Skip to content
OpenAdvisories

Archive

27 July 2023

Vulnerabilities first published on this day (UTC), newest first.

← June 2023 2023 / July /27 August 2023 →
  1. 138
  2. 2 
  3. 341
  4. 459
  5. 580
  6. 6204
  7. 758
  8. 824
  9. 98
  10. 10128
  11. 11278
  12. 12239
  13. 13114
  14. 1460
  15. 1512
  16. 1618
  17. 17102
  18. 18149
  19. 1965
  20. 2066
  21. 2169
  22. 2217
  23. 2319
  24. 2457
  25. 2598
  26. 2673
  27. 2775
  28. 2891
  29. 291
  30. 3011
  31. 3164
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 4.8
    CVE-2023-23764

    Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

    An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff within the GitHub pull request UI. To do so, an attacker would need write access to the repository. This vulnerabili…

    GitHub Enterprise Server
  • Medium 4.3
    CVE-2023-38509

    XWiki Platform's obfuscated email addresses should not be sorted

    XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10.9 and 15.3-rc-1, the mail obfuscation configuration was not fully taken into account and is was stil…

    xwiki xwiki-platform org.xwiki.platform:xwiki-platform-livetable-ui Maven
  • Medium 5.4
    CVE-2023-3982

    Cross-site Scripting (XSS) - Stored in omeka/omeka-s

    Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.

    omeka omeka/omeka-s
  • Medium 6.5
    CVE-2023-3981

    Server-Side Request Forgery (SSRF) in omeka/omeka-s

    Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.

    omeka omeka/omeka-s
  • Medium 5.4
    CVE-2023-3980

    Cross-site Scripting (XSS) - Stored in omeka/omeka-s

    Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.

    omeka omeka/omeka-s
  • Medium 5.3
    CVE-2023-38492

    Kirby vulnerable to denial of service from unlimited password lengths

    Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). The real-world impact of this vulner…

    getkirby kirby getkirby/cms Packagist
  • Medium 5.7
    CVE-2023-38491

    Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

    Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to u…

    getkirby kirby getkirby/cms Packagist
  • Medium 6.8
    CVE-2023-38490 Public exploit

    Kirby XML External Entity (XXE) vulnerability in the XML data handler

    Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plu…

    getkirby kirby getkirby/cms Packagist
  • Medium 6.5
    CVE-2023-37970

    WordPress MF Gig Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Matthew Fries MF Gig Calendar plugin <= 1.2 versions.

    Matthew Fries MF Gig Calendar
  • Medium 5.9
    CVE-2023-37980

    WordPress Custom Field For WP Job Manager Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gravity Master Custom Field For WP Job Manager plugin <= 1.1 versions.

    Gravity Master Custom Field For WP Job Manager
  • Medium 5.9
    CVE-2023-37993

    WordPress wpShopGermany IT-RECHT KANZLEI Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. Stored Cross-Site Scripting (XSS) vulnerability in maennchen1.De wpShopGermany IT-RECHT KANZLEI plugin <= 1.7 versions.

    maennchen1.de wpShopGermany IT-RECHT KANZLEI
  • Medium 5.4
    CVE-2023-38512

    WordPress WpStream plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpstream WpStream wpstream allows Cross Site Request Forgery.This issue affects WpStream: from n/a through <= 4.5.4.

    wpstream WpStream
  • Medium 4.3
    CVE-2023-3957

    ACF Photo Gallery Field <= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update

    The ACF Photo Gallery Field plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient restriction on the 'apg_profile_update' function in versions up to, and including, 1.9. This makes it possible for authenticated attacke…

    navzme ACF Photo Gallery Field Web / CMS
  • Medium 6.1
    CVE-2023-32450

    Dell Power Manager, Versions 3.3 to 3.14 contains an Improper Access Control vulnerability. A low-privileged malicious …

    Dell Dell Power Manager (DPM)