Skip to content
OpenAdvisories

Archive

29 March 2023

Vulnerabilities first published on this day (UTC), newest first.

← February 2023 2023 / March /29 April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

53 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-47602

    WordPress WP Table Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in JoomUnited WP Table Manager plugin <= 3.5.2 versions.

    JoomUnited WP Table Manager
  • Medium 5.9
    CVE-2022-47607

    WordPress Usersnap Plugin <= 4.16 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Usersnap plugin <= 4.16 versions.

    Usersnap Usersnap
  • Medium 5.9
    CVE-2022-47610

    WordPress Simple Image Popup Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mr Digital Simple Image Popup plugin <= 1.3.6 versions.

    Mr Digital Simple Image Popup
  • Medium 5.9
    CVE-2022-47613

    WordPress AI ChatBot Plugin <= 4.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud AI ChatBot plugin <= 4.3.0 versions.

    Quantum Cloud AI ChatBot
  • Medium 5.0
    CVE-2023-25809

    rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

    runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the…

    opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 6.1
    CVE-2023-28642

    AppArmor bypass with symlinked /proc in runc

    runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…

    opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 5.5
    CVE-2023-1550

    NGINX Agent vulnerability CVE-2023-1550

    Insertion of Sensitive Information into log file vulnerability in NGINX Agent. NGINX Agent version 2.0 before 2.23.3 inserts sensitive information into a log file. An authenticated attacker with local access to read agent log files may gain access to private …

    F5 NGINX Agent Network devices
  • Medium 6.1
    CVE-2023-26292

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud …

    Forcepoint Cloud Security Gateway (CSG) Web Security
  • Medium 6.1
    CVE-2023-26291

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud …

    Forcepoint Web Security Cloud Security Gateway (CSG)
  • Medium 6.1
    CVE-2023-26290

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Cloud …

    Forcepoint Cloud Security Gateway (CSG) Web Security
  • Medium 5.9
    CVE-2022-47596

    WordPress Media Library Categories Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 1.9.9 versions.

    Jeffrey-WP Media Library Categories
  • Medium 5.5
    CVE-2023-1575

    Mega Main Menu <= 2.2.2 - Authenticated (Administrator+) Cross-Site Scripting

    The Mega Main Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 2.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticat…

    MegaMain Mega Main Menu Web / CMS
  • Medium 4.3
    CVE-2023-1680

    Xunrui CMS main.html information disclosure

    A vulnerability, which was classified as problematic, has been found in Xunrui CMS 4.61. This issue affects some unknown processing of the file /dayrui/My/View/main.html. The manipulation leads to information disclosure. The attack may be initiated remotely. …

    Xunrui CMS
  • Medium 6.5
    CVE-2023-1663

    Authenticated Resources Accessible via Forced Browsing

    Coverity versions prior to 2023.3.2 are vulnerable to forced browsing, which exposes authenticated resources to unauthorized actors. The root cause of this vulnerability is an insecurely configured servlet mapping for the underlying Apache Tomcat server. As a…

    Synopsys Coverity
  • Medium 5.4
    CVE-2023-23861

    WordPress GMAce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in German Mesky GMAce plugin <= 1.5.2 versions.

    German Mesky GMAce
  • Medium 5.9
    CVE-2022-47438

    WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions.

    wpdevart Booking calendar, Appointment Booking System
  • Medium 6.5
    CVE-2023-28158

    Apache Archiva privilege escalation

    Privilege escalation via stored XSS using the file upload service to upload malicious content. The issue can be exploited only by authenticated users which can create directory name to inject some XSS content and gain some privileges such admin user.

    Apache Software Foundation Apache Archiva org.apache.archiva:archiva Maven
  • Medium 4.3
    CVE-2022-38077

    WordPress Popup Anything Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.

    WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions
  • Medium 6.1
    CVE-2022-48433

    In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built…

    JetBrains IntelliJ IDEA
  • Medium 5.2
    CVE-2022-48432

    In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.

    JetBrains IntelliJ IDEA
  • Medium 4.5
    CVE-2022-48431

    In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust …

    JetBrains IntelliJ IDEA
  • Medium 5.5
    CVE-2022-48430

    In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown pr…

    JetBrains IntelliJ IDEA
  • Medium 6.3
    CVE-2023-1685

    HadSky Installation Interface index.php command injection

    A vulnerability was found in HadSky up to 7.11.8. It has been declared as critical. This vulnerability affects unknown code of the file /install/index.php of the component Installation Interface. The manipulation leads to command injection. The attack can be …

  • Medium 6.6
    CVE-2023-23355

    QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR

    An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fix…

    QNAP Systems QTS QuTS hero QuTScloud
  • Medium 4.7
    CVE-2023-1684

    HadSky unrestricted upload

    A vulnerability was found in HadSky 7.7.16. It has been classified as problematic. This affects an unknown part of the file upload/index.php?c=app&a=superadmin:index. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotel…

  • Medium 4.3
    CVE-2023-1683

    Xunrui CMS system_log.html information disclosure

    A vulnerability was found in Xunrui CMS 4.61 and classified as problematic. Affected by this issue is some unknown functionality of the file /dayrui/Fcms/View/system_log.html. The manipulation leads to information disclosure. The attack may be launched remote…

    Xunrui CMS
  • Medium 5.1
    CVE-2023-1704

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.20.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.0
    CVE-2023-1702

    Cross-site Scripting (XSS) - Generic in pimcore/pimcore

    Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.0
    CVE-2023-1701

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.20.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.3
    CVE-2023-1703

    Cross-site Scripting (XSS) - Generic in pimcore/pimcore

    Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.20.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.5
    CVE-2023-27167 Public exploit

    Suprema BioStar 2 v2.8.16 was discovered to contain a SQL injection vulnerability via the values parameter at /users/ab…

  • Medium 5.4
    CVE-2023-26982 Public exploit

    Trudesk v1.2.6 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Tags parameter u…

  • Medium 5.4
    CVE-2022-1274 Public exploit

    HTML Injection in Keycloak Admin REST API

    A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.

    org.keycloak:keycloak-services Maven
  • Medium 5.5
    CVE-2022-36969 EPSS 14%

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 20…

    AVEVA Edge Browsers
  • Medium 6.5
    CVE-2022-36982 EPSS 74%

    This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.…

    ivanti Avalanche Network devices
  • Medium 5.0
    CVE-2022-27644

    This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected …

    NETGEAR R6700v3 Network devices
  • Medium 6.3
    CVE-2022-27642

    This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R670…

    NETGEAR R6700v3 Network devices
  • Medium 5.5
    CVE-2022-44369

    NASM 2.16 (development) is vulnerable to 476: Null Pointer Dereference via output/outaout.c.

    nasm nasm nasm Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2022-44368

    NASM v2.16 was discovered to contain a null pointer deference in the NASM component

    nasm nasm nasm Debian Ubuntu Azure Linux
  • Medium 6.4
    CVE-2022-42433

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-…

    TP-Link Systems TL-WR841N Network devices