Skip to content
OpenAdvisories

Archive

July 2023

Vulnerabilities first published in this month (UTC), newest first.

← June 2023 2023 / July August 2023 →
  1. 138
  2. 2 
  3. 341
  4. 459
  5. 580
  6. 6204
  7. 758
  8. 824
  9. 98
  10. 10128
  11. 11278
  12. 12239
  13. 13114
  14. 1460
  15. 1512
  16. 1618
  17. 17102
  18. 18149
  19. 1965
  20. 2066
  21. 2169
  22. 2217
  23. 2319
  24. 2457
  25. 2598
  26. 2673
  27. 2775
  28. 2891
  29. 291
  30. 3011
  31. 3164
All Critical High Medium Low Exploited only Public exploit

2,318 results · Feed

  • Medium 5.4
    CVE-2023-37973

    WordPress Replace Word Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in David Pokorny Replace Word plugin <= 2.1 versions.

    David Pokorny Replace Word
  • Medium 4.3
    CVE-2023-37889

    WordPress WPAdmin AWS CDN Plugin <= 2.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPAdmin WPAdmin AWS CDN plugin <= 2.0.13 versions.

    WPAdmin WPAdmin AWS CDN
  • Medium 4.3
    CVE-2023-25036

    WordPress Social Media Icons Widget Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in akhlesh-nagar, a.Ankit Social Media Icons Widget plugin <= 1.6 versions.

    akhlesh-nagar, a.ankit Social Media Icons Widget
  • Medium 5.4
    CVE-2023-37387

    WordPress Classified Listing Plugin <= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme Classified Listing plugin <= 2.4.5 versions.

    RadiusTheme Classified Listing
  • Medium 4.3
    CVE-2022-47169

    WordPress Visibility Logic for Elementor Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StaxWP Visibility Logic for Elementor plugin <= 2.3.4 versions.

    StaxWP Visibility Logic for Elementor
  • Medium 5.4
    CVE-2023-37386

    WordPress Media Library Helper by Codexin Plugin <= 1.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Media Library Helper plugin <= 1.2.0 versions.

  • Medium 4.3
    CVE-2023-25475

    WordPress Smart YouTube PRO Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Smart YouTube PRO plugin <= 4.3 versions.

    Vladimir Prelovac Smart YouTube PRO
  • High 7.5
    CVE-2023-3743

    SQL injection vulnerability in LeoTheme's Ap Page Builder

    Ap Page Builder, in versions lower than 1.7.8.2, could allow a remote attacker to send a specially crafted SQL query to the product_one_img parameter to retrieve the information stored in the database.

    LeoTheme Ap Page Builder
  • Medium 4.3
    CVE-2022-45828

    WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.

    NooTheme Noo Timetable
  • Medium 5.4
    CVE-2022-46857

    WordPress SiteAlert (Formerly WP Health) Plugin <= 1.9.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in SiteAlert plugin <= 1.9.7 versions.

    sitealert SiteAlert
  • Medium 5.4
    CVE-2023-25473

    WordPress Flickr Justified Gallery Plugin <= 3.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Miro Mannino Flickr Justified Gallery plugin <= 3.5 versions.

    miro.mannino Flickr Justified Gallery
  • Medium 4.3
    CVE-2023-25482

    WordPress WP Tiles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mike Martel WP Tiles plugin <= 1.1.2 versions.

    Mike Martel WP Tiles
  • Medium 6.4
    CVE-2023-2433

    YARPP – Yet Another Related Posts Plugin <= 5.30.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The YARPP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'className' parameter in versions up to, and including, 5.30.3 due to insufficient input sanitization and output escaping. This makes it possible for contributor-level attackers t…

    jeffparker YARPP – Yet Another Related Posts Plugin Web / CMS
  • Medium 6.3
    CVE-2015-10122

    wp-donate Plugin donate-display.php sql injection

    A vulnerability was found in wp-donate Plugin up to 1.4 on WordPress. It has been classified as critical. This affects an unknown part of the file includes/donate-display.php. The manipulation leads to sql injection. It is possible to initiate the attack remo…

  • Medium 5.4
    CVE-2023-3403

    ProfileGrid <= 5.5.1 - Missing Authorization to User Import

    The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pm_upload_csv' function in versions up to, and including, 5.5.1. This makes it possible for authenticated attackers, with subscri…

    Metagauss ProfileGrid – User Profiles, Groups and Communities Web / CMS
  • High 7.5
    CVE-2023-3714

    ProfileGrid <= 5.5.2 - Missing Authorization to Arbitrary Group Option Modification and Privilege Escalation

    The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attackers, with group owner…

    Metagauss ProfileGrid – User Profiles, Groups and Communities Web / CMS
  • High 8.8
    CVE-2023-3713

    ProfileGrid <= 5.5.1 - Authenticated (Subscriber+) Arbitrary Option Update

    The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated a…

    Metagauss ProfileGrid – User Profiles, Groups and Communities Web / CMS
  • High 7.2
    CVE-2023-3459

    Export and Import Users and Customers <= 2.4.1 - Missing Authorization to Authenticated (Shop Manager) Arbitrary User Password Change

    The Export and Import Users and Customers plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'hf_update_customer' function called via an AJAX action in versions up to, and including, 2.4.1. This ma…

    WebToffee Export and Import Users and Customers Web / CMS
  • Medium 5.6
    CVE-2023-34143

    Improper Validation of Certificate Vulnerability in Hitachi Device Manager

    Improper Validation of Certificate with Host Mismatch vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Data Collector components) allows Man in the Middle Attack.This issue affects Hitachi Device Man…

    Hitachi Hitachi Device Manager
  • Critical 9.0
    CVE-2023-34142

    Cleartext Transmission Vulnerability in Hitachi Device Manager

    Cleartext Transmission of Sensitive Information vulnerability in Hitachi Device Manager on Windows, Linux (Device Manager Server, Device Manager Agent, Host Data Collector components) allows Interception.This issue affects Hitachi Device Manager: before 8.8.5…

    Hitachi Hitachi Device Manager
  • Medium 5.3
    CVE-2023-3709

    Royal Elementor Addons <=1.3.70 - Unauthenticated MailChimp API Key Disclosure

    The Royal Elementor Addons plugin for WordPress is vulnerable to unauthenticated API key disclosure in versions up to, and including, 1.3.70 due to the plugin adding the API key to the source code of any page running the MailChimp block. This makes it possibl…

    WP Royal Royal Addons for Elementor – Addons and Templates Kit for Elementor Web / CMS
  • Medium 6.1
    CVE-2023-3708

    Multiple DeoThemes Themes <= (Various Versions) - Reflected Cross-Site Scripting

    Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…

    deothemes Nokke Amela Arendelle Web / CMS
  • High 7.3
    CVE-2022-4146

    EL Injection Vulnerability in Hitachi Replication Manager

    Expression Language Injection vulnerability in Hitachi Replication Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Replication Manager: before 8.8.5-02.

    Hitachi Hitachi Replication Manager
  • Medium 6.6
    CVE-2020-36695

    File and Directory Permission Vulnerability in Hitachi Command Suite

    Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hitachi Replication Manager on Linux, Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hi…

    Hitachi Hitachi Device Manager Hitachi Tuning Manager Hitachi Replication Manager
  • Medium 5.9
    CVE-2023-31998

    A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to s…

    Ubiquiti EdgeRouter Aircube Network devices
  • Medium 6.3
    CVE-2021-43072

    A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiAnalyzer version 7.0.2 and be…

    Fortinet FortiManager FortiAnalyzer Network devices
  • Unscored —
    CVE-2020-23909

    Heap-based buffer over-read in function png_convert_4 in file pngex.cc in AdvanceMAME through 2.1.

    advancecomp advancecomp cloop Ubuntu Azure Linux
  • Unscored —
    CVE-2020-23911

    An issue was discovered in asn1c through v0.9.28. A NULL pointer dereference exists in the function _default_error_logg…

    asn1c asn1c Debian Ubuntu
  • Unscored —
    CVE-2020-23910

    Stack-based buffer overflow vulnerability in asn1c through v0.9.28 via function genhash_get in genhash.c.

    asn1c asn1c Debian Ubuntu
  • Unscored —
    CVE-2020-22159

    EVERTZ devices 3080IPX exe-guest-v1.2-r26125, 7801FC 1.3 Build 27, and 7890IXG V494 are vulnerable to Arbitrary File Up…

  • High 7.6
    CVE-2023-33265

    Hazelcast Executor Services don't check client permissions properly

    In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.

    com.hazelcast:hazelcast com.hazelcast:hazelcast-enterprise Maven
  • Unscored —
    CVE-2023-38434 Public exploit

    xHTTP 72f812d has a double free in close_connection in xhttp.c via a malformed HTTP request method.

  • Unscored —
    CVE-2023-36670

    A remotely exploitable command injection vulnerability was found on the Kratos NGC-IDU 9.1.0.4. An attacker can execute…

  • Unscored —
    CVE-2023-36669

    Missing Authentication for a Critical Function within the Kratos NGC Indoor Unit (IDU) before 11.4 allows remote attack…

  • Unscored —
    CVE-2023-31441

    In NATO Communications and Information Agency anet (aka Advisor Network) through 3.3.0, an attacker can provide a craft…

  • Unscored —
    CVE-2023-30383

    TP-LINK Archer C50v2 Archer C50(US)_V2_160801, TP-LINK Archer C20v1 Archer_C20_V1_150707, and TP-LINK Archer C2v1 Arche…

  • Critical 9.8
    CVE-2023-30153

    An SQL injection vulnerability in the Payplug (payplug) module for PrestaShop, in versions 3.6.0, 3.6.1, 3.6.2, 3.6.3, …

  • Unscored —
    CVE-2023-37141

    ChakraCore branch master cbb9b was discovered to contain a segmentation violation via the function Js::ProfilingHelpers…

  • Unscored —
    CVE-2023-37139

    ChakraCore branch master cbb9b was discovered to contain a stack overflow vulnerability via the function Js::ScopeSlots…

  • Unscored —
    CVE-2023-37758

    D-LINK DIR-815 v1.01 was discovered to contain a buffer overflow via the component /web/captcha.cgi.