Skip to content
OpenAdvisories

Archive

24 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /24 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

34 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-1158

    Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization

    Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x expose dashboard prompts to users who are not part of the authorization list. 

    Hitachi Vantara Pentaho Business Analytics Server
  • Medium 5.5
    CVE-2023-2875

    eScan Antivirus IoControlCode PROCOBSRVESX.SYS 0x22E008u null pointer dereference

    A vulnerability, which was classified as problematic, was found in eScan Antivirus 22.0.1400.2443. Affected is the function 0x22E008u in the library PROCOBSRVESX.SYS of the component IoControlCode Handler. The manipulation leads to null pointer dereference. I…

    eScan Antivirus
  • Medium 5.5
    CVE-2023-2874

    Twister Antivirus IoControlCode filppd.sys 0x804f2140 denial of service

    A vulnerability, which was classified as problematic, has been found in Twister Antivirus 8. This issue affects the function 0x804f2158/0x804f2154/0x804f2150/0x804f215c/0x804f2160/0x80800040/0x804f214c/0x804f2148/0x804f2144/0x801120e4/0x804f213c/0x804f2140 in…

    Twister Antivirus
  • Medium 5.3
    CVE-2023-2873

    Twister Antivirus IoControlCode filppd.sys 0x80800043 memory corruption

    A vulnerability classified as critical was found in Twister Antivirus 8. This vulnerability affects the function 0x804f2143/0x804f217f/0x804f214b/0x80800043 in the library filppd.sys of the component IoControlCode Handler. The manipulation leads to memory cor…

    Twister Antivirus
  • Medium 5.5
    CVE-2023-2872

    FlexiHub IoControlCode fusbhub.sys 0x220088 null pointer dereference

    A vulnerability classified as problematic has been found in FlexiHub 5.5.14691.0. This affects the function 0x220088 in the library fusbhub.sys of the component IoControlCode Handler. The manipulation leads to null pointer dereference. An attack has to be app…

  • Medium 5.9
    CVE-2023-25028

    WordPress CC Custom Taxonomy Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in chuyencode CC Custom Taxonomy plugin <= 1.0.1 versions.

    chuyencode CC Custom Taxonomy
  • Medium 5.4
    CVE-2022-47448

    WordPress xili-tidy-tags Plugin <= 1.12.03 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in dev.Xiligroup.Com - MS plugin <= 1.12.03 versions.

    dev.xiligroup.com - MS xili-tidy-tags
  • Medium 6.5
    CVE-2023-33950

    Liferay Portal has Inefficient Regular Expression

    Pattern Redirects in Liferay Portal 7.4.3.48 through 7.4.3.76, and Liferay DXP 7.4 update 48 through 76 allows regular expressions that are vulnerable to ReDoS attacks to be used as patterns, which allows remote attackers to consume an excessive amount of ser…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.3
    CVE-2022-47447 Public exploit

    WordPress WP-Advanced-Search Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.

    Mathieu Chartier WordPress WP-Advanced-Search Web / CMS
  • Medium 5.4
    CVE-2022-47446

    WordPress Store Locator Plugin <= 3.98.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin <= 3.98.7 versions.

    Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales Web / CMS
  • Medium 5.3
    CVE-2023-33949

    Insecure Default Initialization In Liferay Portal

    In Liferay Portal 7.3.0 and earlier, and Liferay DXP 7.2 and earlier the default configuration does not require users to verify their email address, which allows remote attackers to create accounts using fake email addresses or email addresses which they don'…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.3
    CVE-2022-46794

    WordPress WooCommerce Weight Based Shipping Plugin <= 5.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in weightbasedshipping.Com WooCommerce Weight Based Shipping plugin <= 5.4.1 versions.

    weightbasedshipping.com WooCommerce Weight Based Shipping Web / CMS
  • Medium 4.3
    CVE-2022-47180

    WordPress Kopa Framework Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kopa Theme Kopa Framework plugin <= 1.3.5 versions.

    Kopa Theme Kopa Framework
  • Medium 5.4
    CVE-2022-47152

    WordPress clickfunnels Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Etison, LLC ClickFunnels plugin <= 3.1.1 versions.

    Etison ClickFunnels
  • Medium 5.4
    CVE-2022-45364

    WordPress Drag and Drop Multiple File Upload – Contact Form 7 Plugin <= 1.3.6.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Glen Don L. Mongaya Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.6.5 versions.

    Glen Don L. Mongaya Drag and Drop Multiple File Upload – Contact Form 7
  • Medium 4.3
    CVE-2022-46816

    WordPress Booking Ultra Pro Plugin <= 1.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro Appointments Booking Calendar Plugin plugin <= 1.1.4 versions.

    Booking Ultra Pro Booking Ultra Pro Appointments Booking Calendar Plugin
  • Medium 5.3
    CVE-2023-33948

    Missing authorization in Liferay portal

    The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.4
    CVE-2023-33945

    SQL injection in Liferay Portal

    SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's pri…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2023-33944

    Cross-site scripting in Liferay Portal

    Cross-site scripting (XSS) vulnerability in Layout module in Liferay Portal 7.3.4 through 7.4.3.68, and Liferay DXP 7.3 before update 24, and 7.4 before update 69 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected in…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.4
    CVE-2023-33943

    Cross-site scripting in Liferay Portal

    Cross-site scripting (XSS) vulnerability in the Account module in Liferay Portal 7.4.3.21 through 7.4.3.62, and Liferay DXP 7.4 update 21 through 62 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a user's (1…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.4
    CVE-2023-33942

    Cross-site scripting in Liferay Portal

    Cross-site scripting (XSS) vulnerability in the Web Content Display widget's article selector in Liferay Liferay Portal 7.4.3.50, and Liferay DXP 7.4 update 50 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into …

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.1
    CVE-2023-33941

    Cross-site scripting in Liferay Portal

    Multiple cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class in Liferay Portal 7.4.3.41 through 7.4.3.52, and Liferay DXP 7.4 update 41 through 52 allow remote attackers to inject arbitrary w…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2023-33940

    Cross-site scripting in Liferay Portal

    Cross-site scripting (XSS) vulnerability in IFrame type Remote Apps in Liferay Portal 7.4.0 through 7.4.3.30, and Liferay DXP 7.4 before update 31 allows remote attackers to inject arbitrary web script or HTML via the Remote App's IFrame URL.

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.4
    CVE-2023-33939

    Cross-site scripting in Liferay Portal

    Cross-site scripting (XSS) vulnerability in the Modified Facet widget in Liferay Portal 7.1.0 through 7.4.3.12, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 18, 7.3 before update 4, and 7.4 before update 9 allows remote attackers to inject arbi…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 4.8
    CVE-2023-33938

    Cross-site scripting in Liferay Portal

    Cross-site scripting (XSS) vulnerability in the App Builder module's custom object details page in Liferay Portal 7.3.0 through 7.4.0, and Liferay DXP 7.3 before update 14 allows remote attackers to inject arbitrary web script or HTML via a crafted payload in…

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 5.4
    CVE-2023-33937

    Cross-site scripting in Liferay Portal

    Stored cross-site scripting (XSS) vulnerability in Form widget configuration in Liferay Portal 7.1.0 through 7.3.0, and Liferay DXP 7.1 before fix pack 18, and 7.2 before fix pack 5 allows remote attackers to inject arbitrary web script or HTML via a crafted …

    Liferay DXP Portal com.liferay.portal:release.portal.bom Maven
  • Medium 6.3
    CVE-2023-2865

    SourceCodester Theme Park Ticketing System GET Parameter print_ticket.php sql injection

    A vulnerability was found in SourceCodester Theme Park Ticketing System 1.0. It has been classified as critical. This affects an unknown part of the file print_ticket.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql…

    SourceCodester Theme Park Ticketing System
  • Medium 6.7
    CVE-2022-0357

    Improper Quoting Path Issue in Bitdefender Total Security

    Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bitdefender …

    Bitdefender Total Security Antivirus Plus Internet Security
  • Medium 5.9
    CVE-2023-33982

    Bramble Handshake Protocol (BHP) in Briar before 1.5.3 is not forward secure: eavesdroppers can decrypt network traffic…

  • Medium 6.5
    CVE-2023-33981

    Briar before 1.4.22 allows attackers to spoof other users' messages in a blog, forum, or private group, but each spoofe…

  • Medium 5.4
    CVE-2023-33829 Public exploit

    A stored cross-site scripting (XSS) vulnerability in Cloudogu GmbH SCM Manager v1.2 to v1.60 allows attackers to execut…

  • Medium 6.1
    CVE-2023-25598

    A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x throug…

  • Medium 6.5
    CVE-2022-30025

    SQL injection in "/Framewrk/Home.jsp" file (POST method) in tCredence Analytics iDEAL Wealth and Funds - 1.0 iallows au…

  • Medium 5.4
    CVE-2022-42225

    Jumpserver 2.10.0 <= version <= 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of us…