Skip to content
OpenAdvisories

Archive

May 2023

Vulnerabilities first published in this month (UTC), newest first.

← April 2023 2023 / May June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

2,434 results · Feed

  • Medium 5.4
    CVE-2022-33974

    WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds (Tweets Widget) plugin <= 1.8.4 versions.

    Smash Balloon Custom Twitter Feeds (Tweets Widget)
  • Medium 5.9
    CVE-2020-29547

    An issue was discovered in Citadel through webcit-926. Meddler-in-the-middle attackers can pipeline commands after POP3…

    citadel Ubuntu
  • Medium 6.4
    CVE-2023-28153

    An issue was discovered in the Kiddoware Kids Place Parental Control application before 3.8.50 for Android. The child c…

  • Unscored —
    CVE-2023-24601

    OX App Suite before frontend 7.10.6-rev24 allows XSS via a non-app deeplink such as the jslob API's registry sub-tree.

  • Medium 4.2
    CVE-2023-24605

    OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading co…

  • Unscored —
    CVE-2023-24600

    OX App Suite before backend 7.10.6-rev37 allows authenticated users to bypass access controls (for reading contacts) vi…

  • Medium 6.5
    CVE-2023-24603

    OX App Suite before backend 7.10.6-rev37 does not check size limits when downloading, e.g., potentially allowing a craf…

  • Medium 4.3
    CVE-2023-24604

    OX App Suite before backend 7.10.6-rev37 does not check HTTP header lengths when downloading, e.g., potentially allowin…

  • Unscored —
    CVE-2023-24598

    OX App Suite before backend 7.10.6-rev37 has an information leak in the handling of distribution lists, e.g., partial d…

  • Unscored —
    CVE-2023-24597

    OX App Suite before frontend 7.10.6-rev24 allows the loading (without user consent) of an e-mail message's remote resou…

  • Unscored —
    CVE-2023-24602

    OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title.

  • Unscored —
    CVE-2023-24599

    OX App Suite before backend 7.10.6-rev37 allows authenticated users to change the appointments of arbitrary users via c…

  • Medium 4.8
    CVE-2023-2954

    Cross-site Scripting (XSS) - Stored in liangliangyy/djangoblog

    Cross-site Scripting (XSS) - Stored in GitHub repository liangliangyy/djangoblog prior to master.

    liangliangyy liangliangyy/djangoblog
  • High 8.8
    CVE-2023-30253 Public exploit EPSS 82%

    Dolibarr vulnerable to remote code execution via uppercase manipulation

    Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Low 3.9
    CVE-2023-30571

    Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask() call inside archive_writ…

    libarchive libarchive libarchive Debian Ubuntu Wolfi
  • Unscored —
    CVE-2022-24630 Public exploit EPSS 24%

    An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh…

  • Critical 9.8
    CVE-2022-24627 Public exploit Scanner template EPSS 26%

    An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL inje…

  • Unscored —
    CVE-2022-24631 EPSS 41%

    An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTena…

  • Critical 9.8
    CVE-2022-24629 Public exploit EPSS 37%

    An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achi…

  • High 7.2
    CVE-2022-24628

    An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection…

  • Unscored —
    CVE-2022-24632 Public exploit EPSS 27%

    An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during …

  • Unscored —
    CVE-2022-41766

    An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an …

    mediawiki Ubuntu
  • High 7.5
    CVE-2021-27825 Public exploit

    A directory traversal vulnerability on Mercury MAC1200R devices allows attackers to read arbitrary files via a web-stat…

  • Low 3.7
    CVE-2021-37845

    An issue was discovered in Citadel through webcit-932. A meddler-in-the-middle attacker can fixate their own session du…

    citadel Ubuntu
  • Critical 9.8
    CVE-2019-19791

    In LemonLDAP::NG (aka lemonldap-ng) before 2.0.7, the default Apache HTTP Server configuration does not properly restri…

    lemonldap-ng lemonldap-ng Debian Ubuntu
  • Medium 5.5
    CVE-2021-4336

    ITRS Group monitor-ninja scheduled_reports.php sql injection

    A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file modules/reports/models/scheduled_reports.php. The manipulation leads to sql injection. Upgra…

    ITRS Group monitor-ninja
  • Medium 4.3
    CVE-2022-36345

    WordPress Download Plugin Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Plugin <= 2.0.4 versions.

    Metagauss Download Plugin
  • High 7.1
    CVE-2023-33926

    WordPress Easy Google Maps Plugin <= 1.11.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Easy Google Maps plugin <= 1.11.7 versions.

    supsystic Easy Google Maps
  • High 7.1
    CVE-2023-33332

    WordPress WooCommerce Product Vendors Plugin <= 2.1.76 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Product Vendors plugin <= 2.1.76 versions.

    woocommerce WooCommerce Product Vendors Web / CMS
  • Medium 6.5
    CVE-2023-28785

    WordPress Yoast SEO: Local Plugin <= 14.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Yoast Yoast SEO: Local plugin <= 14.9 versions.

    Yoast Yoast SEO: Local
  • High 7.1
    CVE-2023-32800

    WordPress Rank Math SEO PRO Plugin <= 3.0.35 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in One Rank Math SEO PRO plugin <= 3.0.35 versions.

    One Rank Math SEO PRO
  • Medium 6.5
    CVE-2023-33311

    WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CRM Perks Contact Form Entries plugin <= 1.3.0 versions.

    CRM Perks Contact Form Entries
  • Medium 4.3
    CVE-2023-33313

    WordPress WIP Custom Login Plugin <= 1.2.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.

    ThemeinProgress WIP Custom Login
  • Medium 5.9
    CVE-2023-33211

    WordPress WP-Piwik Plugin <= 1.0.27 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in André Bräkling WP-Matomo Integration (WP-Piwik) plugin <= 1.0.27 versions.

    André Bräkling WP-Matomo Integration (WP-Piwik)
  • High 7.1
    CVE-2023-33319

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.

    woocommerce WooCommerce Follow-Up Emails (AutomateWoo) Web / CMS
  • Medium 5.4
    CVE-2023-33316

    WordPress WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce WooCommerce Follow-Up Emails (AutomateWoo) plugin <= 4.9.40 versions.

    woocommerce WooCommerce Follow-Up Emails (AutomateWoo) Web / CMS
  • Medium 5.9
    CVE-2023-33328

    WordPress MailChimp Subscribe Forms Plugin <= 4.0.9.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PluginOps MailChimp Subscribe Form plugin <= 4.0.9.1 versions.

    PluginOps MailChimp Subscribe Form
  • High 7.1
    CVE-2023-33326

    WordPress EventPrime Plugin <= 2.8.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected (XSS) Cross-Site Scripting (XSS) vulnerability in EventPrime plugin <= 2.8.6 versions.

    EventPrime EventPrime
  • High 7.1
    CVE-2023-33309

    WordPress Duplicator Pro Plugin <= 4.5.11 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Awesome Motive Duplicator Pro plugin <= 4.5.11 versions.

    Awesome Motive Duplicator Pro
  • Medium 5.4
    CVE-2023-33314

    WordPress BEAR Plugin <= 1.1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in realmag777 BEAR plugin <= 1.1.3.1 versions.

    RealMag777 BEAR