Skip to content
OpenAdvisories

Archive

12 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /12 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

88 results · Feed

  • High 7.5
    CVE-2023-25774

    A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. A set…

    SoftEther VPN SoftEther VPN
  • Medium 5.5
    CVE-2023-32275

    An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01…

    SoftEther VPN SoftEther VPN
  • High 7.3
    CVE-2023-27516

    An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and …

    SoftEther VPN SoftEther VPN
  • High 7.8
    CVE-2023-32634

    An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4…

    SoftEther VPN SoftEther VPN
  • Medium 5.3
    CVE-2023-31192

    An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. A speci…

    SoftEther VPN SoftEther VPN
  • Medium 4.3
    CVE-2023-45106

    WordPress Urvanov Syntax Highlighter Plugin <= 2.8.33 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter plugin <= 2.8.33 versions.

    Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter
  • Medium 4.3
    CVE-2023-45103

    WordPress Permalinks Customizer Plugin <= 2.8.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 versions.

    YAS Global Team Permalinks Customizer
  • Medium 5.4
    CVE-2023-45102

    WordPress Blog Manager Light Plugin <= 1.20 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Blog Manager Light plugin <= 1.20 versions.

    otwthemes Blog Manager Light
  • Medium 4.3
    CVE-2023-41131

    WordPress Sp*tify Play Button for WordPress Plugin <= 2.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Jonk @ Follow me Darling Sp*tify Play Button for WordPress plugin <= 2.10 versions.

    Jonk @ Follow me Darling Sp*tify Play Button for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-32124

    WordPress Publish Confirm Message Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Publish Confirm Message plugin <= 1.3.1 versions.

    Arul Prasad J Publish Confirm Message
  • Medium 6.5
    CVE-2023-27315

    Information Disclosure Vulnerability in SnapGathers

    SnapGathers versions prior to 4.9 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext domain user credentials

    NETAPP SnapGathers
  • Medium 5.4
    CVE-2023-45068

    WordPress Contact Form by Supsystic Plugin <= 1.7.27 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Contact Form by Supsystic plugin <= 1.7.27 versions.

    supsystic Contact Form by Supsystic
  • Medium 4.3
    CVE-2023-45063

    WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in ReCorp AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One plugin <= 1.1.5 versions.

    Recorp AI Content Writing Assistant (Content Writer, GPT 3 & 4, ChatGPT, Image Generator) All in One
  • Medium 5.4
    CVE-2023-45060

    WordPress Interactive World Map Plugin <= 3.2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versions.

    Fla-shop.com Interactive World Map
  • Medium 4.3
    CVE-2023-45058

    WordPress Short URL Plugin <= 1.6.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Short URL plugin <= 1.6.8 versions.

    KaizenCoders Short URL
  • Medium 4.3
    CVE-2023-45052

    WordPress WP Bing Map Pro Plugin < 5.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in dan009 WP Bing Map Pro plugin < 5.0 versions.

    dan009 WP Bing Map Pro
  • Medium 5.4
    CVE-2023-45048

    WordPress Social proof testimonials and reviews by Repuso Plugin <= 5.00 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Repuso Social proof testimonials and reviews by Repuso plugin <= 5.00 versions.

    Repuso Social proof testimonials and reviews by Repuso
  • Medium 4.3
    CVE-2023-45011

    WordPress WP Power Stats Plugin <= 2.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Igor Buyanov WP Power Stats plugin <= 2.2.3 versions.

    Igor Buyanov WP Power Stats
  • Medium 4.3
    CVE-2023-44998

    WordPress Category Meta Plugin <= 1.2.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in josecoelho, Randy Hoyt, steveclarkcouk, Vitaliy Kukin, Eric Le Bail, Tom Ransom Category Meta plugin plugin <= 1.2.8 versions.

    josecoelho, Randy Hoyt, steveclarkcouk, Vitaliy Kukin, Eric Le Bail, Tom Ransom Category Meta plugin
  • Unscored —
    RUSTSEC-2023-0067

    `fehler` is unmaintained; use `culpa` instead

    The [`fehler`](https://crates.io/crates/fehler) crate is no longer maintained. Consider using [`culpa`](https://crates.io/crates/culpa) instead.

    fehler crates.io
  • Critical 9.8
    CVE-2023-5045

    SQLi in Biltay's Kayısı

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Kayisi allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Kayisi: before 1286.

    Biltay Technology Kayisi
  • Critical 9.8
    CVE-2023-5046

    SQLi in Biltay's Procost

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Biltay Technology Procost allows SQL Injection, Command Line Execution through SQL Injection. This issue affects Procost: before 1390.

    Biltay Technology Procost
  • Medium 5.5
    CVE-2023-43789

    Libxpm: out of bounds read on xpm with corrupted colormap

    A vulnerability was found in libXpm where a vulnerability exists due to a boundary condition, a local user can trigger an out-of-bounds read error and read contents of memory on the system.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Critical 9.3
    CVE-2023-23737

    WordPress MainWP Broken Links Checker Extension Plugin <= 4.0 is vulnerable to SQL Injection

    Unauth. SQL Injection (SQLi) vulnerability in MainWP MainWP Broken Links Checker Extension plugin <= 4.0 versions.

    mainwp MainWP Broken Links Checker Extension
  • High 8.5
    CVE-2023-23651

    WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 - SQL Injection vulnerability

    Auth. (subscriber+) SQL Injection (SQLi) vulnerability in MainWP Google Analytics Extension plugin <= 4.0.4 versions.

    mainwp MainWP Google Analytics Extension
  • Medium 5.3
    CVE-2023-5556 Scanner template

    Cross-site Scripting (XSS) - Reflected in structurizr/onpremises

    Cross-site Scripting (XSS) - Reflected in GitHub repository structurizr/onpremises prior to 3194.

    structurizr structurizr/onpremises
  • High 7.1
    CVE-2023-5555

    Cross-site Scripting (XSS) - Generic in frappe/lms

    Cross-site Scripting (XSS) - Generic in GitHub repository frappe/lms prior to 5614a6203fb7d438be8e2b1e3030e4528d170ec4.

    Frappe Technologies frappe/lms
  • Medium 4.8
    CVE-2023-5554

    Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.1…

    LINE LINE client for iOS iOS
  • High 7.1
    CVE-2023-45047

    WordPress LeadSquared Suite Plugin <= 0.7.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LeadSquared, Inc LeadSquared Suite plugin <= 0.7.4 versions.

    LeadSquared LeadSquared Suite
  • Medium 6.4
    CVE-2023-5470

    Etsy Shop <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Etsy Shop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etsy-shop' shortcode in versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo…

    fsheedy Etsy Shop Web / CMS
  • Critical 9.1
    CVE-2023-32724

    JavaScript engine memory pointers are directly available for Zabbix users for modification

    Memory pointer is in a property of the Ducktape object. This leads to multiple vulnerabilities related to direct memory access and manipulation.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • High 8.5
    CVE-2023-32723

    Inefficient permission check in class CControllerAuthenticationUpdate

    Request to LDAP is sent before user permissions are checked.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Critical 9.6
    CVE-2023-32722

    Stack-buffer Overflow in library module zbxjson

    The zabbix/src/libs/zbxjson module is vulnerable to a buffer overflow when parsing JSON files via zbx_json_open.

    Zabbix Zabbix zabbix Debian
  • High 7.6
    CVE-2023-32721

    Stored XSS in Maps element

    A stored XSS has been found in the Zabbix web application in the Maps element if a URL field is set with spaces before URL.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Critical 9.8
    CVE-2023-29453

    Agent 2 package are built with Go version affected by CVE-2023-24538

    Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 4.3
    CVE-2023-5531

    Thumbnail Slider With Lightbox <= 1.0 - Cross-Site Request Forgery

    The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the delete functionality. This makes it possible for unauthentic…

    nik00726 Thumbnail Slider With Lightbox Web / CMS
  • Medium 5.5
    CVE-2023-45511

    A memory leak in tsMuxer version git-2539d07 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.

  • Unscored —
    CVE-2023-45510

    tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new [] vs operator delete) er…

  • Unscored —
    CVE-2023-40829

    There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.…

  • Unscored —
    CVE-2023-40833

    An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosS…