Skip to content
OpenAdvisories

Archive

10 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /10 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

91 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-41684

    WordPress SIS Handball Plugin <= 1.0.45 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Felix Welberg SIS Handball plugin <= 1.0.45 versions.

    Felix Welberg SIS Handball
  • Medium 6.4
    CVE-2023-5468

    Slick Contact Forms <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Slick Contact Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcscf-link' shortcode in versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it …

    remix4 Slick Contact Forms Web / CMS
  • Medium 6.4
    CVE-2023-5467

    GEO my WordPress <= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The GEO my WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for auth…

    ninjew GEO my WP Web / CMS
  • Medium 6.5
    CVE-2023-42477

    Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application)

    SAP NetWeaver AS Java (GRMG Heartbeat application) - version 7.50, allows an attacker to send a crafted request from a vulnerable web application, causing limited impact on confidentiality and integrity of the application.

    SAP SAP NetWeaver AS Java
  • Medium 4.3
    CVE-2023-42475

    Information Disclosure Vulnerability in Statutory Reporting

    The Statutory Reporting application has a vulnerable file storage location, potentially enabling low privileged attacker to read server files with minimal impact on confidentiality.

    SAP SAP S/4Hana Core
  • Medium 6.8
    CVE-2023-42474

    Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence

    SAP BusinessObjects Web Intelligence - version 420, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information.

    SAP SAP BusinessObjects Web Intelligence
  • Medium 5.4
    CVE-2023-42473

    Missing Authorization Check In S/4HANA (Manage Withholding Tax Items)

    S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the application.

    SAP S/4HANA (Manage Withholding Tax Items)
  • Medium 4.3
    CVE-2023-41365

    Information Disclosure vulnerability in SAP Business One (B1i)

    SAP Business One (B1i) - version 10.0, allows an authorized attacker to retrieve the details stack trace of the fault message to conduct the XXE injection, which will lead to information disclosure. After successful exploitation, an attacker can cause limited…

    SAP SAP Business One (B1i)
  • Medium 6.5
    CVE-2023-40310

    Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import

    SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could i…

    SAP SAP PowerDesigner Client
  • Medium 6.3
    CVE-2023-5471

    codeprojects Farmacia index.php sql injection

    A vulnerability, which was classified as critical, was found in codeprojects Farmacia 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument usario/senha leads to sql injection. It is possible to launch the attack remotel…

    code-projects Farmacia
  • Medium 5.4
    CVE-2023-44763 Public exploit

    ConcreteCMS vulnerable to Stored Cross-site Scripting

    Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XSS). NOTE: the vendor's position is that a customer is supposed to know that "pdf" should be excluded from the allowed f…

    concrete5/concrete5 Packagist