Skip to content
OpenAdvisories

Archive

8 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /8 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

70 results · Clear filters · Feed

  • Medium 5.9
    CVE-2023-25984

    WordPress Dovetail Plugin <= 1.2.13 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Rigorous & Factory Pattern Dovetail plugin <= 1.2.13 versions.

    Rigorous & Factory Pattern Dovetail
  • Medium 6.5
    CVE-2022-45821

    WordPress NOO Timetable Plugin <= 2.1.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NooTheme Noo Timetable plugin <= 2.1.3 versions.

    NooTheme Noo Timetable
  • Medium 5.9
    CVE-2023-27415

    WordPress LetterPress Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Themeqx LetterPress plugin <= 1.1.2 versions.

    themeqx LetterPress
  • Medium 5.9
    CVE-2023-25063

    WordPress Quick Page/Post Redirect Plugin <= 5.2.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anadnet Quick Page/Post Redirect Plugin plugin <= 5.2.3 versions.

    Anadnet Quick Page/Post Redirect Plugin
  • Medium 6.5
    CVE-2023-23829

    WordPress Owl Carousel Plugin <= 0.5.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pierre JEHAN Owl Carousel plugin <= 0.5.3 versions.

    Pierre JEHAN Owl Carousel
  • Medium 6.5
    CVE-2023-23877

    WordPress Pinterest RSS Widget Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in bkmacdaddy designs Pinterest RSS Widget plugin <= 2.3.1 versions.

    bkmacdaddy designs Pinterest RSS Widget
  • Medium 6.5
    CVE-2023-23880

    WordPress ExactMetrics Plugin <= 7.14.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in ExactMetrics plugin <= 7.14.1 versions.

    ExactMetrics ExactMetrics
  • Medium 5.9
    CVE-2023-25459

    WordPress Post Snippets Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Postsnippets Post Snippets plugin <= 4.0.2 versions.

    Post Snippets Post Snippets
  • Medium 6.5
    CVE-2023-29099

    WordPress Divi Theme <= 4.20.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Elegant themes Divi theme <= 4.20.2 versions.

    Elegant Themes Divi
  • Medium 5.9
    CVE-2023-27416

    WordPress Decon WP SMS Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Decon Digital Decon WP SMS plugin <= 1.1 versions.

    Decon Digital Decon WP SMS
  • Medium 5.9
    CVE-2023-27422

    WordPress NS Coupon to Become Customer Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in NsThemes NS Coupon To Become Customer plugin <= 1.2.2 versions.

    nsthemes NS Coupon To Become Customer
  • Medium 5.9
    CVE-2023-36692

    WordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Christian Kramer & Hendrik Thole WP-Cirrus plugin <= 0.6.11 versions.

    Christian Kramer & Hendrik Thole WP-Cirrus
  • Medium 5.3
    CVE-2023-37373

    A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications accept unaut…

    Siemens RUGGEDCOM CROSSBOW ICS / OT
  • Medium 6.7
    CVE-2023-28577

    Multiple Dmabuf Kernel Address UAF Vulnerability

    In the function call related to CAM_REQ_MGR_RELEASE_BUF there is no check if the buffer is being used. So when a function called cam_mem_get_cpu_buf to get the kernel va to use, another thread can call CAM_REQ_MGR_RELEASE_BUF to unmap the kernel va which caus…

    Qualcomm Snapdragon
  • Medium 6.4
    CVE-2023-28576

    Time-of-check Time-of-use (TOCTOU) Race Condition in Camera Kernel Driver

    The buffer obtained from kernel APIs such as cam_mem_get_cpu_buf() may be readable/writable in userspace after kernel accesses it. In other words, user mode may race and modify the packet header (e.g. header.count), causing checks (e.g. size checks) in kernel…

    Qualcomm Snapdragon
  • Medium 6.7
    CVE-2023-28575

    Multiple Type Confusion Vulnerability

    The cam_get_device_priv function does not check the type of handle being returned (device/session/link). This would lead to invalid type usage if a wrong handle is passed to it.

    Qualcomm Snapdragon
  • Medium 6.7
    CVE-2023-21650

    Improper Validation of Array Index in GPS HLOS Driver

    Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.

    Qualcomm Snapdragon
  • Medium 6.7
    CVE-2023-21649

    Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN

    Memory corruption in WLAN while running doDriverCmd for an unspecific command.

    Qualcomm Snapdragon
  • Medium 6.7
    CVE-2023-21648

    Integer Overflow to Buffer Overflow in RIL

    Memory corruption in RIL while trying to send apdu packet.

    Qualcomm Snapdragon
  • Medium 6.5
    CVE-2023-21647

    Improper Input Validation in Bluetooth HOST

    Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.

    Qualcomm Snapdragon
  • Medium 6.7
    CVE-2023-21627

    Incorrect Type Conversion or Cast in Trusted Execution Environment

    Memory corruption in Trusted Execution Environment while calling service API with invalid address.

    Qualcomm Snapdragon
  • Medium 4.9
    CVE-2023-3569

    PHOENIX CONTACT: Denial-of-Service due to malicious XML files in TC ROUTER, TC CLOUD CLIENT and CLOUD CLIENT

    In PHOENIX CONTACTs TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 as well as CLOUD CLIENT 1101T-TX/TX prior to 2.06.10 an authenticated remote attacker with admin privileges could upload a crafted XML file which causes a denial-of-service.

    Phoenix Contact TC ROUTER 3002T-4G TC ROUTER 3002T-4G ATT TC CLOUD CLIENT 1002-4G ATT ICS / OT
  • Medium 5.9
    CVE-2023-37486

    Information Disclosure vulnerability in SAP Commerce (OCC API)

    Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidential…

    SAP SAP Commerce (OCC API)
  • Medium 4.4
    CVE-2023-39440

    Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform

    In SAP BusinessObjects Business Intelligence - version 420, If a user logs in to a particular program, under certain specific conditions memory might not be cleared up properly, due to which attacker might be able to get access to user credentials. For a succ…

    SAP SAP BusinessObjects Business Intelligence
  • Medium 5.8
    CVE-2023-39436

    Information Disclosure in SAP Supplier Relationship Management

    SAP Supplier Relationship Management -versions 600, 602, 603, 604, 605, 606, 616, 617, allows an unauthorized attacker to discover information relating to SRM within Vendor Master Data for Business Partners replication functionality.This information could be …

    SAP SAP Supplier Relationship Management
  • Medium 4.9
    CVE-2023-37492

    Missing Authorization check in SAP NetWeaver AS ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP and ABAP Platform - versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 75…

    SAP SAP NetWeaver AS ABAP and ABAP Platform
  • Medium 6.1
    CVE-2023-37488

    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Process Integration

    In SAP NetWeaver Process Integration - versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, user-controlled inputs, if not sufficiently encoded, could result in Cross-Site Scripting (XSS) attack. On successful exploitation the attacker can cause limited i…

    SAP SAP NetWeaver Process Integration
  • Medium 5.3
    CVE-2023-37487

    Security misconfiguration vulnerability in SAP Business One (Service Layer)

    SAP Business One (Service Layer) - version 10.0, allows an authenticated attacker with deep knowledge perform certain operation to access unintended data over the network which could lead to high impact on confidentiality with no impact on integrity and avail…

    SAP SAP Business One (Service Layer)
  • Medium 5.3
    CVE-2023-37484

    Information Disclosure Vulnerabilities in SAP PowerDesigner

    SAP PowerDesigner - version 16.7, queries all password hashes in the backend database and compares it with the user provided one during login attempt, which might allow an attacker to access password hashes from the client's memory.

    SAP SAP PowerDesigner
  • Medium 5.4
    CVE-2023-38758

    wger Workout Manager Cross-site Scripting vulnerability

    Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function in the templates/ingredients/view.html, models/ingredients.py, and views/…

    wger PyPI