Skip to content
OpenAdvisories

Archive

30 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /30 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

32 results · Clear filters · Feed

  • High 8.6
    CVE-2023-3489

    firmwaredownload command could log servers passwords in clear text

    The firmwaredownload command on Brocade Fabric OS v9.2.0 could log the FTP/SFTP/SCP server password in clear text in the SupportSave file when performing a downgrade from Fabric OS v9.2.0 to any earlier version of Fabric OS.

    Brocade Fabric OS
  • High 8.3
    CVE-2023-41039

    Sandbox escape via various forms of "format" in RestrictedPython

    RestrictedPython is a restricted execution environment for Python to run untrusted code. Python's "format" functionality allows someone controlling the format string to "read" all objects accessible through recursive attribute lookup and subscription from obj…

    zopefoundation RestrictedPython restrictedpython restrictedpython Debian Ubuntu PyPI
  • High 7.8
    CVE-2023-40597

    Absolute Path Traversal in Splunk Enterprise Using runshellscript.py

    In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can exploit an absolute path traversal to execute arbitrary code that is located on a separate disk.

    Splunk Splunk Enterprise Splunk Cloud
  • High 7.0
    CVE-2023-40596

    Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL

    In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path for the OPENSSLDIR build definition. An attacker can abuse this reference and subsequently install …

    Splunk Splunk Enterprise
  • High 8.6
    CVE-2023-4571

    Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)

    In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor can inject American National Standards Institute (ANSI) escape codes into Splunk ITSI log files that, when a vulnerable terminal application reads them,…

    Splunk Splunk ITSI
  • High 8.4
    CVE-2023-40592

    Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint

    In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting (XSS) on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execu…

    Splunk Splunk Enterprise Splunk Cloud
  • High 8.8
    CVE-2023-40595

    Remote Code Execution via Serialized Session Payload

    In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they can then use to serialize untrusted data. The attacker can use the query to execute arbitrary code.

    Splunk Splunk Enterprise Splunk Cloud
  • High 8.5
    CVE-2023-40598

    Command Injection in Splunk Enterprise Using External Lookups

    In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker can create an external lookup that calls a legacy internal function. The attacker can use this internal function to insert code into the Splunk platform installation directory. From the…

    Splunk Splunk Enterprise Splunk Cloud
  • High 7.1
    CVE-2023-25471

    WordPress WCP OpenWeather Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webcodin WCP OpenWeather plugin <= 2.5.0 versions.

    WebCodin WCP OpenWeather
  • High 7.1
    CVE-2023-25453

    WordPress WordPress Tables Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ian Sadovy WordPress Tables plugin <= 1.3.9 versions.

    Ian Sadovy WordPress Tables Web / CMS
  • High 7.1
    CVE-2023-34008

    WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in weDevs WP ERP plugin <= 1.12.3 versions.

    wedevs WP ERP
  • High 7.1
    CVE-2023-34022

    WordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rakib Hasan Dynamic QR Code Generator plugin <= 0.0.5 versions.

    Rakib Hasan Dynamic QR Code Generator
  • High 7.1
    CVE-2023-34023

    WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Miled WordPress Social Login plugin <= 3.0.4 versions.

    miled WordPress Social Login Web / CMS
  • High 7.1
    CVE-2023-34032

    WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.

    Pascal Casier bbPress Toolkit
  • High 7.1
    CVE-2023-34174

    WordPress BBS e-Popup Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in BBS e-Theme BBS e-Popup plugin <= 2.4.5 versions.

    BBS e-Theme BBS e-Popup
  • High 7.1
    CVE-2023-34180

    WordPress Google Fonts For WordPress Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in KAPlugins Google Fonts For WordPress plugin <= 3.0.0 versions.

    KAPlugins Google Fonts For WordPress Web / CMS
  • High 7.1
    CVE-2023-34175

    WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GrandSlambert Login Configurator plugin <= 2.1 versions.

    GrandSlambert Login Configurator
  • High 7.1
    CVE-2023-34176

    WordPress Chilexpress woo oficial Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Chilexpress Chilexpress woo oficial plugin <= 1.2.9 versions.

    Chilexpress Chilexpress woo oficial
  • High 7.1
    CVE-2023-34184

    WordPress Woocommerce Order address Print Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Bhavik Patel Woocommerce Order address Print plugin <= 3.2 versions.

    Bhavik Patel Woocommerce Order address Print Web / CMS
  • High 7.1
    CVE-2023-33320

    WordPress WP-Hijri Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mohammad I. Okfie WP-Hijri plugin <= 1.5.1 versions.

    Mohammad I. Okfie WP-Hijri
  • High 7.1
    CVE-2023-33325

    WordPress Leyka Plugin <= 3.30.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.30.1 versions.

    Teplitsa of social technologies Leyka
  • High 7.1
    CVE-2023-33317

    WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Returns and Warranty Requests plugin <= 2.1.6 versions.

    woocommerce Returns and Warranty Requests
  • High 7.1
    CVE-2023-25019

    WordPress Chaty Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Premio Chaty plugin <= 3.0.9 versions

    Premio Chaty
  • High 7.1
    CVE-2023-32597

    WordPress Video Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Gallery plugin <= 1.0.10 versions.

    I Thirteen Web Solution Video Gallery
  • High 7.1
    CVE-2023-32802

    WordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 1.9.0 versions.

    woocommerce WooCommerce Pre-Orders Web / CMS
  • High 7.1
    CVE-2023-32801

    WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WooCommerce Composite Products plugin <= 8.7.5 versions.

    woocommerce Composite Products
  • High 7.1
    CVE-2023-32742

    WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS plugin <= 6.1.4 versions.

    VeronaLabs WP SMS
  • High 7.2
    CVE-2023-3136

    MailArchiver <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject

    The MailArchiver plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t…

    Pierre Lannoy MailArchiver Web / CMS
  • High 7.8
    CVE-2023-39137

    Filename spoofing in archive

    An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

    archive Pub
  • High 7.8
    CVE-2023-39138

    Path traversal in ZIPFoundation

    An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.

    github.com/weichsel/ZIPFoundation SwiftURL
  • High 7.8
    CVE-2023-39139

    Path traversal in Archive

    An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.

    archive Pub
  • High 7.8
    CVE-2023-39135

    Path traversal in Zip Swift

    An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry.

    github.com/marmelroy/Zip SwiftURL