Skip to content
OpenAdvisories

Archive

August 2023

Vulnerabilities first published in this month (UTC), newest first.

← July 2023 2023 / August September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

2,514 results · Feed

  • Medium 4.3
    CVE-2023-4381

    Unverified Password Change in instantsoft/icms2

    Unverified Password Change in GitHub repository instantsoft/icms2 prior to 2.16.1-git.

    instantsoft instantsoft/icms2
  • High 7.5
    CVE-2023-4241

    lol-html panics on certain HTML inputs

    lol-html can cause panics on certain HTML inputs. Anyone processing arbitrary 3rd party HTML with the library is affected.

    Cloudflare lol-html lol-html crates.io
  • High 7.1
    CVE-2023-30871

    WordPress Stock Exporter for WooCommerce Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce plugin <= 1.1.0 versions.

    PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-30779

    WordPress Query Wrangler Plugin <= 1.5.51 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Jonathan Daggerhart Query Wrangler plugin <= 1.5.51 versions.

    Jonathan Daggerhart Query Wrangler
  • Medium 6.5
    CVE-2023-30784

    WordPress Kaya QR Code Generator Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <= 1.5.2 versions.

    Kaya Studio Kaya QR Code Generator
  • High 7.1
    CVE-2023-30473

    WordPress YML for Yandex Market Plugin <= 3.10.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Maxim Glazunov YML for Yandex Market plugin <= 3.10.7 versions.

    Maxim Glazunov YML for Yandex Market
  • High 7.1
    CVE-2023-30785

    WordPress Video Grid Plugin <= 1.21 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Video Grid plugin <= 1.21 versions.

    I Thirteen Web Solution Video Grid
  • High 7.1
    CVE-2023-30782

    WordPress Church Admin Plugin <= 3.7.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.5 versions.

    andy_moyle Church Admin
  • Medium 5.9
    CVE-2023-30786

    WordPress Captcha Them All Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Benjamin Guy Captcha Them All plugin <= 1.3.3 versions.

    Benjamin Guy Captcha Them All
  • Unscored —
    CVE-2023-39507

    Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows …

    Recruit "Rikunabi NEXT" App for Android Android
  • Medium 6.1
    CVE-2023-26140

    @excalidraw/excalidraw Cross-site Scripting vulnerability

    Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard objects due to improper input sanitization.

    @excalidraw/excalidraw npm
  • Medium 4.3
    CVE-2023-4374

    WP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log View

    The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it possible for authen…

    frogerme WP Remote Users Sync Web / CMS
  • High 8.5
    CVE-2023-3958

    WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery

    The WP Remote Users Sync plugin for WordPress is vulnerable to Server Side Request Forgery via the 'notify_ping_remote' AJAX function in versions up to, and including, 1.2.12. This can allow authenticated attackers with subscriber-level permissions or above t…

    frogerme WP Remote Users Sync Web / CMS
  • Unscored —
    CVE-2020-26037

    Directory Traversal vulnerability in Server functionalty in Even Balance Punkbuster version 1.902 before 1.905 allows r…

  • Unscored —
    CVE-2023-33663

    In the module “Customization fields fee for your store” (aicustomfee) from ai-dev module for PrestaShop, an attacker ca…

  • High 8.8
    CVE-2023-39975

    kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticate…

  • Unscored —
    CVE-2023-39846

    An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.

  • Unscored —
    CVE-2023-39115 Public exploit

    install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG docu…

  • Critical 9.8
    CVE-2023-38894

    tree-kit Prototype Pollution vulnerability

    A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend function.

    tree-kit npm
  • Unscored —
    CVE-2023-38904

    A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code…

  • Unscored —
    CVE-2023-20560

    Insufficient validation of the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may allow a privileged at…

    AMD Ryzen™ Master
  • Unscored —
    CVE-2023-20564 Public exploit

    Insufficient validation in the IOCTL (Input Output Control) input buffer in AMD Ryzen™ Master may permit a privileged a…

    AMD Ryzen™ Master
  • High 7.1
    CVE-2023-38402

    Arbitrary File Overwrite in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows Client

    A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTEM. A successful exploit could allow these malicious users to create a Denial-of-Service (DoS) condit…

    Hewlett Packard Enterprise (HPE) HPE Aruba Networking Virtual Intranet Access (VIA)
  • Unscored —
    CVE-2023-4326

    Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites

    Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4324

    Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers

    Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4329

    Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute

    Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4327

    Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux

    Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux

    Broadcom LSI Storage Authority (LSA)
  • Unscored —
    CVE-2023-4328

    Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux

    Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Windows

    Broadcom LSI Storage Authority (LSA)
  • Unscored —
    CVE-2023-4325

    Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities

    Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4331

    Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols

    Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4334

    Broadcom RAID Controller Web server (nginx) is serving private files without any authentication

    Broadcom RAID Controller Web server (nginx) is serving private files without any authentication

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4335

    Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux

    Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4332

    Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file

    Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4333

    Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server

    Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server

    Broadcom LSI Storage Authority (LSA)
  • Unscored —
    CVE-2023-4338

    Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers

    Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4337

    Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation

    Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4336

    Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute

    Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4339

    Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions

    Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4340

    Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log file

    Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log file

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)
  • Unscored —
    CVE-2023-4342

    Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policy

    Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policy

    Intel Broadcom LSI Storage Authority (LSA) RAID Web Console 3 (RWC3)