Skip to content
OpenAdvisories

Archive

3 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /3 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

138 results · Feed

  • High 8.8
    CVE-2023-2681

    SQL Injection on Jorani

    An SQL Injection vulnerability has been found on Jorani version 1.0.0. This vulnerability allows an authenticated remote user, with low privileges, to send queries with malicious SQL code on the "/leaves/validate" path and the “id” parameter, managing to extr…

    Jorani Jorani
  • High 8.1
    CVE-2023-5353

    Improper Access Control in salesagility/suitecrm

    Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.14.1.

    salesagility salesagility/suitecrm
  • Medium 5.4
    CVE-2023-40202

    WordPress WP HTML Mail Plugin <= 3.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Hannes Etzelstorfer // codemiq WP HTML Mail plugin <= 3.4.1 versions.

    Hannes Etzelstorfer // codemiq WP HTML Mail
  • High 8.9
    CVE-2023-5351

    Cross-site Scripting (XSS) - Stored in salesagility/suitecrm

    Cross-site Scripting (XSS) - Stored in GitHub repository salesagility/suitecrm prior to 7.14.1.

    salesagility salesagility/suitecrm
  • Medium 6.4
    CVE-2023-5350 Public exploit

    SQL Injection in salesagility/suitecrm

    SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.

    salesagility salesagility/suitecrm
  • High 8.8
    CVE-2023-4103

    Multiple vulnerabilities in IDM Sistemas QSige

    QSige statistics are affected by a remote SQLi vulnerability. It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into th…

    IDM Sistemas QSige QSige
  • High 8.8
    CVE-2023-4102

    Multiple vulnerabilities in IDM Sistemas QSige

    QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

    IDM Sistemas QSige QSige
  • Critical 10.0
    CVE-2022-47893

    NetMan 204 Remote Code Execution

    There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, that could allow him to execute arbitrary code as root.

    Riello UPS NetMan 204
  • Medium 5.4
    CVE-2023-40210

    WordPress SB Child List Plugin <= 4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Sean Barton (Tortoise IT) SB Child List plugin <= 4.5 versions.

    Sean Barton (Tortoise IT) SB Child List
  • Medium 5.3
    CVE-2022-47892

    Information disclosure in NetMan 204

    All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials.

    Riello UPS NetMan 204
  • High 8.8
    CVE-2023-4101

    Multiple vulnerabilities in IDM Sistemas QSige

    The QSige login SSO does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

    IDM Sistemas QSige QSige
  • High 8.1
    CVE-2022-47891

    Admin password reset in NetMan 204

    All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery function.

    Riello UPS NetMan 204
  • Medium 5.4
    CVE-2023-2830

    WordPress WP Testimonials Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Trustindex.Io WP Testimonials plugin <= 1.4.2 versions.

    Trustindex.io WP Testimonials
  • Medium 6.5
    CVE-2023-4100

    Multiple vulnerabilities in IDM Sistemas QSige

    Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions.

    IDM Sistemas QSige QSige
  • Medium 5.4
    CVE-2023-39989

    WordPress Header Footer Code Manager Plugin <= 1.1.34 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in 99robots Header Footer Code Manager plugin <= 1.1.34 versions.

    99robots Header Footer Code Manager
  • Medium 4.3
    CVE-2023-39917

    WordPress Photo Gallery by Ays Plugin <= 5.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions.

    Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery
  • Medium 5.4
    CVE-2023-39165

    WordPress Sign-up Sheets Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets plugin <= 2.2.8 versions.

    Fetch Designs Sign-up Sheets
  • High 7.6
    CVE-2023-4099

    Multiple vulnerabilities in IDM Sistemas QSige

    The QSige Monitor application does not have an access control mechanism to verify whether the user requesting a resource has sufficient permissions to do so. As a prerequisite, it is necessary to log into the application.

    QSige de IDM Sistemas QSige
  • Medium 5.4
    CVE-2023-39923

    WordPress The Post Grid Plugin <= 7.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 7.2.7 versions.

    RadiusTheme The Post Grid
  • High 8.8
    CVE-2023-4098

    Multiple vulnerabilities in IDM Sistemas QSige

    It has been identified that the web application does not correctly filter input parameters, allowing SQL injections, DoS or information disclosure. As a prerequisite, it is necessary to log into the application.

    QSige de IDM Sistemas QSige
  • Medium 4.3
    CVE-2023-25989

    Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks

    Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Me…

    Meks Meks Easy Ads Widget Meks Smart Social Widget Meks Smart Author Widget
  • High 8.8
    CVE-2023-4097

    Multiple vulnerabilities in IDM Sistemas QSige

    The file upload functionality is not implemented correctly and allows uploading of any type of file. As a prerequisite, it is necessary for the attacker to log into the application with a valid username.

    IDM Sistemas QSige QSige
  • Medium 6.7
    CVE-2023-0828

    Stored Cross Site Scripting in syslog section

    Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version and prior versions on all platforms.

    Artica PFMS Pandora FMS
  • Medium 6.7
    CVE-2023-24518

    Disabling the administrator's account through cross-site request forgery

    A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This issue affects Pandora FMS version 767 and earlier versions o…

    Artica PFMS Pandora FMS
  • Medium 5.4
    CVE-2023-25463

    WordPress wp tell a friend popup form Plugin <= 7.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy WP tell a friend popup form plugin <= 7.1 versions.

    Gopi Ramasamy WP tell a friend popup form
  • Medium 4.3
    CVE-2023-38390

    WordPress Mobile Address Bar Changer Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Anshul Labs Mobile Address Bar Changer plugin <= 3.0 versions.

    Anshul Labs Mobile Address Bar Changer
  • Medium 5.4
    CVE-2023-38396

    WordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez plugin <= 3.1.2 versions.

    Alain Gonzalez google-map-shortcode
  • Medium 4.3
    CVE-2023-37990

    WordPress Perelink Pro Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <= 2.1.4 versions.

    Mike Perelink Pro
  • Medium 4.3
    CVE-2023-38398

    WordPress Taboola Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Taboola plugin <= 2.0.1 versions.

    Taboola Taboola
  • Medium 5.4
    CVE-2022-46841

    WordPress Oxygen Builder Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <= 4.4 versions.

    Soflyy Oxygen Builder
  • Medium 5.4
    CVE-2023-38381

    WordPress WP-FlyBox Plugin <= 6.46 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Cyle Conoly WP-FlyBox plugin <= 6.46 versions.

    Cyle Conoly WP-FlyBox
  • Medium 4.3
    CVE-2023-37998

    WordPress Disabler Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3.

    Saas Disabler
  • Medium 5.4
    CVE-2023-37996

    WordPress GTmetrix for WordPress Plugin <= 0.4.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.7 versions.

    GTmetrix GTmetrix for WordPress Web / CMS
  • Medium 5.4
    CVE-2023-37992

    WordPress Smarty for WordPress Plugin <= 3.1.35 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.

    PressPage Entertainment Smarty for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-37991

    WordPress WP Emoji One Plugin <= 0.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Monchito.Net WP Emoji One plugin <= 0.6.0 versions.

    Monchito.net WP Emoji One
  • Medium 4.3
    CVE-2023-37891

    WordPress Exit Popups & Onsite Retargeting by OptiMonk Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin <= 2.0.4 versions.

    OptiMonk OptiMonk: Popups, Personalization & A/B Testing
  • Critical 9.4
    CVE-2023-3654

    Origin Check Bypass

    cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the host header in an HTTP request. This vulnerability can be triggered by an HTTP endpoint exposed to the…

    PoS/ Dienstleistung, Entwicklung & Vertrieb cashIT! - serving solutions.
  • High 8.8
    CVE-2023-44218

    A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to gain access to the host Windo…

    SonicWall NetExtender Network devices
  • High 7.8
    CVE-2023-44217

    A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versio…

    SonicWall NetExtender Network devices
  • High 7.5
    CVE-2023-3655

    Unauthenticated Remote Database Exfiltration

    cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dangerous methods, that allows to leak the database (system settings, user accounts,...). This vulnerability can be triggere…

    PoS/ Dienstleistung, Entwicklung & Vertrieb cashIT! - serving solutions.