Skip to content
OpenAdvisories

Archive

20 March 2023

Vulnerabilities first published on this day (UTC), newest first.

← February 2023 2023 / March /20 April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 7.3
    CVE-2012-10009

    404like Plugin 404Like.php checkPage sql injection

    A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage of the file 404Like.php. The manipulation of the argument searchWord leads to sql injection. It is possible to launch …

  • High 8.1
    CVE-2022-43663 EPSS 14%

    An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.…

    WellinTech KingHistorian
  • High 7.5
    CVE-2022-45124 EPSS 13%

    An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.…

    WellinTech KingHistorian
  • High 8.8
    CVE-2023-0340

    Custom Content Shortcode <= 4.0.2 - Contributor+ LFI

    The Custom Content Shortcode WordPress plugin through 4.0.2 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to read non P…

    Web / CMS
  • High 8.8
    CVE-2023-0875

    WP Meta SEO < 4.5.3 - Subscriber+ SQLi

    The WP Meta SEO WordPress plugin before 4.5.3 does not properly sanitize and escape inputs into SQL queries, leading to a blind SQL Injection vulnerability that can be exploited by subscriber+ users.

    Web / CMS
  • High 8.8
    CVE-2023-0940

    ProfileGrid < 5.3.1 - Subscriber+ Arbitrary Password Reset

    The ProfileGrid WordPress plugin before 5.3.1 provides an AJAX endpoint for resetting a user password but does not implement proper authorization. This allows a user with low privileges, such as subscriber, to change the password of any account, including Adm…

    Web / CMS
  • High 7.5
    CVE-2023-28118

    kaml has potential denial of service while parsing input with anchors and aliases

    kaml provides YAML support for kotlinx.serialization. Prior to version 0.53.0, applications that use kaml to parse untrusted input containing anchors and aliases may consume excessive memory and crash. Version 0.53.0 and later default to refusing to parse YAM…

    charleskorn kaml com.charleskorn.kaml:kaml Maven
  • High 8.3
    CVE-2023-28083

    Potential Cross-Site scripting vulnerability in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4).

    A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this vulnerability in HPE Integrated Lights-Ou…

    HPE Integrated Lights-Out
  • High 7.5
    CVE-2023-26513

    Apache Sling Resource Merger: Requests to certain paths managed by the Apache Sling Resource Merger can lead to DoS

    Excessive Iteration vulnerability in Apache Software Foundation Apache Sling Resource Merger.This issue affects Apache Sling Resource Merger: from 1.2.0 before 1.4.2.

    Apache Software Foundation Apache Sling Resource Merger org.apache.sling:org.apache.sling.resourcemerger Maven
  • High 7.1
    CVE-2022-47591

    WordPress Map Multi Marker Plugin <= 3.2.1 is vulnerable to Cross Site Scripting (XSS)

    Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.

    Mickael Austoni Map Multi Marker
  • High 7.1
    CVE-2022-47592

    WordPress MagicForm Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)

    Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions.

    Dmytriy.cooperman MagicForm
  • High 7.1
    CVE-2023-22682

    WordPress Camera slideshow Plugin <= 1.4.0.1 is vulnerable to Cross Site Scripting (XSS)

    Reflected Cross-Site Scripting (XSS) vulnerability in Manuel Masia | Pixedelic.Com Camera slideshow plugin <= 1.4.0.1 versions.

    Manuel Masia | Pixedelic.com Camera slideshow
  • High 7.4
    CVE-2023-1250

    Code execution through ACL creation

    Improper Input Validation vulnerability in OTRS AG OTRS (ACL modules), OTRS AG ((OTRS)) Community Edition (ACL modules) allows Local Execution of Code. When creating/importing an ACL it was possible to inject code that gets executed via manipulated comments a…

    OTRS OTRS ((OTRS)) Community Edition otrs2 Ubuntu