Skip to content
OpenAdvisories

Archive

May 2023

Vulnerabilities first published in this month (UTC), newest first.

← April 2023 2023 / May June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

1,208 results · Clear filters · Feed

  • Medium 6.3
    CVE-2023-30615

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in iris-web

    Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations . The vulnerability in all…

    dfir-iris iris-web
  • Medium 4.8
    CVE-2023-32694

    Non-constant time HMAC comparison in Adyen plugin in Saleor

    Saleor Core is a composable, headless commerce API. Saleor's `validate_hmac_signature` function is vulnerable to timing attacks. Malicious users could abuse this vulnerability on Saleor deployments having the Adyen plugin enabled in order to determine the sec…

    saleor saleor
  • Medium 4.3
    CVE-2023-22504

    Affected versions of Atlassian Confluence Server allow remote attackers who have read permissions to a page, but not wr…

    Atlassian Confluence Server Confluence Data Center Web / CMS
  • Medium 6.5
    CVE-2023-0459

    Copy_from_user Spectre-V1 Gadget in Linux Kernel

    Copy_from_user on 64-bit versions of the Linux kernel does not implement the __uaccess_begin_nospec allowing a user to bypass the "access_ok" check and pass a kernel pointer to copy_from_user(). This would allow an attacker to leak information. We recommend u…

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 4.7
    CVE-2023-2888

    PHPOK unrestricted upload

    A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100. This affects an unknown part of the file /admin.php?c=upload&f=zip&_noCache=0.1683794968. The manipulation leads to unrestricted upload. It is possible to initiate the attack re…

  • Medium 4.3
    CVE-2022-47174

    WordPress Performance Lab Plugin <= 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions.

    WordPress Performance Team Performance Lab
  • Medium 4.3
    CVE-2022-47178

    WordPress Simple Share Buttons Adder Plugin <= 8.4.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Simple Share Buttons Simple Share Buttons Adder plugin <= 8.4.7 versions.

    Simple Share Buttons Simple Share Buttons Adder
  • Medium 4.3
    CVE-2022-47136

    WordPress Ninja Tables Plugin <= 4.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.

    WP ManageNinja Ninja Tables – Best Data Table Plugin for WordPress Web / CMS
  • Medium 4.3
    CVE-2022-47144

    WordPress Mediamatic – Media Library Folders Plugin <= 2.8.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.

    Plugincraft Mediamatic – Media Library Folders
  • Medium 5.4
    CVE-2022-46856

    WordPress Woocommerce Product Designer Plugin <= 4.3.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in ORION Woocommerce Products Designer plugin <= 4.3.3 versions.

    ORION Woocommerce Products Designer Web / CMS
  • Medium 4.3
    CVE-2022-46810

    WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions.

    villatheme Thank You Page Customizer for WooCommerce – Increase Your Sales Web / CMS
  • Medium 4.3
    CVE-2022-46814

    WordPress Kodex Posts likes Plugin <= 2.4.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pierre Lebedel Kodex Posts likes plugin <= 2.4.3 versions.

    Pierre Lebedel Kodex Posts likes
  • Medium 5.4
    CVE-2022-46820

    WordPress Joli Table Of Contents Plugin <= 1.3.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPJoli Joli Table Of Contents plugin <= 1.3.9 versions.

    wpjoli Joli Table Of Contents
  • Medium 4.3
    CVE-2022-45815

    WordPress GDPR Compliance & Cookie Consent Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes GDPR Compliance & Cookie Consent plugin <= 1.2 versions.

    StylemixThemes GDPR Compliance & Cookie Consent
  • Medium 5.4
    CVE-2022-45371

    WordPress ShopEngine Plugin <= 4.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Wpmet ShopEngine plugin <= 4.1.1 versions.

    Wpmet ShopEngine
  • Medium 5.4
    CVE-2022-38716

    WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.4 versions.

    StylemixThemes Motors – Car Dealer, Classifieds & Listing
  • Medium 5.4
    CVE-2022-38356

    WordPress Pearl Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin – Pearl plugin <= 1.3.4 versions.

    StylemixThemes WordPress Header Builder Plugin – Pearl Web / CMS
  • Medium 5.4
    CVE-2022-43490

    WordPress Stream Plugin <= 3.9.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in XWP Stream plugin <= 3.9.2 versions.

    xwp Stream
  • Medium 6.3
    CVE-2022-41987

    WordPress BadgeOS Plugin <= 3.7.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LearningTimes BadgeOS plugin <= 3.7.1.6 versions.

    LearningTimes BadgeOS
  • Medium 4.3
    CVE-2022-45367

    WordPress Custom Order Numbers for WooCommerce Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Tyche Softwares Custom Order Numbers for WooCommerce plugin <= 1.4.0 versions.

    Tyche Softwares Custom Order Numbers for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2022-47177

    WordPress WP EasyPay Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions.

    WP Easy Pay WP EasyPay – Square for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-30484

    WordPress Enable Accessibility Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in uPress Enable Accessibility plugin <= 1.4 versions.

    uPress Enable Accessibility
  • Medium 4.3
    CVE-2022-47149

    WordPress Shortlinks by Pretty Links Plugin <= 3.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pretty Links plugin <= 3.4.0 versions.

    Pretty Links Pretty Links
  • Medium 4.3
    CVE-2022-47165

    WordPress CoSchedule Plugin <= 3.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule plugin <= 3.3.8 versions.

    CoSchedule CoSchedule
  • Medium 4.3
    CVE-2022-47161

    WordPress Health Check & Troubleshooting Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.

    The WordPress.org community Health Check & Troubleshooting
  • Medium 4.3
    CVE-2022-41635

    WordPress Advanced Shipment Tracking for WooCommerce Plugin <= 3.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Zorem Advanced Shipment Tracking for WooCommerce plugin <= 3.5.2 versions.

    zorem Advanced Shipment Tracking for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2022-46800

    WordPress LiteSpeed Cache Plugin <= 5.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache plugin <= 5.3 versions.

    LiteSpeed Technologies LiteSpeed Cache
  • Medium 4.3
    CVE-2022-46812

    WordPress Thank You Page Customizer for WooCommerce – Increase Your Sales Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce – Increase Your Sales plugin <= 1.0.13 versions.

    villatheme Thank You Page Customizer for WooCommerce – Increase Your Sales Web / CMS
  • Medium 4.3
    CVE-2022-46865

    WordPress Bulk Resize Media Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <= 1.1 versions.

    Marty Thornley Bulk Resize Media
  • Medium 4.3
    CVE-2022-46866

    WordPress Import External Images Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <= 1.4 versions.

    Marty Thornley Import External Images
  • Medium 4.3
    CVE-2023-2886

    Cross-Site WebSocket Hijacking in CBOT's Chatbot

    Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.

    CBOT Chatbot
  • Medium 4.3
    CVE-2022-47164

    WordPress Event Manager for WooCommerce Plugin <= 3.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.

    MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2022-47159

    WordPress Logaster Logo Generator Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Logaster Logaster Logo Generator plugin <= 1.3 versions.

    Logaster Logaster Logo Generator
  • Medium 4.3
    CVE-2022-47138

    WordPress LOGIN AND REGISTRATION ATTEMPTS LIMIT Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.

    German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT
  • Medium 5.4
    CVE-2022-47139

    WordPress WP Basic Elements Plugin <= 5.2.15 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <= 5.2.15 versions.

    Damir Calusic WP Basic Elements
  • Medium 4.3
    CVE-2022-47135

    WordPress Chronoforms Plugin <= 7.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <= 7.0.9 versions.

    chronoengine.com Chronoforms
  • Medium 6.1
    CVE-2022-46907 Public exploit

    Apache JSPWiki: XSS Injection points in several plugins

    A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users…

    Apache Software Foundation Apache JSPWiki org.apache.jspwiki:jspwiki-main org.apache.jspwiki:jspwiki-war Maven
  • Medium 5.4
    CVE-2023-33750

    A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or …

  • Medium 5.4
    CVE-2023-33751

    A stored cross-site scripting (XSS) vulnerability in mipjz v5.0.5 allows attackers to execute arbitrary web scripts or …

  • Medium 6.1
    CVE-2023-28370

    Open redirect in Tornado

    Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

    tornadoweb tornado salt python-tornado Debian Ubuntu Azure Linux PyPI