Skip to content
OpenAdvisories

Archive

June 2023

Vulnerabilities first published in this month (UTC), newest first.

← May 2023 2023 / June July 2023 →
  1. 177
  2. 2143
  3. 321
  4. 47
  5. 573
  6. 6149
  7. 7185
  8. 840
  9. 9118
  10. 104
  11. 118
  12. 1284
  13. 13187
  14. 14120
  15. 1596
  16. 1679
  17. 179
  18. 1813
  19. 19116
  20. 2064
  21. 2132
  22. 22112
  23. 23192
  24. 245
  25. 2510
  26. 2695
  27. 2777
  28. 28160
  29. 2965
  30. 3083
All Critical High Medium Low Exploited only Public exploit

2,424 results · Feed

  • Medium 6.5
    CVE-2023-29435

    WordPress Cryptocurrency All-in-One Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Zwaply Cryptocurrency All-in-One plugin <= 3.0.19 versions.

    Zwaply Cryptocurrency All-in-One
  • Medium 6.5
    CVE-2023-29436

    WordPress IFrame Shortcode Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Flyn San IFrame Shortcode plugin <= 1.0.5 versions.

    Flyn San IFrame Shortcode
  • Medium 5.9
    CVE-2023-29434

    WordPress Optin Forms Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in FancyThemes Optin Forms – Simple List Building Plugin for WordPress plugin <= 1.3.1 versions.

    FancyThemes Optin Forms – Simple List Building Plugin for WordPress Web / CMS
  • Medium 5.3
    CVE-2023-3398

    Denial of Service in jgraph/drawio

    Denial of Service in GitHub repository jgraph/drawio prior to 18.1.3.

    jgraph jgraph/drawio
  • High 7.1
    CVE-2023-29430

    WordPress TheRoof Theme <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CTHthemes TheRoof theme <= 1.0.3 versions.

    Cththemes TheRoof
  • High 7.1
    CVE-2023-29427

    WordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia plugin <= 1.0.75 versions.

    TMS Booking for Appointments and Events Calendar – Amelia
  • High 7.1
    CVE-2023-29424

    WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Plainware ShiftController Employee Shift Scheduling plugin <= 4.9.23 versions.

    plainware ShiftController Employee Shift Scheduling
  • Medium 5.9
    CVE-2023-29423

    WordPress Cancel order request WooCommerce Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Cancel order request / Return order / Repeat Order / Reorder for WooCommerce plugin <= 1.3.2 versions.

    PI Websolution Cancel order request / Return order / Repeat Order / Reorder for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-22359

    User-enumeration in RestAPI

    User enumeration in Checkmk <=2.2.0p4 allows an authenticated attacker to enumerate usernames.

    Tribe29 Checkmk check-mk Ubuntu
  • High 7.5
    CVE-2023-1150

    WAGO: Series 750-3x/-8x prone to MODBUS server DoS

    Uncontrolled resource consumption in Series WAGO 750-3x/-8x products may allow an unauthenticated remote attacker to DoS the MODBUS server with specially crafted packets.

    WAGO 750-823 750-832/xxx-xxx 750-890/xxx-xxx ICS / OT
  • Medium 4.9
    CVE-2023-1620

    WAGO: DoS in multiple products in multiple versions using Codesys

    Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a specifically crafted packet to the CODESYS V2 runtime.

    WAGO 750-823 750-831/xxx-xxx 750-832/xxx-xxx ICS / OT
  • Medium 4.9
    CVE-2023-1619

    WAGO: DoS in multiple versions of multiple products

    Multiple WAGO devices in multiple versions may allow an authenticated remote attacker with high privileges to DoS the device by sending a malformed packet.

    WAGO 750-889 750-852 750-862 ICS / OT
  • Medium 5.9
    CVE-2023-29093

    WordPress Conditional extra fees for woocommerce Plugin <= 1.0.96 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PI Websolution Conditional cart fee plugin <= 1.0.96 versions.

    PI Websolution Conditional cart fee
  • Medium 5.9
    CVE-2023-28991

    WordPress Order date time for WooCommerce Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Order date, Order pickup, Order date time, Pickup Location, delivery date for WooCommerce plugin <= 3.0.19 versions.

    PI Websolution Order date, Order pickup, Order date time, Pickup Location, delivery date for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-28992

    WordPress Coupon Affiliates Plugin <= 5.4.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Elliot Sowersby, RelyWP Coupon Affiliates – WooCommerce Affiliate Plugin plugin <= 5.4.3 versions.

    Elliot Sowersby / RelyWP Coupon Affiliates – WooCommerce Affiliate Plugin Web / CMS
  • Medium 5.9
    CVE-2023-28988

    WordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce plugin <= 2.1.48 versions.

    PI Websolution Direct checkout, Add to cart redirect, Quick purchase button, Buy now button, Quick View button for WooCommerce Web / CMS
  • Unscored —
    CVE-2020-23065

    Cross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish Legacy v.5.4 allows a remot…

  • Unscored —
    CVE-2020-20210

    Bludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.

  • Unscored —
    CVE-2023-34924 Public exploit

    H3C Magic B1STW B1STV100R012 was discovered to contain a stack overflow via the function SetAPInfoById. This vulnerabil…

  • Unscored —
    CVE-2023-33580 Public exploit

    Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS) in the "Admin Name" …

  • Unscored —
    CVE-2023-33404 Public exploit EPSS 26%

    An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net ver…

  • Unscored —
    CVE-2023-28485

    A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticat…

  • Unscored —
    CVE-2023-29459

    The laola.redbull application through 5.1.9-R for Android exposes the exported activity at.redbullsalzburg.android.AppM…

  • Unscored —
    CVE-2023-36301

    Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet.

  • Unscored —
    CVE-2023-36631

    Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged u…

  • Unscored —
    CVE-2023-36252

    An issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to execute arbitrary code …

  • Unscored —
    CVE-2023-36662

    The TechTime User Management components for Atlassian products allow stored XSS on the Bulk User Actions page. This aff…

  • Unscored —
    CVE-2023-36675

    An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. Blo…

    mediawiki mediawiki Debian Ubuntu
  • Unscored —
    CVE-2023-27082

    Cross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4 allows remote attackers …

  • Unscored —
    CVE-2023-30261 EPSS 32%

    Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET…

  • High 8.8
    CVE-2023-25307

    mrpack-install vulnerable to path traversal with dependency

    nothub mrpack-install <= v0.16.2 is vulnerable to Directory Traversal.

    github.com/nothub/mrpack-install Go
  • Unscored —
    CVE-2023-25306

    MultiMC Launcher <= 0.6.16 is vulnerable to Directory Traversal.

  • Unscored —
    CVE-2022-48336

    Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagParseAndStoreData integer overflow and resultant buff…

  • Unscored —
    CVE-2022-48331

    Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_save_keys feature_name_len integer overflow and resulta…

  • Unscored —
    CVE-2022-48332

    Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_save_keys file_name_len integer overflow and resultant …

  • Unscored —
    CVE-2022-48333

    Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_verify_keys prefix_len+feature_name_len integer overflo…

  • Unscored —
    CVE-2022-48335

    Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer overflow and resultant buf…

  • Unscored —
    CVE-2022-48334

    Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_verify_keys total_len+file_name_len integer overflow an…

  • Unscored —
    CVE-2022-40010

    Tenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi was discovered to contain a cross-site scripting (XSS) v…

  • Critical 9.8
    CVE-2021-31635

    jFinal Server-Side Template Injection vulnerability

    Server-Side Template Injection (SSTI) vulnerability in jFinal v.4.9.08 allows a remote attacker to execute arbitrary code via the template function.

    com.jfinal:jfinal Maven