Skip to content
OpenAdvisories

Archive

17 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /17 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

52 results · Clear filters · Feed

  • Medium 6.3
    CVE-2024-11146

    TrueFiling authorization bypass via user-controlled keys

    TrueFiling is a collaborative, web-based electronic filing system where attorneys, paralegals, court reporters and self-represented filers collect public legal documentation into cases. TrueFiling is an entirely cloud-hosted application. Prior to version 3.1.…

    i3 Verticals TrueFiling
  • Medium 6.4
    CVE-2024-13398

    Checkout for PayPal <= 1.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Checkout for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'checkout_for_paypal' shortcode in all versions up to, and including, 1.0.32 due to insufficient input sanitization and output escaping on user supplied…

    naa986 Checkout for PayPal Web / CMS
  • Medium 6.1
    CVE-2024-13434

    WP Inventory Manager <= 2.3.2 - Reflected Cross-Site Scripting

    The WP Inventory Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauth…

    chuck1982 WP Inventory Manager Web / CMS
  • Medium 6.4
    CVE-2024-13401

    Payment Button for PayPal <= 1.2.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Payment Button for PayPal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_paypal_checkout' shortcode in all versions up to, and including, 1.2.3.35 due to insufficient input sanitization and output escaping on user s…

    naa986 Payment Button for PayPal Web / CMS
  • Medium 4.0
    CVE-2024-51462

    IBM QRadar WinCollect Agent data manipulation

    IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data.

    IBM QRadar WinCollect Agent
  • Medium 6.5
    CVE-2024-52363

    IBM InfoSphere Information Server directory traversal

    IBM InfoSphere Information Server 11.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

    IBM InfoSphere Information Server
  • Medium 6.5
    CVE-2024-50967 Public exploit Scanner template

    The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability…

  • Medium 6.1
    CVE-2024-57370

    Cross Site Scripting vulnerability in sunnygkp10 Online Exam System master version allows a remote attacker to obtain s…

  • Medium 6.1
    CVE-2024-57372

    Cross Site Scripting vulnerability in InformationPush master version allows a remote attacker to obtain sensitive infor…

  • Medium 6.1
    CVE-2024-57033

    WeGIA < 3.2.0 is vulnerable to Cross Site Scripting (XSS) via the dados_addInfo parameter of documentos_funcionario.php.

  • Medium 4.3
    CVE-2024-57252

    OtCMS <=V7.46 is vulnerable to Server-Side Request Forgery (SSRF) in /admin/read.php, which can Read system files arbit…

  • Medium 6.4
    CVE-2024-57369

    Clickjacking vulnerability in typecho v1.2.1.