Skip to content
OpenAdvisories

Archive

18 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /18 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

59 results · Feed

  • Medium 6.5
    CVE-2023-40037 Public exploit

    Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs

    Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jms-processors org.apache.nifi:nifi-dbcp-base Maven
  • Medium 6.5
    CVE-2023-40172

    Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton

    Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on…

    fobybus social-media-skeleton
  • High 7.5
    CVE-2023-40173

    Unsalted passwords in fobybus/social-media-skeleton

    Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Prior to version 1.0.5 Social media skeleton did not properly salt passwords leaving user passwords susceptible to cracking should an att…

    fobybus social-media-skeleton
  • Medium 6.8
    CVE-2023-40174

    Insufficient Session Expiration in fobybus/social-media-skeleton

    Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage t…

    fobybus social-media-skeleton
  • High 7.3
    CVE-2023-40175

    Inconsistent Interpretation of HTTP Requests in puma

    Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Sever…

    puma puma puma puma Debian Ubuntu RubyGems
  • High 7.5
    CVE-2023-20212

    A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of ser…

    Cisco Cisco Secure Endpoint clamav Network devices Debian
  • Medium 6.8
    CVE-2023-4422

    Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

    Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

    cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  • High 7.3
    CVE-2023-4415 Scanner template EPSS 58%

    Ruijie RG-EW1200G login improper authentication

    A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may be launched remotel…

    Ruijie RG-EW1200G
  • Medium 6.3
    CVE-2023-4414

    Byzoro Smart S85F Management Platform decodmail.php command injection

    A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to comm…

    Byzoro Smart S85F Management Platform
  • Medium 5.8
    CVE-2023-32122

    WordPress Spiffy Calendar Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <= 4.9.3 versions.

    Spiffy Plugins Spiffy Calendar
  • Medium 5.9
    CVE-2023-32130

    WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.

    Daniel Powney Multi Rating
  • Medium 6.5
    CVE-2023-29387

    WordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Crego Manager for Icomoon plugin <= 2.0 versions.

    Julien Crego Manager for Icomoon
  • High 7.1
    CVE-2023-32109

    WordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6.3 versions.

    Ignazio Scimone Albo Pretorio On line
  • High 7.1
    CVE-2023-30499

    WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FolioVision FV Flowplayer Video Player plugin <= 7.5.32.7212 versions.

    foliovision FV Flowplayer Video Player
  • Medium 6.3
    CVE-2023-4412

    TOTOLINK EX1200L setWanCfg os command injection

    A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed…

    Toto Link EX1200L
  • High 7.1
    CVE-2023-32108

    WordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ignazio Scimone Albo Pretorio On line plugin <= 4.6.3 versions.

    Ignazio Scimone Albo Pretorio On line
  • Medium 6.3
    CVE-2023-4411

    TOTOLINK EX1200L setTracerouteCfg os command injection

    A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to os command injection. The attack can be initiated remotely. The exploi…

    Toto Link EX1200L
  • Medium 6.3
    CVE-2023-4410

    TOTOLINK EX1200L setDiagnosisCfg os command injection

    A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit …

    Toto Link EX1200L
  • High 7.1
    CVE-2023-32107

    WordPress Photo Gallery by Ays Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.1.3 versions.

    Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery
  • High 7.1
    CVE-2023-32106

    WordPress WP Docs Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fahad Mahmood WP Docs plugin <= 1.9.9 versions.

    Fahad Mahmood WP Docs
  • High 7.1
    CVE-2023-32105

    WordPress WPPizza Plugin <= 3.17.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ollybach WPPizza – A Restaurant Plugin plugin <= 3.17.1 versions.

    ollybach WPPizza – A Restaurant Plugin
  • Medium 6.5
    CVE-2023-32103

    WordPress TP Education Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Theme Palace TP Education plugin <= 4.4 versions.

    Theme Palace TP Education
  • High 7.1
    CVE-2023-31218

    WordPress WOLF Plugin <= 1.0.6 is vulnerable to CSRF leading to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.6 versions.

    RealMag777 WOLF – WordPress Posts Bulk Editor and Manager Professional Web / CMS
  • Medium 5.9
    CVE-2023-31232

    WordPress Plugins List Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Artiss Plugins List plugin <= 2.5 versions.

    David Artiss Plugins List
  • Medium 6.3
    CVE-2023-4409

    NBS&HappySoftWeChat unrestricted upload

    A vulnerability, which was classified as critical, has been found in NBS&HappySoftWeChat 1.1.6. Affected by this issue is some unknown functionality. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disc…

  • Medium 6.3
    CVE-2023-4407 Public exploit

    Codecanyon Credit Lite POST Request account_statement sql injection

    A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument …

    CodeCanyon Credit Lite
  • Medium 5.9
    CVE-2023-31228

    WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.

    CreativeMindsSolutions CM On Demand Search And Replace
  • High 7.1
    CVE-2023-31094

    WordPress Stock Sync for WooCommerce Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Lauri Karisola / WP Trio Stock Sync for WooCommerce plugin <= 2.4.0 versions.

    Lauri Karisola / WP Trio Stock Sync for WooCommerce Web / CMS
  • Unscored —
    RUSTSEC-2023-0110

    `postgresderive` was removed from crates.io for malicious code

    This crate was part of a typosquatting malware cluster published by the malicious user `amaperf` and contained a malware payload in `build.rs` to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. …

    postgresderive crates.io
  • High 8.8
    CVE-2023-40072

    OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute …

    ELECOM WAB-I1750-PS WAB-S1775 WAB-M1775-PS
  • Critical 9.8
    CVE-2023-40069

    OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to exec…

    ELECOM WRC-1750GHBK WRC-F1167ACF WRC-1750GHBK2-I
  • Unscored —
    CVE-2023-39944

    OS command injection vulnerability in WRC-F1167ACF all versions, and WRC-1750GHBK all versions allows an attacker who c…

    ELECOM WRC-F1167ACF WRC-1750GHBK
  • Unscored —
    CVE-2023-39455

    OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary …

    ELECOM WRC-1467GHBK-A WRC-F1167ACF2 WRC-733FEBK2-A
  • High 8.8
    CVE-2023-39454

    Buffer overflow vulnerability exists in ELECOM wireless LAN routers, which may allow an unauthenticated attacker to exe…

    ELECOM WMC-X1800GST-B WRC-X1800GSH-B WRC-X6000QSA-G
  • Unscored —
    CVE-2023-39445

    Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthentica…

    LOGITEC LAN-WH300N/RE
  • Unscored —
    CVE-2023-38576

    Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an authenticate…

    LOGITEC LAN-WH300N/RE
  • Unscored —
    CVE-2023-38132

    LAN-W451NGR all versions provided by LOGITEC CORPORATION contains an improper access control vulnerability, which allow…

    LOGITEC LAN-W451NGR
  • High 8.8
    CVE-2023-35991

    Hidden functionality vulnerability in LOGITEC wireless LAN routers allows an unauthenticated attacker to log in to the …

    LOGITEC LAN-W300N/DR LAN-W300N/P LAN-WH300AN/DGP
  • Unscored —
    CVE-2023-32626

    Hidden functionality vulnerability in LAN-W300N/RS all versions, and LAN-W300N/PR5 all versions allows an unauthenticat…

    LOGITEC LAN-W300N/RS LAN-W300N/PR5
  • Unscored —
    CVE-2023-39416

    Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail …

    North Grid Proself Gateway Edition Proself Enterprise/Standard Edition Proself Mail Sanitize Edition