Skip to content
OpenAdvisories

Archive

18 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /18 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-40037 Public exploit

    Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs

    Apache NiFi 1.21.0 through 1.23.0 support JDBC and JNDI JMS access in several Processors and Controller Services with connection URL validation that does not provide sufficient protection against crafted inputs. An authenticated and authorized user can bypass…

    Apache Software Foundation Apache NiFi org.apache.nifi:nifi-jms-processors org.apache.nifi:nifi-dbcp-base Maven
  • Medium 6.5
    CVE-2023-40172

    Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton

    Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. A Cross-site request forgery (CSRF) attack is a type of malicious attack whereby an attacker tricks a victim into performing an action on…

    fobybus social-media-skeleton
  • Medium 6.8
    CVE-2023-40174

    Insufficient Session Expiration in fobybus/social-media-skeleton

    Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage t…

    fobybus social-media-skeleton
  • Medium 6.8
    CVE-2023-4422

    Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

    Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

    cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  • Medium 6.3
    CVE-2023-4414

    Byzoro Smart S85F Management Platform decodmail.php command injection

    A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to comm…

    Byzoro Smart S85F Management Platform
  • Medium 5.8
    CVE-2023-32122

    WordPress Spiffy Calendar Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <= 4.9.3 versions.

    Spiffy Plugins Spiffy Calendar
  • Medium 5.9
    CVE-2023-32130

    WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.

    Daniel Powney Multi Rating
  • Medium 6.5
    CVE-2023-29387

    WordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Crego Manager for Icomoon plugin <= 2.0 versions.

    Julien Crego Manager for Icomoon
  • Medium 6.3
    CVE-2023-4412

    TOTOLINK EX1200L setWanCfg os command injection

    A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed…

    Toto Link EX1200L
  • Medium 6.3
    CVE-2023-4411

    TOTOLINK EX1200L setTracerouteCfg os command injection

    A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to os command injection. The attack can be initiated remotely. The exploi…

    Toto Link EX1200L
  • Medium 6.3
    CVE-2023-4410

    TOTOLINK EX1200L setDiagnosisCfg os command injection

    A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit …

    Toto Link EX1200L
  • Medium 6.5
    CVE-2023-32103

    WordPress TP Education Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Theme Palace TP Education plugin <= 4.4 versions.

    Theme Palace TP Education
  • Medium 5.9
    CVE-2023-31232

    WordPress Plugins List Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Artiss Plugins List plugin <= 2.5 versions.

    David Artiss Plugins List
  • Medium 6.3
    CVE-2023-4409

    NBS&HappySoftWeChat unrestricted upload

    A vulnerability, which was classified as critical, has been found in NBS&HappySoftWeChat 1.1.6. Affected by this issue is some unknown functionality. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disc…

  • Medium 6.3
    CVE-2023-4407 Public exploit

    Codecanyon Credit Lite POST Request account_statement sql injection

    A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument …

    CodeCanyon Credit Lite
  • Medium 5.9
    CVE-2023-31228

    WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 5.9
    CVE-2023-30875

    WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in All My Web Needs Logo Scheduler plugin <= 1.2.0 versions.

    All My Web Needs Logo Scheduler
  • Medium 5.3
    CVE-2023-4040

    The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due t…

    WebToffee Stripe Payment Plugin for WooCommerce Web / CMS