Skip to content
OpenAdvisories

Archive

17 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /17 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

65 results · Clear filters · Feed

  • High 7.6
    CVE-2024-43579

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • High 7.6
    CVE-2024-43578

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • High 7.5
    CVE-2024-43566

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • High 7.8
    CVE-2024-10093

    VSO ConvertXtoDvd ConvertXtoDvd.exe uncontrolled search path

    A vulnerability, which was classified as critical, was found in VSO ConvertXtoDvd 7.0.0.83. Affected is an unknown function in the library avcodec.dll of the file ConvertXtoDvd.exe. The manipulation leads to uncontrolled search path. Attacking locally is a re…

    VSO ConvertXtoDvd
  • High 8.7
    CVE-2024-48924

    MessagePack allows untrusted data to lead to DoS attack due to hash collisions and stack overflow

    ### Impact When this library is used to deserialize messagepack data from an untrusted source, there is a risk of a denial of service attack by an attacker that sends data contrived to produce hash collisions, leading to large CPU consumption disproportionate…

    MessagePack-CSharp MessagePack-CSharp python-msgpack MessagePack Azure Linux NuGet
  • High 7.1
    CVE-2024-49248

    WordPress Ad Inserter plugin <= 2.7.37 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spacetime Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through <= 2.7.37.

    spacetime Ad Inserter
  • High 7.1
    CVE-2024-49276

    WordPress Clio Grow plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cliogrow Clio Grow clio-grow-form allows Reflected XSS.This issue affects Clio Grow: from n/a through <= 1.0.2.

    cliogrow Clio Grow
  • High 7.1
    CVE-2024-49283

    WordPress CURCY plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows Reflected XSS.This issue affects CURCY: from n/a through <= 2.2.3.

    villatheme CURCY
  • High 7.1
    CVE-2024-49308

    WordPress Animator – Scroll Triggered Animations plugin <= 3.0.15 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Animator scroll-triggered-animations allows Reflected XSS.This issue affects Animator: from n/a through <= 3.0.15.

    Toast Plugins Animator
  • High 7.1
    CVE-2024-49309

    WordPress Digitally theme <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omarfolghe Digitally digitally allows Reflected XSS.This issue affects Digitally: from n/a through <= 1.0.8.

    omarfolghe Digitally
  • High 7.1
    CVE-2024-49316

    WordPress Akismet htaccess writer plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zodiac Akismet htaccess writer akismet-htaccess-writer allows Reflected XSS.This issue affects Akismet htaccess writer: from n/a through <= 1.0.1.

    zodiac Akismet htaccess writer
  • High 8.2
    CVE-2024-7755

    HMS Networks EWON FLEXY 202 Insufficiently Protected Credentials

    The EWON FLEXY 202 transmits credentials using a weak encoding method base64. An attacker who is present in the network can sniff the traffic and decode the credentials.

    HMS Networks Ewon Flexy 202
  • High 7.1
    CVE-2024-43997

    WordPress easy.jobs- Best Recruitment Plugin for Job Board Listing, Manager, Career Page for Elementor & Gutenberg plugin <= 2.4.14 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in easy.Jobs EasyJobs allows Reflected XSS.This issue affects EasyJobs: from n/a through 2.4.14.

    easy.jobs EasyJobs
  • High 7.1
    CVE-2024-49220

    WordPress Cookie Scanner plugin <= 1.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Nikel Cookie Scanner cookie-scanner allows Cross Site Request Forgery.This issue affects Cookie Scanner: from n/a through <= 1.1.

    Nikel Cookie Scanner
  • High 7.1
    CVE-2024-49221

    WordPress cSlider plugin <= 2.4.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in julian.weinert cSlider cslider allows Cross Site Request Forgery.This issue affects cSlider: from n/a through <= 2.4.2.

    julian.weinert cSlider
  • High 7.1
    CVE-2024-49223

    WordPress CJ Change Howdy plugin <= 3.3.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Change Howdy cj-change-howdy allows Cross Site Request Forgery.This issue affects CJ Change Howdy: from n/a through <= 3.3.1.

    shibulijack CJ Change Howdy
  • High 7.1
    CVE-2024-49229

    WordPress Better Author Bio plugin <= 2.7.10.11 - CSRF to Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arifnezami Better Author Bio better-author-bio allows Reflected XSS.This issue affects Better Author Bio: from n/a through <= 2.7.10.11.

    arifnezami Better Author Bio
  • High 7.1
    CVE-2024-49237

    WordPress Ahmeti Wp Timeline plugin <= 5.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ahmeti Ahmeti Wp Timeline ahmeti-wp-timeline allows Stored XSS.This issue affects Ahmeti Wp Timeline: from n/a through <= 5.1.

    ahmeti Ahmeti Wp Timeline
  • High 7.1
    CVE-2024-49313

    WordPress VKontakte Wall Post plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in rudestan VKontakte Wall Post vkontakte-wall-post allows Stored XSS.This issue affects VKontakte Wall Post: from n/a through <= 2.0.

    rudestan VKontakte Wall Post
  • High 8.8
    CVE-2024-49219

    WordPress RS-Members plugin <= 1.0.3 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in themexpo RS-Members rs-members allows Privilege Escalation.This issue affects RS-Members: from n/a through <= 1.0.3.

    themexpo RS-Members
  • High 8.5
    CVE-2024-47304

    WordPress Fluent Support plugin <= 1.8.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjahan Jewel Fluent Support fluent-support allows SQL Injection.This issue affects Fluent Support: from n/a through <= 1.8.0.

    Shahjahan Jewel Fluent Support
  • High 8.5
    CVE-2024-47312

    WordPress Classic Editor and Classic Widgets plugin <= 1.4.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Grim Classic Editor and Classic Widgets classic-editor-and-classic-widgets allows SQL Injection.This issue affects Classic Editor and Classic Widgets: fro…

    WP Grim Classic Editor and Classic Widgets
  • High 8.5
    CVE-2024-49244

    WordPress SV Product Import Export for WooCommerce plugin <= 1.0.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vrinsoft CSV Product Import Export for WooCommerce csv-wc-product-import-export.This issue affects CSV Product Import Export for WooCommerce: from n/a throug…

    vrinsoft CSV Product Import Export for WooCommerce Web / CMS
  • High 8.5
    CVE-2024-49297

    WordPress Zoho CRM Lead Magnet plugin <= 1.7.9.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows SQL Injection.This issue affects Zoho CRM Lead Magnet: from n/a through <= 1.7.9.7.

    Zoho CRM Zoho CRM Lead Magnet
  • High 7.6
    CVE-2024-49299

    WordPress Surfer plugin <= 1.5.0.502 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Surfer Surfer surferseo allows SQL Injection.This issue affects Surfer: from n/a through <= 1.5.0.502.

    Surfer Surfer
  • High 7.5
    CVE-2024-49235

    WordPress Contact Forms, Live Support, CRM, Video Messages plugin <= 1.10.2 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in videowhisper Contact Forms, Live Support, CRM, Video Messages live-support-tickets allows Retrieve Embedded Sensitive Data.This issue affects Contact Forms, Live Support, CRM, Video Messages: …

    videowhisper Contact Forms, Live Support, CRM, Video Messages
  • High 7.5
    CVE-2024-49285

    WordPress SSV MailChimp plugin <= 3.1.5 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Jeroen Berkvens SSV MailChimp ssv-mailchimp allows PHP Local File Inclusion.This issue affects SSV MailChimp: from n/a through <= 3.1.5.

    Jeroen Berkvens SSV MailChimp
  • High 7.5
    CVE-2024-49287

    WordPress PDF-Rechnungsverwaltung plugin <= 0.0.1 - Local File Inclusion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in mh6webentwicklung PDF-Rechnungsverwaltung pdf-rechnungsverwaltung allows PHP Local File Inclusion.This issue affects PDF-Rechnungsverwaltung: from n/a through <= 0…

    mh6webentwicklung PDF-Rechnungsverwaltung
  • High 7.5
    CVE-2024-49317

    WordPress Point Maker plugin <= 0.1.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ZIPANG Point Maker point-maker allows PHP Local File Inclusion.This issue affects Point Maker: from n/a through <= 0.1.4.

    ZIPANG Point Maker
  • High 8.7
    CVE-2024-49399

    Missing Authentication for Critical Function in Elvaco M-Bus Metering Gateway CMe3100

    The affected product is vulnerable to an attacker being able to use commands without providing a password which may allow an attacker to leak information.

    Elvaco M-Bus Metering Gateway CMe3100
  • High 8.8
    CVE-2024-49398

    Unrestricted Upload of File with Dangerous Type in Elvaco M-Bus Metering Gateway CMe3100

    The affected product is vulnerable to unrestricted file uploads, which may allow an attacker to remotely execute code.

    Elvaco M-Bus Metering Gateway CMe3100
  • High 8.7
    CVE-2024-49396

    Insufficiently Protected Credentials in Elvaco M-Bus Metering Gateway CMe3100

    The affected product is vulnerable due to insufficiently protected credentials, which may allow an attacker to impersonate Elvaco and send false information.

    Elvaco M-Bus Metering Gateway CMe3100
  • High 7.0
    CVE-2024-9414

    Cross-site Scripting vulnerability in LCDS LAquis SCADA

    In LAquis SCADA version 4.7.1.511, a cross-site scripting vulnerability could allow an attacker to inject arbitrary code into a web page. This could allow an attacker to steal cookies, redirect users, or perform unauthorized actions.

    LCDS - Leão Consultoria e Desenvolvimento de Sistemas Ltda ME LAquis SCADA
  • High 7.2
    CVE-2024-6333 Public exploit

    Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products

    Authenticated Remote Code Execution in Altalink, Versalink & WorkCentre Products.

    Xerox WorkCentre 5945/55i AltaLink® B8045 / B8055 / B8065 / B8075 / B8090 | C8030 / C8035 / C8045 / C8055 / C807 WorkCentre 7220/7225i
  • High 8.6
    CVE-2024-49315

    WordPress FREE DOWNLOAD MANAGER plugin <= 1.0.0 - Arbitrary File Deletion vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in CodeFlock FREE DOWNLOAD MANAGER free-download-manager allows Path Traversal.This issue affects FREE DOWNLOAD MANAGER: from n/a through <= 1.0.0.

    CodeFlock FREE DOWNLOAD MANAGER
  • High 8.1
    CVE-2024-49579

    In JetBrains YouTrack before 2024.3.47197 insecure plugin iframe allowed arbitrary JavaScript execution and unauthorize…

    JetBrains YouTrack
  • High 7.1
    CVE-2024-48021

    WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Paterson Contact Form 7 – PayPal & Stripe Add-on contact-form-7-paypal-add-on allows Reflected XSS.This issue affects Contact Form 7 – PayPal & Stripe …

    Scott Paterson Contact Form 7 – PayPal & Stripe Add-on
  • High 7.1
    CVE-2024-48023

    WordPress Restaurant Reservations Widget plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rconnect305 Restaurant Reservations Widget restaurantconnect-reswidget allows Reflected XSS.This issue affects Restaurant Reservations Widget: from n/a throu…

    rconnect305 Restaurant Reservations Widget
  • High 7.1
    CVE-2024-48032

    WordPress Featured Posts with Multiple Custom Groups (FPMCG) plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sumitsurai Featured Posts with Multiple Custom Groups (FPMCG) featured-posts-with-multiple-custom-groups-fpmcg allows Reflected XSS.This issue affects Featur…

    sumitsurai Featured Posts with Multiple Custom Groups (FPMCG)
  • High 7.3
    CVE-2023-6729

    Nokia SR OS: File Access Security Vulnerability

    Nokia SR OS routers allow read-write access to the entire file system via SFTP or SCP for users configured with "access console." Consequently, a low privilege authenticated user with "access console" can read or replace the router configuration file as well …

    Nokia SR OS (7250 IXR, 7450 ESS, 7750 SR, 7950 IXR, VSR), 7705 SAR OS, 7210 SAS OS