Skip to content
OpenAdvisories

Archive

August 2023

Vulnerabilities first published in this month (UTC), newest first.

← July 2023 2023 / August September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

772 results · Clear filters · Feed

  • Medium 6.8
    CVE-2023-40174

    Insufficient Session Expiration in fobybus/social-media-skeleton

    Social media skeleton is an uncompleted/framework social media project implemented using a php, css ,javascript and html. Insufficient session expiration is a web application security vulnerability that occurs when a web application does not properly manage t…

    fobybus social-media-skeleton
  • Medium 6.8
    CVE-2023-4422

    Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

    Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3.

    cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  • Medium 6.3
    CVE-2023-4414

    Byzoro Smart S85F Management Platform decodmail.php command injection

    A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to comm…

    Byzoro Smart S85F Management Platform
  • Medium 5.8
    CVE-2023-32122

    WordPress Spiffy Calendar Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Spiffy Plugins Spiffy Calendar plugin <= 4.9.3 versions.

    Spiffy Plugins Spiffy Calendar
  • Medium 5.9
    CVE-2023-32130

    WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.

    Daniel Powney Multi Rating
  • Medium 6.5
    CVE-2023-29387

    WordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Julien Crego Manager for Icomoon plugin <= 2.0 versions.

    Julien Crego Manager for Icomoon
  • Medium 6.3
    CVE-2023-4412

    TOTOLINK EX1200L setWanCfg os command injection

    A vulnerability was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed…

    Toto Link EX1200L
  • Medium 6.3
    CVE-2023-4411

    TOTOLINK EX1200L setTracerouteCfg os command injection

    A vulnerability has been found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 and classified as critical. This vulnerability affects the function setTracerouteCfg. The manipulation leads to os command injection. The attack can be initiated remotely. The exploi…

    Toto Link EX1200L
  • Medium 6.3
    CVE-2023-4410

    TOTOLINK EX1200L setDiagnosisCfg os command injection

    A vulnerability, which was classified as critical, was found in TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023. This affects the function setDiagnosisCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. The exploit …

    Toto Link EX1200L
  • Medium 6.5
    CVE-2023-32103

    WordPress TP Education Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Theme Palace TP Education plugin <= 4.4 versions.

    Theme Palace TP Education
  • Medium 5.9
    CVE-2023-31232

    WordPress Plugins List Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Artiss Plugins List plugin <= 2.5 versions.

    David Artiss Plugins List
  • Medium 6.3
    CVE-2023-4409

    NBS&HappySoftWeChat unrestricted upload

    A vulnerability, which was classified as critical, has been found in NBS&HappySoftWeChat 1.1.6. Affected by this issue is some unknown functionality. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disc…

  • Medium 6.3
    CVE-2023-4407 Public exploit

    Codecanyon Credit Lite POST Request account_statement sql injection

    A vulnerability classified as critical was found in Codecanyon Credit Lite 1.5.4. Affected by this vulnerability is an unknown functionality of the file /portal/reports/account_statement of the component POST Request Handler. The manipulation of the argument …

    CodeCanyon Credit Lite
  • Medium 5.9
    CVE-2023-31228

    WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 5.9
    CVE-2023-30875

    WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in All My Web Needs Logo Scheduler plugin <= 1.2.0 versions.

    All My Web Needs Logo Scheduler
  • Medium 5.3
    CVE-2023-4040

    The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due t…

    WebToffee Stripe Payment Plugin for WooCommerce Web / CMS
  • Medium 5.9
    CVE-2023-28690

    WordPress WP BrowserUpdate Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.5 versions.

    Marco Steinbrecher WP BrowserUpdate
  • Medium 5.3
    CVE-2023-36846 Exploited Public exploit EPSS 93%

    Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

    A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't re…

    Juniper Networks Junos OS Network devices
    KEV Nov 13, 2023
  • Medium 5.3
    CVE-2023-36844 Exploited Public exploit Scanner template EPSS 90%

    Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables

    A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify …

    Juniper Networks Junos OS Network devices
    KEV Nov 13, 2023
  • Medium 5.3
    CVE-2023-36847 Exploited EPSS 83%

    Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files

    A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php tha…

    Juniper Networks Junos OS Network devices
    KEV Nov 13, 2023
  • Medium 5.3
    CVE-2023-40315 Public exploit

    ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMIN

    In OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 and related Meridian versions, any user that has the ROLE_FILESYSTEM_EDITOR can easily escalate their privileges to ROLE_ADMIN or any other role. The solution is to upgrade to Meridian 2023.1.5 or Hor…

    The OpenNMS Group Meridian Horizon org.opennms:opennms-webapp-rest Maven
  • Medium 6.7
    CVE-2023-34419

    A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an at…

    Lenovo Lenovo Notebook
  • Medium 6.7
    CVE-2023-4029

    A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow…

    Lenovo ThinkPad
  • Medium 6.7
    CVE-2023-4028

    A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which ma…

    Lenovo Lenovo Notebook
  • Medium 5.9
    CVE-2023-28783

    WordPress Woocommerce Tip/Donation Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (shop manager+) Stored Cross-Site Scripting (XSS) vulnerability in PHPRADAR Woocommerce Tip/Donation plugin <= 1.2 versions.

    PHPRADAR Woocommerce Tip/Donation Web / CMS
  • Medium 6.5
    CVE-2023-31079

    WordPress Tippy Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Roberts Tippy plugin <= 6.2.1 versions.

    Chris Roberts Tippy
  • Medium 4.8
    CVE-2023-34412

    Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250

    A vulnerability in Red Lion Europe mbNET/mbNET.rokey and Helmholz REX 200 and REX 250 devices with firmware lower 7.3.2 allows an authenticated remote attacker with high privileges to inject malicious HTML or JavaScript code (XSS).

    Helmholz Red Lion Europe mbNET.rokey REX 250
  • Medium 6.7
    CVE-2023-4394

    Memory leak in btrfs_get_dev_args_from_path()

    A use-after-free flaw was found in btrfs_get_dev_args_from_path in fs/btrfs/volumes.c in btrfs file-system in the Linux Kernel. This flaw allows a local attacker with special privileges to cause a system crash or leak internal kernel information

    Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2023-31091

    WordPress Dynamically Register Sidebars Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pradeep Singh Dynamically Register Sidebars plugin <= 1.0.1 versions.

    Pradeep Singh Dynamically Register Sidebars
  • Medium 6.4
    CVE-2023-29182

    A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to …

    Fortinet FortiOS Network devices
  • Medium 5.9
    CVE-2023-30874

    WordPress GPS Plotter Plugin <= 5.1.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Steve Curtis, St. Pete Design Gps Plotter plugin <= 5.1.4 versions.

    Steve Curtis, St. Pete Design Gps Plotter
  • Medium 5.9
    CVE-2023-30876

    WordPress Dave's WordPress Live Search Plugin <= 4.8.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dave Ross Dave's WordPress Live Search plugin <= 4.8.1 versions.

    Dave Ross Dave's WordPress Live Search Web / CMS
  • Medium 5.9
    CVE-2023-28533

    WordPress Cab Grid Plugin <= 1.5.15 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in M Williams Cab Grid plugin <= 1.5.15 versions.

    M Williams Cab Grid
  • Medium 5.9
    CVE-2023-28622

    WordPress Easy Slider Revolution Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in Trident Technolabs Easy Slider Revolution plugin <= 1.0.0 versions.

    Trident Technolabs Easy Slider Revolution
  • Medium 5.2
    CVE-2023-40251

    Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian …

    Genians Genian NAC V5.0 Genian NAC V4.0 Genian ZTNA
  • Medium 4.3
    CVE-2023-3244 Public exploit

    Comments Like Dislike <= 1.2.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset

    The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This makes it possible for …

    happy-coders Comments Like Dislike Web / CMS
  • Medium 6.0
    CVE-2023-40252

    Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC …

    Genians Genian NAC V5.0 Genian NAC V4.0 Genian ZTNA
  • Medium 4.7
    CVE-2023-25647

    Permission and Access Control Vulnerability in Some ZTE Mobile Phones

    There is a permission and access control vulnerability in some ZTE mobile phones. Due to improper access control, applications in mobile phone could monitor the touch event.

    ZTE Some ZTE Mobile Phones
  • Medium 5.5
    CVE-2023-38905

    Jeecg-boot SQL Injection vulnerability

    SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleep, DBMS_Lock.Sleep, Waitfor, DECODE, and DBMS_PIPE.RECEIVE_MESSAGE functions.

    org.jeecgframework.boot:jeecg-boot-parent Maven
  • Medium 5.4
    CVE-2023-35011

    IBM Cognos Analytics server-side request forgey

    IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attac…

    IBM Cognos Analytics