Skip to content
OpenAdvisories

Archive

23 March 2023

Vulnerabilities first published on this day (UTC), newest first.

← February 2023 2023 / March /23 April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

141 results · Feed

  • Critical 10.0
    CVE-2023-28445

    Deno improperly handles resizable ArrayBuffer

    Deno is a runtime for JavaScript and TypeScript that uses V8 and is built in Rust. Resizable ArrayBuffers passed to asynchronous functions that are shrunk during the asynchronous operation could result in an out-of-bound read/write. It is unlikely that this h…

    denoland deno deno deno_runtime crates.io
  • Medium 4.2
    CVE-2023-28443

    directus vulnerable to Insertion of Sensitive Information into Log File

    Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is p…

    directus directus directus npm
  • High 7.5
    CVE-2023-28442

    Geoserver for GeoNode sensitive information leak

    GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Prior to versions 2.20.6, 2.19.6, and 2.18.7, anonymous users can obtain sensitive information about GeoNode configurations from the response …

    GeoNode GeoNode
  • High 8.0
    CVE-2023-28441

    smartCARS 3 Password Stored as plain text in Error Log

    smartCARS 3 is flight tracking software. In version 0.5.8 and prior, all persons who have failed login attempts will have their password stored in error logs. This problem doesn't occur in version 0.5.9. As a workaround, delete the affected log file, and ensu…

    invernyx smartcars-3-bugs
  • Low 3.5
    CVE-2023-1613

    Rebuild publish cross site scripting

    A vulnerability has been found in Rebuild up to 3.2.3 and classified as problematic. This vulnerability affects unknown code of the file /feeds/post/publish. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has…

  • Medium 6.3
    CVE-2023-1612

    Rebuild list-file sql injection

    A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3. This affects an unknown part of the file /files/list-file. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been discl…

  • Medium 6.3
    CVE-2023-1610

    Rebuild list sql injection

    A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3. Affected by this issue is some unknown functionality of the file /project/tasks/list. The manipulation leads to sql injection. The attack may be launched remotely. The e…

  • Low 3.5
    CVE-2023-1609

    Zhong Bang CRMEB Java save cross site scripting

    A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been rated as problematic. This issue affects the function save of the file /api/admin/store/product/save. The manipulation leads to cross site scripting. The attack may be initiated remot…

    Zhong Bang CRMEB Java
  • Medium 6.3
    CVE-2023-1608

    Zhong Bang CRMEB Java list getAdminList sql injection

    A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the file /api/admin/store/product/list. The manipulation of the argument cateId leads to sql injection. T…

    Zhong Bang CRMEB Java
  • Medium 4.7
    CVE-2023-1607

    novel-plus list sql injection

    A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The…

  • Medium 5.7
    CVE-2023-28436

    Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process

    Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in version 1.34.0 and prior to prior to 1.38.2 in FreeBSD allows commands to be run with a higher privi…

    tailscale tailscale tailscale.com Go
  • Critical 9.8
    CVE-2023-25655

    baserCMS allows any file to be uploaded

    baserCMS is a Content Management system. Prior to version 4.7.5, any file may be uploaded on the management system of baserCMS. Version 4.7.5 contains a patch.

    baserproject basercms baserproject/basercms Packagist
  • Critical 9.8
    CVE-2023-25654

    baserCMS File Uploader Remote Code Execution (RCE) vulnerability

    baserCMS is a Content Management system. Prior to version 4.7.5, there is a Remote Code Execution (RCE) Vulnerability in the management system of baserCMS. Version 4.7.5 contains a patch.

    baserproject basercms baserproject/basercms Packagist
  • Medium 6.3
    CVE-2023-1606

    novel-plus DictController.java sql injection

    A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotel…

  • High 8.8
    CVE-2023-20558

    Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler pot…

    AMD Ryzen 5000 Series Ryzen 3000 Series Ryzen 2000 Series
  • High 8.8
    CVE-2023-20559

    Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handle…

    AMD Ryzen 5000 Series Ryzen 3000 Series Ryzen 2000 Series
  • Medium 6.5
    CVE-2023-1603

    Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versi…

    Devolutions Server
  • Medium 6.5
    CVE-2023-1202

    Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 …

    Devolutions Remote Desktop Manager
  • Medium 5.9
    CVE-2023-25456

    WordPress Klaviyo Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Klaviyo, Inc. Klaviyo plugin <= 3.0.7 versions.

    Klaviyo Klaviyo
  • Medium 5.9
    CVE-2023-26008

    WordPress Top 10 Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin <= 3.2.4 versions.

    Ajay D'Souza Top 10 – Popular posts plugin for WordPress Web / CMS
  • Medium 5.9
    CVE-2023-25992

    WordPress CM Answers Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM Answers plugin <= 3.1.9 versions.

    CreativeMindsSolutions CM Answers
  • Medium 5.9
    CVE-2023-23707

    WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via uplo…

    AWSM Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
  • High 7.1
    CVE-2022-47145

    WordPress Blockonomics Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)

    Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.

    blockonomics WordPress Bitcoin Payments – Blockonomics Web / CMS
  • Medium 5.9
    CVE-2022-47173

    WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.62.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration plugin <= 1.62.0 versions.

    Nasir Ahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Web / CMS
  • Medium 5.9
    CVE-2022-47589

    WordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin <= 3.2.11 versions.

    this.functional CTT Expresso para WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-22702

    WordPress WPMobile.App — Android and iOS Mobile Application Plugin <= 11.13 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.13 versions.

    WPMobile.App WPMobile.App — Android and iOS Mobile Application Android iOS
  • Medium 5.9
    CVE-2023-23722

    WordPress WP eBay Product Feeds Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP eBay Product Feeds plugin <= 3.3.1 versions.

    Winwar Media WP eBay Product Feeds
  • Medium 6.5
    CVE-2023-23728

    WordPress WP Flipclock Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Flipclock plugin <= 1.7.4 versions.

    Winwar Media WP Flipclock
  • Medium 6.5
    CVE-2023-23864

    WordPress Very Simple Google Maps Plugin <= 2.8.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Michael Aronoff Very Simple Google Maps plugin <= 2.8.4 versions.

    Michael Aronoff Very Simple Google Maps
  • Medium 6.5
    CVE-2023-23650

    WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in MainWP MainWP Code Snippets Extension plugin <= 4.0.2 versions.

    mainwp MainWP Code Snippets Extension
  • Medium 6.5
    CVE-2023-22712

    WordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TemplatesNext TemplatesNext ToolKit plugin <= 3.2.7 versions.

    TemplatesNext TemplatesNext ToolKit
  • Medium 5.9
    CVE-2023-22715

    WordPress WP-CommentNavi Plugin <= 1.12.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Lester 'GaMerZ' Chan WP-CommentNavi plugin <= 1.12.1 versions.

    Lester 'GaMerZ' Chan WP-CommentNavi
  • Medium 5.9
    CVE-2023-22716

    WordPress OOPSpam Anti-Spam Plugin <= 1.1.35 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.35 versions.

    OOPSpam Team OOPSpam Anti-Spam
  • High 7.1
    CVE-2022-47431

    WordPress Open RDW kenteken voertuiginformatie Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)

    Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.

    Tussendoor internet & marketing Open RDW kenteken voertuiginformatie
  • Medium 5.9
    CVE-2023-28422

    WordPress Event Manager for WooCommerce Plugin <= 3.8.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.

    MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-22704

    WordPress teachPress Plugin <= 8.1.8 is vulnerable to Cross Site Scripting (XSS)

    Reflected Cross-Site Scripting (XSS) vulnerability in Michael Winkler teachPress plugin <= 8.1.8 versions.

    Michael Winkler teachPress
  • Medium 4.8
    CVE-2022-44742

    WordPress Community Events Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions.

    Yannick Lefebvre Community Events
  • Medium 5.4
    CVE-2022-45843

    WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin <= 3.5.1.9 versions.

    Nextend Smart Slider 3
  • Medium 6.5
    CVE-2023-28684

    Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks

    Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    Jenkins Project Jenkins remote-jobs-view-plugin Plugin com.sap.jenkinsci:remote-jobs-view-plugin Web / CMS Maven
  • High 8.2
    CVE-2023-28683

    Jenkins Phabricator Differential Plugin vulnerable to XML external entity (XXE) attacks

    Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    Jenkins Project Jenkins Phabricator Differential Plugin org.jenkins-ci.plugins:phabricator-plugin Web / CMS Maven