Skip to content
OpenAdvisories

Archive

5 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /5 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

26 results · Feed

  • Medium 6.5
    CVE-2023-32600

    WordPress Rank Math SEO Plugin <= 1.0.119 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rank Math SEO plugin <= 1.0.119 versions.

    Rank Math Rank Math SEO
  • Medium 4.3
    CVE-2023-4172

    Chengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx absolute path traversal

    A vulnerability, which was classified as problematic, has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This issue affects some unknown processing of the file \Service\FileHandler.ashx. The manipulation of the argument FileDire…

    Chengdu Flash Flood Disaster Monitoring and Warning System
  • Medium 5.8
    CVE-2023-34010

    WordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in submodule of David Lingren Media Library Assistant plugin  <= 3.0.7 versions.

    David Lingren Media LIbrary Assistant
  • Medium 5.9
    CVE-2023-34377

    WordPress My Content Management Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Joseph C Dolson My Content Management plugin <= 1.7.6 versions.

    Joseph C Dolson My Content Management
  • Medium 5.9
    CVE-2023-36678

    WordPress WP Content Copy Protection & No Right Click Plugin <= 3.5.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP-buy WP Content Copy Protection & No Right Click plugin <= 3.5.5 versions.

    wp-buy WP Content Copy Protection & No Right Click
  • High 7.1
    CVE-2023-30491

    WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.8 versions.

    CodeBard CodeBard's Patron Button and Widgets for Patreon
  • High 7.1
    CVE-2023-36686

    WordPress CartFlows Pro Plugin <= 1.11.11 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in CartFlows Pro plugin <= 1.11.11 versions.

    CartFlows CartFlows Pro
  • High 7.1
    CVE-2023-36689

    WordPress WPFactory Helper Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory WPFactory Helper plugin <= 1.5.2 versions.

    WPFactory WPFactory Helper
  • High 7.1
    CVE-2023-37873

    WordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Shipping Multiple Addresses plugin <= 3.8.5 versions.

    woocommerce Shipping Multiple Addresses
  • Medium 5.9
    CVE-2023-37874

    WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dimitar Ivanov HTTP Headers plugin <= 1.18.11 versions.

    Dimitar Ivanov HTTP Headers
  • Medium 4.3
    CVE-2023-4171

    Chengdu Flash Flood Disaster Monitoring and Warning System FileDownload.ashx path traversal

    A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file \Service\FileDownload.ashx. The manipulation of the argument Files leads to path travers…

    Chengdu Flash Flood Disaster Monitoring and Warning System
  • Medium 4.8
    CVE-2023-4189

    Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

    Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Critical 9.8
    CVE-2023-4188

    SQL Injection in instantsoft/icms2

    SQL Injection in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Low 3.5
    CVE-2023-4170

    DedeBIZ Article cross site scripting

    A vulnerability was found in DedeBIZ 6.2.10. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Article Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The expl…

  • Medium 6.3
    CVE-2023-4169 Public exploit Scanner template EPSS 48%

    Ruijie RG-EW1200G Administrator Password set_passwd access control

    A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /api/sys/set_passwd of the component Administrator Password Handler. The manipulation leads to …

    Ruijie RG-EW1200G
  • Medium 4.3
    CVE-2023-4168 Public exploit Scanner template EPSS 46%

    Templatecookie Adlisting Redirect ad-list information disclosure

    A vulnerability was found in Templatecookie Adlisting 2.14.0. It has been classified as problematic. Affected is an unknown function of the file /ad-list of the component Redirect Handler. The manipulation leads to information disclosure. It is possible to la…

    Templatecookie Adlisting
  • Low 3.5
    CVE-2023-4187

    Cross-site Scripting (XSS) - Stored in instantsoft/icms2

    Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Low 3.5
    CVE-2023-4167

    Media Browser Emby Server cross site scripting

    A vulnerability was found in Media Browser Emby Server 4.7.13.0 and classified as problematic. This issue affects some unknown processing of the file /web/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has …

    Media Browser Emby Server
  • Medium 5.5
    CVE-2023-4166 Public exploit EPSS 12%

    Tongda OA delete_log.php sql injection

    A vulnerability has been found in Tongda OA and classified as critical. This vulnerability affects unknown code of the file general/system/seal_manage/dianju/delete_log.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has b…

    Tongda OA
  • Medium 5.5
    CVE-2023-4165 Public exploit EPSS 12%

    Tongda OA delete_seal.php sql injection

    A vulnerability, which was classified as critical, was found in Tongda OA. This affects an unknown part of the file general/system/seal_manage/iweboffice/delete_seal.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been…

    Tongda OA
  • High 8.8
    CVE-2023-39508

    Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges

    Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. I…

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Unscored —
    CVE-2020-23564

    File Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via SEMCMS_Upfile.php.

  • Unscored —
    CVE-2023-33367

    A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to w…

  • Unscored —
    CVE-2023-38943

    ShuiZe_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via the component /iniFile/c…

  • Critical 9.8
    CVE-2023-36095

    langchain Code Injection vulnerability

    An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include from_math_prompt and from_colored_object_prompt.

    langchain PyPI
  • Unscored —
    CVE-2022-46782

    An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Cl…