Skip to content
OpenAdvisories

Archive

7 April 2023

Vulnerabilities first published on this day (UTC), newest first.

← March 2023 2023 / April /7 May 2023 →
  1. 119
  2. 211
  3. 346
  4. 4165
  5. 5139
  6. 6111
  7. 799
  8. 820
  9. 915
  10. 1078
  11. 11239
  12. 12105
  13. 1342
  14. 14111
  15. 1565
  16. 1638
  17. 1786
  18. 18191
  19. 1994
  20. 2054
  21. 2161
  22. 2231
  23. 2326
  24. 24114
  25. 2599
  26. 2659
  27. 2772
  28. 28111
  29. 2913
  30. 303
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • High 7.7
    CVE-2023-23761

    Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gists

    An improper authentication vulnerability was identified in GitHub Enterprise Server that allowed an unauthorized actor to modify other users' secret gists by authenticating through an SSH certificate authority. To do so, a user had to know the secret gist's U…

    GitHub Enterprise Server
  • High 7.3
    CVE-2023-1941

    SourceCodester Simple and Beautiful Shopping Cart System login.php sql injection

    A vulnerability, which was classified as critical, has been found in SourceCodester Simple and Beautiful Shopping Cart System 1.0. This issue affects some unknown processing of the file login.php. The manipulation of the argument username/password leads to sq…

    SourceCodester Simple and Beautiful Shopping Cart System
  • High 7.5
    CVE-2023-28710

    Apache Airflow Spark Provider Arbitrary File Read via JDBC

    Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Spark Provider.This issue affects Apache Airflow Spark Provider: before 4.0.1.

    Apache Software Foundation Apache Airflow Spark Provider apache-airflow-providers-apache-spark PyPI
  • High 7.5
    CVE-2023-28707

    Airflow Apache Drill Provider Arbitrary File Read Vulnerability

    Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Drill Provider.This issue affects Apache Airflow Drill Provider: before 2.3.2.

    Apache Software Foundation Apache Airflow Drill Provider apache-airflow apache-airflow-providers-apache-drill PyPI
  • High 7.1
    CVE-2023-29388

    WordPress Product Catalog Simple Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in impleCode Product Catalog Simple plugin <= 1.6.17 versions.

    impleCode Product Catalog Simple
  • High 7.1
    CVE-2023-29171

    WordPress Magic Post Thumbnail Plugin <= 4.1.10 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-site Scripting (XSS) vulnerability in Magic Post Thumbnail plugin <= 4.1.10 versions.

    Magic Post Thumbnail Magic Post Thumbnail
  • High 7.1
    CVE-2023-29172

    WordPress PropertyHive Plugin <= 1.5.46 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PropertyHive plugin <= 1.5.46 versions.

    Property Hive PropertyHive
  • High 7.1
    CVE-2023-28789

    WordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions.

    Cimatti Consulting WordPress Contact Forms by Cimatti Web / CMS
  • High 7.1
    CVE-2023-28781

    WordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Cimatti Consulting WordPress Contact Forms by Cimatti plugin <= 1.5.4 versions.

    Cimatti Consulting WordPress Contact Forms by Cimatti Web / CMS
  • High 7.1
    CVE-2023-28792

    WordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions.

    I Thirteen Web Solution Continuous Image Carousel With Lightbox
  • High 7.1
    CVE-2023-27876

    IBM TRIRIGA Application Platform XML external entity injection

    IBM TRIRIGA 4.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 249975.

    IBM TRIRIGA Application Platform
  • High 7.1
    CVE-2023-25713

    WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.

    fullworks Quick Paypal Payments
  • High 7.1
    CVE-2023-28993

    WordPress Albo Pretorio Online Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth.  Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On Line plugin <= 4.6.1 versions.

    Ignazio Scimone Albo Pretorio On line
  • High 7.1
    CVE-2023-29236

    WordPress Outdoor Theme <= 3.9.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Outdoor theme <= 3.9.6 versions.

    Cththemes Outdoor
  • High 7.1
    CVE-2023-25041

    WordPress Monolit Theme <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cththemes Monolit theme <= 2.0.6 versions.

    Cththemes Monolit
  • High 7.1
    CVE-2023-25020

    WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.1.1 versions.

    Kiboko Labs Arigato Autoresponder and Newsletter
  • High 7.8
    CVE-2023-28051

    Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability. A low-privileged attack…

    Dell Dell Power Manager (DPM)
  • High 7.5
    CVE-2023-27180

    GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is acce…

  • High 8.8
    CVE-2023-26817

    codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the …

  • High 7.5
    CVE-2023-26820

    siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js.