Skip to content
OpenAdvisories

Archive

31 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /31 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

104 results · Feed

  • Medium 4.3
    CVE-2023-0689

    Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcode

    The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the 'mf_first_name' shortcode in versions up to, and including, 3.3.1. This allows authenticated attackers, with subscriber-level capabilities or above to obt…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor
  • High 8.8
    CVE-2023-2229

    Quick Post Duplicator <= 2.0 - Authenticated (Contributor+) SQL Injection via post_id

    The Quick Post Duplicator for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. …

    rahulsingh74388 Quick Post Duplicator
  • Medium 4.3
    CVE-2023-4245

    WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposure

    The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscribers to view arbitrar…

    Edgar Rojas PDF Builder for WooCommerce. Create invoices,packing slips and more Web / CMS
  • Medium 6.3
    CVE-2023-3999

    Waiting: One-click countdowns <= 0.6.2 - Missing Authorization

    The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to, and including, 0.6.2. This makes it possible for authenticated attackers, with subscriber-level …

    pluginbuilders Waiting: One-click countdowns Web / CMS
  • High 8.1
    CVE-2023-31424

    Web authentication and authorization bypass

    Brocade SANnav Web interface before Brocade SANnav v2.3.0 and v2.2.2a allows remote unauthenticated users to bypass web authentication and authorization.

    Brocade SANnav
  • Medium 5.7
    CVE-2023-31423

    Possible information exposure through log file vulnerability

    Possible information exposure through log file vulnerability where sensitive fields are recorded in the configuration log without masking on Brocade SANnav before v2.3.0 and 2.2.2a. Notes: To access the logs, the local attacker must have access to an already …

    Brocade SANnav
  • Medium 5.4
    CVE-2023-31925

    Storage of clear text password in Brocade SANnav

    Brocade SANnav before v2.3.0 and v2.2.2a stores SNMPv3 Authentication passwords in plaintext. A privileged user could retrieve these credentials with knowledge and access to these log files. SNMP credentials could be seen in SANnav SupportSave if the capture …

    Brocade Brocade SANnav
  • Medium 4.4
    CVE-2023-4162

    Segmentation fault in Brocade Fabric OS after Brocade Fabric OS v9.0

    A segmentation fault can occur in Brocade Fabric OS after Brocade Fabric OS v9.0 and before Brocade Fabric OS v9.2.0a through the passwdcfg command. This could allow an authenticated privileged user local user to crash a Brocade Fabric OS swith using the cli …

    Brocade Fabric OS
  • Medium 4.4
    CVE-2023-4163

    Possible buffer overflow in portcfgfportbuffers in Brocade Fabric OS

    In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large input to buffers in the portcfgfportbuffers command.

    Brocade Brocade Fabric OS
  • Low 2.6
    CVE-2023-4654

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository instantsoft/icms2 prior to 2.16.1.

    instantsoft instantsoft/icms2
  • Medium 4.3
    CVE-2023-4655

    Cross-site Scripting (XSS) - Reflected in instantsoft/icms2

    Cross-site Scripting (XSS) - Reflected in GitHub repository instantsoft/icms2 prior to 2.16.1.

    instantsoft instantsoft/icms2
  • Medium 6.4
    CVE-2023-4651

    Server-Side Request Forgery (SSRF) in instantsoft/icms2

    Server-Side Request Forgery (SSRF) in GitHub repository instantsoft/icms2 prior to 2.16.1.

    instantsoft instantsoft/icms2
  • Medium 4.7
    CVE-2023-4650

    Improper Access Control in instantsoft/icms2

    Improper Access Control in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Medium 6.8
    CVE-2023-4652

    Cross-site Scripting (XSS) - Stored in instantsoft/icms2

    Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Medium 4.3
    CVE-2023-4649

    Session Fixation in instantsoft/icms2

    Session Fixation in GitHub repository instantsoft/icms2 prior to 2.16.1.

    instantsoft instantsoft/icms2
  • Medium 5.9
    CVE-2023-4653

    Cross-site Scripting (XSS) - Stored in instantsoft/icms2

    Cross-site Scripting (XSS) - Stored in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • Medium 4.9
    CVE-2023-39912

    Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine w…

  • Unscored —
    CVE-2023-41637

    An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attacker…

  • Unscored —
    CVE-2023-41717 Public exploit

    Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file down…

  • Unscored —
    CVE-2023-41636

    A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to…

  • Unscored —
    CVE-2023-41640

    An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows…

  • Unscored —
    CVE-2023-41638

    An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm 1.1.37p38 allows attac…

  • Unscored —
    CVE-2023-41642 Scanner template

    Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI Real…

  • Unscored —
    CVE-2023-41635

    A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 a…