Skip to content
OpenAdvisories

Archive

11 July 2023

Vulnerabilities first published on this day (UTC), newest first.

← June 2023 2023 / July /11 August 2023 →
  1. 138
  2. 2 
  3. 341
  4. 459
  5. 580
  6. 6204
  7. 758
  8. 824
  9. 98
  10. 10128
  11. 11278
  12. 12239
  13. 13114
  14. 1460
  15. 1512
  16. 1618
  17. 17102
  18. 18149
  19. 1965
  20. 2066
  21. 2169
  22. 2217
  23. 2319
  24. 2457
  25. 2598
  26. 2673
  27. 2775
  28. 2891
  29. 291
  30. 3011
  31. 3164
All Critical High Medium Low Exploited only Public exploit

112 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-36693

    WordPress WP RSS Images Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez WP RSS Images plugin <= 1.1 versions.

    Alain Gonzalez WP RSS Images
  • Medium 5.4
    CVE-2023-37391

    WordPress WordPress Mobile Pack Plugin <= 3.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPMobilePack.Com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps plugin <= 3.4.1 versions.

    WPMobilePack.com WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps Web / CMS
  • Medium 5.9
    CVE-2023-36748

    A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.0), RUGGEDCOM ROX MX5000RE (All versi…

    Siemens RUGGEDCOM ROX RX1501 RUGGEDCOM ROX RX1511 RUGGEDCOM ROX RX1524 ICS / OT
  • Medium 5.3
    CVE-2022-22302

    A clear text storage of sensitive information (CWE-312) vulnerability in both FortiGate version 6.4.0 through 6.4.1, 6.…

    Fortinet FortiOS FortiAuthenticator Network devices
  • Medium 4.7
    CVE-2023-29156

    Denial of Service due to loss of information in DroneScout ds230 Remote ID receiver from BlueMark Innovations

    DroneScout ds230 Remote ID receiver from BlueMark Innovations is affected by an information loss vulnerability through traffic injection. An attacker can exploit this vulnerability by injecting, at the right times, spoofed Open Drone ID (ODID) messages which …

    bluemark ds230
  • Medium 5.4
    CVE-2023-34015

    WordPress Advanced Flat rate shipping Woocommerce Plugin <= 1.6.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping plugin <= 1.6.4.4 versions.

    PI Websolution Conditional shipping & Advanced Flat rate shipping rates / Flexible shipping for WooCommerce shipping Web / CMS
  • Medium 4.3
    CVE-2023-35913

    WordPress OOPSpam Anti-Spam Plugin <= 1.1.44 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in OOPSpam OOPSpam Anti-Spam plugin <= 1.1.44 versions.

    OOPSpam Team OOPSpam Anti-Spam
  • Medium 5.4
    CVE-2023-35774

    WordPress LWS Tools Plugin <= 2.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.4.1 versions.

    LWS LWS Tools
  • Medium 4.3
    CVE-2023-36517

    WordPress WP Abstracts Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kevon Adonis WP Abstracts plugin <= 2.6.2 versions.

    Kevon Adonis WP Abstracts
  • Medium 5.4
    CVE-2023-35781

    WordPress LWS Cleaner Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LWS Cleaner plugin <= 2.3.0 versions.

    LWS LWS Cleaner
  • Medium 4.3
    CVE-2022-45823

    WordPress Video Contest WordPress Plugin Plugin <= 3.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in GalleryPlugins Video Contest WordPress plugin <= 3.2 versions.

    GalleryPlugins Video Contest WordPress Plugin Web / CMS
  • Medium 4.3
    CVE-2023-25468

    WordPress Reservation.Studio widget Plugin <= 1.0.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Reservation.Studio Reservation.Studio widget plugin <= 1.0.11 versions.

    Reservation.Studio Reservation.Studio widget
  • Medium 4.3
    CVE-2023-23997

    WordPress Database Collation Fix Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dave Jesch Database Collation Fix plugin <= 1.2.7 versions.

    Dave Jesch Database Collation Fix
  • Medium 4.3
    CVE-2023-23704

    WordPress Comments Ratings Plugin <= 1.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.6 versions.

    pixelgrade Comments Ratings
  • Medium 4.3
    CVE-2023-25487

    WordPress PixTypes Plugin <= 1.4.14 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade PixTypes plugin <= 1.4.14 versions.

    pixelgrade PixTypes
  • Medium 5.4
    CVE-2023-24421

    WordPress PHP Compatibility Checker Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Engine PHP Compatibility Checker plugin <= 1.5.2 versions.

    WP Engine PHP Compatibility Checker
  • Medium 4.3
    CVE-2023-25051

    WordPress Comment Reply Notification Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Denishua Comment Reply Notification plugin <= 1.4 versions.

    denishua Comment Reply Notification
  • Medium 4.3
    CVE-2023-23731

    WordPress WishSuite Plugin <= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasTheme WishSuite plugin <= 1.3.3 versions.

    HasTheme WishSuite
  • Medium 4.3
    CVE-2023-23791

    WordPress HT Menu Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes HT Menu plugin <= 1.2.1 versions.

    HasThemes HT Menu
  • Medium 4.3
    CVE-2023-23803

    WordPress JustTables – WooCommerce Product Table Plugin <= 1.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes JustTables plugin <= 1.4.9 versions.

    HasThemes JustTables
  • Medium 4.3
    CVE-2023-23792

    WordPress Swatchly – WooCommerce Variation Swatches for Products Plugin <= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes Swatchly plugin <= 1.2.0 versions.

    HasThemes Swatchly
  • Medium 4.9
    CVE-2023-36924

    Log Injection vulnerability in SAP ERP Defense Forces and Public Security

    While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On succe…

    SAP SAP ERP Defense Forces and Public Security
  • Medium 5.3
    CVE-2023-36919

    Information Disclosure in SAP Enable Now

    In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Referrer-Policy response header is not implemented, allowing an unauthenticated attacker to obtain referrer details, resulting in informatio…

    SAP SAP Enable Now
  • Medium 6.1
    CVE-2023-36918

    Cross-Site Scripting vulnerability in SAP Enable Now

    In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the X-Content-Type-Options response header is not implemented, allowing an unauthenticated attacker to trigger MIME type sniffing, which leads t…

    SAP SAP Enable Now
  • Medium 5.9
    CVE-2023-36917

    Password Change rate limit bypass in SAP BusinessObjects Business Intelligence Platform

    SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change function…

    SAP SAP BusinessObjects Business Intelligence Platform
  • Medium 6.0
    CVE-2023-35874

    Improper authentication vulnerability in SAP NetWeaver AS ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERN…

    SAP SAP NetWeaver AS ABAP and ABAP Platform
  • Medium 6.5
    CVE-2023-35873

    Missing Authentication check in SAP NetWeaver Process Integration (Runtime Workbench)

    The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product st…

    SAP SAP NetWeaver Process Integration (Runtime Workbench)
  • Medium 6.5
    CVE-2023-35872

    Missing Authentication check in SAP NetWeaver Process Integration (Message Display Tool)

    The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical data about the product s…

    SAP SAP NetWeaver Process Integration (Message Display Tool)
  • Medium 6.3
    CVE-2023-35870

    Improper Access Control in SAP S/4HANA (Manage Journal Entry Template)

    When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the reso…

    SAP SAP S/4HANA (Manage Journal Entry Template)
  • Medium 4.5
    CVE-2023-33992

    Missing Authorization Check in SAP Business Warehouse and SAP BW/4HANA

    The SAP BW BICS communication layer in SAP Business Warehouse and SAP BW/4HANA - version SAP_BW 730, SAP_BW 731, SAP_BW 740, SAP_BW 730, SAP_BW 750, DW4CORE 100, DW4CORE 200, DW4CORE 300, may expose unauthorized cell values to the data response. To be able to…

    SAP SAP Business Warehouse and SAP BW/4HANA
  • Medium 6.1
    CVE-2023-33988

    Cross-Site Scripting vulnerability in SAP Enable Now

    In SAP Enable Now - versions WPB_MANAGER 1.0, WPB_MANAGER_CE 10, WPB_MANAGER_HANA 10, ENABLE_NOW_CONSUMP_DEL 1704, the Content-Security-Policy and X-XSS-Protection response headers are not implemented, allowing an unauthenticated attacker to attempt reflected…

    SAP SAP Enable Now
  • Medium 5.3
    CVE-2023-31405

    Log Injection vulnerability in SAP NetWeaver AS for Java (Log Viewer)

    SAP NetWeaver AS for Java - versions ENGINEAPI 7.50, SERVERCORE 7.50, J2EE-APPS 7.50, allows an unauthenticated attacker to craft a request over the network which can result in unwarranted modifications to a system log without user interaction. There is no ab…

    SAP SAP NetWeaver AS for Java (Log Viewer)