Skip to content
OpenAdvisories

Archive

24 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /24 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

53 results · Clear filters · Feed

  • Medium 6.3
    CVE-2024-9943

    MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Cross-Site Request Forgery to Vendor Updates

    The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.4. This is due to missing or incorrect nonce validation on several function…

    wcmp MultiVendorX – WooCommerce Multivendor Marketplace Solutions Web / CMS
  • Medium 4.3
    CVE-2024-8667

    HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce <= 2.10.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Publication

    The HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce plugin for WordPress is vulnerable to unauthorized post publication due to a missing capability check on the activateCampaign() function in all versions up to, and including,…

    nlemsieh HurryTimer – An Scarcity and Urgency Countdown Timer for WordPress & WooCommerce Web / CMS
  • Medium 4.3
    CVE-2024-9531

    MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.4 - Missing Authorization to Forged Vendor Profile Deletion Email Sending

    The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mvx_sent_deactivation_request' function in all versions up to, and i…

    wcmp MultiVendorX – WooCommerce Multivendor Marketplace Solutions Web / CMS
  • Medium 6.1
    CVE-2024-9864

    EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting

    The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket names in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and output escaping. This makes it p…

    Metagauss EventPrime – Events Calendar, Bookings and Tickets Web / CMS
  • Medium 6.1
    CVE-2024-9865

    EventPrime – Modern Events Calendar, Bookings and Tickets <= 4.0.4.7 - Unauthenticated Stored Cross-Site Scripting via Transaction Log

    The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ep_booking_attendee_fields’ fields in all versions up to, and including, 4.0.4.7 due to insufficient input sanitization and outpu…

    Metagauss EventPrime – Events Calendar, Bookings and Tickets Web / CMS
  • Medium 6.1
    CVE-2024-9374

    Terms descriptions <= 3.4.6 - Reflected Cross-Site Scripting

    The Terms descriptions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.4.6. This makes it possible for unauthenticated attacke…

    vladimirs Terms descriptions Web / CMS
  • Medium 6.5
    CVE-2024-48442

    Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.…

  • Medium 6.2
    CVE-2024-48540

    Incorrect access control in XIAO HE Smart 4.3.1 allows attackers to access sensitive information by analyzing the code …

  • Medium 5.5
    CVE-2024-48424

    A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assim…

    assimp assimp pyassimp spring Debian Ubuntu PyPI
  • Medium 5.5
    CVE-2024-48425

    A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within th…

    assimp assimp pyassimp spring Debian Ubuntu PyPI
  • Medium 6.2
    CVE-2024-48426

    A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz …

    assimp assimp pyassimp spring Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2024-45259

    An issue was discovered on certain GL-iNet devices, including MT6000, MT3000, MT2500, AXT1800, and AX1800 4.6.2. By int…

  • Medium 5.3
    CVE-2024-40595

    An authentication-bypass issue in the RDP component of One Identity Safeguard for Privileged Sessions (SPS) On Premise …