Skip to content
OpenAdvisories

Archive

23 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /23 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

99 results · Feed

  • Medium 4.6
    CVE-2023-2494

    Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting

    The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible …

    Granth Go Pricing - WordPress Responsive Pricing Tables Web / CMS
  • High 7.1
    CVE-2023-2496

    Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Improper Authorization to Arbitrary File Upload

    The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized arbitrary file uploads due to an improper capability check on the 'validate_upload' function in versions up to, and including, 3.3.19. This makes it possib…

    Granth Go Pricing - WordPress Responsive Pricing Tables Web / CMS
  • Medium 6.4
    CVE-2023-2498

    Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.19 due to insufficient input sanitization and output escaping. This makes it possible f…

    Granth Go Pricing - WordPress Responsive Pricing Tables Web / CMS
  • High 8.8
    CVE-2023-32697 Public exploit

    Sqlite-jdbc vulnerable to remote code execution when JDBC url is attacker controlled

    SQLite JDBC is a library for accessing and creating SQLite database files in Java. Sqlite-jdbc addresses a remote code execution vulnerability via JDBC URL. This issue impacting versions 3.6.14.1 through 3.41.2.1 and has been fixed in version 3.41.2.2.

    xerial sqlite-jdbc org.xerial:sqlite-jdbc xerial-sqlite-jdbc Debian Ubuntu Maven
  • Medium 5.3
    CVE-2023-28015

    HCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerability

    The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability.   During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not.  The attacker could use this informat…

    HCL Software Domino AppDev Pack
  • Critical 9.8
    CVE-2023-1508

    SQLi in AdamPOS's Mobilmen Terminal Software

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adam Retail Automation Systems Mobilmen Terminal Software allows SQL Injection. This issue affects Mobilmen Terminal Software: before 3.

    Adam Retail Automation Mobilmen Terminal Software
  • High 7.5
    CVE-2023-2703

    Information Disclosure in Finex Media's Competition Management System

    Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Finex Media Competition Management System allows Retrieve Embedded Sensitive Data, Collect Data as Provided by Users. This issue affects Competition Management System: before 2…

    Finex Media Competition Management System
  • High 8.8
    CVE-2023-2702

    IDOR in Finex Media's Competition Management System

    Authorization Bypass Through User-Controlled Key vulnerability in Finex Media Competition Management System allows Authentication Abuse, Authentication Bypass. This issue affects Competition Management System: before 23.07.

    Finex Media Competition Management System
  • High 8.5
    CVE-2023-1837

    Missing Authentication for critical function vulnerability in HYPR Server allows Authentication Bypass when using Legac…

    HYPR HYPR Server
  • Medium 4.3
    CVE-2023-1209

    Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arb…

    ServiceNow ServiceNow Records
  • Medium 4.3
    CVE-2023-25474

    WordPress About Me 3000 widget Plugin <= 2.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Csaba Kissi About Me 3000 widget plugin <= 2.2.6 versions.

    Csaba Kissi About Me 3000 widget
  • Medium 4.3
    CVE-2022-46813

    WordPress Advanced Database Cleaner Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR. Advanced Database Cleaner plugin <= 3.1.1 versions.

    Younes JFR. Advanced Database Cleaner
  • Medium 4.3
    CVE-2023-26011

    WordPress Read More Excerpt Link Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tim Eckel Read More Excerpt Link plugin <= 1.6 versions.

    Tim Eckel Read More Excerpt Link
  • Medium 4.3
    CVE-2023-26014

    WordPress Minify HTML Plugin <= 2.1.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tim Eckel Minify HTML plugin <= 2.1.7 vulnerability.

    Tim Eckel Minify HTML
  • Medium 4.3
    CVE-2023-25056

    WordPress Feed Them Social Plugin <= 3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in SlickRemix Feed Them Social plugin <= 3.0.2 versions.

    SlickRemix Feed Them Social
  • Medium 6.7
    CVE-2023-30440

    IBM PowerVM Hypervisor denial of service

    IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 through FW1020.30, and FW1030.00 through FW1030.10 could allow a local attacker with control a partition that has been assigned SRIOV virtual f…

    IBM PowerVM Hypervisor
  • Medium 4.3
    CVE-2023-23713

    WordPress Theme Tweaker Plugin <= 5.20 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Manoj Thulasidas Theme Tweaker plugin <= 5.20 versions.

    Manoj Thulasidas Theme Tweaker Web / CMS
  • Medium 4.3
    CVE-2022-46853

    WordPress The Post Grid Plugin <= 5.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 5.0.4 versions.

    RadiusTheme The Post Grid
  • Medium 4.3
    CVE-2022-46851

    WordPress Starter Templates Plugin <= 3.1.20 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates plugin <= 3.1.20 versions.

    Brainstorm Force Starter Templates
  • Medium 4.3
    CVE-2023-23705

    WordPress Books Gallery Plugin <= 4.4.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions.

    HM Plugin WordPress Books Gallery Web / CMS
  • Medium 4.3
    CVE-2023-23724

    WordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.9.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.

    Winwar Media WP Email Capture
  • Medium 4.3
    CVE-2023-23706

    WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

    miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • Medium 6.3
    CVE-2023-25707

    WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.12 versions.

    E4J s.r.l. VikBooking Hotel Booking Engine & PMS
  • Medium 5.4
    CVE-2023-25481

    WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.

    Podlove Podlove Subscribe button
  • Medium 4.3
    CVE-2023-25472

    WordPress Podlove Podcast Publisher Plugin <= 3.8.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.3 versions.

    Podlove Podlove Podcast Publisher
  • Medium 4.7
    CVE-2023-23694

    Dell VxRail versions earlier than 7.0.450, contain(s) an OS command injection vulnerability in VxRail Manager. A local …

    Dell Dell VxRail HCI
  • Medium 6.7
    CVE-2023-23693

    Dell VxRail, versions prior to 7.0.450, contains an OS command injection Vulnerability in DCManager command-line utilit…

    Dell Dell VxRail HCI
  • High 7.6
    CVE-2023-30469

    Reflrected Cross Site Scripting Vulnerability in Hitachi Ops Center Analyzer

    Cross-site Scripting vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view component) allows Reflected XSS.This issue affects Hitachi Ops Center Analyzer: from 10.9.1-00 before 10.9.2-00.

    Hitachi Hitachi Ops Center Analyzer
  • Unscored —
    CVE-2020-20012

    WebPlus Pro v1.4.7.8.4-01 is vulnerable to Incorrect Access Control.

  • High 7.2
    CVE-2023-33617 Public exploit

    An OS Command Injection vulnerability in Parks Fiberlink 210 firmware version V2.1.14_X000 was found via the /boaform/a…

  • Medium 4.3
    CVE-2023-33359

    Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.

  • Critical 9.8
    CVE-2023-33338 Scanner template

    Old Age Home Management 1.0 is vulnerable to SQL Injection via the username parameter.

  • Critical 9.8
    CVE-2023-33361

    Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php.

  • Medium 6.1
    CVE-2023-33599

    EasyImages2.0 ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.

  • Critical 9.8
    CVE-2023-33362 Public exploit

    Piwigo 13.6.0 is vulnerable to SQL Injection via in the "profile" function.

  • High 7.2
    CVE-2023-28392

    Wi-Fi AP UNIT AC-PD-WAPU v1.05_B04 and earlier, AC-PD-WAPUM v1.05_B04 and earlier, AC-PD-WAPU-P v1.05_B04P and earlier,…

    Inaba Denki Sangyo Wi-Fi AP UNIT
  • Critical 9.8
    CVE-2023-28409

    Unrestricted upload of file with dangerous type exists in MW WP Form versions v4.4.2 and earlier, which may allow a rem…

    Monkey Wrench MW WP Form
  • Medium 6.8
    CVE-2023-28390

    Privilege escalation vulnerability in SR-7100VN firmware Ver.1.38(N) and earlier and SR-7100VN #31 firmware Ver.1.21 an…

    ICOM SR-7100VN
  • Critical 9.8
    CVE-2023-28413

    Directory traversal vulnerability in Snow Monkey Forms versions v5.0.6 and earlier allows a remote unauthenticated atta…

    Monkey Wrench Snow Monkey Forms
  • Critical 9.8
    CVE-2023-28408

    Directory traversal vulnerability in MW WP Form versions v4.4.2 and earlier allows a remote unauthenticated attacker to…

    Monkey Wrench MW WP Form