Skip to content
OpenAdvisories

Archive

9 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /9 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

85 results · Feed

  • High 8.2
    CVE-2023-43696

    Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary file…

    SICK APU0200
  • High 7.1
    CVE-2023-45247

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Ac…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 16
  • Medium 6.6
    CVE-2023-45248

    Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 16
  • Medium 4.3
    CVE-2023-5333

    Denial of Service via multiple identical User IDs in /api/v4/users/ids

    Mattermost fails to deduplicate input IDs allowing a simple user to cause the application to consume excessive resources and possibly crash by sending a specially crafted request to /api/v4/users/ids with multiple identical IDs.

    Mattermost Mattermost
  • Medium 4.3
    CVE-2023-5331

    File Information Leak via IDOR in file_id in Draft Posts

    Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.

    Mattermost Mattermost
  • Medium 4.3
    CVE-2023-5330

    Denial of Service via Opengraph Data Cache

    Mattermost fails to enforce a limit for the size of the cache entry for OpenGraph data allowing an attacker to send a specially crafted request to the /api/v4/opengraph filling the cache and turning the server unavailable.

    Mattermost Mattermost
  • Medium 6.8
    CVE-2023-45613

    In JetBrains Ktor before 2.3.5 server certificates were not verified

    JetBrains Ktor
  • High 8.6
    CVE-2023-45612 Public exploit

    In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE

    JetBrains Ktor
  • Medium 4.3
    CVE-2023-44993

    WordPress ChatBot Plugin <= 4.7.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.7.8 versions.

    Quantum Cloud AI ChatBot
  • Medium 5.4
    CVE-2023-44473

    WordPress Table of Contents Plus Plugin <= 2302 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Michael Tran Table of Contents Plus plugin <= 2302 versions.

    Michael Tran Table of Contents Plus
  • Medium 4.3
    CVE-2023-44240

    WordPress Timthumb Vulnerability Scanner Plugin <= 1.54 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Peter Butler Timthumb Vulnerability Scanner plugin <= 1.54 versions.

    Peter Butler Timthumb Vulnerability Scanner
  • Medium 4.3
    CVE-2023-44246

    WordPress Shockingly Simple Favicon Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Matias s Shockingly Simple Favicon plugin <= 1.8.2 versions.

    Matias s Shockingly Simple Favicon
  • Medium 4.3
    CVE-2023-44238

    WordPress Remove slug from custom post type Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Joakim Ling Remove slug from custom post type plugin <= 1.0.3 versions.

    Joakim Ling Remove slug from custom post type
  • Medium 4.3
    CVE-2023-44237

    WordPress WP Site Protector Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Moriyan Jay WP Site Protector plugin <= 2.0 versions.

    Moriyan Jay WP Site Protector
  • Medium 5.4
    CVE-2023-44236

    WordPress WP Captcha Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Devnath verma WP Captcha plugin <= 2.0.0 versions.

    Devnath verma WP Captcha
  • Medium 6.8
    CVE-2023-3589

    Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x

    A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x could allow with some very specific conditions an attacker to send a specifically crafted query to the server.

    Dassault Systèmes Teamwork Cloud - Enterprise Edition Teamwork Cloud - Standard Edition Teamwork Cloud - Business Pro Edition
  • Medium 4.3
    CVE-2023-44232

    WordPress WP Hide Pages Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Huseyin Berberoglu WP Hide Pages plugin <= 1.0 versions.

    Huseyin Berberoglu WP Hide Pages
  • Medium 4.3
    CVE-2023-44231

    WordPress Contact Form Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in NickDuncan Contact Form plugin <= 2.0.10 versions.

    NickDuncan Contact Form
  • Medium 4.3
    CVE-2023-44260

    WordPress Woocommerce ESTO Plugin <= 2.23.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mikk Mihkel Nurges, Rebing OÜ Woocommerce ESTO plugin <= 2.23.1 versions.

    Mikk Mihkel Nurges, Rebing OÜ Woocommerce ESTO Web / CMS
  • Unscored —
    CVE-2023-39854

    The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the …

  • Unscored —
    CVE-2023-45371

    An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, an…

  • Unscored —
    CVE-2023-45373

    An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.…

  • Unscored —
    CVE-2023-45372

    An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, an…

  • Unscored —
    CVE-2023-45370

    An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5,…

  • Unscored —
    CVE-2023-45350

    Atos Unify OpenScape 4000 Manager V10 R1 before V10 R1.42.1 and 4000 Manager V10 R0 allow Privilege escalation that may…

  • Unscored —
    CVE-2023-45367

    An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, a…

  • Unscored —
    CVE-2023-45353

    Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to…

  • Unscored —
    CVE-2023-45355

    Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix …

  • Unscored —
    CVE-2023-45349

    Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.34.7, 4000 Assistant V10 R1.42.0, 4000 Assistant V10 R0, 4000 …

  • Unscored —
    CVE-2023-45364

    An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before…

    mediawiki mediawiki Debian Ubuntu
  • Unscored —
    CVE-2023-45352

    Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to…

  • High 7.5
    CVE-2023-45363 EPSS 24%

    MediaWiki Denial of Service vulnerability

    An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected …

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Unscored —
    CVE-2023-45351

    Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1…

  • Unscored —
    CVE-2023-45374

    An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5,…

  • Unscored —
    CVE-2023-45369

    An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, …

  • Unscored —
    CVE-2023-45356

    Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000 and Manager Platform V10 R1 before Hotfix V10 …

  • Unscored —
    CVE-2023-45354

    Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated remote atta…

  • Unscored —
    CVE-2023-44811 Public exploit

    Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code…

  • Unscored —
    CVE-2023-44813 Public exploit Scanner template

    Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a …

  • Unscored —
    CVE-2023-44821

    Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a deni…

    gifsicle Debian