Skip to content
OpenAdvisories

Archive

11 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /11 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

9 results · Clear filters · Feed

  • Critical 10.0
    CVE-2024-47875 Public exploit

    DOMPurify nesting-based mXSS

    DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMpurify was vulnerable to nesting-based mXSS. This vulnerability is fixed in 2.5.0 and 3.1.3.

    cure53 DOMPurify cacti argo-workflows Debian Ubuntu Wolfi npm
  • Medium 6.5
    CVE-2024-7514 Public exploit

    WordPress Comments Import & Export <= 2.3.7 - Authenticated (Author+) Arbitrary File Read via Directory Traversal

    The WordPress Comments Import & Export plugin for WordPress is vulnerable to to arbitrary file read due to insufficient file path validation during the comments import process, in versions up to, and including, 2.3.7. This makes it possible for authenticated …

    WebToffee Comments Import & Export Web / CMS
  • Critical 9.8
    CVE-2024-9234 Public exploit Scanner template EPSS 10%

    GutenKit <= 2.1.0 - Unauthenticated Arbitrary File Upload

    The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function (install-active-p…

    Ataur R GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor Web / CMS
  • Critical 9.8
    CVE-2024-9707 Public exploit Scanner template

    Hunk Companion <= 1.8.4 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation/Activation

    The Hunk Companion plugin for WordPress is vulnerable to unauthorized plugin installation/activation due to a missing capability check on the /wp-json/hc/v1/themehunk-import REST API endpoint in all versions up to, and including, 1.8.4. This makes it possible…

    ThemeHunk Hunk Companion Web / CMS
  • Critical 9.8
    CVE-2024-21534 Public exploit

    JSONPath Plus Remote Code Execution (RCE) Vulnerability

    All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. An attacker can execute aribitrary code on the system by exploiting the unsafe default usage of vm in Node. **Note:** There were severa…

    katib-suggestion-hyperopt katib-earlystopping katib-suggestion-pbt-enas katib-suggestion-hyperband Wolfi npm Maven
  • Critical 9.8
    CVE-2024-9822 Public exploit

    Pedalo Connector <= 2.0.5 - Authentication Bypass to Administrator

    The Pedalo Connector plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.5. This is due to insufficient restriction on the 'login_admin_user' function. This makes it possible for unauthenticated attackers to log t…

    pedaloagency Pedalo Connector Web / CMS
  • High 8.8
    CVE-2024-48827 Public exploit

    An issue in sbondCo Watcharr v.1.43.0 allows a remote attacker to execute arbitrary code and escalate privileges via th…

  • Critical 9.8
    CVE-2024-46532 Public exploit

    SQL Injection vulnerability in OpenHIS v.1.0 allows an attacker to execute arbitrary code via the refund function in th…

  • Critical 9.8
    CVE-2024-42640 Public exploit Scanner template EPSS 40%

    angular-base64-upload vulnerable to unauthenticated remote code execution

    angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. Exploiting this vulnerability allows an attacker to upload arbitrary content to the server, which can subsequently be accessed through demo/uplo…

    angular-base64-upload npm