Skip to content
OpenAdvisories

Archive

6 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /6 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

72 results · Feed

  • Medium 5.4
    CVE-2023-27615

    WordPress WP Super Minify Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dipak C. Gajjar WP Super Minify plugin <= 1.5.1 versions.

    Dipak C. Gajjar WP Super Minify
  • Medium 5.4
    CVE-2023-27448

    WordPress MakeStories (for Google Web Stories) Plugin <= 2.8.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in MakeStories Team MakeStories (for Google Web Stories) plugin <= 2.8.0 versions.

    MakeStories Team MakeStories (for Google Web Stories)
  • Medium 5.4
    CVE-2023-25033

    WordPress Social Share Boost Plugin <= 4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <= 4.5 versions.

    Sumo Social Share Boost
  • Medium 4.3
    CVE-2022-47175

    WordPress Royal Elementor Addons Plugin <= 1.3.75 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions.

    P Royal Royal Elementor Addons and Templates
  • Medium 4.3
    CVE-2023-25480

    WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.24.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions.

    Bold Grid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
  • Medium 4.3
    CVE-2023-40671

    WordPress DX-auto-save-images Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in 大侠wp DX-auto-save-images plugin <= 1.4.0 versions.

    大侠WP DX-auto-save-images
  • Medium 4.3
    CVE-2023-40008

    WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions.

    Gangesh Matta Simple Org Chart
  • Critical 9.1
    CVE-2023-36465

    Decidim has broken access control in templates

    Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and offline participation website. The `templates` module doesn't enforce the correct permissions, allowing any logged-in u…

    decidim decidim decidim decidim-templates RubyGems
  • High 7.1
    CVE-2023-45246

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 16
  • Low 3.3
    CVE-2023-45245

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linu…

    Acronis Acronis Agent
  • High 7.1
    CVE-2023-45244

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 16
  • Medium 5.3
    CVE-2023-4469

    Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information Exposure

    The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it possible for unauthentic…

    bestwebsoft Profile Extra Fields by BestWebSoft Web / CMS
  • Critical 9.8
    CVE-2023-4530

    SQLi in Turna Media's Advertising Administration Panel

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Turna Advertising Administration Panel allows SQL Injection. This issue affects Advertising Administration Panel: before 1.1.

    Turna Advertising Administration Panel
  • Medium 6.3
    CVE-2015-10126

    Easy2Map Photos Plugin sql injection

    A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to addres…

  • Medium 4.3
    CVE-2023-40556

    WordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.

    Greg Ross Schedule Posts Calendar
  • High 8.3
    CVE-2023-26153

    geokit-rails Command Injection vulnerability

    Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_location' cookie. This issue can be exploited remotely via a malicious cookie value. **Note:** An attacker can use this…

    geokit-rails RubyGems
  • Unscored —
    CVE-2023-36123 Public exploit

    Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to e…

  • High 7.5
    CVE-2023-45282

    Prototype Pollution in NASA Open MCT

    In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.

    openmct npm
  • Unscored —
    CVE-2023-45322

    libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in…

    libxml2 libxml2 libxml2 Debian Azure Linux Wolfi
  • High 8.4
    CVE-2023-45303

    ThingsBoard Server-Side Template Injection

    ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker supports freemarker.template.utility.Execute (for content sent to the /api/admin/settings endpoint).

    org.thingsboard:thingsboard Maven
  • Critical 9.8
    CVE-2023-45311

    Code injection in fsevents

    fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a…

    qtwebengine-opensource-src npm fsevents Ubuntu npm
  • Unscored —
    CVE-2023-44061 Public exploit

    File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary c…

  • Medium 5.4
    CVE-2023-44764 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44762 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44770 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44761 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44765 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.

    concrete5/concrete5 Packagist
  • Unscored —
    CVE-2023-44860 EPSS 23%

    An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization…

  • Medium 5.4
    CVE-2023-44771 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.

    tribalsystems/zenario Packagist
  • Unscored —
    CVE-2023-44807

    D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function.

  • Medium 5.4
    CVE-2023-44766 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made …

    concrete5/concrete5 Packagist
  • Unscored —
    CVE-2023-44758 Public exploit

    GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary co…