Skip to content
OpenAdvisories

Archive

March 2023

Vulnerabilities first published in this month (UTC), newest first.

← February 2023 2023 / March April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

1,048 results · Clear filters · Feed

  • Medium 5.5
    CVE-2023-20972

    In btm_vendor_specific_evt of btm_devctl.cc, there is a possible out of bounds read due to a missing bounds check. This…

    Android
  • Medium 5.5
    CVE-2023-20910

    In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhausti…

    Google Android android-platform-frameworks-base Android Ubuntu
  • Medium 4.4
    CVE-2023-20968

    In multiple functions of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This coul…

    Android
  • Medium 5.5
    CVE-2023-20996

    In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. Th…

    Android
  • Medium 5.5
    CVE-2023-20973

    In btm_create_conn_cancel_complete of btm_sec.cc, there is a possible out of bounds read due to a missing bounds check.…

    Android
  • Medium 5.5
    CVE-2023-20979

    In GetNextSourceDataPacket of bta_av_co.cc, there is a possible out of bounds read due to a missing bounds check. This …

    Android
  • Medium 5.5
    CVE-2023-20998

    In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. Th…

    Android
  • Medium 5.5
    CVE-2023-20952

    In A2DP_BuildCodecHeaderSbc of a2dp_sbc.cc, there is a possible out of bounds write due to a missing bounds check. This…

    Android
  • Medium 5.5
    CVE-2023-20999

    In multiple locations, there is a possible way to trigger a persistent reboot loop due to improper input validation. Th…

    Android
  • Medium 4.3
    CVE-2022-40208

    Moodle may allow students to bypass sequential navigation during a quiz attempt

    In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.5
    CVE-2022-20467

    In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. T…

    Android
  • Medium 5.5
    CVE-2022-20499

    In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to loc…

    android-platform-frameworks-base Android Ubuntu
  • Medium 5.5
    CVE-2021-3684

    OpenShift Assisted Installer leaks image pull secrets as plaintext in installation logs

    A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull contain…

    github.com/openshift/assisted-installer Go
  • Medium 4.2
    CVE-2023-28443

    directus vulnerable to Insertion of Sensitive Information into Log File

    Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is p…

    directus directus directus npm
  • Medium 6.3
    CVE-2023-1612

    Rebuild list-file sql injection

    A vulnerability, which was classified as critical, was found in Rebuild up to 3.2.3. This affects an unknown part of the file /files/list-file. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been discl…

  • Medium 6.3
    CVE-2023-1610

    Rebuild list sql injection

    A vulnerability, which was classified as critical, has been found in Rebuild up to 3.2.3. Affected by this issue is some unknown functionality of the file /project/tasks/list. The manipulation leads to sql injection. The attack may be launched remotely. The e…

  • Medium 6.3
    CVE-2023-1608

    Zhong Bang CRMEB Java list getAdminList sql injection

    A vulnerability was found in Zhong Bang CRMEB Java up to 1.3.4. It has been declared as critical. This vulnerability affects the function getAdminList of the file /api/admin/store/product/list. The manipulation of the argument cateId leads to sql injection. T…

    Zhong Bang CRMEB Java
  • Medium 4.7
    CVE-2023-1607

    novel-plus list sql injection

    A vulnerability was found in novel-plus 3.6.2. It has been classified as critical. This affects an unknown part of the file /common/sysFile/list. The manipulation of the argument sort leads to sql injection. It is possible to initiate the attack remotely. The…

  • Medium 5.7
    CVE-2023-28436

    Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process

    Tailscale is software for using Wireguard and multi-factor authentication (MFA). A vulnerability identified in the implementation of Tailscale SSH starting in version 1.34.0 and prior to prior to 1.38.2 in FreeBSD allows commands to be run with a higher privi…

    tailscale tailscale tailscale.com Go
  • Medium 6.3
    CVE-2023-1606

    novel-plus DictController.java sql injection

    A vulnerability was found in novel-plus 3.6.2 and classified as critical. Affected by this issue is some unknown functionality of the file DictController.java. The manipulation of the argument orderby leads to sql injection. The attack may be launched remotel…

  • Medium 6.5
    CVE-2023-1603

    Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versi…

    Devolutions Server
  • Medium 6.5
    CVE-2023-1202

    Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 …

    Devolutions Remote Desktop Manager
  • Medium 5.9
    CVE-2023-25456

    WordPress Klaviyo Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Klaviyo, Inc. Klaviyo plugin <= 3.0.7 versions.

    Klaviyo Klaviyo
  • Medium 5.9
    CVE-2023-26008

    WordPress Top 10 Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ajay D'Souza Top 10 – Popular posts plugin for WordPress plugin <= 3.2.4 versions.

    Ajay D'Souza Top 10 – Popular posts plugin for WordPress Web / CMS
  • Medium 5.9
    CVE-2023-25992

    WordPress CM Answers Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM Answers plugin <= 3.1.9 versions.

    CreativeMindsSolutions CM Answers
  • Medium 5.9
    CVE-2023-23707

    WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Unrestricted Upload of File with Dangerous Type vulnerability in Awsm Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files allows Stored XSS via uplo…

    AWSM Innovations Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
  • Medium 5.9
    CVE-2022-47173

    WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.62.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration plugin <= 1.62.0 versions.

    Nasir Ahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Web / CMS
  • Medium 5.9
    CVE-2022-47589

    WordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin <= 3.2.11 versions.

    this.functional CTT Expresso para WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-22702

    WordPress WPMobile.App — Android and iOS Mobile Application Plugin <= 11.13 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.13 versions.

    WPMobile.App WPMobile.App — Android and iOS Mobile Application Android iOS
  • Medium 5.9
    CVE-2023-23722

    WordPress WP eBay Product Feeds Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media WP eBay Product Feeds plugin <= 3.3.1 versions.

    Winwar Media WP eBay Product Feeds
  • Medium 6.5
    CVE-2023-23728

    WordPress WP Flipclock Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Winwar Media WP Flipclock plugin <= 1.7.4 versions.

    Winwar Media WP Flipclock
  • Medium 6.5
    CVE-2023-23864

    WordPress Very Simple Google Maps Plugin <= 2.8.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Michael Aronoff Very Simple Google Maps plugin <= 2.8.4 versions.

    Michael Aronoff Very Simple Google Maps
  • Medium 6.5
    CVE-2023-23650

    WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in MainWP MainWP Code Snippets Extension plugin <= 4.0.2 versions.

    mainwp MainWP Code Snippets Extension
  • Medium 6.5
    CVE-2023-22712

    WordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TemplatesNext TemplatesNext ToolKit plugin <= 3.2.7 versions.

    TemplatesNext TemplatesNext ToolKit
  • Medium 5.9
    CVE-2023-22715

    WordPress WP-CommentNavi Plugin <= 1.12.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Lester 'GaMerZ' Chan WP-CommentNavi plugin <= 1.12.1 versions.

    Lester 'GaMerZ' Chan WP-CommentNavi
  • Medium 5.9
    CVE-2023-22716

    WordPress OOPSpam Anti-Spam Plugin <= 1.1.35 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.35 versions.

    OOPSpam Team OOPSpam Anti-Spam
  • Medium 5.9
    CVE-2023-28422

    WordPress Event Manager for WooCommerce Plugin <= 3.8.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-site Scripting (XSS) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce <= 3.8.6. versions.

    MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce Web / CMS
  • Medium 4.8
    CVE-2022-44742

    WordPress Community Events Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions.

    Yannick Lefebvre Community Events
  • Medium 5.4
    CVE-2022-45843

    WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin <= 3.5.1.9 versions.

    Nextend Smart Slider 3
  • Medium 6.5
    CVE-2023-28684

    Jenkins remote-jobs-view-plugin vulnerable to XML external entity attacks

    Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.

    Jenkins Project Jenkins remote-jobs-view-plugin Plugin com.sap.jenkinsci:remote-jobs-view-plugin Web / CMS Maven