurant & Cafe Addon for Elemen…

    nicheaddons Restaurant & Cafe Addon for Elementor
  • Critical 9.8
    CVE-2024-45252

    Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    Elsight Halo version 11.7.1.5
  • Critical 9.8
    CVE-2024-45251

    Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    Elsight Halo version 11.7.1.5
  • Medium 4.3
    CVE-2024-45250

    ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor

    ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor

    ZKTeco iClock v3.1-168
  • Critical 9.8
    CVE-2024-45249

    Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

    Cavok Cavok
  • High 7.5
    CVE-2024-45248

    Multi-DNC – CWE-35: Path Traversal: '.../...//'

    Multi-DNC – CWE-35: Path Traversal: '.../...//'

    Multi-DNC Multi-DNC
  • Medium 6.5
    CVE-2024-44033

    WordPress Primary Addon for Elementor plugin <= 1.5.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.5…

    nicheaddons Primary Addon for Elementor
  • Medium 6.5
    CVE-2024-44035

    WordPress Gum Elementor Addon plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Stored XSS.This issue affects Gum Elementor Addon: from n/a through <= 1.3.7.

    Atawai Gum Elementor Addon
  • Medium 5.9
    CVE-2024-44036

    WordPress Kodex Posts likes plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lebedel Kodex Posts likes kodex-posts-likes allows Stored XSS.This issue affects Kodex Posts likes: from n/a through <= 2.5.0.

    Pierre Lebedel Kodex Posts likes
  • Medium 5.9
    CVE-2024-44037

    WordPress Multipurpose Ticket Booking Manager plugin <= 4.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magepeopleteam Multipurpose Ticket Booking Manager bus-booking-manager allows Stored XSS.This issue affects Multipurpose Ticket Booking Manager: from n/a thr…

    MagePeople Team Multipurpose Ticket Booking Manager
  • Medium 5.9
    CVE-2024-44039

    WordPress WP Travel plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel wp-travel allows Stored XSS.This issue affects WP Travel: from n/a through <= 9.3.1.

    WP Travel WP Travel
  • Medium 5.9
    CVE-2024-44040

    WordPress ShiftController Employee Shift Scheduling plugin <= 4.9.64 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware ShiftController Employee Shift Scheduling shiftcontroller allows Stored XSS.This issue affects ShiftController Employee Shift Scheduling: from n/a …

    plainware ShiftController Employee Shift Scheduling
  • Medium 5.9
    CVE-2024-44041

    WordPress IdeaPush plugin <= 8.66 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Northern Beaches Websites IdeaPush ideapush allows Stored XSS.This issue affects IdeaPush: from n/a through <= 8.66.

    Northern Beaches Websites IdeaPush
  • Medium 5.9
    CVE-2024-44042

    WordPress WP Datepicker plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fahad Mahmood WP Datepicker wp-datepicker allows Stored XSS.This issue affects WP Datepicker: from n/a through <= 2.1.1.

    Fahad Mahmood WP Datepicker
  • Medium 5.9
    CVE-2024-44043

    WordPress Photo Gallery by 10Web plugin <= 1.8.27 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Photo Gallery by 10Web photo-gallery allows Stored XSS.This issue affects Photo Gallery by 10Web: from n/a through <= 1.8.27.

    10web Photo Gallery by 10Web
  • Medium 5.9
    CVE-2024-44045

    WordPress WP Abstracts plugin <= 2.6.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows Stored XSS.This issue affects WP Abstracts: from n/a through <= 2.6.5.

    Kevon Adonis WP Abstracts
  • Medium 6.1
    CVE-2024-45247

    Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

    Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

    Sonarr Sonarr
  • High 7.3
    CVE-2024-45246

    Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element

    Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element

    Diebold Nixdorf Vynamic View prior to v5.9.5
  • Medium 5.9
    CVE-2024-44046

    WordPress Themify plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify – WooCommerce Product Filter themify-wc-product-filter allows Stored XSS.This issue affects Themify – WooCommerce Product Filter: from n/a …

    themifyme Themify – WooCommerce Product Filter Web / CMS
  • High 7.1
    CVE-2024-45454

    WordPress Unlimited Elements for Elementor plugin <= 1.5.121 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affect…

    Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates)