Skip to content
OpenAdvisories

Archive

11 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /11 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

55 results · Clear filters · Feed

  • Medium 5.5
    CVE-2024-11079

    Ansible-core: unsafe tagging bypass via hostvars object in ansible-core

    A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs a…

    Red Hat Red Hat Enterprise Linux 10 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Linux Debian Ubuntu Wolfi PyPI
  • Medium 5.8
    CVE-2024-23983

    Access rules for PingAccess may be circumvented with URL-encoded characters

    Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules.

    Ping Identity PingAccess
  • Medium 5.3
    CVE-2024-51484

    Insufficient Validation in Controllers (Activation/Deactivation) in Ampache

    Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating controllers. This vulnerability allows an attacker to exploit CSRF at…

    ampache ampache ampache Ubuntu
  • Medium 5.3
    CVE-2024-51485

    Insufficient Validation in Plugins (Activation/Deactivation) in Ampache

    Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating plugins. This vulnerability allows an attacker to exploit CSRF attack…

    ampache ampache ampache Ubuntu
  • Medium 5.5
    CVE-2024-51486

    Stored Cross-Site Scripting in Ampache

    Ampache is a web based audio/video streaming application and file manager. The vulnerability exists in the interface section of the Ampache menu, where users can change the "Custom URL - Favicon". This section is not properly sanitized, allowing for the input…

    ampache ampache ampache Ubuntu
  • Medium 5.3
    CVE-2024-51487

    Insufficient Validation in Catalog (Activation/Deactivation) in Ampache

    Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing fails to properly validate CSRF tokens when activating or deactivating catalog. This vulnerability allows an attacker to exploit CSRF attack…

    ampache ampache ampache Ubuntu
  • Medium 5.3
    CVE-2024-51488

    Insufficient Validation in Delete Message in Ampache

    Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users delete messages. This vulnerability could be exploited to forge CSRF attacks, allowing a…

    ampache ampache ampache Ubuntu
  • Medium 5.3
    CVE-2024-51489

    Insufficient Message Token Validation in Ampache

    Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users send messages to one another. This vulnerability could be exploited to forge CSRF attack…

    ampache ampache ampache Ubuntu
  • Medium 5.5
    CVE-2024-51490

    Stored Cross-Site Scripting in Ampache

    Ampache is a web based audio/video streaming application and file manager. This vulnerability exists in the interface section of the Ampache menu, where users can change "Custom URL - Logo". This section is not properly sanitized, allowing for the input of st…

    ampache ampache ampache Ubuntu
  • Medium 4.1
    CVE-2024-51992

    Method Exposure Vulnerability in Modals in orchid/platform

    Orchid is a @laravel package that allows for rapid application development of back-office applications, admin/user panels, and dashboards. This vulnerability is a method exposure issue (CWE-749: Exposed Dangerous Method or Function) in the Orchid Platform’s a…

    orchidsoftware platform orchid/platform Packagist
  • Medium 6.9
    CVE-2024-10315

    Insecure Configuration in Gliffy Online

    In Gliffy Online an insecure configuration was discovered in versions before 4.14.0-6. Reported by Alpha Inferno PVT LTD.

    Gliffy Gliffy Online
  • Medium 5.1
    CVE-2024-52288

    RMAC revert to the beginning of the session in libosdp

    libosdp is an implementation of IEC 60839-11-5 OSDP (Open Supervised Device Protocol) and provides a C library with support for C++, Rust and Python3. In affected versions an unexpected `REPLY_CCRYPT` or `REPLY_RMAC_I` may be introduced into an active stream …

    goToMain libosdp libosdp PyPI
  • Medium 6.3
    CVE-2024-11076

    code-projects Job Recruitment activation.php sql injection

    A vulnerability, which was classified as critical, has been found in code-projects Job Recruitment 1.0. This issue affects some unknown processing of the file /activation.php. The manipulation of the argument e_hash leads to sql injection. The attack may be i…

    code-projects Job Recruitment
  • Medium 6.3
    CVE-2024-11074

    itsourcecode Tailoring Management System incadd.php sql injection

    A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. This vulnerability affects unknown code of the file /incadd.php. The manipulation of the argument inccat/desc/date/amount leads to sql injection. The attack can …

    itsourcecode Tailoring Management System
  • Medium 4.8
    CVE-2024-45087

    IBM WebSphere Application Server cross-site scripting

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclo…

    IBM WebSphere Application Server
  • Medium 4.3
    CVE-2024-11073

    SourceCodester Hospital Management System delete-account.php improper authorization

    A vulnerability classified as problematic has been found in SourceCodester Hospital Management System 1.0. This affects an unknown part of the file /vm/patient/delete-account.php. The manipulation of the argument id leads to improper authorization. It is poss…

    SourceCodester Hospital Management System
  • Medium 6.4
    CVE-2024-45088

    IBM Maximo Asset Management cross-site scripting

    IBM Maximo Asset Management 7.6.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclo…

    IBM Maximo Asset Management
  • Medium 5.4
    CVE-2024-43439

    Moodle: reflected xss via h5p error message

    A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting (XSS) risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.5
    CVE-2024-34014

    Arbitrary file overwrite during recovery due to improper symbolic link handling. The following products are affected: A…

    Acronis Acronis Backup plugin for cPanel & WHM Acronis Backup extension for Plesk Acronis Backup plugin for DirectAdmin
  • Medium 5.4
    CVE-2024-43437

    Moodle: xss risk when restoring malicious course backup file

    A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting (XSS) risk from malicious backup files.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2024-43435

    Moodle: can create global glossary without being admin

    A flaw was found in moodle. Insufficient capability checks make it possible for users with access to restore glossaries in courses to restore them into the global site glossary.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2024-43433

    Moodle: matrix user/power level management not always working as expected with suspended users

    A flaw was found in moodle. Matrix room membership and power levels are incorrectly applied and revoked for suspended Moodle users.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2024-43432

    Moodle: authorization headers preserved between "emulated redirects"

    A flaw was found in moodle. The cURL wrapper in Moodle strips HTTPAUTH and USERPWD headers during emulated redirects, but retains other original request headers, so HTTP authorization header information could be unintentionally sent in requests to redirect UR…

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2024-43430

    Moodle: lack of access control when using external methods for quiz overrides

    A flaw was found in moodle. External API access to Quiz can override contained insufficient access control.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2024-43429

    Moodle: user information visibility control issues in gradebook reports

    A flaw was found in moodle. Some hidden user profile fields are visible in gradebook reports, which could result in users without the "view hidden user fields" capability having access to the information.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2024-11021

    Grand Vice info Webopac - Stored XSS

    Webopac from Grand Vice info has Stored Cross-site Scripting vulnerability. Remote attackers with regular privileges can inject arbitrary JavaScript code into the server. When users visit the compromised page, the code is automatically executed in their brows…

    Grand Vice info Webopac
  • Medium 6.1
    CVE-2024-11019

    Grand Vice info Webopac7 - Reflected XSS

    Webopac from Grand Vice info has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the user's browser through phishing techniques.

    Grand Vice info Webopac7
  • Medium 6.5
    CVE-2024-52350

    WordPress CRM 2go plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nrmendez CRM 2go crm2go allows DOM-Based XSS.This issue affects CRM 2go: from n/a through <= 1.0.

    nrmendez CRM 2go
  • Medium 6.5
    CVE-2024-52351

    WordPress BU Slideshow plugin <= 2.3.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BU Web Team BU Slideshow bu-slideshow allows Stored XSS.This issue affects BU Slideshow: from n/a through <= 2.3.10.

    BU Web Team BU Slideshow
  • Medium 6.5
    CVE-2024-52352

    WordPress Postcasa Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in miloandrew Postcasa Shortcode postcasa allows DOM-Based XSS.This issue affects Postcasa Shortcode: from n/a through <= 1.0.

    miloandrew Postcasa Shortcode
  • Medium 6.5
    CVE-2024-52353

    WordPress Christian Science Bible Lesson Subjects plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gabriel Serafini Christian Science Bible Lesson Subjects christian-science-bible-lesson-subjects allows DOM-Based XSS.This issue affects Christian Science Bi…

    Gabriel Serafini Christian Science Bible Lesson Subjects
  • Medium 6.5
    CVE-2024-52354

    WordPress Web Stories Widgets For Elementor plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cool Plugins Web Stories Widgets For Elementor shortcodes-for-amp-web-stories-and-elementor-widget allows Stored XSS.This issue affects Web Stories Widgets F…

    Cool Plugins Web Stories Widgets For Elementor
  • Medium 6.5
    CVE-2024-52355

    WordPress OSM – OpenStreetMap plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MiKa OSM osm.This issue affects OSM: from n/a through <= 6.1.2.

    MiKa OSM
  • Medium 6.5
    CVE-2024-52356

    WordPress The Pack Elementor addons plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows Stored XSS.This issue affects The Pack Elementor addons: from n/a through <= 2.1.0.

    webangon The Pack Elementor addons
  • Medium 6.5
    CVE-2024-52357

    WordPress LIQUID BLOCKS plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lqd LIQUID BLOCKS liquid-blocks allows Stored XSS.This issue affects LIQUID BLOCKS: from n/a through <= 1.2.0.

    lqd LIQUID BLOCKS
  • Medium 6.5
    CVE-2024-52358

    WordPress Responsive Addons for Elementor plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows DOM-Based XSS.This issue affects Responsive Addons for Elementor: from n/a…

    cyberchimps Responsive Addons for Elementor
  • Medium 6.5
    CVE-2024-51571

    WordPress MasterBip para Elementor plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in masterbip MasterBip para Elementor masterbip-for-elementor allows DOM-Based XSS.This issue affects MasterBip para Elementor: from n/a through <= 1.6.3.

    masterbip MasterBip para Elementor
  • Medium 6.5
    CVE-2024-51572

    WordPress LH QR Codes plugin <= 1.06 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shawfactor LH QR Codes lh-qr-codes allows Stored XSS.This issue affects LH QR Codes: from n/a through <= 1.06.

    shawfactor LH QR Codes
  • Medium 6.5
    CVE-2024-51573

    WordPress ML Responsive Audio plugin <= 0.2 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ersatzpole ML Responsive Audio player with playlist Shortcode mlr-audio allows Stored XSS.This issue affects ML Responsive Audio player with playlist Shortco…

    ersatzpole ML Responsive Audio player with playlist Shortcode
  • Medium 6.5
    CVE-2024-51574

    WordPress Simple Goods plugin <= 0.1.3 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simple Goods Simple Goods simple-goods allows Stored XSS.This issue affects Simple Goods: from n/a through <= 0.1.3.

    Simple Goods Simple Goods