Skip to content
OpenAdvisories

Archive

26 June 2023

Vulnerabilities first published on this day (UTC), newest first.

← May 2023 2023 / June /26 July 2023 →
  1. 177
  2. 2143
  3. 321
  4. 47
  5. 573
  6. 6149
  7. 7185
  8. 840
  9. 9118
  10. 104
  11. 118
  12. 1284
  13. 13187
  14. 14120
  15. 1596
  16. 1679
  17. 179
  18. 1813
  19. 19116
  20. 2064
  21. 2132
  22. 22112
  23. 23192
  24. 245
  25. 2510
  26. 2695
  27. 2777
  28. 28160
  29. 2965
  30. 3083
All Critical High Medium Low Exploited only Public exploit

95 results · Feed

  • Medium 6.5
    CVE-2023-35168

    DataEase has a privilege bypass vulnerability

    DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. Affected versions of DataEase has a privilege bypass vulnerability where ordinary users can gain access to the user database. Exposed informatio…

    dataease dataease
  • Medium 4.8
    CVE-2023-33176

    Blind SSRF When Uploading Presentation in BigBlueButton

    BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a Server-Side Request Forgery (SSRF) vulnerability. In an `insertDocument` API request the user is able to supply a URL …

    bigbluebutton bigbluebutton
  • Medium 6.5
    CVE-2023-34422

    A valid, authenticated LXCA user with elevated privileges may be able to delete folders in the LXCA filesystem through …

    Lenovo Lenovo XClarity Administrator
  • Medium 6.5
    CVE-2023-34421

    A valid, authenticated LXCA user with elevated privileges may be able to replace filesystem data through a specifically…

    Lenovo Lenovo XClarity Administrator
  • High 7.2
    CVE-2023-34420

    A valid, authenticated LXCA user with elevated privileges may be able to execute command injections through crafted cal…

    Lenovo Lenovo XClarity Administrator
  • High 8.1
    CVE-2023-34418

    A valid, authenticated LXCA user may be able to gain unauthorized access to events and other data stored in LXCA due to…

    Lenovo Lenovo XClarity Administrator
  • High 8.2
    CVE-2023-3113

    An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) se…

    Lenovo Lenovo XClarity Administrator
  • Medium 5.4
    CVE-2023-2993

    A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API c…

    Lenovo Fan Power Controller (FPC) System Management Module (SMM)
  • High 7.5
    CVE-2023-2992

    An unauthenticated  denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which c…

    Lenovo Fan Power Controller (FPC) System Management Module (SMM)
  • Medium 6.4
    CVE-2023-2290

    A potential vulnerability in the LenovoFlashDeviceInterface SMI handler may allow an attacker with local access and ele…

    Lenovo ThinkPad
  • Low 3.7
    CVE-2023-35930

    LookupResources may return partial results in spicedb

    SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. Any user making a negative authorization decision based on the results of a `LookupResources` request with 1.22.0 is affe…

    authzed spicedb github.com/authzed/spicedb Go
  • Medium 5.9
    CVE-2023-35933

    OpenFGA denial of service die to circular relationship

    OPenFGA is an open source authorization/permission engine built for developers. OpenFGA versions v1.1.0 and prior are vulnerable to a DoS attack when Check and ListObjects calls are executed against authorization models that contain circular relationship defi…

    openfga openfga github.com/openfga/openfga Go
  • Medium 6.3
    CVE-2023-2005

    Tenable Plugin Feed ID #202306261202 Fixes Privilege Escalation Vulnerability

    Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: before Plugin Feed ID #202306261202 ; Security Center: before Plugin Feed ID #202306261202 . This vulnera…

    Tenable Security Center Nessus Tenable.io
  • Medium 5.9
    CVE-2023-29438

    WordPress SimpleModal Contact Form (SMCF) Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Eric Martin SimpleModal Contact Form (SMCF) plugin <= 1.2.9 versions.

    Eric Martin SimpleModal Contact Form (SMCF)
  • Medium 6.5
    CVE-2023-29437

    WordPress Connections Business Directory Plugin <= 10.4.36 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Steven A. Zahm Connections Business Directory plugin <= 10.4.36 versions.

    Steven A. Zahm Connections Business Directory
  • Medium 6.5
    CVE-2023-29435

    WordPress Cryptocurrency All-in-One Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Zwaply Cryptocurrency All-in-One plugin <= 3.0.19 versions.

    Zwaply Cryptocurrency All-in-One
  • Medium 6.5
    CVE-2023-29436

    WordPress IFrame Shortcode Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Flyn San IFrame Shortcode plugin <= 1.0.5 versions.

    Flyn San IFrame Shortcode
  • Medium 5.9
    CVE-2023-29434

    WordPress Optin Forms Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress plugin <= 1.3.1 versions.

    FancyThemes Optin Forms – Simple List Building Plugin for WordPress Web / CMS
  • Medium 5.3
    CVE-2023-3398

    Denial of Service in jgraph/drawio

    Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.

    jgraph jgraph/drawio
  • High 7.1
    CVE-2023-29430

    WordPress TheRoof Theme <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CTHthemes TheRoof theme <= 1.0.3 versions.

    Cththemes TheRoof
  • High 7.1
    CVE-2023-29427

    WordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia plugin <= 1.0.75 versions.

    TMS Booking for Appointments and Events Calendar – Amelia
  • High 7.1
    CVE-2023-29424

    WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Plainware ShiftController Employee Shift Scheduling plugin <= 4.9.23 versions.

    plainware ShiftController Employee Shift Scheduling
  • Medium 5.9
    CVE-2023-29423

    WordPress Cancel order request WooCommerce Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Cancel order request / Return order / Repeat Order / Reorder for WooCommerce plugin <= 1.3.2 versions.

    PI Websolution Cancel order request / Return order / Repeat Order / Reorder for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-22359

    User-enumeration in RestAPI

    User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames.

    Tribe29 Checkmk check-mk Ubuntu
  • High 7.5
    CVE-2023-1150

    WAGO: Series 750-3x/-8x prone to MODBUS server DoS

    Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.

    WAGO 750-890/xxx-xxx 750-862 750-891 ICS / OT
  • Medium 4.9
    CVE-2023-1620

    WAGO: DoS in multiple products in multiple versions using Codesys

    Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.

    WAGO 750-889 750-852 750-862 ICS / OT
  • Medium 4.9
    CVE-2023-1619

    WAGO: DoS in multiple versions of multiple products

    Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet.

    WAGO 750-891 750-823 750-831/xxx-xxx ICS / OT
  • Medium 5.9
    CVE-2023-29093

    WordPress Conditional extra fees for woocommerce Plugin <= 1.0.96 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PI Websolution Conditional cart fee plugin <= 1.0.96 versions.

    PI Websolution Conditional cart fee
  • Medium 5.9
    CVE-2023-28991

    WordPress Order date time for WooCommerce Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Order date, Order pickup, Order date time, Pickup Location, delivery date for WooCommerce plugin <= 3.0.19 versions.

    PI Websolution Order date, Order pickup, Order date time, Pickup Location, delivery date for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-28992

    WordPress Coupon Affiliates Plugin <= 5.4.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Elliot Sowersby, RelyWP Coupon Affiliates – WooCommerce Affiliate Plugin plugin <= 5.4.3 versions.

    Elliot Sowersby / RelyWP Coupon Affiliates – WooCommerce Affiliate Plugin Web / CMS
  • Medium 5.9
    CVE-2023-28988

    WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin <= 2.1.48 versions.

    PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce Web / CMS
  • Unscored —
    CVE-2020-23065

    Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remot…

  • Unscored —
    CVE-2020-20210

    Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.

  • Unscored —
    CVE-2023-34924 Public exploit

    H3C Magic B1STW B1STV100R012 was discovered to contain a stack overflow via the function SetAPInfoById. This vulnerabil…

  • Unscored —
    CVE-2023-33580 Public exploit

    Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" …

  • Unscored —
    CVE-2023-33404 Public exploit EPSS 26%

    An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net ver…

  • Unscored —
    CVE-2023-28485

    A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticat…

  • Unscored —
    CVE-2023-29459

    The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppM…

  • Unscored —
    CVE-2023-36301

    Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet.

  • Unscored —
    CVE-2023-36631

    Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged u…