Skip to content
OpenAdvisories

Archive

16 December 2024

Vulnerabilities first published on this day (UTC), newest first.

← November 2024 2024 / December /16 January 2025 →
  1. 112
  2. 2199
  3. 383
  4. 4138
  5. 5112
  6. 6170
  7. 732
  8. 87
  9. 9288
  10. 10339
  11. 11157
  12. 12150
  13. 13297
  14. 1449
  15. 159
  16. 16208
  17. 1785
  18. 18156
  19. 1994
  20. 2087
  21. 2130
  22. 2216
  23. 2333
  24. 2460
  25. 2528
  26. 2666
  27. 27284
  28. 2850
  29. 2969
  30. 3059
  31. 31105
All Critical High Medium Low Exploited only Public exploit

73 results · Clear filters · Feed

  • Medium 4.3
    CVE-2024-54355

    WordPress WP Mailster plugin <= 1.8.17.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in brandtoss WP Mailster wp-mailster allows Cross Site Request Forgery.This issue affects WP Mailster: from n/a through <= 1.8.17.0.

    Brandtoss WP Mailster
  • Medium 5.4
    CVE-2024-54356

    WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: f…

    vcita Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • Medium 4.3
    CVE-2024-54396

    WordPress Bet sport Free plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in elmervillanueva Bet sport Free bet-sport-free allows Cross Site Request Forgery.This issue affects Bet sport Free: from n/a through <= 1.0.0.

    elmervillanueva Bet sport Free
  • Medium 5.4
    CVE-2024-54418

    WordPress DTC Documents plugin <= 1.1.05 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Diversified Technology Corp. DTC Documents dtc-documents allows Cross Site Request Forgery.This issue affects DTC Documents: from n/a through <= 1.1.05.

    Diversified Technology DTC Documents
  • Medium 5.4
    CVE-2024-54419

    WordPress Ui Slider Filter By Price plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in chenyenming Ui Slider Filter By Price ui-slider-filter-by-price allows Cross Site Request Forgery.This issue affects Ui Slider Filter By Price: from n/a through <= 1.1.

    chenyenming Ui Slider Filter By Price
  • Medium 6.5
    CVE-2024-56005

    WordPress Posti Shipping Plugin <= 3.10.3 - CSRF to Settings Change vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Posti Posti Shipping posti-shipping allows Cross Site Request Forgery.This issue affects Posti Shipping: from n/a through <= 3.10.3.

    Posti Posti Shipping
  • Medium 4.3
    CVE-2024-54402

    WordPress Arabic Webfonts plugin <= 1.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mohamed Abd Elhalim Arabic Webfonts arabic-webfonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arabic Webfonts: from n/a through <= 1.4.6.

    Mohamed Abd Elhalim Arabic Webfonts
  • Medium 6.5
    CVE-2024-54408

    WordPress Youtube Video Grid plugin <= 1.9 - CSRF to Settings Change vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in codehandling Youtube Video Grid youmax-channel-embeds-for-youtube-businesses allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Youtube Video Grid: from n/a through <= …

    codehandling Youtube Video Grid
  • Medium 5.4
    CVE-2024-54430

    WordPress EELV Newsletter plugin <= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Europe Ecologie Les Verts EELV Newsletter eelv-newsletter allows Cross Site Request Forgery.This issue affects EELV Newsletter: from n/a through <= 4.8.2.

    Europe Ecologie Les Verts EELV Newsletter
  • Medium 5.4
    CVE-2024-55998

    WordPress Popup Surveys & Polls for WordPress (Mare.io) plugin <= 1.36 - Settings Change vulnerability

    Missing Authorization vulnerability in Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) popup-surveys allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Surveys & Polls for WordPress (Mare.io): from n/a th…

    Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) Web / CMS
  • Medium 5.3
    CVE-2024-54366

    WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability

    Generation of Error Message Containing Sensitive Information vulnerability in videogallery Vimeography vimeography allows Retrieve Embedded Sensitive Data.This issue affects Vimeography: from n/a through <= 2.4.4.

    videogallery Vimeography
  • Medium 5.4
    CVE-2024-56004

    WordPress Easy Site Importer plugin <= 1.0.1 - Settings Change vulnerability

    Missing Authorization vulnerability in awfowler Easy Site Importer easy-site-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Site Importer: from n/a through <= 1.0.1.

    awfowler Easy Site Importer
  • Medium 6.3
    CVE-2024-12478

    InvoicePlane 1 upload_file unrestricted upload

    A vulnerability was found in InvoicePlane up to 1.6.1. It has been declared as critical. This vulnerability affects the function upload_file of the file /index.php/upload/upload_file/1/1. The manipulation of the argument file leads to unrestricted upload. The…

  • Medium 4.3
    CVE-2024-12362

    InvoicePlane invoices.php download path traversal

    A vulnerability was found in InvoicePlane up to 1.6.1. It has been classified as problematic. This affects the function download of the file invoices.php. The manipulation of the argument invoice leads to path traversal. It is possible to initiate the attack …

  • Medium 6.5
    CVE-2024-54682

    Zipbomb DoS via Missing Slack Import Validation

    Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin.

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Medium 6.5
    CVE-2024-54083

    DoS via lack of type validation in Calls

    Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, 9.5.x <= 9.5.12 fail to properly validate the type of callProps which allows a user to cause a client side (webapp and mobile) DoS to users of particular channels, by sending a speciall…

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Medium 4.8
    CVE-2024-48872

    Bypass of "Max failed attempts" restriction via race condition

    Mattermost versions 10.1.x <= 10.1.2, 10.0.x <= 10.0.2, 9.11.x <= 9.11.4, and 9.5.x <= 9.5.12 fail to prevent concurrently checking and updating the failed login attempts. which allows an attacker to bypass of "Max failed attempts" restriction and send a big …

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • Medium 5.3
    CVE-2024-9679

    A Hardcoded Cryptographic key vulnerability existed in DLP Extension 11.11.1.3 which allowed the decryption of previous…

    Trellix DLP Extension
  • Medium 6.5
    CVE-2024-12645

    Chunghwa Telecom topm-client - Arbitrary File Read

    The topm-client from Chunghwa Telecom has an Arbitrary File Read vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection for the APIs, unauthenticated rem…

    Chunghwa Telecom topm-client
  • Medium 4.9
    CVE-2024-9678

    An SQL Injection vulnerability existed in DLP Extension 11.11.1.3. The vulnerability allowed an attacker to perform arb…

    Trellix DLP Extension
  • Medium 5.4
    CVE-2024-11841

    Tithe.ly Giving Button <= 1.1 - Contributor+ Stored XSS via Shortcode

    The Tithe.ly Giving Button WordPress plugin through 1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perfo…

    Web / CMS
  • Medium 5.3
    CVE-2024-5333 Scanner template

    The Events Calendar < 6.8.2.1 - Unauthenticated Password Protected Event Disclosure

    The Events Calendar WordPress plugin before 6.8.2.1 is missing access checks in the REST API, allowing for unauthenticated users to access information about password protected events.

    Web / CMS
  • Medium 5.3
    CVE-2024-8116

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2024-8650

    Incorrect Authorization in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-member users to view unresolved threads marked as internal notes in public projects merge requests.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.4
    CVE-2024-55452

    A URL redirection vulnerability exists in UJCMS 9.6.3 due to improper validation of URLs in the upload and rendering of…

  • Medium 4.8
    CVE-2024-55451

    A Stored Cross-Site Scripting (XSS) vulnerability exists in authenticated SVG file upload and viewing functionality in …

  • Medium 5.4
    CVE-2024-55554

    Intrexx Portal Server before 12.0.2 allows XSS via a user-defined portlet.

  • Medium 4.8
    CVE-2024-55100

    A stored cross-site scripting (XSS) vulnerability in the component /admin/profile.php of Online Nurse Hiring System v1.…

  • Medium 4.8
    CVE-2024-37776

    A cross-site scripting (XSS) vulnerability in Sunbird DCIM dcTrack v9.1.2 allows attackers to execute arbitrary web scr…

  • Medium 4.8
    CVE-2024-37773

    An HTML injection vulnerability in Sunbird DCIM dcTrack 9.1.2 allows attackers authenticated as administrators to injec…

  • Medium 5.9
    CVE-2024-56087

    An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Templat…

  • Medium 5.9
    CVE-2024-56085

    An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Templat…

  • Medium 6.1
    CVE-2024-56112

    CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php.