Skip to content
OpenAdvisories

Archive

22 June 2023

Vulnerabilities first published on this day (UTC), newest first.

← May 2023 2023 / June /22 July 2023 →
  1. 177
  2. 2143
  3. 321
  4. 47
  5. 573
  6. 6149
  7. 7185
  8. 840
  9. 9118
  10. 104
  11. 118
  12. 1284
  13. 13187
  14. 14120
  15. 1596
  16. 1679
  17. 179
  18. 1813
  19. 19116
  20. 2064
  21. 2132
  22. 22112
  23. 23192
  24. 245
  25. 2510
  26. 2695
  27. 2777
  28. 28160
  29. 2965
  30. 3083
All Critical High Medium Low Exploited only Public exploit

29 results · Clear filters · Feed

  • High 7.0
    CVE-2023-28006

    HCL BigFix OSD Bare Metal Server is affected by a weak cryptographic algorithm.

    The OSD Bare Metal Server uses a cryptographic algorithm that is no longer considered sufficiently secure.

    HCL Software HCL BigFix OSD Bare Metal Server
  • High 8.7
    CVE-2023-32320

    Nextcloud Server's brute force protection allows someone to send more requests than intended

    Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, all of them were executed even if the amount of faulty requests succeeded the limit by the time the response was sent to…

    Nextcloud security-advisories
  • High 8.1
    CVE-2023-28800

    Output encoding missing in redrurl parameter

    When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login.

    Zscaler Client Connector
  • High 8.2
    CVE-2023-28799

    A URL parameter during login flow was vulnerable to injection. An attacker could insert a malicious domain in this para…

    Zscaler Client Connector
  • High 8.8
    CVE-2023-3256

    Advantech R-SeeNet External Control of File Name or Path

    Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files.

    Advantech R-SeeNet
  • High 8.6
    CVE-2023-35174

    Livebook Desktop's protocol handler can be exploited to execute arbitrary command on Windows

    Livebook is a web application for writing interactive and collaborative code notebooks. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Any user usi…

    livebook-dev livebook livebook Hex
  • High 8.1
    CVE-2023-35926

    Insecure sandbox in Backstage Scaffolder plugin

    Backstage is an open platform for building developer portals. The Backstage scaffolder-backend plugin uses a templating library that requires sandbox, as it by design allows for code injection. The library used for this sandbox so far has been `vm2`, but in l…

    backstage backstage @backstage/plugin-scaffolder-backend npm
  • High 7.1
    CVE-2023-33997

    WordPress bbp style pack Plugin <= 5.5.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.5.5 versions.

    Robin Wilson bbp style pack
  • High 7.1
    CVE-2023-32960

    WordPress UpdraftPlus Plugin <= 1.23.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin <= 1.23.3 versions leads to sitewide Cross-Site Scripting (XSS).

    UpdraftPlus.Com, DavidAnderson UpdraftPlus WordPress Backup Plugin Web / CMS
  • High 8.5
    CVE-2022-47593

    WordPress RapidLoad Power-Up for Autoptimize Plugin <= 1.6.35 is vulnerable to SQL Injection

    Auth. (subscriber+) SQL Injection (SQLi) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize plugin <= 1.6.35 versions.

    RapidLoad RapidLoad Power-Up for Autoptimize
  • High 7.1
    CVE-2023-28418

    WordPress Mediciti Lite Theme <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Yudlee themes Mediciti Lite theme <= 1.3.0 versions.

    Yudlee themes Mediciti Lite
  • High 8.1
    CVE-2023-20895

    The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A ma…

    VMware VMware vCenter Server (vCenter Server) VMware Cloud Foundation (vCenter Server) Virtualization
  • High 8.1
    CVE-2023-20894 EPSS 34%

    The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A…

    VMware VMware Cloud Foundation (vCenter Server) VMware vCenter Server (vCenter Server) Virtualization
  • High 8.1
    CVE-2023-20893

    The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malic…

    VMware VMware Cloud Foundation (vCenter Server) VMware vCenter Server (vCenter Server) Virtualization
  • High 7.1
    CVE-2023-35918

    WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions.

    woocommerce Bulk Stock Management
  • High 8.1
    CVE-2023-20892

    VMware vCenter Server heap-overflow vulnerability

    The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitra…

    VMware VMware Cloud Foundation (vCenter Server) VMware vCenter Server (vCenter Server) Virtualization
  • High 7.1
    CVE-2023-23795

    WordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions.

    Muneeb Form Builder
  • High 7.1
    CVE-2023-28776

    WordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions.

    I Thirteen Web Solution Continuous Image Carousel With Lightbox
  • High 7.1
    CVE-2023-28750

    WordPress Albo Pretorio Online Plugin <= 4.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6 versions.

    Ignazio Scimone Albo Pretorio On line
  • High 7.1
    CVE-2023-28784

    WordPress Contest Gallery Plugin <= 21.1.2 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 21.1.2 versions.

    contest-gallery Contest Gallery
  • High 7.1
    CVE-2023-28166

    WordPress Tags Cloud Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <= 1.0.0 versions.

    Aakif Kadiwala Tags Cloud Manager
  • High 7.2
    CVE-2023-32449

    Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. An att…

    Dell PowerStore
  • High 7.2
    CVE-2019-25152 Scanner template

    Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting

    The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient inp…

    Tyche Softwares TYCHE Abandoned Cart Lite for WooCommerce Abandoned Cart Pro for WooCommerce Web / CMS
  • High 8.4
    CVE-2023-28956

    IBM Spectrum Protect Backup-Archive Client privilege escalation

    IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls.

    IBM Spectrum Protect Backup-Archive Client
  • High 7.5
    CVE-2023-35133

    Moodle: ssrf risk due to insufficient check on the curl blocked hosts

    An issue in the logic used to check 0.0.0.0 against the cURL blocked hosts lists resulted in an SSRF risk. This flaw affects Moodle versions 4.2, 4.1 to 4.1.3, 4.0 to 4.0.8, 3.11 to 3.11.14, 3.9 to 3.9.21 and earlier unsupported versions.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 8.1
    CVE-2023-28094

    Pega platform clients who are using versions 7.4 through 8.8.x and have upgraded from a version prior to 8.x may be uti…

    Pega Systems Pega Platform
  • High 7.5
    CVE-2023-29709

    An issue was discovered in /cgi-bin/login_rj.cgi in Wildix WSG24POE version 103SP7D190822, allows attackers to bypass a…

  • High 7.5
    CVE-2023-36359

    TP-Link TL-WR940N V4, TL-WR841N V8/V10, TL-WR940N V2/V3 and TL-WR941ND V5/V6 were discovered to contain a buffer overfl…

  • High 7.7
    CVE-2023-36358

    TP-Link TL-WR940N V2/V3/V4, TL-WR941ND V5/V6, TL-WR743ND V1 and TL-WR841N V8 were discovered to contain a buffer overfl…