Skip to content
OpenAdvisories

Archive

25 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /25 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

78 results · Feed

  • Medium 4.3
    CVE-2022-47161

    WordPress Health Check & Troubleshooting Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.

    The WordPress.org community Health Check & Troubleshooting
  • Medium 4.3
    CVE-2022-41635

    WordPress Advanced Shipment Tracking for WooCommerce Plugin <= 3.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Zorem Advanced Shipment Tracking for WooCommerce plugin <= 3.5.2 versions.

    zorem Advanced Shipment Tracking for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2022-46800

    WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache plugin <= 5.3 versions.

    LiteSpeed Technologies LiteSpeed Cache
  • Medium 4.3
    CVE-2022-46812

    WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions.

    villatheme Thank You Page Customizer for WooCommerce – Increase Your Sales Web / CMS
  • Medium 4.3
    CVE-2022-46865

    WordPress Bulk Resize Media Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <= 1.1 versions.

    Marty Thornley Bulk Resize Media
  • Critical 9.8
    CVE-2023-2887

    User Authentication Bypass in CBOT's Chatbot

    Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • Medium 4.3
    CVE-2022-46866

    WordPress Import External Images Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.

    Marty Thornley Import External Images
  • Medium 4.3
    CVE-2023-2886

    Cross-Site WebSocket Hijacking in CBOT's Chatbot

    Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • High 8.1
    CVE-2023-2885

    Channel Accessible by Non-Endpoint in CBOT's Chatbot

    Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM). This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • Medium 4.3
    CVE-2022-47164

    WordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.

    MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2023-2884

    Insecure Randomness in CBOT's Chatbot

    Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • High 8.8
    CVE-2023-2883

    IDOR in CBOT's Chatbot

    Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • Critical 9.8
    CVE-2023-2882

    Privilege Escalation in CBOT's Chatbot

    Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • Medium 4.3
    CVE-2022-47159

    WordPress Logaster Logo Generator Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Logaster Logaster Logo Generator plugin <= 1.3 versions.

    Logaster Logaster Logo Generator
  • Medium 4.3
    CVE-2022-47138

    WordPress LOGIN AND REGISTRATION ATTEMPTS LIMIT Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.

    German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT
  • Medium 5.4
    CVE-2022-47139

    WordPress WP Basic Elements Plugin <= 5.2.15 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <= 5.2.15 versions.

    Damir Calusic WP Basic Elements
  • Medium 4.3
    CVE-2022-47135

    WordPress Chronoforms Plugin <= 7.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.

    chronoengine.com Chronoforms
  • Medium 6.1
    CVE-2022-46907 Public exploit

    Apache JSPWiki: XSS Injection points in several plugins

    A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users…

    Apache Software Foundation Apache JSPWiki org.apache.jspwiki:jspwiki-main org.apache.jspwiki:jspwiki-war Maven
  • Critical 9.8
    CVE-2023-2732 Public exploit Scanner template EPSS 67%

    MStore API <= 3.9.2 - Authentication Bypass

    The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it p…

    inspireui MStore API – Create Native Android & iOS Apps On The Cloud Android iOS Web / CMS
  • Critical 9.8
    CVE-2023-2733

    MStore API <= 3.9.0 - Authentication Bypass

    The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This make…

    inspireui MStore API – Create Native Android & iOS Apps On The Cloud Android iOS Web / CMS
  • Critical 9.8
    CVE-2023-2734 Scanner template

    MStore API <= 3.9.1 - Authentication Bypass

    The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This …

    inspireui MStore API – Create Native Android & iOS Apps On The Cloud Android iOS Web / CMS
  • High 7.8
    CVE-2023-0950

    Array Index UnderFlow in Calc Formula Parsing

    Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffi…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 5.4
    CVE-2023-33750

    A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or …

  • Critical 9.8
    CVE-2023-33279

    In the Store Commander scfixmyprestashop module through 2023-05-09 for PrestaShop, sensitive SQL calls can be executed …

  • Medium 5.4
    CVE-2023-33751

    A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or …

  • High 7.5
    CVE-2023-33355

    IceCMS v1.0.0 has Insecure Permissions. There is unauthorized access to the API, resulting in the disclosure of sensiti…

  • Critical 9.8
    CVE-2023-33280

    In the Store Commander scquickaccounting module for PrestaShop through 3.7.3, multiple sensitive SQL calls can be execu…

  • High 7.5
    CVE-2023-33263

    In WFTPD 3.25, usernames and password hashes are stored in an openly viewable wftpd.ini configuration file within the W…

  • Critical 9.8
    CVE-2023-33278

    In the Store Commander scexportcustomers module for PrestaShop through 3.6.1, sensitive SQL calls can be executed with …

  • Unscored —
    CVE-2023-33356

    IceCMS v1.0.0 is vulnerable to Cross Site Scripting (XSS).

  • Medium 6.1
    CVE-2023-28370

    Open redirect in Tornado

    Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

    tornadoweb tornado salt python-tornado Debian Ubuntu Azure Linux PyPI
  • High 7.5
    CVE-2023-31861

    ZLMediaKit 4.0 is vulnerable to Directory Traversal.

  • High 7.5
    CVE-2023-31594 Public exploit

    IC Realtime ICIP-P2012T 2.420 is vulnerable to Incorrect Access Control via an exposed HTTP channel using VLC network.

  • High 7.8
    CVE-2023-27529

    Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vuln…

    Wacom Wacom Tablet Driver installer
  • Unscored —
    CVE-2023-2255 Public exploit

    Remote documents loaded without prompt via IFrame

    Improper access control in editor components of The Document Foundation LibreOffice allowed an attacker to craft a document that would cause external links to be loaded without prompt. In the affected versions of LibreOffice documents that used "floating fram…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  • Medium 6.7
    CVE-2023-2881

    Storing Passwords in a Recoverable Format in pimcore/customer-data-framework

    Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.

    pimcore Pimcore Customer Data Framework pimcore/customer-management-framework-bundle Packagist
  • Medium 6.5
    CVE-2023-2804

    A heap-based buffer overflow issue was discovered in libjpeg-turbo in h2v2_merged_upsample_internal() function of jdmrg…

    libjpeg-turbo libjpeg-turbo Alpine Wolfi
  • Medium 6.1
    CVE-2023-25439 Public exploit

    Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionInvoice 2023-1.0, allows attackers to execute arbit…