Skip to content
OpenAdvisories

Archive

10 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /10 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

91 results · Clear filters · Feed

  • Medium 6.3
    CVE-2023-5492

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform licence.php unrestricted upload

    A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. Affected is an unknown function of the file /sysmanage/licence.php. The manipulation of the argument…

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
  • Medium 6.3
    CVE-2023-5491

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform updatelib.php unrestricted upload

    A vulnerability, which was classified as critical, has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This issue affects some unknown processing of the file /sysmanage/updatelib.php. The manipulati…

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
  • Medium 6.3
    CVE-2023-5490

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform userattestation.php unrestricted upload

    A vulnerability classified as critical was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This vulnerability affects unknown code of the file /useratte/userattestation.php. The manipulation of the argum…

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
  • Medium 4.3
    CVE-2023-44994

    WordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Bainternet ShortCodes UI plugin <= 1.9.8 versions.

    Bainternet ShortCodes UI
  • Medium 6.3
    CVE-2023-5489

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform uploadfile.php unrestricted upload

    A vulnerability classified as critical has been found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. This affects an unknown part of the file /Tool/uploadfile.php. The manipulation of the argument file_upload…

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
  • Medium 4.3
    CVE-2023-44476

    WordPress CopyRightPro Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Andres Felipe Perea V. CopyRightPro plugin <= 2.1 versions.

    Andres Felipe Perea V. CopyRightPro
  • Medium 5.4
    CVE-2023-44475

    WordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Michael Simpson Add Shortcodes Actions And Filters plugin <= 2.0.9 versions.

    Michael Simpson Add Shortcodes Actions And Filters
  • Medium 4.3
    CVE-2023-44471

    WordPress Backend Localization Plugin <= 2.1.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Bernhard Kau Backend Localization plugin <= 2.1.10 versions.

    Bernhard Kau Backend Localization
  • Medium 4.9
    CVE-2023-30804 EPSS 39%

    Sangfor Next-Gen Application Firewall Authenticated File Disclosure

    The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. A remote and authenticated attacker can read arbitrary system files using the svpn_html/loadfile.php endpoint. This issue is exploita…

    Sangfor Next-Gen Application Firewall (NGAF)
  • Medium 5.3
    CVE-2023-30802

    Sangfor Next-Gen Application Firewall Source Code Disclosure

    The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to a source code disclosure vulnerability. A remote and unauthenticated attacker can obtain PHP source code by sending an HTTP request with an invalid Content-Length field.

    Sangfor Net-Gen Application Firewall
  • Medium 6.3
    CVE-2023-5488

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform updatelib.php unrestricted upload

    A vulnerability was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230928. It has been rated as critical. Affected by this issue is some unknown functionality of the file /sysmanage/updatelib.php. The manipulat…

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform
  • Medium 5.4
    CVE-2023-44470

    WordPress Kv TinyMCE Editor Add Fonts Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kvvaradha Kv TinyMCE Editor Add Fonts plugin <= 1.1 versions.

    kvvaradha Kv TinyMCE Editor Add Fonts
  • Medium 4.3
    CVE-2023-44241

    WordPress Keap Landing Pages Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Keap Keap Landing Pages plugin <= 1.4.2 versions.

    Keap Keap Landing Pages
  • Medium 4.4
    CVE-2023-45219

    BIG-IP tmsh vulnerability

    Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may allow an authenticated attacker with resource administrator role privileges to view sensitive information.   Note: Software versions which have …

    F5 BIG-IP Network devices
  • Medium 5.5
    CVE-2023-43485

    BIGIP and BIG-IQ TACACS+ audit log Vulnerability

    When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP BIG-IQ Network devices
  • Medium 4.3
    CVE-2023-41964

    BIG-IP and BIG-IQ Database Variable vulnerability

    The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP BIG-IQ Network devices
  • Medium 5.5
    CVE-2023-41253

    BIG-IP DNS TSIG Key vulnerability

    When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the audit log.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Network devices
  • Medium 4.4
    CVE-2023-39447

    BIG-IP APM Guided Configuration vulnerability

    When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Network devices
  • Medium 5.5
    CVE-2023-43788

    Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer()

    A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Medium 5.5
    CVE-2023-43786 Public exploit

    Libx11: stack exhaustion from infinite recursion in putsubimage()

    A vulnerability was found in libX11 due to an infinite loop within the PutSubImage() function. This flaw allows a local user to consume all available system resources and cause a denial of service condition.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2023-43785

    Libx11: out-of-bounds memory access in _xkbreadkeysyms()

    A vulnerability was found in libX11 due to a boundary condition within the _XkbReadKeySyms() function. This flaw allows a local user to trigger an out-of-bounds read error and read the contents of memory on the system.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Medium 4.7
    CVE-2023-44315

    A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application improperly sanitizes c…

    Siemens SINEC NMS ICS / OT
  • Medium 5.3
    CVE-2023-43623

    A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions < V5.4.0), Mendix Fo…

    Siemens Mendix Forgot Password (Mendix 8 compatible) Mendix Forgot Password (Mendix 7 compatible) Mendix Forgot Password (Mendix 9 compatible) ICS / OT
  • Medium 6.6
    CVE-2023-38640

    A vulnerability has been identified in SICAM PAS/PQS (All versions >= V8.00 < V8.22). The affected application is insta…

    Siemens SICAM PAS/PQS ICS / OT
  • Medium 4.4
    CVE-2023-37195

    A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 …

    Siemens SIMATIC CP 1604 SIMATIC CP 1616 SIMATIC CP 1626 ICS / OT
  • Medium 6.7
    CVE-2023-37194

    A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 …

    Siemens SIMATIC CP 1604 SIMATIC CP 1616 SIMATIC CP 1626 ICS / OT
  • Medium 4.3
    CVE-2023-5498

    Cross-Site Request Forgery (CSRF) in chiefonboarding/chiefonboarding

    Cross-Site Request Forgery (CSRF) in GitHub repository chiefonboarding/chiefonboarding prior to v2.0.47.

    chiefonboarding chiefonboarding/chiefonboarding
  • Medium 4.3
    CVE-2023-44261

    WordPress Block Plugin Update Plugin <= 3.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dinesh Karki Block Plugin Update plugin <= 3.3 versions.

    Dinesh Karki Block Plugin Update
  • Medium 4.3
    CVE-2023-44259

    WordPress Mediavine Control Panel Plugin <= 2.10.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mediavine Mediavine Control Panel plugin <= 2.10.2 versions.

    mediavine Mediavine Control Panel
  • Medium 4.3
    CVE-2023-44257

    WordPress Mang Board WP Plugin <= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Hometory Mang Board WP plugin <= 1.7.6 versions.

    Hometory Mang Board WP
  • Medium 4.3
    CVE-2023-41876

    WordPress WP Gallery Metabox Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Hardik Kalathiya WP Gallery Metabox plugin <= 1.0.0 versions.

    Hardik Kalathiya WP Gallery Metabox
  • Medium 4.3
    CVE-2023-41858

    WordPress Order Delivery Date for WP e-Commerce Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Ashok Rane Order Delivery Date for WP e-Commerce plugin <= 1.2 versions.

    Ashok Rane Order Delivery Date for WP e-Commerce
  • Medium 5.4
    CVE-2023-41854

    WordPress wpCentral Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Softaculous Ltd. WpCentral plugin <= 1.5.7 versions.

    Softaculous wpCentral
  • Medium 4.3
    CVE-2023-41853

    WordPress WP iCal Availability Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP iCal Availability plugin <= 1.0.3 versions.

    WP iCal Availability WP iCal Availability
  • Medium 4.3
    CVE-2023-41852

    WordPress MailMunch – Grow your Email List Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailMunch – Grow your Email List plugin <= 3.1.2 versions.

    mailmunch MailMunch – Grow your Email List
  • Medium 4.3
    CVE-2023-41851

    WordPress WP Custom Post Template Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dotsquares WP Custom Post Template <= 1.0 versions.

    Dotsquares WP Custom Post Template
  • Medium 4.3
    CVE-2023-41850

    WordPress Outbound Link Manager Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Morris Bryant, Ruben Sargsyan Outbound Link Manager plugin <= 1.2 versions.

    Morris Bryant, Ruben Sargsyan Outbound Link Manager
  • Medium 4.3
    CVE-2023-41730

    WordPress SendPress Newsletters Plugin <= 1.22.3.31 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in SendPress Newsletters plugin <= 1.22.3.31 versions.

    SendPress SendPress Newsletters
  • Medium 4.3
    CVE-2023-41697

    WordPress Easy WP Cleaner Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Nikunj Soni Easy WP Cleaner plugin <= 1.9 versions.

    Nikunj Soni Easy WP Cleaner
  • Medium 4.3
    CVE-2023-41694

    WordPress Realbig Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Realbig Team Realbig For WordPress plugin <= 1.0.3 versions.

    Realbig Team Realbig For WordPress Web / CMS