Skip to content
OpenAdvisories

Archive

25 April 2023

Vulnerabilities first published on this day (UTC), newest first.

← March 2023 2023 / April /25 May 2023 →
  1. 119
  2. 211
  3. 346
  4. 4165
  5. 5139
  6. 6111
  7. 799
  8. 820
  9. 915
  10. 1078
  11. 11239
  12. 12105
  13. 1342
  14. 14111
  15. 1565
  16. 1638
  17. 1786
  18. 18191
  19. 1994
  20. 2054
  21. 2161
  22. 2231
  23. 2326
  24. 24114
  25. 2599
  26. 2659
  27. 2772
  28. 28111
  29. 2913
  30. 303
All Critical High Medium Low Exploited only Public exploit

50 results · Clear filters · Feed

  • Medium 4.7
    CVE-2023-0045 Public exploit

    Incorrect indirect branch prediction barrier in the Linux Kernel

    The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ib_prctl_set  function updates the Thread Information Flags (TIFs) for the task and updates the SPEC_CTRL MSR on the function __speculation_ctrl_update,…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.4
    CVE-2023-30609

    matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting

    matrix-react-sdk is a react-based SDK for inserting a Matrix chat/VoIP client into a web page. Prior to version 3.71.0, plain text messages containing HTML tags are rendered as HTML in the search results. To exploit this, an attacker needs to trick a user int…

    Matrix matrix-react-sdk element-web riot-web Alpine npm
  • Medium 5.9
    CVE-2023-24005

    WordPress Inline Tweet Sharer – Twitter Sharing Plugin Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin plugin <= 2.5.3 versions.

    Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin
  • Medium 5.9
    CVE-2023-23710

    WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

    miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • Medium 6.5
    CVE-2023-23866

    WordPress Interactive Geo Maps Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Carlos Moreira Interactive Geo Maps plugin <= 1.5.8 versions.

    Carlos Moreira Interactive Geo Maps
  • Medium 6.5
    CVE-2023-23889

    WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Paypal Payments plugin <= 5.7.25 versions.

    fullworks Quick Paypal Payments
  • Medium 5.9
    CVE-2023-23995

    WordPress TinyMCE Custom Styles Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Reeves & David Stöckl TinyMCE Custom Styles plugin <= 1.1.2 versions.

    Tim Reeves & David Stöckl TinyMCE Custom Styles
  • Medium 5.9
    CVE-2023-25461

    WordPress Wp-Insert Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in namithjawahar Wp-Insert plugin <= 2.5.0 versions.

    namithjawahar Wp-Insert
  • Medium 5.5
    CVE-2023-28084

    HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens

    HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens

    Hewlett Packard Enterprise HPE OneView HPE OneView Global Dashboard
  • Medium 5.5
    CVE-2023-28090

    An HPE OneView appliance dump may expose SNMPv3 read credentials

    Hewlett Packard Enterprise (HPE) HPE OneView
  • Medium 5.5
    CVE-2023-28087

    An HPE OneView appliance dump may expose OneView user accounts

    Hewlett Packard Enterprise (HPE) HPE OneView
  • Medium 5.9
    CVE-2023-25793

    WordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in George Pattihis Link Juice Keeper plugin <= 2.0.2 versions.

    George Pattihis Link Juice Keeper
  • Medium 5.5
    CVE-2023-28086

    An HPE OneView appliance dump may expose proxy credential settings

    Hewlett Packard Enterprise (HPE) HPE OneView
  • Medium 5.9
    CVE-2023-25485

    WordPress JSON Content Importer Plugin <= 1.3.15 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bernhard Kux JSON Content Importer plugin <= 1.3.15 versions.

    Bernhard Kux JSON Content Importer
  • Medium 6.5
    CVE-2021-26947 Scanner template

    Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote at…

    Odoo Odoo Enterprise Odoo Community odoo Debian Ubuntu
  • Medium 5.3
    CVE-2021-44465

    Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated at…

    Odoo Odoo Enterprise Odoo Community odoo Ubuntu
  • Medium 6.5
    CVE-2021-44775

    Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier…

    Odoo Odoo Enterprise Odoo Community odoo Debian Ubuntu
  • Medium 6.5
    CVE-2021-44461

    Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who ar…

    Odoo Odoo Enterprise
  • Medium 6.8
    CVE-2021-44476

    A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated adminis…

    Odoo Odoo Enterprise Odoo Community odoo Debian Ubuntu
  • Medium 6.5
    CVE-2021-23176

    Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterpris…

    Odoo Odoo Enterprise Odoo Community odoo Debian Ubuntu
  • Medium 5.3
    CVE-2021-45071

    Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote at…

    Odoo Odoo Enterprise Odoo Community odoo Debian Ubuntu
  • Medium 4.3
    CVE-2023-29200

    contao/core-bundle has path traversal vulnerability in the file manager

    Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these f…

    contao contao contao/contao Packagist
  • Medium 5.9
    CVE-2022-47608

    WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.

    fullworks Quick Contact Form
  • Medium 5.9
    CVE-2023-25484

    WordPress Simple Yearly Archive Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Oliver Schlöbe Simple Yearly Archive plugin <= 2.1.8 versions.

    Oliver Schlöbe Simple Yearly Archive
  • Medium 5.9
    CVE-2023-25479

    WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.

    Podlove Podlove Subscribe button
  • Medium 5.9
    CVE-2023-25490

    WordPress Archivist – Custom Archive Templates Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.4 versions.

    Eric Teubert Archivist – Custom Archive Templates
  • Medium 5.4
    CVE-2023-27619

    WordPress Regina Lite Theme <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)

    Auth (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Macho Themes Regina Lite theme <= 2.0.7 versions.

    Macho Themes Regina Lite
  • Medium 5.9
    CVE-2023-25710

    WordPress Click to Call or Chat Buttons Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0 versions.

    DIGITALBLUE Click to Call or Chat Buttons
  • Medium 5.4
    CVE-2023-22665

    Apache Jena: Exposure of arbitrary execution in script engine expressions.

    There is insufficient checking of user queries in Apache Jena versions 4.7.0 and earlier, when invoking custom scripts. It allows a remote user to execute arbitrary javascript via a SPARQL query.

    Apache Software Foundation Apache Jena apache-jena apache-jena Debian Ubuntu Maven
  • Medium 6.1
    CVE-2023-30177

    Cross Site Scripting in CraftCMS

    CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS). An attacker can inject javascript code into Volume Name.

    craftcms/cms Packagist
  • Medium 6.1
    CVE-2023-30106

    Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.

  • Medium 6.1
    CVE-2023-30111

    Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).

  • Medium 5.4
    CVE-2023-30417

    A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web sc…

  • Medium 6.5
    CVE-2023-23838

    Directory traversal and file enumeration vulnerability: Database Performance Analyzer (DPA) 2023.1

    Directory traversal and file enumeration vulnerability which allowed users to enumerate to different folders of the server.

    SolarWinds Database Performance Analyzer
  • Medium 6.5
    CVE-2023-23839

    SolarWinds Platform Exposure of Sensitive Information Vulnerability

    The SolarWinds Platform was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users to access Orion.WebCommunityStrings SWIS schema object and obtain sensitive information.

    SolarWinds SolarWinds Platform
  • Medium 5.4
    CVE-2023-25347

    A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web s…

  • Medium 6.1
    CVE-2023-25346 Scanner template

    A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web…

  • Medium 6.1
    CVE-2023-25314

    Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain s…

  • Medium 5.4
    CVE-2023-26843 Scanner template

    A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web sc…

  • Medium 6.5
    CVE-2023-26841

    A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password ex…