Skip to content
OpenAdvisories

Archive

3 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /3 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

53 results · Clear filters · Feed

  • Medium 5.9
    CVE-2023-22637

    An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in Forti…

    Fortinet FortiNAC Network devices
  • Medium 6.1
    CVE-2023-26203

    A use of hard-coded credentials vulnerability [CWE-798] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, …

    Fortinet FortiNAC Network devices
  • Medium 5.0
    CVE-2022-45860

    A weak authentication vulnerability [CWE-1390] in FortiNAC-F version 7.2.0, FortiNAC version 9.4.2 and below, 9.2 all v…

    Fortinet FortiNAC Network devices
  • Medium 5.7
    CVE-2023-27993

    A relative path traversal [CWE-23] in Fortinet FortiADC version 7.2.0 and before 7.1.1 allows a privileged attacker to …

    Fortinet FortiADC Network devices
  • Medium 4.8
    CVE-2022-39161

    IBM WebSphere Application Server information disclosure

    IBM WebSphere Application Server 7.0, 8.0, 8.5, 9.0, and IBM WebSphere Application Server Liberty, when configured to communicate with the Web Server Plug-ins for IBM WebSphere Application Server, could allow an authenticated user to conduct spoofing attacks.…

    IBM WebSphere Application Server
  • Medium 4.3
    CVE-2023-25967

    WordPress Community by PeepSo Plugin <= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo plugin <= 6.0.2.0 versions.

    PeepSo Community by PeepSo
  • Medium 5.9
    CVE-2023-26017

    WordPress Jobs for WordPress Plugin <= 2.5.10.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.10.2 versions.

    BlueGlass Jobs for WordPress Web / CMS
  • Medium 5.9
    CVE-2023-23875

    WordPress Bing Site Verification plugin using Meta Tag Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Himanshu Bing Site Verification plugin using Meta Tag plugin <= 1.0 versions.

    Himanshu Bing Site Verification plugin using Meta Tag
  • Medium 5.9
    CVE-2023-23881

    WordPress Circles Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GreenTreeLabs Circles Gallery plugin <= 1.0.10 versions.

    GreenTreeLabs Circles Gallery
  • Medium 5.4
    CVE-2023-29240

    BIG-IQ iControl REST Vulnerability

    An authenticated attacker granted a Viewer or Auditor role on a BIG-IQ can upload arbitrary files using an undisclosed iControl REST endpoint.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IQ Network devices
  • Medium 4.3
    CVE-2023-28406

    BIG-IP Configuration utility vulnerability

    A directory traversal vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which may allow an authenticated attacker to read files with .xml extension. Access to restricted information is limited and the attacker does not control wh…

    F5 BIG-IP Network devices
  • Medium 5.9
    CVE-2023-23808

    WordPress Sponsors Carousel Plugin <= 4.02 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sergey Panasenko Sponsors Carousel plugin <= 4.02 versions.

    Sergey Panasenko Sponsors Carousel
  • Medium 5.3
    CVE-2023-24594

    BIG-IP TMM SSL vulnerability

    When an SSL profile is configured on a Virtual Server, undisclosed traffic can cause an increase in CPU or SSL accelerator resource utilization.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP BIG-IP SPK Network devices
  • Medium 5.9
    CVE-2023-22372

    BIG-IP Edge Client for Windows and Mac OS vulnerability

    In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows and Mac OS.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Edge Client Network devices Browsers
  • Medium 5.9
    CVE-2023-23809

    WordPress Stock market charts from finviz Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Moris Dov Stock market charts from finviz plugin <= 1.0.1 versions.

    Moris Dov Stock market charts from finviz
  • Medium 5.9
    CVE-2023-23785

    WordPress Exquisite PayPal Donation Plugin <= v2.0.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DgCult Exquisite PayPal Donation plugin <= v2.0.0 versions.

    DgCult Exquisite PayPal Donation
  • Medium 5.9
    CVE-2022-46852

    WordPress WP Table Builder – WordPress Table Plugin Plugin <= 1.4.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Table Builder plugin <= 1.4.6 versions.

    WP Table Builder WP Table Builder
  • Medium 5.9
    CVE-2023-22683

    WordPress Clio Grow Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themis Solutions, Inc. Clio Grow plugin <= 1.0.0 versions.

    Themis Solutions Clio Grow
  • Medium 5.9
    CVE-2023-25979

    WordPress Video Gallery – YouTube Gallery Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Video Gallery by Total-Soft Video Gallery plugin <= 1.7.6 versions.

    Video Gallery by Total-Soft Video Gallery
  • Medium 6.5
    CVE-2023-23876

    WordPress wpDataTables Plugin <= 2.1.49 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TMS-Plugins wpDataTables plugin <= 2.1.49 versions.

    TMS-Plugins wpDataTables
  • Medium 6.5
    CVE-2023-23874

    WordPress Ditty Plugin <= 3.0.32 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Metaphor Creations Ditty plugin <= 3.0.32 versions.

    Metaphor Creations Ditty
  • Medium 6.5
    CVE-2023-23820

    WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions.

    ProfilePress Membership Team ProfilePress
  • Medium 6.5
    CVE-2023-23708

    WordPress Visualizer Plugin <= 3.9.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <= 3.9.4 versions.

    themeisle Visualizer: Tables and Charts Manager for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-1384

    The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary…

    amazon Insignia TV with FireOS Fire TV Stick 3rd gen
  • Medium 5.4
    CVE-2023-1383

    An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr se…

    Insignia AmazonFire TV Stick 3rd gen TV with FireOS Fire TV Stick 3rd gen
  • Medium 6.5
    CVE-2023-22713

    WordPress Gutenberg Blocks by WordPress Download Manager Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress Download Manager Gutenberg Blocks by WordPress Download Manager plugin <= 2.1.8 versions.

    WordPress Download Manager Gutenberg Blocks by WordPress Download Manager Web / CMS
  • Medium 5.9
    CVE-2023-25796

    WordPress WP BaiDu Submit Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Include WP BaiDu Submit plugin <= 1.2.1 versions.

    Include WP BaiDu Submit
  • Medium 6.5
    CVE-2023-25798

    WordPress Olevmedia Shortcodes Plugin <= 1.1.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Olevmedia Olevmedia Shortcodes plugin <= 1.1.9 versions.

    Olevmedia Olevmedia Shortcodes
  • Medium 5.9
    CVE-2023-25786

    WordPress Eyes Only: User Access Shortcode Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Thom Stark Eyes Only: User Access Shortcode plugin <= 1.8.2 versions.

    Thom Stark Eyes Only: User Access Shortcode
  • Medium 5.9
    CVE-2023-25789

    WordPress Tapfiliate Plugin <= 3.0.12 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tapfiliate plugin <= 3.0.12 versions.

    tapfiliate Tapfiliate
  • Medium 5.9
    CVE-2023-25783

    WordPress FireCask Like & Share Button Plugin <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Moss FireCask Like & Share Button plugin <= 1.1.5 versions.

    Alex Moss FireCask Like & Share Button
  • Medium 5.9
    CVE-2023-25787

    WordPress WP资源下载管理 Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wbolt team WP资源下载管理 plugin <= 1.3.9 versions.

    Wbolt team WP资源下载管理
  • Medium 5.9
    CVE-2023-25797

    WordPress vSlider Multi Image Slider for WordPress Plugin <= 4.1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. Stored Cross-Site Scripting (XSS) vulnerability in Mr.Vibe vSlider Multi Image Slider for WordPress plugin <= 4.1.2 versions.

    Mr.Vibe vSlider Multi Image Slider for WordPress Web / CMS
  • Medium 5.9
    CVE-2023-25784

    WordPress Sticky Ad Bar Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bon Plan Gratos Sticky Ad Bar plugin <= 1.3.1 versions.

    Bon Plan Gratos Sticky Ad Bar Plugin
  • Medium 5.9
    CVE-2023-25792

    WordPress WP Open Social Plugin <= 5.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XiaoMac WP Open Social plugin <= 5.0 versions.

    XiaoMac WP Open Social
  • Medium 6.7
    CVE-2023-28070

    Alienware Command Center Application, versions 5.5.43.0 and prior, contain an improper access control vulnerability. A …

    Dell Alienware Command Center (AWCC
  • Medium 4.3
    CVE-2023-22691

    WordPress Category Specific RSS feed Subscription Plugin <= v2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription plugin <= v2.1 versions.

    Tips and Tricks HQ, Ruhul Amin Category Specific RSS feed Subscription
  • Medium 4.8
    CVE-2023-0756

    An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.9
    CVE-2023-0805

    An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions startin…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2023-0485

    An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting …

    GitLab GitLab gitlab Web / CMS Ubuntu