Skip to content
OpenAdvisories

Archive

23 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /23 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

40 results · Clear filters · Feed

  • Medium 4.6
    CVE-2023-2494

    Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Missing Authorization to Limited Privilege Granting

    The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible …

    Granth Go Pricing - WordPress Responsive Pricing Tables Web / CMS
  • Medium 6.4
    CVE-2023-2498

    Go Pricing - WordPress Responsive Pricing Tables <= 3.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.19 due to insufficient input sanitization and output escaping. This makes it possible f…

    Granth Go Pricing - WordPress Responsive Pricing Tables Web / CMS
  • Medium 5.3
    CVE-2023-28015

    HCL Domino AppDev Pack is susceptible to a User Account Enumeration vulnerability

    The HCL Domino AppDev Pack IAM service is susceptible to a User Account Enumeration vulnerability.   During a failed login attempt a difference in messages could allow an attacker to determine if the user is valid or not.  The attacker could use this informat…

    HCL Software Domino AppDev Pack
  • Medium 4.3
    CVE-2023-1209

    Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arb…

    ServiceNow ServiceNow Records
  • Medium 4.3
    CVE-2023-25474

    WordPress About Me 3000 widget Plugin <= 2.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Csaba Kissi About Me 3000 widget plugin <= 2.2.6 versions.

    Csaba Kissi About Me 3000 widget
  • Medium 4.3
    CVE-2022-46813

    WordPress Advanced Database Cleaner Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR. Advanced Database Cleaner plugin <= 3.1.1 versions.

    Younes JFR. Advanced Database Cleaner
  • Medium 4.3
    CVE-2023-26011

    WordPress Read More Excerpt Link Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tim Eckel Read More Excerpt Link plugin <= 1.6 versions.

    Tim Eckel Read More Excerpt Link
  • Medium 4.3
    CVE-2023-26014

    WordPress Minify HTML Plugin <= 2.1.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tim Eckel Minify HTML plugin <= 2.1.7 vulnerability.

    Tim Eckel Minify HTML
  • Medium 4.3
    CVE-2023-25056

    WordPress Feed Them Social Plugin <= 3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in SlickRemix Feed Them Social plugin <= 3.0.2 versions.

    SlickRemix Feed Them Social
  • Medium 6.7
    CVE-2023-30440

    IBM PowerVM Hypervisor denial of service

    IBM PowerVM Hypervisor FW860.00 through FW860.B3, FW950.00 through FW950.70, FW1010.00 through FW1010.50, FW1020.00 through FW1020.30, and FW1030.00 through FW1030.10 could allow a local attacker with control a partition that has been assigned SRIOV virtual f…

    IBM PowerVM Hypervisor
  • Medium 4.3
    CVE-2023-23713

    WordPress Theme Tweaker Plugin <= 5.20 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Manoj Thulasidas Theme Tweaker plugin <= 5.20 versions.

    Manoj Thulasidas Theme Tweaker Web / CMS
  • Medium 4.3
    CVE-2022-46853

    WordPress The Post Grid Plugin <= 5.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 5.0.4 versions.

    RadiusTheme The Post Grid
  • Medium 4.3
    CVE-2022-46851

    WordPress Starter Templates Plugin <= 3.1.20 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates plugin <= 3.1.20 versions.

    Brainstorm Force Starter Templates
  • Medium 4.3
    CVE-2023-23705

    WordPress Books Gallery Plugin <= 4.4.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin WordPress Books Gallery plugin <= 4.4.8 versions.

    HM Plugin WordPress Books Gallery Web / CMS
  • Medium 4.3
    CVE-2023-23724

    WordPress WordPress Email Marketing Plugin – WP Email Capture Plugin <= 3.9.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Winwar Media WP Email Capture plugin <= 3.9.3 versions.

    Winwar Media WP Email Capture
  • Medium 4.3
    CVE-2023-23706

    WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Plugin <= 7.5.14 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 versions.

    miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • Medium 6.3
    CVE-2023-25707

    WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.12 versions.

    E4J s.r.l. VikBooking Hotel Booking Engine & PMS
  • Medium 5.4
    CVE-2023-25481

    WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Subscribe button plugin <= 1.3.7 versions.

    Podlove Podlove Subscribe button
  • Medium 4.3
    CVE-2023-25472

    WordPress Podlove Podcast Publisher Plugin <= 3.8.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher plugin <= 3.8.3 versions.

    Podlove Podlove Podcast Publisher
  • Medium 4.7
    CVE-2023-23694

    Dell VxRail versions earlier than 7.0.450, contain(s) an OS command injection vulnerability in VxRail Manager. A local …

    Dell Dell VxRail HCI
  • Medium 6.7
    CVE-2023-23693

    Dell VxRail, versions prior to 7.0.450, contains an OS command injection Vulnerability in DCManager command-line utilit…

    Dell Dell VxRail HCI
  • Medium 4.3
    CVE-2023-33359

    Piwigo 13.6.0 is vulnerable to Cross Site Request Forgery (CSRF) in the "add tags" function.

  • Medium 6.1
    CVE-2023-33599

    EasyImages2.0 ≤ 2.8.1 is vulnerable to Cross Site Scripting (XSS) via viewlog.php.

  • Medium 6.8
    CVE-2023-28390

    Privilege escalation vulnerability in SR-7100VN firmware Ver.1.38(N) and earlier and SR-7100VN #31 firmware Ver.1.21 an…

    ICOM SR-7100VN
  • Medium 5.4
    CVE-2023-28367

    Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a r…

    Vektor VK All in One Expansion Unit
  • Medium 5.5
    CVE-2023-31518

    A heap use-after-free in the component CDataFileReader::GetItem of teeworlds v0.7.5 allows attackers to cause a Denial …

    teeworlds teeworlds Debian Ubuntu
  • Medium 5.4
    CVE-2023-31995

    Hanwha IP Camera ANE-L7012R 1.41.01 is vulnerable to Cross Site Scripting (XSS).

  • Medium 5.5
    CVE-2023-31669

    WebAssembly wat2wasm v1.0.32 allows attackers to cause a libc++abi.dylib crash by putting '@' before a quote (").

    wabt wabt Debian Ubuntu
  • Medium 6.1
    CVE-2023-31664 Public exploit

    A reflected cross-site scripting (XSS) vulnerability in /authenticationendpoint/login.do of WSO2 API Manager before 4.2…

  • Medium 4.3
    CVE-2023-31708

    A Cross-Site Request Forgery (CSRF) in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a …

  • Medium 5.4
    CVE-2023-31860

    Wuzhi CMS v3.1.2 has a storage type XSS vulnerability in the backend of the Five Finger CMS b2b system.

  • Medium 5.3
    CVE-2023-31994

    Certain Hanwha products are vulnerable to Denial of Service (DoS). ck vector is: When an empty UDP packet is sent to th…

  • Medium 5.4
    CVE-2023-27925

    Cross-site scripting vulnerability in Post function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 and ea…

    Vektor VK Blocks and VK Blocks Pro
  • Medium 5.4
    CVE-2023-27926

    Cross-site scripting vulnerability in Profile setting function of VK All in One Expansion Unit 9.88.1.0 and earlier all…

    Vektor VK All in One Expansion Unit
  • Medium 5.4
    CVE-2023-27923

    Cross-site scripting vulnerability in Tag edit function of VK Blocks 1.53.0.1 and earlier and VK Blocks Pro 1.53.0.1 an…

    Vektor VK Blocks and VK Blocks Pro
  • Medium 4.3
    CVE-2023-27920

    Improper access control vulnerability in the system date/time setting page of SolarView Compact SV-CPT-MC310 versions p…

    Contec SolarView Compact
  • Medium 6.5
    CVE-2023-27921

    JINS MEME CORE Firmware version 2.2.0 and earlier uses a hard-coded cryptographic key, which may lead to data acquired …

    JINS JINS MEME CORE
  • Medium 5.3
    CVE-2023-23545

    Missing authentication for critical function exists in T&D Corporation and ESPEC MIC CORP. data logger products, which …

    T&D Corporation and ESPEC MIC T&D Corporation and ESPEC MIC CORP. data logger products
  • Medium 5.4
    CVE-2023-25440 Public exploit

    Stored Cross Site Scripting (XSS) vulnerability in the add contact function CiviCRM 5.59.alpha1, allows attackers to ex…

    civicrm civicrm Debian Ubuntu
  • Medium 5.5
    CVE-2023-26595

    Denial-of-service (DoS) vulnerability in Message of Cybozu Garoon 4.10.0 to 5.9.2 allows a remote authenticated attacke…

    Cybozu Cybozu Garoon