Skip to content
OpenAdvisories

Archive

June 2023

Vulnerabilities first published in this month (UTC), newest first.

← May 2023 2023 / June July 2023 →
  1. 177
  2. 2143
  3. 321
  4. 47
  5. 573
  6. 6149
  7. 7185
  8. 840
  9. 9118
  10. 104
  11. 118
  12. 1284
  13. 13187
  14. 14120
  15. 1596
  16. 1679
  17. 179
  18. 1813
  19. 19116
  20. 2064
  21. 2132
  22. 22112
  23. 23192
  24. 245
  25. 2510
  26. 2695
  27. 2777
  28. 28160
  29. 2965
  30. 3083
All Critical High Medium Low Exploited only Public exploit

2,424 results · Feed

  • Medium 5.9
    CVE-2023-20896

    The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A …

    VMware VMware Cloud Foundation (vCenter Server) VMware vCenter Server (vCenter Server) Virtualization
  • Medium 5.9
    CVE-2023-28174

    WordPress eRocket Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in eLightUp eRocket plugin <= 1.2.4 versions.

    eLightUp eRocket
  • Medium 5.9
    CVE-2023-27452

    WordPress Button Generator – easily Button Builder Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wow-Company Button Generator – easily Button Builder plugin <= 2.3.3 versions.

    Wow-Company Button Generator – easily Button Builder
  • High 8.1
    CVE-2023-20895

    The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A ma…

    VMware VMware vCenter Server (vCenter Server) VMware Cloud Foundation (vCenter Server) Virtualization
  • High 8.1
    CVE-2023-20894 EPSS 34%

    The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A…

    VMware VMware vCenter Server (vCenter Server) VMware Cloud Foundation (vCenter Server) Virtualization
  • High 8.1
    CVE-2023-20893

    The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malic…

    VMware VMware vCenter Server (vCenter Server) VMware Cloud Foundation (vCenter Server) Virtualization
  • Medium 5.9
    CVE-2023-26534

    WordPress WP Repost Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in OneWebsite WP Repost plugin <= 0.1 versions.

    OneWebsite WP Repost
  • Medium 5.9
    CVE-2023-26539

    WordPress Advanced Text Widget Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Chirkov Advanced Text Widget plugin <= 2.1.2 versions.

    Max Chirkov Advanced Text Widget
  • Medium 4.3
    CVE-2023-35917

    WordPress WooCommerce PayPal Payments Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce PayPal Payments plugin <= 2.0.4 versions.

    woocommerce WooCommerce PayPal Payments Web / CMS
  • High 7.1
    CVE-2023-35918

    WordPress WooCommerce Bulk Stock Management Plugin <= 2.2.33 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Bulk Stock Management plugin <= 2.2.33 versions.

    woocommerce Bulk Stock Management
  • High 8.1
    CVE-2023-20892

    VMware vCenter Server heap-overflow vulnerability

    The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitra…

    VMware VMware Cloud Foundation (vCenter Server) VMware vCenter Server (vCenter Server) Virtualization
  • Medium 5.8
    CVE-2023-30500

    WordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPForms WPForms Lite (wpforms-lite), WPForms WPForms Pro (wpforms) plugins <= 1.8.1.2 versions.

    WPForms WPForms Pro WPForms Lite
  • Medium 5.9
    CVE-2023-23811

    WordPress Smoothscroller Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Neil Gee Smoothscroller plugin <= 1.0.0 versions.

    Neil Gee Smoothscroller
  • High 7.1
    CVE-2023-23795

    WordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Muneeb Form Builder plugin <= 1.9.9.0 versions.

    Muneeb Form Builder
  • Medium 5.9
    CVE-2023-23807

    WordPress MojoPlug Slide Panel Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Qumos MojoPlug Slide Panel plugin <= 1.1.2 versions.

    Qumos MojoPlug Slide Panel
  • Medium 5.9
    CVE-2023-28778

    WordPress Pagination by BestWebSoft Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Pagination plugin <= 1.2.2 versions.

    bestwebsoft Pagination
  • High 7.1
    CVE-2023-28776

    WordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Continuous Image Carousel With Lightbox plugin <= 1.0.15 versions.

    I Thirteen Web Solution Continuous Image Carousel With Lightbox
  • High 7.1
    CVE-2023-28750

    WordPress Albo Pretorio Online Plugin <= 4.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6 versions.

    Ignazio Scimone Albo Pretorio On line
  • High 7.1
    CVE-2023-28784

    WordPress Contest Gallery Plugin <= 21.1.2 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 21.1.2 versions.

    contest-gallery Contest Gallery
  • Medium 6.5
    CVE-2023-35093

    WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Broken Access Control

    Broken Access Control vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.8 versions allows any logged-in users, such as subscribers to view the "Orders" of the plugin and get the data related to t…

    StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education Web / CMS
  • Medium 6.5
    CVE-2023-35090

    WordPress MasterStudy LMS Plugin <= 3.0.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin <= 3.0.7 versions.

    StylemixThemes MasterStudy LMS WordPress Plugin – for Online Courses and Education Web / CMS
  • Medium 6.5
    CVE-2023-31213

    WordPress WPBakery Page Builder Plugin < 6.13.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPBakery Page Builder plugin <= 6.13.0 versions.

    wpbakery WPBakery Page Builder
  • Medium 5.9
    CVE-2023-28695

    WordPress VigilanTor Plugin <= 1.3.10 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Drew Phillips VigilanTor plugin <= 1.3.10 versions.

    Drew Phillips VigilanTor
  • Medium 5.9
    CVE-2023-27618

    WordPress Store Locator WordPress Plugin <= 1.4.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in AGILELOGIX Store Locator WordPress plugin <= 1.4.9 versions.

    Agile Logix Store Locator WordPress Web / CMS
  • Medium 6.5
    CVE-2023-28534

    WordPress WP Job Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board plugin <= 2.0.0 versions.

    WP Job Portal WP Job Portal – A Complete Job Board
  • Medium 5.9
    CVE-2023-28496

    WordPress SMTP2GO Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SMTP2GO – Email Made Easy plugin <= 1.4.2 versions.

    smtp2go SMTP2GO – Email Made Easy
  • Medium 5.9
    CVE-2023-28423

    WordPress Modern Footnotes Plugin <= 1.4.15 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Prism Tech Studios Modern Footnotes plugin <= 1.4.15 versions.

    Prism Tech Studios Modern Footnotes
  • High 7.1
    CVE-2023-28166

    WordPress Tags Cloud Manager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Aakif Kadiwala Tags Cloud Manager plugin <= 1.0.0 versions.

    Aakif Kadiwala Tags Cloud Manager
  • Medium 5.4
    CVE-2023-28171

    WordPress Brilliance Theme <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (subscriber+) Stored Cross-Site Scripting (XSS) vulnerability in WP Chill Brilliance theme <= 1.3.1 versions.

    WP Chill Brilliance
  • Medium 6.5
    CVE-2023-27612

    WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.

    Paul Ryley Site Reviews
  • Medium 6.5
    CVE-2023-27629

    WordPress Site Reviews Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Paul Ryley Site Reviews plugin <= 6.5.1 versions.

    Paul Ryley Site Reviews
  • Medium 6.5
    CVE-2023-27413

    WordPress W4 Post List Plugin <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Shazzad Hossain Khan W4 Post List plugin <= 2.4.4 versions.

    Shazzad Hossain Khan W4 Post List
  • Medium 6.5
    CVE-2023-27631

    WordPress Daily Prayer Time Plugin <= 2023.05.04 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.05.04 versions.

    mmrs151 Daily Prayer Time
  • High 7.2
    CVE-2023-32449

    Dell PowerStore versions prior to 3.5 contain an improper verification of cryptographic signature vulnerability. An att…

    Dell PowerStore
  • Medium 5.3
    CVE-2023-26115

    word-wrap vulnerable to Regular Expression Denial of Service

    All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.

    js-jquery word-wrap Azure Linux npm
  • High 7.2
    CVE-2019-25152 Scanner template

    Abandoned Cart Lite for WooCommerce < 5.2.0 and Abandoned Cart Pro for WooCommerce < 7.13.0 - Stored Cross-Site Scripting

    The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient inp…

    Tyche Softwares TYCHE Abandoned Cart Lite for WooCommerce Abandoned Cart Pro for WooCommerce Web / CMS
  • Medium 6.2
    CVE-2023-33842

    IBM SPSS Modeler information disclosure

    IBM SPSS Modeler on Windows 17.0, 18.0, 18.2.2, 18.3, 18.4, and 18.5 requires the end user to have access to the server SSL key which could allow a local user to decrypt and obtain sensitive information. IBM X-Force ID: 256117.

    IBM SPSS Modeler
  • High 8.4
    CVE-2023-28956

    IBM Spectrum Protect Backup-Archive Client privilege escalation

    IBM Spectrum Protect Backup-Archive Client 8.1.0.0 through 8.1.17.2 may allow a local user to escalate their privileges due to improper access controls.

    IBM Spectrum Protect Backup-Archive Client
  • Unscored —
    CVE-2023-34796

    Cross site scripting (XSS) vulnerabiliy in dmarcts-report-viewer dashboard versions 1.1 and thru commit 8a1d882b4c481a0…

  • Unscored —
    CVE-2023-34601

    Jeesite before commit 10742d3 was discovered to contain a SQL injection vulnerability via the component ${businessTable…