Skip to content
OpenAdvisories

Archive

28 October 2024

Vulnerabilities first published on this day (UTC), newest first.

← September 2024 2024 / October /28 November 2024 →
  1. 1110
  2. 292
  3. 363
  4. 489
  5. 582
  6. 685
  7. 7110
  8. 8234
  9. 9125
  10. 10119
  11. 11132
  12. 1222
  13. 1318
  14. 1477
  15. 15188
  16. 16185
  17. 17157
  18. 1879
  19. 1924
  20. 2068
  21. 21433
  22. 2283
  23. 23120
  24. 24111
  25. 25136
  26. 2644
  27. 2735
  28. 28193
  29. 29208
  30. 3096
  31. 3171
All Critical High Medium Low Exploited only Public exploit

104 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-50574

    In JetBrains YouTrack before 2024.3.47707 potential ReDoS exploit was possible via email header parsing in Helpdesk fun…

    JetBrains YouTrack
  • Medium 4.3
    CVE-2024-50573

    In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorize…

    JetBrains Hub
  • Medium 6.5
    CVE-2024-50470

    WordPress Themes4WP YouTube External Subtitles plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themes4WP Themes4WP YouTube External Subtitles themes4wp-youtube-external-subtitles allows DOM-Based XSS.This issue affects Themes4WP YouTube External Subtit…

    Themes4WP Themes4WP YouTube External Subtitles
  • Medium 6.5
    CVE-2024-50471

    WordPress Trip Plan plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in checklistcom Trip Plan tripplan allows DOM-Based XSS.This issue affects Trip Plan: from n/a through <= 1.0.10.

    checklistcom Trip Plan
  • Medium 6.5
    CVE-2024-50472

    WordPress Amilia Store plugin <= 2.9.8 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in martindrapeau Amilia Store amilia-store allows Stored XSS.This issue affects Amilia Store: from n/a through <= 2.9.8.

    martindrapeau Amilia Store
  • Medium 6.5
    CVE-2024-50501

    WordPress Kata Plus plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Climax Themes Kata Plus kata-plus allows DOM-Based XSS.This issue affects Kata Plus: from n/a through <= 1.4.7.

    Climax Themes Kata Plus
  • Medium 6.5
    CVE-2024-50502

    WordPress Cozy Blocks plugin <= 2.0.18 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows DOM-Based XSS.This issue affects Cozy Blocks: from n/a through <= 2.0.18.

    CozyThemes Cozy Blocks
  • Medium 4.7
    CVE-2024-50463

    WordPress Sunshine Photo Cart plugin <= 3.2.9 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart.This issue affects Sunshine Photo Cart: from n/a through <= 3.2.9.

    sunshinephotocart Sunshine Photo Cart
  • Medium 6.3
    CVE-2024-10446

    Project Worlds Online Time Table Generator admindashboard.php sql injection

    A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Affected is an unknown function of the file /timetable/admin/admindashboard.php?info=add_course. The manipulation of the argument c leads to sql injection…

    Project Worlds Online Time Table Generator
  • Medium 6.5
    CVE-2024-50442

    WordPress Royal Elementor Addons and Templates plugin <= 1.3.980 - XML External Entity (XXE) vulnerability

    Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows XML Injection.This issue affects Royal Elementor Addons: from n/a through <= 1.3.980.

    WP Royal Royal Elementor Addons
  • Medium 5.5
    CVE-2024-50307

    Use of potentially dangerous function issue exists in Chatwork Desktop Application (Windows) versions prior to 2.9.2. I…

    kubell Chatwork Desktop Application (Windows) Windows
  • Medium 5.3
    CVE-2024-10439

    Sunnet eHRD CTMS - Insecure Direct Object Reference

    The eHRD CTMS from Sunnet has an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated remote attackers to modify a specific parameter to access arbitrary files uploaded by any user.

    Sunnet eHRD CTMS
  • Medium 6.3
    CVE-2024-10435

    didi Super-Jacoco triggerEnvCov command injection

    A vulnerability was found in didi Super-Jacoco 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cov/triggerEnvCov. The manipulation of the argument uuid leads to command injection. The attack can be initiated remotel…

    didi Super-Jacoco
  • Medium 4.9
    CVE-2024-34537

    Denial of Service in TYPO3 Bookmark Toolbar

    TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versio…

    typo3/cms-backend Packagist
  • Medium 6.1
    CVE-2024-48195

    Cross Site Scripting vulnerability in eyouCMS v.1.6.7 allows a remote attacker to obtain sensitive information via a cr…

  • Medium 6.3
    CVE-2024-48291

    dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/doAdminAction.php?act=editAd…

  • Medium 6.5
    CVE-2024-48107

    SparkShop <=1.1.7 is vulnerable to server-side request forgery (SSRF). This vulnerability allows attacks to scan ports …

  • Medium 6.3
    CVE-2024-48191

    dingfanzu CMS 1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.…

  • Medium 5.0
    CVE-2024-48936

    SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in authentication handling in stepmgr could permit …

    slurm-wlm Debian
  • Medium 6.1
    CVE-2024-42930

    PbootCMS 3.2.8 is vulnerable to URL Redirect.

  • Medium 4.8
    CVE-2024-51509

    Tiki through 27.0 allows users who have certain permissions to insert a "Modules" (aka tiki-admin_modules.php) stored X…

  • Medium 4.8
    CVE-2024-51506

    Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the…

  • Medium 4.8
    CVE-2024-51507

    Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload …

  • Medium 4.8
    CVE-2024-51508

    Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload …