Skip to content
OpenAdvisories

Archive

17 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /17 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

76 results · Clear filters · Feed

  • Medium 5.9
    CVE-2024-49023

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 6.5
    CVE-2024-43596

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 5.9
    CVE-2024-43587

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 6.5
    CVE-2024-43595

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 5.4
    CVE-2024-43580

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

    Microsoft Edge (Chromium-based) Spoofing Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 5.9
    CVE-2024-7316

    Denial of Service (DoS) Vulnerability in Mitsubishi Electric CNC Series

    Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric CNC Series allows a remote unauthenticated attacker to cause Denial of Service (DoS) condition on the product by sending specially crafted packets to TCP port 683, causing…

    Mitsubishi Electric Mitsubishi Electric CNC M80 Series M80W Mitsubishi Electric CNC M70V Series M70V Mitsubishi Electric CNC M800V Series M800VW ICS / OT
  • Medium 6.5
    CVE-2024-49255

    WordPress Da Reactions plugin <= 5.1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniele Alessandra Da Reactions da-reactions allows Stored XSS.This issue affects Da Reactions: from n/a through <= 5.1.5.

    Daniele Alessandra Da Reactions
  • Medium 6.5
    CVE-2024-49259

    WordPress Primary Addon for Elementor plugin <= 1.5.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Primary Addon for Elementor primary-addon-for-elementor allows Stored XSS.This issue affects Primary Addon for Elementor: from n/a through <= 1.5…

    nicheaddons Primary Addon for Elementor
  • Medium 6.5
    CVE-2024-49261

    WordPress Arkhe Blocks plugin <= 2.23.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryo Arkhe Blocks arkhe-blocks.This issue affects Arkhe Blocks: from n/a through <= 2.23.0.

    Ryo Arkhe Blocks
  • Medium 6.5
    CVE-2024-49262

    WordPress Country Flags for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in wepic Country Flags for Elementor allows Stored XSS.This issue affects Country Flags for Elementor: from n/a through 1.0.1.

    wepic Country Flags for Elementor
  • Medium 6.5
    CVE-2024-49263

    WordPress My Favorites plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Matsuyama My Favorites my-favorites allows Stored XSS.This issue affects My Favorites: from n/a through <= 1.4.1.

    Takashi Matsuyama My Favorites
  • Medium 6.5
    CVE-2024-49264

    WordPress Events Addon for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicheaddons Events Addon for Elementor events-addon-for-elementor allows Stored XSS.This issue affects Events Addon for Elementor: from n/a through <= 2.2.0.

    nicheaddons Events Addon for Elementor
  • Medium 6.5
    CVE-2024-49277

    WordPress UltraAddons – Elementor Addons plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Stored XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.

    Saiful Islam UltraAddons Elementor Lite
  • Medium 6.5
    CVE-2024-49278

    WordPress Omnipress plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows Stored XSS.This issue affects Omnipress: from n/a through <= 1.4.3.

    omnipressteam Omnipress
  • Medium 6.5
    CVE-2024-49279

    WordPress Hyperlink Group Block plugin <= 1.17.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-block allows Stored XSS.This issue affects Hyperlink Group Block: from n/a through <= 1.17.5.

    Daniel Floeter Hyperlink Group Block
  • Medium 6.5
    CVE-2024-49280

    WordPress Lightbox slider -- Responsive Lightbox Gallery plugin <= 1.10.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin Lightbox slider – Responsive Lightbox Gallery simple-lightbox-gallery allows Stored XSS.This issue affects Lightbox slid…

    Weblizar – WordPress Themes & Plugin Lightbox slider – Responsive Lightbox Gallery
  • Medium 6.5
    CVE-2024-49281

    WordPress Click to Chat – WP Support All-in-One Floating Widget plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Ninja Team Click to Chat – WP Support All-in-One Floating Widget support-chat allows Stored XSS.This issue affects Click to Chat – WP Support All-in-On…

    Ninja Team Click to Chat – WP Support All-in-One Floating Widget
  • Medium 5.9
    CVE-2024-49282

    WordPress Responsive Lightbox & Gallery plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Responsive Lightbox responsive-lightbox allows Stored XSS.This issue affects Responsive Lightbox: from n/a through <= 2.4.8.

    dfactory Responsive Lightbox
  • Medium 5.9
    CVE-2024-49288

    WordPress Email Template Customizer for WooCommerce plugin <= 1.2.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for Woo…

    villatheme Email Template Customizer for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2024-49289

    WordPress Cooked Pro plugin < 1.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gora Tech LLC Cooked Pro allows Stored XSS.This issue affects Cooked Pro: from n/a before 1.8.0.

    Gora Tech Cooked Pro
  • Medium 6.5
    CVE-2024-49292

    WordPress Exclusive Addons for Elementor plugin <= 2.7.1 - Cross-Site Scripting vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor exclusive-addons-for-elementor allows Stored XSS.This issue affects Exclusive Addons Elementor: from n/a through <= 2…

    Tim Strifler Exclusive Addons Elementor
  • Medium 5.9
    CVE-2024-49295

    WordPress Simple Testimonials Showcase plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PressTigers Simple Testimonials Showcase simple-testimonials-showcase allows Stored XSS.This issue affects Simple Testimonials Showcase: from n/a through <= …

    PressTigers Simple Testimonials Showcase
  • Medium 6.5
    CVE-2024-49296

    WordPress Custom Add to Cart Button Label and Link plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JC Custom Add to Cart Button Label and Link woo-custom-cart-button allows Stored XSS.This issue affects Custom Add to Cart Button Label and Link: from n/a th…

    JC Custom Add to Cart Button Label and Link
  • Medium 6.5
    CVE-2024-49298

    WordPress PeproDev Ultimate Invoice plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice pepro-ultimate-invoice allows Stored XSS.This issue affects PeproDev Ultimate Invoice: from n/a through <= 2.0.6.

    Pepro Dev. Group PeproDev Ultimate Invoice
  • Medium 6.5
    CVE-2024-49301

    WordPress G Meta Keywords plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sinan Yorulmaz G Meta Keywords g-meta-keywords allows Stored XSS.This issue affects G Meta Keywords: from n/a through <= 1.4.

    Sinan Yorulmaz G Meta Keywords
  • Medium 6.5
    CVE-2024-49302

    WordPress WordPress Portfolio Builder – Portfolio Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gallery uber-grid allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: …

    portfoliohub WordPress Portfolio Builder – Portfolio Gallery Web / CMS
  • Medium 6.5
    CVE-2024-49307

    WordPress Admin Management Xtended plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpseek Admin Management Xtended admin-management-xtended allows Stored XSS.This issue affects Admin Management Xtended : from n/a through <= 2.4.6.

    wpseek Admin Management Xtended
  • Medium 6.5
    CVE-2024-49310

    WordPress Themesflat Addons For Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesflat themesflat-addons-for-elementor themesflat-addons-for-elementor allows Stored XSS.This issue affects themesflat-addons-for-elementor: from n/a thr…

    Themesflat themesflat-addons-for-elementor
  • Medium 6.5
    CVE-2024-49311

    WordPress Edwiser Bridge plugin <= 3.0.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Stored XSS.This issue affects Edwiser Bridge: from n/a through <= 3.0.7.

    WisdmLabs Edwiser Bridge
  • Medium 6.5
    CVE-2024-49319

    WordPress Awesome Contact Form7 for Elementor plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in B.M. Rafiul Alam Awesome Contact Form7 for Elementor awesome-contact-form7-for-elementor.This issue affects Awesome Contact Form7 for Elementor: from n/a thr…

    B.M. Rafiul Alam Awesome Contact Form7 for Elementor
  • Medium 6.1
    CVE-2024-10099

    Stored XSS in comfyanonymous/comfyui

    A stored cross-site scripting (XSS) vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the `/api/upload/image` endpoint. The …

    comfyanonymous comfyanonymous/comfyui
  • Medium 5.4
    CVE-2024-10101

    Stored XSS in binary-husky/gpt_academic

    A stored cross-site scripting (XSS) vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability occurs at the /file endpoint, which renders HTML files. Malicious HTML files containing XSS payloads can be uploaded and stored in the backen…

    binary-husky binary-husky/gpt_academic
  • Medium 6.5
    CVE-2024-10100

    Path Traversal in binary-husky/gpt_academic

    A path traversal vulnerability exists in binary-husky/gpt_academic version 3.83. The vulnerability is due to improper handling of the file parameter, which is open to path traversal through URL encoding. This allows attackers to view any file on the host syst…

    binary-husky binary-husky/gpt_academic
  • Medium 5.4
    CVE-2024-49304

    WordPress Pinpoint Booking System plugin <= 2.9.9.5.7 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Stored XSS.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.

    dotonpaper Pinpoint Booking System
  • Medium 5.3
    CVE-2024-49284

    WordPress WP SendFox plugin <= 1.3.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BogdanFix WP SendFox wp-sendfox allows Retrieve Embedded Sensitive Data.This issue affects WP SendFox: from n/a through <= 1.3.1.

    BogdanFix WP SendFox
  • Medium 4.9
    CVE-2024-49312

    WordPress Edwiser Bridge plugin <= 3.0.7 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge.This issue affects Edwiser Bridge: from n/a through <= 3.0.7.

    WisdmLabs Edwiser Bridge
  • Medium 5.0
    CVE-2024-10073

    flairNLP flair Mode File Loader clustering.py ClusteringModel code injection

    A vulnerability, which was classified as critical, was found in flairNLP flair 0.14.0. Affected is the function ClusteringModel of the file flair\models\clustering.py of the component Mode File Loader. The manipulation leads to code injection. It is possible …

    flairNLP flair flair PyPI
  • Medium 6.3
    CVE-2024-10072

    ESAFENET CDG EncryptPolicyService.java actionAddEncryptPolicyGroup sql injection

    A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5. This issue affects the function actionAddEncryptPolicyGroup of the file /com/esafenet/servlet/policy/EncryptPolicyService.java. The manipulation of the argument checklist lea…

    ESAFENET CDG
  • Medium 6.3
    CVE-2024-10071

    ESAFENET CDG EncryptPolicyService.java actionUpdateEncryptPolicyEdit sql injection

    A vulnerability classified as critical was found in ESAFENET CDG 5. This vulnerability affects the function actionUpdateEncryptPolicyEdit of the file /com/esafenet/servlet/policy/EncryptPolicyService.java. The manipulation of the argument encryptPolicyId lead…

    ESAFENET CDG
  • Medium 4.3
    CVE-2018-25104

    CoinGate Plugin Payment callback.php postProcess logic error

    A vulnerability was found in CoinGate Plugin up to 1.2.7 on PrestaShop. It has been rated as problematic. Affected by this issue is the function postProcess of the file modules/coingate/controllers/front/callback.php of the component Payment Handler. The mani…