Skip to content
OpenAdvisories

Archive

11 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /11 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

55 results · Clear filters · Feed

  • Medium 6.1
    CVE-2024-9436

    PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes <= 3.5.14 - Reflected Cross-Site Scripting

    The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and i…

    publishpress PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes Web / CMS
  • Medium 6.1
    CVE-2024-9221

    Tainacan <= 0.21.10 - Reflected Cross-Site Scripting

    The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 0.21.10. This makes it possible for unauthenticated attackers to in…

    Tainacan.org Tainacan Web / CMS
  • Medium 6.1
    CVE-2024-9616

    BlockMeister – Block Pattern Builder <= 3.1.10 - Reflected Cross-Site Scripting

    The BlockMeister – Block Pattern Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.10. This makes it possible for unau…

    blockmeister BlockMeister – Block Pattern Builder Web / CMS
  • Medium 6.1
    CVE-2024-9346

    Embed videos and respect privacy <= 1.2 - Reflected Cross-Site Scripting

    The Embed videos and respect privacy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'v' parameter in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for un…

    michaelzangl Embed videos and respect privacy Web / CMS
  • Medium 6.1
    CVE-2024-9611

    Increase upload file size & Maximum Execution Time limit <= 2.0 - Reflected Cross-Site Scripting

    The Increase upload file size & Maximum Execution Time limit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 2.0. This makes it …

    ttodua Increase upload file size & Maximum Execution Time limit Web / CMS
  • Medium 6.5
    CVE-2024-9586

    Linkz.ai <= 1.1.8 - Missing Authorization to Unauthenticated Plugin Settings Update

    The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_auth' and 'check_logout' functions in versions up to, and including, 1.1.8. This makes it possible for unauthenticated attacke…

    vittor1o Linkz.ai – Automatic link previews on hover Web / CMS
  • Medium 5.4
    CVE-2024-9587

    Linkz.ai <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via AJAX

    The Linkz.ai plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_linkz' function in versions up to, and including, 1.1.8. This makes it possible for authenticated attackers with contributor-le…

    vittor1o Linkz.ai – Automatic link previews on hover Web / CMS
  • Medium 6.4
    CVE-2024-9543

    Powerpress <= 11.9.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via skipto Shortcode

    The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'skipto' shortcode in all versions up to, and including, 11.9.18 due to insufficient input sanitization and output escaping on user …

    blubrry PowerPress Podcasting plugin by Blubrry Web / CMS
  • Medium 6.1
    CVE-2024-48937

    Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of …

    znuny znuny Debian Ubuntu
  • Medium 6.6
    CVE-2024-48987

    Snipe-IT remote code execution

    Snipe-IT before 7.0.10 allows remote code execution (associated with cookie serialization) when an attacker knows the APP_KEY. This is exacerbated by .env files, available from the product's repository, that have default APP_KEY values.

    snipe/snipe-it Packagist
  • Medium 6.5
    CVE-2024-46215

    A vulnerability was discovered in KM08-708H-v1.1, There is a buffer overflow in the sub_445BDC() function within the /u…

  • Medium 6.2
    CVE-2024-45184

    An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modems with chipset Exynos 9820, 9825, 980…

  • Medium 4.7
    CVE-2024-44731

    Mirotalk before commit 9de226 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allo…

  • Medium 6.5
    CVE-2024-44415

    A vulnerability was discovered in DI_8200-16.07.26A1, There is a buffer overflow in the dbsrv_asp function; The strcpy …

  • Medium 5.3
    CVE-2024-44807

    A directory listing issue in the baserCMS plugin in D-ZERO CO., LTD. BurgerEditor and BurgerEditor Limited Edition befo…