Skip to content
OpenAdvisories

Archive

November 2024

Vulnerabilities first published in this month (UTC), newest first.

← October 2024 2024 / November December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

4,074 results · Feed

  • Medium 6.5
    CVE-2024-53756

    WordPress Vertical Carousel plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aftab Husain Vertical Carousel vertical-carousel-slider allows Stored XSS.This issue affects Vertical Carousel: from n/a through <= 1.0.2.

    Aftab Husain Vertical Carousel
  • Medium 6.5
    CVE-2024-53757

    WordPress WP Find Your Nearest plugin <= 0.3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SocialEvolution WP Find Your Nearest wp-find-your-nearest allows Stored XSS.This issue affects WP Find Your Nearest: from n/a through <= 0.3.1.

    SocialEvolution WP Find Your Nearest
  • Medium 6.5
    CVE-2024-53758

    WordPress WP MathJax plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Terry L. WP MathJax wp-mathjax-plus allows Stored XSS.This issue affects WP MathJax: from n/a through <= 1.0.1.

    Terry L. WP MathJax
  • Medium 6.5
    CVE-2024-53760

    WordPress Capitalize My Title WordPress plugin <= 0.5.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Capitalize My Title Capitalize My Title capitalize-my-title allows Stored XSS.This issue affects Capitalize My Title: from n/a through <= 0.5.3.

    Capitalize My Title Capitalize My Title Web / CMS
  • Medium 6.5
    CVE-2024-53763

    WordPress Best Addons for Elementor plugin <=1.0.5 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rejuan Ahamed Best Addons for Elementor allows Stored XSS.This issue affects Best Addons for Elementor: from n/a through 1.0.5.

    Rejuan Ahamed Best Addons for Elementor
  • Medium 6.5
    CVE-2024-53764

    WordPress Softtemplates For Elementor plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SoftHopper Softtemplates For Elementor softtemplates-for-elementor allows DOM-Based XSS.This issue affects Softtemplates For Elementor: from n/a through <= 1…

    SoftHopper Softtemplates For Elementor
  • Medium 6.5
    CVE-2024-53766

    WordPress Devnex Addons For Elementor plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devnex Devnex Addons For Elementor devnex-addons-for-elementor allows DOM-Based XSS.This issue affects Devnex Addons For Elementor: from n/a through <= 1.0.9.

    devnex Devnex Addons For Elementor
  • Medium 6.5
    CVE-2024-53767

    WordPress Pixobe Cartography plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixobe Pixobe Cartography pixobe-cartography allows DOM-Based XSS.This issue affects Pixobe Cartography: from n/a through <= 1.0.1.

    Pixobe Pixobe Cartography
  • Medium 6.5
    CVE-2024-53771

    WordPress SimpleSchema plugin <= 1.7.6.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sergiomico SimpleSchema simpleschema-free allows DOM-Based XSS.This issue affects SimpleSchema: from n/a through <= 1.7.6.9.

    sergiomico SimpleSchema
  • Medium 6.5
    CVE-2024-53772

    WordPress Mail Picker plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Mail Picker mail-picker allows DOM-Based XSS.This issue affects Mail Picker: from n/a through <= 1.0.15.

    PickPlugins Mail Picker
  • Medium 6.5
    CVE-2024-53773

    WordPress Znajdź Pracę z Praca.pl plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pracapl Znajdź Pracę z Praca.pl znajdz-prace-z-pracapl allows DOM-Based XSS.This issue affects Znajdź Pracę z Praca.pl: from n/a through <= 2.2.3.

    pracapl Znajdź Pracę z Praca.pl
  • Medium 6.5
    CVE-2024-53774

    WordPress Sparkle Elementor Kit plugin <= 2.0.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows DOM-Based XSS.This issue affects Sparkle Elementor Kit: from n/a through <= 2.0.9.

    Jakub Glos Sparkle Elementor Kit
  • High 7.1
    CVE-2024-53778

    WordPress Essential Breadcrumbs plugin <= 1.1.1 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Essential Marketer Essential Breadcrumbs essential-breadcrumbs allows Stored XSS.This issue affects Essential Breadcrumbs: from n/a through <= 1.1.1.

    Essential Marketer Essential Breadcrumbs
  • Medium 6.5
    CVE-2024-53786

    WordPress Cowidgets – Elementor Addons plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codeless Cowidgets – Elementor Addons cowidgets-elementor-addons allows Stored XSS.This issue affects Cowidgets – Elementor Addons: from n/a through <= 1.2.0.

    Codeless Cowidgets – Elementor Addons
  • Medium 6.5
    CVE-2024-53787

    WordPress Random Banner plugin <= 4.2.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Random Banner random-banner allows Stored XSS.This issue affects Random Banner: from n/a through <= 4.2.12.

    M A Vinoth Kumar Random Banner
  • Medium 5.9
    CVE-2024-53788

    WordPress WordPress Portfolio Builder – Portfolio Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in portfoliohub WordPress Portfolio Builder – Portfolio Gallery uber-grid allows Stored XSS.This issue affects WordPress Portfolio Builder – Portfolio Gallery: …

    portfoliohub WordPress Portfolio Builder – Portfolio Gallery Web / CMS
  • High 7.6
    CVE-2024-53783

    WordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-cost-of-goods.This issue affects Ni WooCommerce Cost Of Goods: from n/a through <= 3.2.8.

    Anzar Ahmed Ni WooCommerce Cost Of Goods Web / CMS
  • Medium 5.3
    CVE-2024-53768

    WordPress Content Audit Exporter plugin <= 1.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ideinteractive Content Audit Exporter content-audit-exporter allows Retrieve Embedded Sensitive Data.This issue affects Content Audit Exporter: from n/a through <= 1.1.

    ideinteractive Content Audit Exporter
  • High 8.1
    CVE-2024-53739

    WordPress Cryptocurrency Widgets For Elementor plugin <= 1.6.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cool Plugins Cryptocurrency Widgets For Elementor cryptocurrency-widgets-for-elementor allows PHP Local File Inclusion.This issue affects …

    Cool Plugins Cryptocurrency Widgets For Elementor
  • Medium 4.4
    CVE-2024-53738

    WordPress Asset CleanUp: Page Speed Booster plugin <=1.3.9.8 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Server Side Request Forgery.This issue affects Asset CleanUp: Page Speed Booster: from n/a through <= 1.3.9.8.

    Gabe Livan Asset CleanUp: Page Speed Booster
  • Medium 4.3
    CVE-2024-12002

    Tenda FH451/FH1201/FH1202/FH1206 GetIPTV websReadEvent null pointer dereference

    A vulnerability classified as problematic was found in Tenda FH451, FH1201, FH1202 and FH1206 up to 20241129. Affected by this vulnerability is the function websReadEvent of the file /goform/GetIPTV. The manipulation of the argument Content-Length leads to nu…

    Tenda FH1202 FH451 FH1201
  • Low 3.5
    CVE-2024-12001

    code-projects Wazifa System Setting updatesettings.php cross site scripting

    A vulnerability classified as problematic has been found in code-projects Wazifa System 1.0. Affected is an unknown function of the file /controllers/updatesettings.php of the component Setting Handler. The manipulation of the argument firstname leads to cros…

    code-projects Wazifa System
  • Low 3.5
    CVE-2024-12000

    code-projects Blood Bank System Setting updatesettings.php cross site scripting

    A vulnerability was found in code-projects Blood Bank System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /controllers/updatesettings.php of the component Setting Handler. The manipulation of the argument first…

    code-projects Blood Bank System
  • Medium 6.3
    CVE-2024-11998

    code-projects Farmacia visualizer-forneccedor.chp sql injection

    A vulnerability was found in code-projects Farmacia 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /visualizer-forneccedor.chp. The manipulation of the argument id leads to sql injection. The attack can be initiated…

    code-projects Farmacia
  • Low 3.5
    CVE-2024-11997

    code-projects Farmacia vendas.php cross site scripting

    A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file /vendas.php. The manipulation of the argument notaFiscal leads to cross site scripting. It is possible to initiate the att…

    code-projects Farmacia
  • Low 3.5
    CVE-2024-11996

    code-projects Farmacia editar-fornecedor.php cross site scripting

    A vulnerability was found in code-projects Farmacia 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /editar-fornecedor.php. The manipulation of the argument cidade leads to cross site scripting. The attack m…

    code-projects Farmacia
  • Medium 6.1
    CVE-2024-11252 Public exploit

    Social Sharing Plugin – Sassy Social Share <= 3.3.69 - Reflected Cross-Site Scripting via heateor_mastodon_share Parameter

    The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in all versions up to, and including, 3.3.69 due to insufficient input sanitization and output escapin…

    heateor Social Sharing Plugin – Sassy Social Share Web / CMS
  • High 8.1
    CVE-2024-43703

    GPU DDK - Duplicate calls to RGXCreateFreeList on the same reservation leads to GPU UAF

    Software installed and run as a non-privileged user may conduct improper GPU system calls to achieve unauthorised reads and writes of physical memory from the GPU HW.

    Imagination Technologies Graphics DDK
  • High 8.1
    CVE-2024-43702

    GPU DDK - MLIST/PM render state buffers writable allowing arbitrary writes to kernel memory pages

    Software installed and run as a non-privileged user may conduct improper GPU system calls to allow unprivileged access to arbitrary physical memory page.

    Imagination Technologies Graphics DDK
  • Low 3.5
    CVE-2024-11995

    code-projects Farmacia pagamento.php cross site scripting

    A vulnerability has been found in code-projects Farmacia 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /pagamento.php. The manipulation of the argument total leads to cross site scripting. The attack…

    code-projects Farmacia
  • Medium 6.9
    CVE-2024-53980

    Spoofed length byte traps CC2538 in endless loop

    RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A malicious actor can send a IEEE 802.15.4 packet with spoofed length byte and optionally spoofed FCS, …

    RIOT-OS RIOT
  • Medium 5.4
    CVE-2024-53983

    Server-side request forgery in Backstage Scaffolder plugin

    The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection (SSTI) can be exploited to perform Git config…

    backstage backstage @backstage/plugin-scaffolder-node npm
  • High 8.3
    CVE-2024-53979

    Ansible collection "ibm.ibm_zhmc" has passwords in clear text in log file and in output of some modules when specified as input

    ibm.ibm_zhmc is an Ansible collection for the IBM Z HMC. The Ansible collection "ibm.ibm_zhmc" writes password-like properties in clear text into its log file and into the output returned by some of its Ansible module in the following cases: 1. The 'boot_ftp_…

    zhmcclient zhmc-ansible-modules
  • High 8.3
    CVE-2024-53865

    Python package "zhmcclient" has passwords in clear text in its HMC and API logs

    zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and …

    zhmcclient python-zhmcclient zhmcclient PyPI
  • Medium 5.3
    CVE-2024-53864

    Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui

    Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is req…

    ibexa admin-ui ibexa/admin-ui Packagist
  • Low 2.2
    CVE-2024-53861

    Issuer field partial matches allowed in pyjwt

    pyjwt is a JSON Web Token implementation in Python. An incorrect string comparison is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. This is a bug introduced in version 2.10.0: checking the "iss" claim changed from `isinstance(issu…

    jpadilla pyjwt az pyjwt Wolfi PyPI
  • High 7.1
    CVE-2024-53848

    check-jsonschema default caching for remote schemas allows for cache confusion

    check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. `https://example.org/schema.json` will be stored as `schema.json`. This…

    python-jsonschema check-jsonschema check-jsonschema PyPI
  • Medium 6.9
    CVE-2024-52810

    Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4

    @intlify/shared is a shared library for the intlify project. The latest version of @intlify/shared (10.0.4) is vulnerable to Prototype Pollution through the entry function(s) lib.deepCopy. An attacker can supply a payload with Object.prototype setter to intro…

    intlify vue-i18n @intlify/vue-i18n-core petite-vue-i18n npm
  • Medium 5.3
    CVE-2024-52809

    Cross-site Scripting vulnerability with prototype pollution in vue-i18n

    vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to `createI18n` or `useI18n`. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. …

    intlify vue-i18n @intlify/vue-i18n-core petite-vue-i18n npm
  • Medium 5.3
    CVE-2024-52801

    Brute force takeover of OpenID Connect session cookies in sftpgo

    sftpgo is a full-featured and highly configurable event-driven file transfer solution. Server protocols: SFTP, HTTP/S, FTP/S, WebDAV. The OpenID Connect implementation allows authenticated users to brute force session cookies and thereby gain access to other …

    drakkan sftpgo github.com/drakkan/sftpgo/v2 github.com/drakkan/sftpgo Go