Skip to content
OpenAdvisories

Archive

13 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /13 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

64 results · Feed

  • Medium 6.5
    CVE-2023-38000

    Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block

    Auth. Stored (contributor+) Cross-Site Scripting (XSS) vulnerability in WordPress core 6.3 through 6.3.1, from 6.2 through 6.2.2, from 6.1 through 6.1.3, from 6.0 through 6.0.5, from 5.9 through 5.9.7 and Gutenberg plugin <= 16.8.0 versions.

    WordPress Gutenberg Team WordPress Gutenberg Web / CMS Debian Ubuntu
  • Critical 10.0
    CVE-2023-5572

    Server-Side Request Forgery (SSRF) in vriteio/vrite

    Server-Side Request Forgery (SSRF) in GitHub repository vriteio/vrite prior to 0.3.0.

    vriteio vriteio/vrite @vrite/sdk npm
  • Medium 6.5
    CVE-2023-5571

    Improper Input Validation in vriteio/vrite

    Improper Input Validation in GitHub repository vriteio/vrite prior to 0.3.0.

    vriteio vriteio/vrite @vrite/sdk npm
  • Medium 5.3
    CVE-2023-38251

    Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Uncontrolled Resource Consumption vulnerability that could lead in minor application denial-of-service. Exploitation…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.7
    CVE-2023-38219

    Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject maliciou…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 7.5
    CVE-2023-38220

    Full page cache enumeration via cookie X-Magento-Vary

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Authorization vulnerability that could lead in a security feature bypass in a way that an attacker could a…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 4.9
    CVE-2023-26367

    Error based file extraction via PHP filter chains during product bulk import logic

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read by an admin-privilege authent…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 6.8
    CVE-2023-26366

    Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to arbitrary file system read. A high-privileged au…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.8
    CVE-2023-38218

    Incorrect Authorization - Customer account takeover

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Incorrect Authorization . An authenticated attacker can exploit this to achieve information exposure and privilege …

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.0
    CVE-2023-38250

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead …

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.0
    CVE-2023-38249

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead …

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • High 8.0
    CVE-2023-38221

    Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)

    Adobe Commerce versions 2.4.7-beta1 (and earlier), 2.4.6-p2 (and earlier), 2.4.5-p4 (and earlier) and 2.4.4-p5 (and earlier) are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could lead …

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Medium 5.5
    CVE-2023-42752

    Kernel: integer overflow in igmpv3_newpack leading to exploitable memory access

    An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating `skb_shared_info` in the userspace, which is exploitable in systems without SMAP protection since `skb_shared_info` contains references to function pointers.

    Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-5557

    Tracker-miners: sandbox escape

    A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  • Critical 9.1
    CVE-2023-4562

    Information Disclosure, Information Tampering and Authentication Bypass Vulnerability in MELSEC-F Series main module

    Improper Authentication vulnerability in Mitsubishi Electric Corporation MELSEC-F Series main modules allows a remote unauthenticated attacker to obtain sequence programs from the product or write malicious sequence programs or improper data in the product wi…

    Mitsubishi Electric MELSEC-F Series FX3U-80MT/DS MELSEC-F Series FX3U-128MR/ES MELSEC-F Series FX3U-32MT/ES-A ICS / OT
  • Medium 5.2
    CVE-2023-5564

    Cross-site Scripting (XSS) - Stored in froxlor/froxlor

    Cross-site Scripting (XSS) - Stored in GitHub repository froxlor/froxlor prior to 2.1.0-dev1.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Unscored —
    CVE-2023-45391

    A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7…

  • Unscored —
    CVE-2023-45464

    Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. This vulnerability all…

  • Unscored —
    CVE-2023-45465

    Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in …

  • Unscored —
    CVE-2023-45393

    An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to …

  • Unscored —
    CVE-2023-45466

    Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WP…

  • Unscored —
    CVE-2023-45468

    Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. This vulnerability allows attack…

  • Unscored —
    CVE-2023-45467

    Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the T…

  • High 7.5
    CVE-2023-45463

    Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc funct…