Medium
CVE-2024-11224
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2024-9777
Ashe <= 2.243 - Reflected Cross-Site Scripting via add_query_arg Parameter
Medium
CVE-2024-9830
Bard <= 2.216 - Reflected Cross-Site Scripting via add_query_arg Parameter
High
CVE-2024-11038
WPB Popup for Contact Form 7 – Showing The Contact Form 7 Popup on Button Click – CF7 Popup <= 1.7.5 - Unauthenticated Arbitrary Shortcode Execution via wpb_pcf_fire_contact_form
High
CVE-2024-11036
GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.1.5 - Unauthenticated Arbitrary Shortcode Execution via gamipress_get_user_earnings
Medium
CVE-2024-11195
Email Subscription Popup <= 1.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via print_email_subscribe_form Shortcode
High
CVE-2024-52506
Graylog concurrent PDF report rendering can leak other users' reports
High
CVE-2024-48917
XXE in PHPSpreadsheet's XLSX reader
High
CVE-2024-47873
XmlScanner bypass leads to XXE
Critical
CVE-2024-47533
cobbler allows anyone to connect to cobbler XML-RPC server with known password and make changes
Medium
CVE-2024-10268
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar <= 5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via sonaar_audioplayer Shortcode
Medium
CVE-2024-11098
SVG Block <= 1.1.24 - Authenticated (Administrator+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-52318
Apache Tomcat - XSS in generated JSPs
Medium
CVE-2024-37155
OpenCTI May Bypass Introspection Restriction
Critical
CVE-2024-52316
Apache Tomcat - Authentication Bypass
Medium
CVE-2024-52317
Apache Tomcat Request and/or response mix-up
Medium
CVE-2024-48901
moodle: IDOR when fetching report schedules
Medium
CVE-2024-48897
moodle: IDOR in edit/delete RSS feed
Medium
CVE-2024-48896
Moodle leaks user names
Medium
CVE-2024-48898
moodle: Some users can delete audiences of other reports
Medium
CVE-2024-11023
Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server
Medium
CVE-2024-11319
django CMS Cross-Site Scripting (XSS)
Medium
CVE-2024-10486
Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File
Medium
CVE-2024-38828
Spring MVC controller vulnerable to a DoS attack
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.