Skip to content
OpenAdvisories

Archive

25 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /25 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • High 7.5
    CVE-2022-4244 Public exploit

    Codehaus-plexus: directory traversal

    A flaw was found in codeplex-codehaus. A directory traversal attack (also known as path traversal) aims to access files and directories stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and their variations or by u…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Maven
  • High 8.1
    CVE-2022-4137 Public exploit

    Keycloak: reflected xss attack

    A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrato…

    Red Hat Red Hat Single Sign-On 7 Red Hat Single Sign-On 7.6 for RHEL 7 Red Hat Single Sign-On 7.6 for RHEL 9 Maven
  • Unscored —
    CVE-2023-4549 Public exploit

    DoLogin Security < 3.7 - Unauthenticated Stored Cross-Site Scripting

    The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.

    Web / CMS
  • Medium 5.3
    CVE-2023-4631 Public exploit

    DoLogin Security < 3.7 - IP Spoofing

    The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing.

    Web / CMS
  • Medium 5.3
    CVE-2023-4281 Public exploit

    Activity Log < 2.8.8 - IP Spoofing

    This Activity Log WordPress plugin before 2.8.8 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious traffic.

    Web / CMS
  • High 7.2
    CVE-2023-4300 Public exploit

    Import XML and RSS Feeds < 2.1.4 - Admin+ Arbitrary File Upload

    The Import XML and RSS Feeds WordPress plugin before 2.1.4 does not filter file extensions for uploaded files, allowing an attacker to upload a malicious PHP file, leading to Remote Code Execution.

    Web / CMS
  • Medium 6.1
    CVE-2023-42426 Public exploit

    Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary c…

  • Unscored —
    CVE-2023-43326 Public exploit Scanner template

    A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to st…

  • Unscored —
    CVE-2023-43339 Public exploit

    Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code vi…

  • Unscored —
    CVE-2023-43325 Public exploit Scanner template

    A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows att…