Skip to content
OpenAdvisories

Archive

21 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /21 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

24 results · Clear filters · Feed

  • Medium 4.0
    CVE-2024-47825

    CIDR deny policies may not take effect when a more narrow CIDR allow is present

    Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than `/32` may be ignored if there is a policy rule…

    cilium cilium hubble-ui-backend github.com/cilium/cilium Wolfi Go
  • Medium 5.5
    CVE-2024-49367

    Nginx UI's log path can be controlled

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. …

    0xJacky nginx-ui
  • Medium 5.4
    CVE-2024-40746

    Extension - hikashop.com - Stored cross site scripting vulnerability in Hikashop component for Joomla < 5.1.1

    A stored cross-site scripting (XSS) vulnerability in HikaShop Joomla Component < 5.1.1 allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload in the `description` parameter of any product. The `d…

    hikashop.com Hikashop component for Joomla Web / CMS
  • Medium 6.5
    CVE-2024-8305

    MongoDB Server secondaries may crash due to forced index constraints

    prepareUnique index may cause secondaries to crash due to incorrect enforcement of index constraints on secondaries, where in extreme cases may cause multiple secondaries crashing leading to no primaries. This issue affects MongoDB Server v6.0 versions prior …

    MongoDB MongoDB Server
  • Medium 4.3
    CVE-2024-49273

    WordPress ProfileGrid plugin <= 5.9.3 - Cross Site Request Forgery (CSRF) vulnerability

    Missing Authorization vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities.This issue affects ProfileGrid : from n/a through <= 5.9.3.

    Metagauss ProfileGrid
  • Medium 4.3
    CVE-2024-49293

    WordPress WP VR plugin <= 8.5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in RexTheme WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through <= 8.5.4.

    RexTheme WP VR
  • Medium 4.3
    CVE-2024-49321

    WordPress Simple Custom Post Order plugin <= 2.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in colorlibplugins Simple Custom Post Order simple-custom-post-order allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Custom Post Order: from n/a through <= 2.5.7.

    colorlibplugins Simple Custom Post Order
  • Medium 6.5
    CVE-2024-43945

    WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.This issue affects LatePoint: from n/a through 4.9.91.

    latepoint LatePoint
  • Medium 6.3
    CVE-2024-10196

    code-projects Pharmacy Management System add_new_invoice.php sql injection

    A vulnerability was found in code-projects Pharmacy Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /add_new_invoice.php. The manipulation of the argument text leads to sql injection. The attack may be …

    code-projects Pharmacy Management System
  • Medium 6.7
    CVE-2024-35287

    A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allo…

  • Medium 5.6
    CVE-2024-35315 Public exploit

    A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instan…

  • Medium 5.5
    CVE-2024-31007

    Buffer Overflow vulnerability in IrfanView 32bit v.4.66 allows a local attacker to cause a denial of service via a craf…

  • Medium 5.4
    CVE-2024-48709

    CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the membershipType paramete…

  • Medium 5.9
    CVE-2024-46239

    Multiple cross-site scripting vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname parame…

  • Medium 5.9
    CVE-2024-46238

    Multiple Cross Site Scripting (XSS) vulnerabilities exist in PHPGurukul Hospital Management System 4.0 via the docname …

  • Medium 5.4
    CVE-2024-46236

    CodeAstro Membership Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via the address parameter in ad…

  • Medium 6.1
    CVE-2024-46326

    Public Knowledge Project pkp-lib 3.4.0-7 and earlier is vulnerable to Open redirect due to a lack of input sanitization…

  • Medium 4.8
    CVE-2024-30160

    A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authent…

  • Medium 4.8
    CVE-2024-30159

    A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated atta…

  • Medium 5.3
    CVE-2024-40088

    A Directory Traversal vulnerability in the Boa webserver of Vilo 5 Mesh WiFi System <= 5.16.1.33 allows remote, unauthe…

  • Medium 5.3
    CVE-2024-40091

    Vilo 5 Mesh WiFi System <= 5.16.1.33 lacks authentication in the Boa webserver, which allows remote, unauthenticated at…

  • Medium 4.3
    CVE-2024-40090

    Vilo 5 Mesh WiFi System <= 5.16.1.33 is vulnerable to Information Disclosure. An information leak in the Boa webserver …

  • Medium 6.6
    CVE-2024-41712

    A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attack…

  • Medium 6.5
    CVE-2024-47224

    A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.2…