Skip to content
OpenAdvisories

Archive

28 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /28 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 8.4
    CVE-2024-44285 Public exploit

    A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.1 and iPadOS 18.1, …

    Apple macOS iOS and iPadOS watchOS macOS iOS
  • High 7.1
    CVE-2024-44258 Public exploit

    This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 1…

    Apple iOS and iPadOS tvOS visionOS iOS
  • High 7.3
    CVE-2024-10449 Public exploit

    Codezips Hospital Appointment System loginAction.php sql injection

    A vulnerability, which was classified as critical, was found in Codezips Hospital Appointment System 1.0. This affects an unknown part of the file /loginAction.php. The manipulation of the argument Username leads to sql injection. It is possible to initiate t…

    CodeZips Hospital Appointment System
  • Medium 4.3
    CVE-2024-10448 Public exploit

    code-projects Blood Bank Management System delete.php cross-site request forgery

    A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank Management System 1.0. Affected by this issue is some unknown functionality of the file /file/delete.php. The manipulation of the argument bid leads to cross-site…

    code-projects Blood Bank Management System
  • Critical 9.3
    CVE-2024-50491 Public exploit

    WordPress RSVP ME plugin <= 1.9.9 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MicahBlu RSVP ME rsvp-me allows SQL Injection.This issue affects RSVP ME: from n/a through <= 1.9.9.

    MicahBlu RSVP ME
  • Critical 9.8
    CVE-2024-50478 Public exploit

    WordPress 1-Click Login: Passwordless Authentication plugin 1.4.5 - Broken Authentication vulnerability

    Authentication Bypass by Primary Weakness vulnerability in Swoop 1-Click Login: Passwordless Authentication allows Authentication Bypass.This issue affects 1-Click Login: Passwordless Authentication: 1.4.5.

    Swoop 1-Click Login: Passwordless Authentication
  • Critical 9.8
    CVE-2024-50483 Public exploit

    WordPress Meetup plugin <= 0.1 - Broken Authentication vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Tareq Hasan Meetup meetup allows Privilege Escalation.This issue affects Meetup: from n/a through <= 0.1.

    Tareq Hasan Meetup
  • High 8.8
    CVE-2024-50488 Public exploit

    WordPress Token Login plugin <= 1.0.3 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in yespbs Token Login token-login allows Authentication Bypass.This issue affects Token Login: from n/a through <= 1.0.3.

    yespbs Token Login
  • High 7.3
    CVE-2024-50450 Public exploit

    WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3.4 - Bypass Vulnerability vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows Code Injection.This issue affects MDTF: from n/a through <= 1.3.3.4.

    RealMag777 MDTF
  • High 8.3
    CVE-2024-50492 Public exploit

    WordPress ScottCart plugin <= 1.1 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson ScottCart scottcart allows Code Injection.This issue affects ScottCart: from n/a through <= 1.1.

    Scott Paterson ScottCart
  • Critical 10.0
    CVE-2024-50498 Public exploit Scanner template EPSS 53%

    WordPress WP Query Console plugin <= 1.0 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Ajit Bohra WP Query Console wp-query-console allows Code Injection.This issue affects WP Query Console: from n/a through <= 1.0.

    Ajit Bohra WP Query Console
  • Critical 9.8
    CVE-2024-50477 Public exploit Scanner template

    WordPress Stacks Mobile App Builder plugin <= 5.2.3 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Stacks Stacks Mobile App Builder stacks-mobile-app-builder allows Authentication Bypass.This issue affects Stacks Mobile App Builder: from n/a through <= 5.2.3.

    Stacks Stacks Mobile App Builder
  • Critical 9.1
    CVE-2024-38821 Public exploit

    Authorization Bypass of Static Resources in WebFlux Applications

    Spring WebFlux applications that have Spring Security authorization rules on static resources can be bypassed under certain circumstances. For this to impact an application, all of the following must be true: * It must be a WebFlux application * It must be us…

    Spring Spring thingsboard-tb-node thingsboard-tb-mqtt-transport Wolfi Maven
  • High 7.2
    CVE-2024-9162 Public exploit

    All-in-One WP Migration and Backup <= 7.86 - Authenticated (Administrator+) Arbitrary PHP Code Injection

    The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to arbitrary PHP Code Injection due to missing file type validation during the export in all versions up to, and including, 7.86. This makes it possible for authenticated attackers, wit…

    servmask All-in-One WP Migration and Backup Web / CMS
  • Critical 9.8
    CVE-2024-39205 Public exploit EPSS 17%

    pyload-ng vulnerable to RCE with js2py sandbox escape

    An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.

    pyload-ng PyPI
  • High 8.8
    CVE-2024-48594 Public exploit

    File Upload vulnerability in Prison Management System v.1.0 allows a remote attacker to execute arbitrary code via the …