Skip to content
OpenAdvisories

Archive

September 2023

Vulnerabilities first published in this month (UTC), newest first.

← August 2023 2023 / September October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

597 results · Clear filters · Feed

  • High 8.6
    CVE-2023-20223

    A vulnerability in Cisco DNA Center could allow an unauthenticated, remote attacker to read and modify data in a reposi…

    Cisco Cisco Digital Network Architecture Center (DNA Center) Network devices
  • High 8.6
    CVE-2023-20033

    A vulnerability in Cisco IOS XE Software for Cisco Catalyst 3650 and Catalyst 3850 Series Switches could allow an unaut…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.6
    CVE-2023-20187

    A vulnerability in the Multicast Leaf Recycle Elimination (mLRE) feature of Cisco IOS XE Software for Cisco ASR 1000 Se…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 8.8
    CVE-2023-20231

    A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an inje…

    Cisco Cisco IOS XE Software iOS Network devices
  • High 7.5
    CVE-2023-20034

    Vulnerability in the Elasticsearch database used in the of Cisco SD-WAN vManage software could allow an unauthenticated…

    Cisco Cisco SD-WAN vManage Network devices
  • High 7.1
    CVE-2023-20253

    A vulnerability in the command line interface (cli) management interface of Cisco SD-WAN vManage could allow an authent…

    Cisco Cisco SD-WAN vManage Network devices
  • High 7.2
    CVE-2023-20254

    A vulnerability in the session management system of the Cisco Catalyst SD-WAN Manager multi-tenant feature could allow …

    Cisco Cisco SD-WAN vManage Network devices
  • High 7.3
    CVE-2023-32458

    Dell AppSync, versions 4.4.0.0 to 4.6.0.0 including Service Pack releases, contains an improper access control vulnerab…

    Dell Dell EMC AppSync
  • High 8.3
    CVE-2023-40047

    WS_FTP Server Stored Cross-Site Scripting Vulnerability

    In WS_FTP Server version prior to 8.8.2, a stored cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Management module. An attacker with administrative privileges could import a SSL certificate with malicious attributes containing cross-site s…

    Progress Software WS_FTP Server
  • High 8.2
    CVE-2023-40046

    WS_FTP Server SQL Injection via Administrative Interface

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a SQL injection vulnerability exists in the WS_FTP Server manager interface. An attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alte…

    Progress Software WS_FTP Server
  • High 8.3
    CVE-2023-40045

    WS_FTP Server Ad Hoc Transfer Module Reflected Cross-Site Scripting Vulnerability

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a reflected cross-site scripting (XSS) vulnerability exists in WS_FTP Server's Ad Hoc Transfer module.  An attacker could leverage this vulnerability to target WS_FTP Server users with a specialized payload …

    Progress Software WS_FTP Server
  • High 7.5
    CVE-2023-3223

    Undertow: outofmemoryerror due to @multipartconfig handling

    A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limi…

    Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat Data Grid 8 RHEL-8 based Middleware Containers Debian Ubuntu Maven
  • High 7.4
    CVE-2023-0456

    Apicast proxies the api call with incorrect jwt token to the api backend without proper authorization check

    A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.

    Red Hat Red Hat 3scale API Management Platform 2
  • High 7.1
    CVE-2023-41653

    WordPress Sermon'e – Sermons Online Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Beplus Sermon'e – Sermons Online plugin <= 1.0.0 versions.

    Beplus Sermon'e – Sermons Online
  • High 7.5
    CVE-2023-42487

    Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    Soundminer – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

    Soundminer Soundminer
  • High 7.6
    CVE-2023-4003

    One Identity Password Manager version 5.9.7.1 - Unauthenticated physical access privilege escalation

    One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to SYSTEM through an unspecified method. CWE-250: Execution with Unnecessary Privileges.

    One One
  • High 7.1
    CVE-2023-44206

    Sensitive information disclosure and manipulation due to improper authorization. The following products are affected: A…

    Acronis Acronis Cyber Protect 15
  • High 7.1
    CVE-2023-41238

    WordPress Social Media & Share Icons Plugin <= 2.8.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in UltimatelySocial Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.3 versions.

    UltimatelySocial Social Media Share Buttons & Social Sharing Icons
  • High 7.1
    CVE-2023-41237

    WordPress Arya Multipurpose Pro Theme <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Arya Multipurpose Pro theme <= 1.0.8 versions.

    Everest themes Arya Multipurpose Pro
  • High 7.1
    CVE-2023-41236

    WordPress Happy Elementor Addons Pro Plugin <= 2.8.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Happy addons Happy Elementor Addons Pro plugin <= 2.8.0 versions.

    Happy addons Happy Elementor Addons Pro
  • High 7.1
    CVE-2023-41235

    WordPress Everest News Pro Theme <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Everest Themes Everest News Pro theme <= 1.1.7 versions.

    Everest themes Everest News Pro
  • High 7.1
    CVE-2023-40333

    WordPress Bridge Core Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Qode Interactive Bridge Core plugin <= 3.0.9 versions.

    Qode Interactive Bridge Core
  • High 7.1
    CVE-2023-30493

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <= 3.2.0 versions.

    themefic Ultimate Addons for Contact Form 7
  • High 7.1
    CVE-2023-30472

    WordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in MyThemeShop URL Shortener by MyThemeShop plugin <= 1.0.17 versions.

    mythemeshop URL Shortener by MyThemeShop
  • High 7.1
    CVE-2023-30471

    WordPress WP Search Analytics Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <= 1.4.7 versions.

    Cornel Raiu WP Search Analytics
  • High 8.8
    CVE-2023-4934

    IDOR in Usta AYBS

    Authorization Bypass Through User-Controlled Key vulnerability in Usta AYBS allows Authentication Abuse, Authentication Bypass. This issue affects AYBS: before 1.0.3.

    Usta AYBS
  • High 7.1
    CVE-2023-40667

    WordPress Simple URLs Plugin <= 117 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Lasso Simple URLs plugin <= 117 versions.

    Lasso Simple URLs
  • High 7.1
    CVE-2023-40664

    WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions.

    RedNao Donations Made Easy – Smart Donations
  • High 7.1
    CVE-2023-40663

    WordPress WP VR Plugin <= 8.3.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rextheme WP VR plugin <= 8.3.4 versions.

    RexTheme WP VR
  • High 7.1
    CVE-2023-40330

    WordPress GD Security Headers Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Milan Petrovic GD Security Headers plugin <= 1.6.1 versions.

    Milan Petrovic GD Security Headers
  • High 7.1
    CVE-2023-27616

    WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in David F. Carr RSVPMaker plugin <= 10.6.6 versions.

    David F. Carr RSVPMaker
  • High 7.1
    CVE-2023-28490

    WordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Estatik Estatik Mortgage Calculator plugin <= 2.0.7 versions.

    Estatik Estatik Mortgage Calculator
  • High 8.8
    CVE-2023-44018 EPSS 16%

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the domain par…

  • High 8.8
    CVE-2023-44013

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the list param…

  • High 8.8
    CVE-2023-44015

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the schedEndTi…

  • High 8.8
    CVE-2023-44014

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain multiple stack overflows in the for…

  • High 8.8
    CVE-2023-44016

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the deviceId p…

  • High 8.8
    CVE-2023-44017

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the timeZone p…

  • High 8.8
    CVE-2023-44019

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the mac parame…

  • High 7.5
    CVE-2023-43314

    ** UNSUPPORTED WHEN ASSIGNED **The buffer overflow vulnerability in the Zyxel PMG2005-T20B firmware version V1.00(ABNK.…

    Zyxel PMG2005-T20B Network devices