Skip to content
OpenAdvisories

Archive

22 November 2024

Vulnerabilities first published on this day (UTC), newest first.

← October 2024 2024 / November /22 December 2024 →
  1. 1235
  2. 212
  3. 317
  4. 4148
  5. 5211
  6. 694
  7. 7115
  8. 8122
  9. 9195
  10. 1035
  11. 11114
  12. 12338
  13. 13230
  14. 14149
  15. 15222
  16. 1650
  17. 1711
  18. 18185
  19. 19388
  20. 20123
  21. 21130
  22. 22388
  23. 2345
  24. 2416
  25. 2577
  26. 26162
  27. 2782
  28. 2875
  29. 2976
  30. 3029
All Critical High Medium Low Exploited only Public exploit

60 results · Clear filters · Feed

  • Medium 6.5
    CVE-2024-7882

    SQLi in Special Minds' e-Commerce

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Special Minds Design and Software e-Commerce allows SQL Injection. This issue affects e-Commerce: before 22.11.2024.

    Special Minds Design and Software e-Commerce arm-trusted-firmware Alpine
  • Medium 5.8
    CVE-2024-8929

    Leak partial content of the heap through heap buffer over-read in mysqlnd

    In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, a hostile MySQL server can cause the client to disclose the content of its heap containing data from other SQL requests and possible other data belonging to different users of the …

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.6
    CVE-2024-9422

    GEO My WordPress < 4.5 - Admin+ Arbitrary File Upload

    The GEO my WP WordPress plugin before 4.5, gmw-premium-settings WordPress plugin before 3.1 does not sufficiently validate files to be uploaded, which could allow attackers to upload arbitrary files such as PHP on the server.

    Web / CMS
  • Medium 4.3
    CVE-2024-10666

    Easy Twitter Feed – Twitter feeds plugin for WP <= 1.2.6 - Authenticated (Contributor+) Post Exposure

    The Easy Twitter Feed – Twitter feeds plugin for WP plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.6 via the [etf] shortcode. This makes it possible for authenticated attackers, with Contributor-level acce…

    bPlugins Feeds for Twitter – Embed Social Media Posts with Live Updates Web / CMS
  • Medium 6.1
    CVE-2024-11225

    Premium Packages – Sell Digital Products Securely <= 5.9.3 - Reflected Cross-Site Scripting via add_query_arg

    The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 5.9.3. This makes it possi…

    codename065 Premium Packages – Sell Digital Products Securely Web / CMS
  • Medium 6.1
    CVE-2024-8735

    MailMunch – Grow your Email List <= 3.1.8 - Reflected Cross-Site Scripting

    The MailMunch – Grow your Email List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.1.8. This makes it possible for unauthent…

    mailmunch MailMunch – Grow your Email List Web / CMS
  • Medium 5.5
    CVE-2024-10034

    Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery <= 3.2.4.2 - Authenticated (Editor+) Stored Cross-Site Scripting

    The Gallery Blocks with Lightbox. Image Gallery, (HTML5 video , YouTube, Vimeo) Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery link text parameter in all versions up to, and incl…

    gallerycreator Mixed Media Gallery Blocks Web / CMS
  • Medium 4.3
    CVE-2024-11355

    Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure

    The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_setting() function in all versions up to, and including, 3.3. This makes it possible for authe…

    codelizarplugs Ultimate YouTube Video & Shorts Player With Vimeo Web / CMS
  • Medium 6.4
    CVE-2024-11381

    Control horas <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Control horas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ch_registro' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. Th…

    cesarmaeso Control horas Web / CMS
  • Medium 6.7
    CVE-2024-38296

    Dell Edge Gateway 3200, versions prior to 15.40.30.2879, and Edge Gateway 5200, versions prior to 12.0.94.2380, contain…

    Dell Edge Gateway 5200 Browsers
  • Medium 5.5
    CVE-2024-47142

    AIPHONE IXG SYSTEM IXG-2C7 firmware Ver.2.03 and earlier and IXG-2C7-L firmware Ver.2.03 and earlier contain an issue w…

    AIPHONE IXG-2C7-L IXG-2C7
  • Medium 5.4
    CVE-2024-45837

    Use of hard-coded cryptographic key issue exists in AIPHONE IX SYSTEM, IXG SYSTEM, and System Support Software. A netwo…

    AIPHONE IXG-2C7 IXG-2C7-L IX-MV7-HB
  • Medium 6.5
    CVE-2024-39290

    Insufficiently protected credentials issue exists in AIPHONE IX SYSTEM and IXG SYSTEM. A network-adjacent unauthenticat…

    AIPHONE IXG-2C7 IXG-2C7-L IX-DVF-L
  • Medium 6.8
    CVE-2024-50657 Public exploit

    An issue in Owncloud android apk v.4.3.1 allows a physically proximate attacker to escalate privileges via the PassCode…

  • Medium 5.4
    CVE-2024-50965

    Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an at…

  • Medium 5.3
    CVE-2024-51072

    An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to cause a Denial of…

  • Medium 6.7
    CVE-2024-51074

    Incorrect access control in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to a…

  • Medium 6.7
    CVE-2024-51073

    An issue in KIA Seltos vehicle instrument cluster with software and hardware v1.0 allows attackers to control or disrup…

  • Medium 6.1
    CVE-2024-37783

    A reflected cross-site scripting (XSS) vulnerability in Gladinet CentreStack v13.12.9934.54690 allows attackers to inje…

  • Medium 6.2
    CVE-2024-47863

    An issue was discovered in Centreon Web 24.10.x before 24.10.0, 24.04.x before 24.04.8, 23.10.x before 23.10.18, 23.04.…