Skip to content
OpenAdvisories

Archive

6 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /6 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

39 results · Clear filters · Feed

  • Medium 5.5
    CVE-2023-5182

    Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier. An attacker in the adm group could us…

    Canonical subiquity subiquity Ubuntu
  • Medium 4.0
    CVE-2022-34355

    IBM Jazz Foundation information disclosure

    IBM Jazz Foundation (IBM Engineering Lifecycle Management 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2) could disclose sensitive version information to a user that could be used in further attacks against the system. IBM X-Force ID: 230498.

    IBM Engineering Lifecycle Management
  • Medium 5.5
    CVE-2023-5452

    Cross-site Scripting (XSS) - Stored in snipe/snipe-it

    Cross-site Scripting (XSS) - Stored in GitHub repository snipe/snipe-it prior to v6.2.2.

    snipe snipe/snipe-it snipe/snipe-it Packagist
  • Medium 6.7
    CVE-2023-21244

    In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission ch…

    Google Android android-platform-frameworks-base Android Ubuntu
  • Medium 6.5
    CVE-2023-5214

    CVE-2023-5214 - Privilege Escalation in Puppet Bolt

    In Puppet Bolt versions prior to 3.27.4, a path to escalate privileges was identified.

    Puppet Bolt bolt bolt Azure Linux RubyGems
  • Medium 4.1
    CVE-2023-44384

    Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary location

    Discourse-jira is a Discourse plugin allows Jira projects, issue types, fields and field options will be synced automatically. An administrator user can make an SSRF attack by setting the Jira URL to an arbitrary location and enabling the `discourse_jira_verb…

    Discourse discourse-jira Web / CMS
  • Medium 5.2
    CVE-2023-23371

    QVPN Device Client

    A cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to read sensitive data via unspecified vectors. We have already fixe…

    QNAP Systems QVPN Windows Windows
  • Medium 6.7
    CVE-2023-23370

    QVPN Device Client

    An insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local authenticated administrators to gain access to user accounts and access sensitive data used by the user acc…

    QNAP Systems QVPN Windows Windows
  • Medium 5.4
    CVE-2023-44233

    WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in FooPlugins Best WordPress Gallery Plugin – FooGallery plugin <= 2.2.44 versions.

    FooPlugins Best WordPress Gallery Plugin – FooGallery Web / CMS
  • Medium 4.3
    CVE-2023-44243

    WordPress Instant CSS Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dylan Blokhuis Instant CSS plugin <= 1.2.1 versions.

    Dylan Blokhuis Instant CSS
  • Medium 4.3
    CVE-2023-44146

    WordPress Checkfront Online Booking System Plugin <= 3.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Checkfront Inc. Checkfront Online Booking System plugin <= 3.6 versions.

    Checkfront Checkfront Online Booking System
  • Medium 5.4
    CVE-2023-41950

    WordPress Laposta Signup Basic Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions.

    Laposta - Roel Bousardt Laposta Signup Basic
  • Medium 4.3
    CVE-2023-40607

    WordPress CLUEVO LMS, E-Learning Platform Plugin <= 1.10.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <= 1.10.0 versions.

    cluevo CLUEVO LMS, E-Learning Platform
  • Medium 5.4
    CVE-2023-41801

    WordPress AWP Classifieds Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions.

    AWP Classifieds Team Ad Directory & Listings by AWP Classifieds
  • Medium 5.4
    CVE-2023-41732

    WordPress CP Blocks Plugin <= 1.0.20 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Blocks plugin <= 1.0.20 versions.

    codepeople CP Blocks
  • Medium 5.4
    CVE-2023-41659

    WordPress Responsive Gallery Grid Plugin <= 2.3.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Jules Colle, BDWM Responsive Gallery Grid plugin <= 2.3.10 versions.

    Jules Colle, BDWM Responsive Gallery Grid
  • Medium 5.4
    CVE-2023-41654

    WordPress authLdap Plugin <= 2.5.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Andreas Heigl authLdap plugin <= 2.5.8 versions.

    Andreas Heigl authLdap
  • Medium 4.3
    CVE-2023-41650

    WordPress Remove/hide Author, Date, Category Like Entry-Meta Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin <= 2.1 versions.

    Venugopal Remove/hide Author, Date, Category Like Entry-Meta
  • Medium 6.8
    CVE-2023-42445

    Possible local file exfiltration by XML External entity injection

    Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing X…

    gradle gradle gradle gradle Debian Ubuntu
  • Medium 5.3
    CVE-2023-43058

    IBM Robotic Process Automation privilege escalation

    IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527.

    IBM Robotic Process Automation
  • Medium 5.4
    CVE-2023-29235

    WordPress Maintenance Switch Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions.

    Fugu Maintenance Switch
  • Medium 4.3
    CVE-2023-28791

    WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions.

    Gangesh Matta Simple Org Chart
  • Medium 5.4
    CVE-2023-27615

    WordPress WP Super Minify Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dipak C. Gajjar WP Super Minify plugin <= 1.5.1 versions.

    Dipak C. Gajjar WP Super Minify
  • Medium 5.4
    CVE-2023-27448

    WordPress MakeStories (for Google Web Stories) Plugin <= 2.8.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in MakeStories Team MakeStories (for Google Web Stories) plugin <= 2.8.0 versions.

    MakeStories Team MakeStories (for Google Web Stories)
  • Medium 5.4
    CVE-2023-25033

    WordPress Social Share Boost Plugin <= 4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <= 4.5 versions.

    Sumo Social Share Boost
  • Medium 4.3
    CVE-2022-47175

    WordPress Royal Elementor Addons Plugin <= 1.3.75 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions.

    P Royal Royal Elementor Addons and Templates
  • Medium 4.3
    CVE-2023-25480

    WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.24.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions.

    Bold Grid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
  • Medium 4.3
    CVE-2023-40671

    WordPress DX-auto-save-images Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in 大侠wp DX-auto-save-images plugin <= 1.4.0 versions.

    大侠WP DX-auto-save-images
  • Medium 4.3
    CVE-2023-40008

    WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions.

    Gangesh Matta Simple Org Chart
  • Medium 5.3
    CVE-2023-4469

    Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information Exposure

    The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it possible for unauthentic…

    bestwebsoft Profile Extra Fields by BestWebSoft Web / CMS
  • Medium 6.3
    CVE-2015-10126

    Easy2Map Photos Plugin sql injection

    A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to addres…

  • Medium 4.3
    CVE-2023-40556

    WordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.

    Greg Ross Schedule Posts Calendar
  • Medium 5.4
    CVE-2023-44764 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44762 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44770 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44761 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44765 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44771 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44766 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made …

    concrete5/concrete5 Packagist