Skip to content
OpenAdvisories

Archive

23 January 2023

Vulnerabilities first published on this day (UTC), newest first.

← December 2022 2023 / January /23 February 2023 →
  1. 123
  2. 276
  3. 394
  4. 480
  5. 584
  6. 678
  7. 748
  8. 818
  9. 965
  10. 10215
  11. 11149
  12. 12103
  13. 1380
  14. 1428
  15. 1531
  16. 1667
  17. 17164
  18. 1893
  19. 1956
  20. 20103
  21. 219
  22. 227
  23. 2394
  24. 24125
  25. 2560
  26. 26174
  27. 2786
  28. 287
  29. 2912
  30. 30102
  31. 3151
All Critical High Medium Low Exploited only Public exploit

56 results · Clear filters · Feed

  • Medium 5.4
    CVE-2022-4629

    Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in Shortcode

    The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scri…

    Web / CMS
  • Medium 5.4
    CVE-2022-4668

    Easy Appointments < 3.11.2 - Contributor+ Stored XSS in Shortcode

    The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack…

    Web / CMS
  • Medium 5.4
    CVE-2022-4672

    WordPress Simple Shopping Cart < 4.6.2 - Contributor+ Stored XSS via Shortcode

    The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scri…

    Web / CMS
  • Medium 5.4
    CVE-2022-4760

    OneClick Chat to Order < 1.0.4.2 - Contributor+ Stored XSS via Shortcode

    The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting …

    Web / CMS
  • Medium 5.4
    CVE-2022-4625

    Login Logout Menu < 1.4.0 - Contributor+ Stored XSS in Shortcode

    The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks…

    Web / CMS
  • Medium 5.4
    CVE-2022-4832

    Store Locator WordPress < 1.4.9 - Contributor+ Stored XSS via Shortcode

    The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks whi…

    Web / CMS
  • Medium 5.4
    CVE-2023-0438

    Cross-Site Request Forgery (CSRF) in modoboa/modoboa

    Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.0.4.

    modoboa modoboa/modoboa modoboa PyPI
  • Medium 5.3
    CVE-2023-0440

    Observable Discrepancy in healthchecks/healthchecks

    Observable Discrepancy in GitHub repository healthchecks/healthchecks prior to v2.6.

    healthchecks healthchecks/healthchecks
  • Medium 6.5
    CVE-2023-21719

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 4.3
    CVE-2023-22630

    IzyBat Orange casiers before 20221102_1 allows SQL Injection via a getCasier.php?taille= URI.

  • Medium 5.5
    CVE-2022-48281

    processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of si…

    tiff tiff tiff libtiff Debian Ubuntu Azure Linux Alpine
  • Medium 4.3
    CVE-2022-46959

    Path Traversal in github.com/go-sonic/sonic

    An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal.

    github.com/go-sonic/sonic Go
  • Medium 5.4
    CVE-2022-40034

    Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via …

  • Medium 6.4
    CVE-2022-41505

    An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by …

  • Medium 5.3
    CVE-2021-43448

    ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. A lack of input validation can all…

  • Medium 6.1
    CVE-2021-43446

    ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). The "macros" feature of the docum…