Skip to content
OpenAdvisories

Archive

31 July 2023

Vulnerabilities first published on this day (UTC), newest first.

← June 2023 2023 / July /31 August 2023 →
  1. 138
  2. 2 
  3. 341
  4. 459
  5. 580
  6. 6204
  7. 758
  8. 824
  9. 98
  10. 10128
  11. 11278
  12. 12239
  13. 13114
  14. 1460
  15. 1512
  16. 1618
  17. 17102
  18. 18149
  19. 1965
  20. 2066
  21. 2169
  22. 2217
  23. 2319
  24. 2457
  25. 2598
  26. 2673
  27. 2775
  28. 2891
  29. 291
  30. 3011
  31. 3164
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-3462

    Vault's LDAP Auth Method Allows for User Enumeration

    HashiCorp's Vault and Vault Enterprise are vulnerable to user enumeration when using the LDAP auth method. An attacker may submit requests of existent and non-existent LDAP users and observe the response from Vault to check if the account is valid on the LDAP…

    HashiCorp Vault Enterprise Vault k3d Wolfi Go
  • Medium 5.4
    GHSA-4q66-g4mm-8rg5

    Silverstripe has Cross-site Scripting (XSS) vulnerabilities inherited from TinyMCE

    TinyMCE 4.x is vulnerable to several XSS vectors, which had been patched in later versions. Two of these have been identified as affecting `silverstripe/admin`. Only Silverstripe CMS 4 is affected by this issue. It's not possible to upgrade Silverstripe CMS 4…

    silverstripe/admin Packagist
  • Medium 5.3
    CVE-2023-3817

    Excessive time spent checking DH q parameter value

    Issue summary: Checking excessively long DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_check(), DH_check_ex() or EVP_PKEY_param_check() to check a DH key or DH parameters may experience long delays. Where the k…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.5
    CVE-2023-3507

    WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRF

    The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could allow attackers to make logged in admins cancel arbitrary pre-orders via a CSRF attack

    Web / CMS
  • Medium 6.5
    CVE-2023-3508

    WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRF

    The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which could allow attackers to make logged in admins email pre-orders customer, change the released date, mark all pre-orders of a specific produ…

    Web / CMS
  • Medium 6.1
    CVE-2023-3292

    Grid Kit Premium < 2.2.0 - Multiple Reflected Cross-Site Scripting

    The grid-kit-premium WordPress plugin before 2.2.0 does not escape some parameters as well as generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin

    Web / CMS
  • Medium 6.5
    CVE-2022-4888

    Multiple Plugins from Addify - Multiple CSRF

    The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builde…

    Web / CMS
  • Medium 4.3
    CVE-2020-4868

    IBM TRIRIGA information disclosure

    IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 190744.

    IBM TRIRIGA Application Platform
  • Medium 5.4
    CVE-2023-22595

    IBM B2B Advanced Communication cross-site scripting

    IBM B2B Advanced Communications 1.0.0.0 and IBM Multi-Enterprise Integration Gateway 1.0.0.1 are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality pote…

    IBM B2B Advanced Communications Multi-Enterprise Integration Gateway
  • Medium 6.5
    CVE-2023-35016

    IBM Security Verify Governance path traversal

    IBM Security Verify Governance, Identity Manager 10.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM …

    IBM Security Verify Governance Identity Manager
  • Medium 5.5
    CVE-2023-34872

    A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) …

    poppler poppler Debian Ubuntu
  • Medium 6.1
    CVE-2023-35791

    Vound Intella Connect 2.6.0.3 has an Open Redirect vulnerability.

  • Medium 5.4
    CVE-2023-35792

    Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS).

  • Medium 6.1
    CVE-2023-37580 Exploited Scanner template EPSS 49%

    Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

    KEV Jul 27, 2023