Skip to content
OpenAdvisories

Archive

August 2023

Vulnerabilities first published in this month (UTC), newest first.

← July 2023 2023 / August September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

772 results · Clear filters · Feed

  • Medium 5.5
    CVE-2023-38230

    ZDI-CAN-21318: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure Vulnerability

    Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use-After-Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such …

    Adobe Acrobat Reader
  • Medium 5.5
    CVE-2023-38241

    ZDI-CAN-21246: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

    Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations …

    Adobe Acrobat Reader
  • Medium 5.5
    CVE-2023-38243

    ZDI-CAN-21252: Adobe Acrobat Reader DC JBIG2 File Parsing Use-After-Free Information Disclosure Vulnerability

    Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by a Use-After-Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such …

    Adobe Acrobat Reader
  • Medium 5.9
    CVE-2023-37388

    WordPress Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sudipto Pratap Mahato Simple Light Weight Social Share plugin <= 2.0 versions.

    Sudipto Pratap Mahato Simple Light Weight Social Share
  • Medium 6.5
    CVE-2023-37983

    WordPress Art Direction Plugin <= 0.2.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Noël Jackson Art Direction plugin <= 0.2.4 versions.

    Noël Jackson Art Direction
  • Medium 6.5
    CVE-2023-24393

    WordPress Animated Number Counters Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Sk. Abul Hasan Animated Number Counters plugin <= 1.6 versions.

    Sk. Abul Hasan Animated Number Counters
  • Medium 5.9
    CVE-2023-24391

    WordPress ApplyOnline – Application Form Builder and Manager Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Spider Teams ApplyOnline plugin <= 2.5 versions.

    Spider Teams ApplyOnline
  • Medium 6.5
    CVE-2023-23828

    WordPress WP Category Post List Widget Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Swashata WP Category Post List Widget plugin <= 2.0.3 versions.

    Swashata WP Category Post List Widget
  • Medium 5.9
    CVE-2023-36530

    WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Smartypants SP Project & Document Manager plugin <= 4.67 versions.

    smartypants SP Project & Document Manager
  • Medium 5.8
    CVE-2023-23900

    WordPress Easy Forms for Mailchimp Plugin <= 6.8.8 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in YIKES, Inc. Easy Forms for Mailchimp plugin <= 6.8.8 versions.

    YIKES Easy Forms for Mailchimp
  • Medium 5.9
    CVE-2023-34374

    WordPress AnsPress – Question and answer Plugin <= 4.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Rahul Aryan AnsPress plugin <= 4.3.0 versions.

    Rahul Aryan AnsPress
  • Medium 6.4
    CVE-2023-4283

    EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The EmbedPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embedpress_calendar' shortcode in versions up to, and including, 3.8.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes…

    wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Web / CMS
  • Medium 5.4
    CVE-2023-4282

    EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_data

    The EmbedPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'admin_post_remove' and 'remove_private_data' functions in versions up to, and including, 3.8.2. This makes it possible for authenticated a…

    wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos, 3D FlipBook, Social feeds, Docs & more Web / CMS
  • Medium 5.9
    CVE-2023-23871

    WordPress Button Plugin <= 1.1.23 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Webdzier Button plugin <= 1.1.23 versions.

    webdzier Button
  • Medium 6.5
    CVE-2023-24009

    WordPress Upfrontwp Theme <= 1.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (subscriber+) Reflected Cross-site Scripting (XSS) vulnerability in Wpazure Themes Upfrontwp theme <= 1.1 versions.

    Wpazure Themes Upfrontwp
  • Medium 6.5
    CVE-2023-23798

    WordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions.

    Muneeb Layer Slider
  • Medium 5.9
    CVE-2022-44629

    WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions.

    Catalyst Connect Catalyst Connect Zoho CRM Client Portal
  • Medium 4.7
    CVE-2022-27861

    WordPress Ninja Popups Plugin <= 4.7.5 is vulnerable to Open Redirection

    Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin <= 4.7.5 versions.

    arscode Ninja Popups
  • Medium 6.5
    CVE-2023-23826

    WordPress Add Posts to Pages Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Arsham Mirshah Add Posts to Pages plugin <= 1.4.1 versions.

    Arsham Mirshah Add Posts to Pages
  • Medium 5.9
    CVE-2023-24389

    WordPress Social Proof (Testimonial) Slider Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in brandiD Social Proof (Testimonial) Slider plugin <= 2.2.3 versions.

    brandiD Social Proof (Testimonial) Slider
  • Medium 6.8
    CVE-2023-30705

    Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access pri…

    Samsung Mobile Galaxy Store
  • Medium 6.7
    CVE-2023-30702

    Stack overflow vulnerability in SSHDCPAPP TA prior to &quot;SAMSUNG ELECTONICS, CO, LTD. - System Hardware Update - 7/1…

    Samsung Mobile Galaxy book Go, Galaxy book Go 5G, Galaxy book2 Go and Galaxy book2 Pro 360
  • Medium 4.7
    CVE-2023-30701

    PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file …

    Samsung Mobile Samsung Mobile Devices
  • Medium 5.3
    CVE-2023-30700

    PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local…

    Samsung Mobile Samsung Mobile Devices
  • Medium 5.5
    CVE-2023-30698

    Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local attacker to connect B…

    Samsung Mobile Samsung Mobile Devices
  • Medium 4.4
    CVE-2023-30697

    An improper input validation in IpcTxCfgSetSimlockPayload in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker…

    Samsung Mobile Samsung Mobile Devices
  • Medium 4.4
    CVE-2023-30696

    An improper input validation in IpcTxGetVerifyAkey in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cau…

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.7
    CVE-2023-30695

    Out-of-bounds Write vulnerability in SSHDCPAPP TA prior to &quot;SAMSUNG ELECTONICS, CO, LTD. - System Hardware Update …

    Samsung Mobile Galaxy book Go, Galaxy book Go 5G, Galaxy book2 Go and Galaxy book2 Pro 360
  • Medium 6.7
    CVE-2023-30694

    Out-of-bounds Write in IpcTxPcscTransmitApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to exe…

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.7
    CVE-2023-30693

    Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local …

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.7
    CVE-2023-30689

    Out-of-bounds Write in BuildOemEmbmsGetSigStrengthResponse of libsec-ril prior to SMR Aug-2023 Release 1 allows local a…

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.7
    CVE-2023-30688

    Out-of-bounds Write in MakeUiccAuthForOem of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execut…

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.7
    CVE-2023-30687

    Out-of-bounds Write in RmtUimApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitr…

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.7
    CVE-2023-30686

    Out-of-bounds Write in ReqDataRaw of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitr…

    Samsung Mobile Samsung Mobile Devices
  • Medium 4.3
    CVE-2023-30685

    Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY m…

    Samsung Mobile Samsung Mobile Devices
  • Medium 4.3
    CVE-2023-30684

    Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRinging…

    Samsung Mobile Samsung Mobile Devices
  • Medium 4.3
    CVE-2023-30683

    Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without p…

    Samsung Mobile Samsung Mobile Devices
  • Medium 4.3
    CVE-2023-30682

    Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API wit…

    Samsung Mobile Samsung Mobile Devices
  • Medium 4.4
    CVE-2023-30681

    An improper input validation vulnerability within initialize function in HAL VaultKeeper prior to SMR Aug-2023 Release …

    Samsung Mobile Samsung Mobile Devices
  • Medium 6.7
    CVE-2023-30654

    Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows local attacker to upda…

    Samsung Mobile Samsung Mobile Devices