Skip to content
OpenAdvisories

Archive

12 June 2023

Vulnerabilities first published on this day (UTC), newest first.

← May 2023 2023 / June /12 July 2023 →
  1. 177
  2. 2143
  3. 321
  4. 47
  5. 573
  6. 6149
  7. 7185
  8. 840
  9. 9118
  10. 104
  11. 118
  12. 1284
  13. 13187
  14. 14120
  15. 1596
  16. 1679
  17. 179
  18. 1813
  19. 19116
  20. 2064
  21. 2132
  22. 22112
  23. 23192
  24. 245
  25. 2510
  26. 2695
  27. 2777
  28. 28160
  29. 2965
  30. 3083
All Critical High Medium Low Exploited only Public exploit

84 results · Feed

  • High 7.1
    CVE-2023-34026

    WordPress This Day In History Plugin <= 3.10.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BrokenCrust This Day In History plugin <= 3.10.1 versions.

    BrokenCrust This Day In History
  • Medium 6.3
    CVE-2023-3208

    RoadFlow Visual Process Engine .NET Core Mvc Login sql injection

    A vulnerability, which was classified as critical, has been found in RoadFlow Visual Process Engine .NET Core Mvc 2.13.3. Affected by this issue is some unknown functionality of the file /Log/Query?appid=0B736354-9473-4D66-B9C0-15CAC149EB05&tabid=tab_0B736354…

    RoadFlow Visual Process Engine .NET Core Mvc
  • Medium 5.3
    CVE-2023-3206 EPSS 19%

    Chengdu VEC40G denial of service

    A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. Affected by this vulnerability is an unknown functionality of the file /send_order.cgi?parameter=restart. The manipulation of the argument restart with the input reboot leads to denial…

    Chengdu VEC40G
  • High 7.1
    CVE-2023-32118

    WordPress SALERT Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPoperation SALERT – Fake Sales Notification WooCommerce plugin <= 1.2.1 versions.

    WPoperation SALERT – Fake Sales Notification WooCommerce Web / CMS
  • Medium 5.9
    CVE-2023-31236

    WordPress Scripts n Styles Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in unFocus Projects Scripts n Styles plugin <= 3.5.7 versions.

    unFocus Projects Scripts n Styles
  • High 7.1
    CVE-2023-32961 Public exploit

    WordPress Zotpress Plugin <= 7.3.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <= 7.3.3 versions.

    Katie Seaborn Zotpress
  • Medium 5.9
    CVE-2023-30745

    WordPress IP Metaboxes Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1 versions.

    Phan Chuong IP Metaboxes
  • High 7.1
    CVE-2023-30753

    WordPress IP Metaboxes Plugin <= 2.1.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Phan Chuong IP Metaboxes plugin <= 2.1.1.

    Phan Chuong IP Metaboxes
  • Medium 5.9
    CVE-2023-23822

    WordPress UTM Tracker Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ludwig Media UTM Tracker plugin <= 1.3.1 versions.

    Ludwig Media UTM Tracker
  • Medium 5.9
    CVE-2023-23819

    WordPress itemprop WP for SERP/SEO Rich snippets Plugin <= 3.5.201706131 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Rolands Umbrovskis itemprop WP for SERP/SEO Rich snippets plugin <= 3.5.201706131 versions.

    Rolands Umbrovskis itemprop WP for SERP/SEO Rich snippets
  • High 7.1
    CVE-2022-47140

    WordPress ARMember Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.1 versions.

    Repute InfoSystems ARMember
  • Medium 5.9
    CVE-2022-45827

    WordPress Video Contest WordPress Plugin Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GalleryPlugins Video Contest plugin <= 3.2 versions.

    GalleryPlugins Video Contest Web / CMS
  • Medium 5.9
    CVE-2023-23818

    WordPress WP Register Profile With Shortcode Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Aviplugins.Com WP Register Profile With Shortcode plugin <= 3.5.7 versions.

    aviplugins.com WP Register Profile With Shortcode
  • Low 3.5
    CVE-2015-10118

    cchetanonline WP-CopyProtect wp-copyprotect.php CopyProtect_options_page cross site scripting

    A vulnerability classified as problematic was found in cchetanonline WP-CopyProtect up to 3.0.0. This vulnerability affects the function CopyProtect_options_page of the file wp-copyprotect.php. The manipulation of the argument CopyProtect_nrc_text leads to cr…

    cchetanonline WP-CopyProtect
  • High 8.2
    CVE-2023-26133

    progressbar.js vulnerable to Prototype Pollution

    All versions of the package progressbar.js are vulnerable to Prototype Pollution via the function extend() in the file utils.js.

    progressbar.js npm
  • Medium 5.3
    CVE-2020-36732

    crypto-js uses insecure random numbers

    The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary.

    crypto-js cryptojs Debian npm
  • Unscored —
    CVE-2023-34581 Public exploit

    Sourcecodester Service Provider Management System v1.0 is vulnerable to SQL Injection via the ID parameter in /php-spms…

  • High 8.0
    CVE-2023-34488

    NanoMQ 0.17.5 has a one-byte heap-based buffer over-read in the conn_handler function of mqtt_parser.c when it processe…

  • Medium 5.4
    CVE-2023-34941 EPSS 24%

    A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allow…

  • Unscored —
    CVE-2023-34942

    Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the mac parameter at /start-apply.html. N…

  • High 7.5
    CVE-2023-34940

    Asus RT-N10LX Router v2.0.0.39 was discovered to contain a stack overflow via the url parameter at /start-apply.html. N…

  • Unscored —
    CVE-2023-34494

    NanoMQ 0.16.5 is vulnerable to heap-use-after-free in the nano_ctx_send function of nmq_mqtt.c.

  • Unscored —
    CVE-2023-34855

    A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management…

  • Unscored —
    CVE-2023-33492

    EyouCMS 1.6.2 is vulnerable to Cross Site Scripting (XSS).

  • Unscored —
    CVE-2023-33625 Public exploit EPSS 33%

    D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability v…

  • Low —
    CVE-2023-33290

    git-url-parse crate vulnerable to Regular Expression Denial of Service

    The git-url-parse crate through 0.4.4 for Rust allows Regular Expression Denial of Service (ReDos) via a crafted URL to normalize_url in lib.rs, a similar issue to CVE-2023-32758 (Python).

    git-url-parse crates.io
  • Unscored —
    CVE-2023-33253 Public exploit

    LabCollector 6.0 though 6.15 allows remote code execution. An authenticated remote low-privileged user can upload an ex…

  • Unscored —
    CVE-2023-33626

    D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a stack overflow via the gena.cgi b…

  • High 8.8
    CVE-2023-35031

    Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before …

  • Unscored —
    CVE-2023-35032

    Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and…

  • Critical 9.1
    CVE-2023-35036 EPSS 13%

    In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023…

  • Critical 9.8
    CVE-2023-35042 EPSS 45%

    GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language

    GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable…

    org.geoserver:gs-wms org.geoserver:gs-wfs org.geoserver:gs-wps Maven
  • Unscored —
    CVE-2023-35035

    Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before …

  • Unscored —
    CVE-2023-35033

    Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8, Assistant V10 R0, Manager V10 R1 before …

  • Unscored —
    CVE-2023-35034

    Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and…

  • High 8.8
    CVE-2023-28478

    TP-Link EC-70 devices through 2.3.4 Build 20220902 rel.69498 have a Buffer Overflow.

  • High 8.2
    CVE-2023-32220

    Milesight NCR/Camera Authentication Bypass

    Milesight NCR/camera version 71.8.0.6-r5 allows authentication bypass through an unspecified method.

    Milesight NCR/Camera
  • High 8.8
    CVE-2023-32221

    EaseUS Todo Backup may allow local privilege escalation

    EaseUS Todo Backup version 20220111.390 - An omission during installation may allow a local attacker to perform privilege escalation.

    EaseUS Todo Backup
  • Medium 6.5
    CVE-2023-32219

    Mazda cars unlocking

    A Mazda model (2015-2016) can be unlocked via an unspecified method.

    Mazda Mazda (2015-2016)
  • Critical 9.8
    CVE-2023-27716

    An issue was discovered in freakchicken kafkaUI-lite 1.2.11 allows attackers on the same network to gain escalated priv…