Skip to content
OpenAdvisories

Archive

16 April 2023

Vulnerabilities first published on this day (UTC), newest first.

← March 2023 2023 / April /16 May 2023 →
  1. 119
  2. 211
  3. 346
  4. 4165
  5. 5139
  6. 6111
  7. 799
  8. 820
  9. 915
  10. 1078
  11. 11239
  12. 12105
  13. 1342
  14. 14111
  15. 1565
  16. 1638
  17. 1786
  18. 18191
  19. 1994
  20. 2054
  21. 2161
  22. 2231
  23. 2326
  24. 24114
  25. 2599
  26. 2659
  27. 2772
  28. 28111
  29. 2913
  30. 303
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • Medium 5.4
    CVE-2022-45849

    WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions.

    silkalns Activello
  • Medium 4.8
    CVE-2022-44734

    WordPress Car Rental by BestWebSoft Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.

    bestwebsoft Car Rental by BestWebSoft
  • Medium 4.1
    CVE-2022-43458

    WordPress Advanced Floating Content Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Code Tides Advanced Floating Content plugin <= 1.2.1 versions.

    Code Tides Advanced Floating Content
  • Medium 6.1
    CVE-2022-43480

    WordPress Homepage Pop-up Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.

    Magneticlab Sàrl Homepage Pop-up
  • Medium 4.3
    CVE-2023-30474

    WordPress Ultimate Noindex Nofollow Tool II Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin <= 1.3 versions.

    Kilian Evang Ultimate Noindex Nofollow Tool II
  • Medium 5.5
    CVE-2023-27610

    WordPress Transbank Webpay REST Plugin <= 1.6.6 is vulnerable to SQL Injection

    Auth. (admin+) SQL Injection (SQLi) vulnerability in TransbankDevelopers Transbank Webpay REST plugin <= 1.6.6 versions.

    TransbankDevelopers Transbank Webpay REST
  • Medium 6.3
    CVE-2023-2108

    SourceCodester Judging Management System edit_contestant.php sql injection

    A vulnerability has been found in SourceCodester Judging Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_contestant.php. The manipulation of the argument contestant_id leads to sql …

    SourceCodester Judging Management System
  • Medium 6.5
    CVE-2022-48314

    The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploita…

    Huawei HarmonyOS EMUI Network devices
  • Medium 6.8
    CVE-2023-30542

    GovernorCompatibilityBravo may trim proposal calldata

    OpenZeppelin Contracts is a library for secure smart contract development. The proposal creation entrypoint (`propose`) in `GovernorCompatibilityBravo` allows the creation of proposals with a `signatures` array shorter than the `calldatas` array. This causes …

    OpenZeppelin openzeppelin-contracts @openzeppelin/contracts-upgradeable @openzeppelin/contracts npm
  • Medium 6.5
    CVE-2022-48313

    The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploita…

    Huawei HarmonyOS EMUI Network devices
  • Medium 5.4
    CVE-2023-29506 Scanner template

    org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpoints

    XWiki Commons are technical libraries common to several other top level XWiki projects. It was possible to inject some code using the URL of authenticated endpoints. This problem has been patched on XWiki 13.10.11, 14.4.7 and 14.10.

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-security-authentication-default Maven
  • Medium 6.4
    CVE-2023-30772

    The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2022-34125 Public exploit

    front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive informat…

  • Medium 6.1
    CVE-2022-28353

    In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.

  • Medium 5.3
    CVE-2022-30076 Public exploit

    ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student username…

  • Medium 6.7
    CVE-2022-37704 Public exploit

    Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/r…

    amanda amanda Debian Ubuntu
  • Medium 6.1
    CVE-2022-37306

    OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.

  • Medium 5.9
    CVE-2022-37186

    In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the tim…

    lemonldap-ng lemonldap-ng Debian Ubuntu