Skip to content
OpenAdvisories

Archive

May 2023

Vulnerabilities first published in this month (UTC), newest first.

← April 2023 2023 / May June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

1,208 results · Clear filters · Feed

  • Medium 6.7
    CVE-2023-27382

    Incorrect default permissions in the Audio Service for some Intel(R) NUC P14E Laptop Element software for Windows 10 be…

    Windows
  • Medium 5.0
    CVE-2022-46645

    Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an auth…

    Android
  • Medium 6.7
    CVE-2022-41628

    Uncontrolled search path element in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows …

    Windows
  • Medium 6.7
    CVE-2022-41687

    Insecure inherited permissions in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10…

    Windows
  • Medium 6.7
    CVE-2022-41658

    Insecure inherited permissions in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authentic…

  • Medium 6.7
    CVE-2022-41982

    Uncontrolled search path element in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authent…

  • Medium 5.3
    CVE-2023-1732

    Improper random reading in CIRCL

    When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read() returns an error. In rare deployment cases (error thrown by the Read() function), this could lead to a predictable shared secret. …

    Cloudflare CIRCL aactl pulumi-language-java Wolfi Go
  • Medium 5.4
    CVE-2022-45846

    WordPress Image Map Pro Plugin < 5.6.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder plugin < 5.6.9 versions.

    Nickys Image Map Pro for WordPress - Interactive SVG Image Map Builder Web / CMS
  • Medium 5.9
    CVE-2022-47587

    WordPress WP Search Analytics Plugin <= 1.4.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.5 versions.

    Cornel Raiu WP Search Analytics
  • Medium 5.9
    CVE-2022-47606

    WordPress WP-CORS Plugin <= 0.2.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Stephenson WP-CORS plugin <= 0.2.1 versions.

    Tim Stephenson WP-CORS
  • Medium 5.9
    CVE-2022-47423

    WordPress WP-dTree Plugin <= 4.4.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions.

    Ulf Benjaminsson WP-dTree
  • Medium 5.9
    CVE-2022-47436

    WordPress Yatra Plugin <= 2.1.14 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MantraBrain Yatra allows Stored XSS.This issue affects Yatra: from n/a through 2.1.14.

    MantraBrain Yatra
  • Medium 5.9
    CVE-2022-47137

    WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPManageNinja LLC Ninja Tables plugin <= 4.3.4 versions.

    WP ManageNinja Ninja Tables
  • Medium 5.9
    CVE-2022-46861

    WordPress Login Page Styler Plugin <= 6.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Zia Imtiaz Custom Login Page Styler for WordPress plugin <= 6.2 versions.

    zia-imtiaz Custom Login Page Styler for WordPress Web / CMS
  • Medium 5.9
    CVE-2022-46817

    WordPress Flyzoo Chat Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flyzoo Flyzoo Chat plugin <= 2.3.3 versions.

    Flyzoo Flyzoo Chat
  • Medium 5.9
    CVE-2022-46819

    WordPress Continuous announcement scroller Plugin <= 13.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Continuous announcement scroller plugin <= 13.0 versions.

    Gopi Ramasamy Continuous announcement scroller
  • Medium 4.0
    CVE-2022-33961

    WordPress YellowPencil Visual CSS Style Editor Plugin <= 7.5.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WaspThemes Visual CSS Style Editor plugin <= 7.5.8 versions.

    WaspThemes Visual CSS Style Editor
  • Medium 4.1
    CVE-2022-32970

    WordPress Themify Portfolio Post Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Themify Themify Portfolio Post plugin <= 1.2.4 versions.

    Themify Themify Portfolio Post
  • Medium 5.9
    CVE-2023-23794

    WordPress Semalt Blocker Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alex Moss Semalt Blocker plugin <= 1.1.3 versions.

    Alex Moss Semalt Blocker
  • Medium 6.5
    CVE-2023-23873

    WordPress BBSpoiler Plugin <= 2.01 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Flector BBSpoiler plugin <= 2.01 versions.

    Flector BBSpoiler
  • Medium 5.9
    CVE-2023-30746

    WordPress Booqable Rental Plugin Plugin <= 2.4.15 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Booqable Rental Software Booqable Rental plugin <= 2.4.15 versions.

    Booqable Rental Software Booqable Rental Plugin
  • Medium 6.5
    CVE-2023-22696

    WordPress Affiliate Links Lite Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Custom4Web Affiliate Links Lite plugin <= 2.5 versions.

    Custom4Web Affiliate Links Lite
  • Medium 5.9
    CVE-2023-24406

    WordPress Simple Popup Images Plugin <= 1.8.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb ur Rehman Simple PopUp plugin <= 1.8.6 versions.

    Muneeb ur Rehman Simple PopUp
  • Medium 6.5
    CVE-2023-23701

    WordPress Easy Sign Up Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Andrew @ Geeenville Web Design Easy Sign Up plugin <= 3.4.1 versions.

    Andrew @ Geeenville Web Design Easy Sign Up
  • Medium 6.5
    CVE-2023-22711

    WordPress IMPress Listings Plugin <= 2.6.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Agent Evolution IMPress Listings plugin <= 2.6.2 versions.

    Agent Evolution IMPress Listings
  • Medium 5.9
    CVE-2023-24418

    WordPress Tiny carousel horizontal slider plus Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny carousel horizontal slider plus plugin <= 3.2 versions.

    Gopi Ramasamy Tiny carousel horizontal slider plus
  • Medium 5.9
    CVE-2023-23812

    WordPress Enhanced WP Contact Form Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joost de Valk Enhanced WP Contact Form plugin <= 2.2.3 versions.

    Joost de Valk Enhanced WP Contact Form
  • Medium 5.9
    CVE-2023-23789

    WordPress Premmerce Redirect Manager Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Premmerce Premmerce Redirect Manager plugin <= 1.0.9 versions.

    Premmerce Premmerce Redirect Manager
  • Medium 5.9
    CVE-2023-23786

    WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Christof Servit affiliate-toolkit plugin <= 3.3.3 versions.

    Christof Servit affiliate-toolkit
  • Medium 5.9
    CVE-2023-23788

    WordPress Custom More Link Complete Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Florin Arjocu Custom More Link Complete plugin <= 1.4.1 versions.

    Florin Arjocu Custom More Link Complete
  • Medium 5.9
    CVE-2023-28932

    WordPress WPMobile.App Plugin <= 11.20 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPMobile.App WPMobile.App — Android and iOS Mobile Application plugin <= 11.20 versions.

    WPMobile.App WPMobile.App — Android and iOS Mobile Application Android iOS
  • Medium 6.3
    CVE-2023-2619

    SourceCodester Online Tours & Travels Management System disapprove_delete.php exec sql injection

    A vulnerability, which was classified as critical, was found in SourceCodester Online Tours & Travels Management System 1.0. This affects the function exec of the file disapprove_delete.php. The manipulation of the argument id leads to sql injection. It is po…

    SourceCodester Online Tours & Travels Management System
  • Medium 5.3
    CVE-2023-2618

    OpenCV wechat_qrcode Module decoded_bit_stream_parser.cpp decodeHanziSegment memory leak

    A vulnerability, which was classified as problematic, has been found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this issue is the function DecodedBitStreamParser::decodeHanziSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The ma…

    opencv wechat_qrcode Module opencv opencv Debian Ubuntu
  • Medium 5.3
    CVE-2023-2617

    OpenCV wechat_qrcode Module decoded_bit_stream_parser.cpp decodeByteSegment null pointer dereference

    A vulnerability classified as problematic was found in OpenCV wechat_qrcode Module up to 4.7.0. Affected by this vulnerability is the function DecodedBitStreamParser::decodeByteSegment of the file qrcode/decoder/decoded_bit_stream_parser.cpp. The manipulation…

    opencv wechat_qrcode Module opencv opencv Debian Ubuntu
  • Medium 5.9
    CVE-2023-32570

    VideoLAN dav1d before 1.2.0 has a thread_task.c race condition that can lead to an application crash, related to dav1d_…

    dav1d dav1d Debian Ubuntu
  • Medium 6.5
    CVE-2023-32573

    In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPer…

    qt5-qtsvg qt6-svg qtsvg-opensource-src qtsvg-opensource-src Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2023-31555

    podofoinfo 0.10.0 was discovered to contain a segmentation violation via the function PoDoFo::PdfObject::DelayedLoad.

  • Medium 5.4
    CVE-2023-27888

    Cross-site scripting vulnerability in Joruri Gw Ver 3.2.5 and earlier allows a remote authenticated attacker to inject …

    SiteBridge Joruri Gw
  • Medium 6.1
    CVE-2023-27918

    Cross-site scripting vulnerability in Appointment and Event Booking Calendar for WordPress - Amelia versions prior to 1…

    TMS Appointment and Event Booking Calendar for WordPress - Amelia Web / CMS
  • Medium 5.3
    CVE-2023-27510

    JB Inquiry form contains an exposure of private personal information to an unauthorized actor vulnerability, which may …

    Jubei JB Inquiry form