Skip to content
OpenAdvisories

Archive

16 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /16 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

87 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-45149

    Password of talk conversations can be bruteforced in Nextcloud

    Nextcloud talk is a chat module for the Nextcloud server platform. In affected versions brute force protection of public talk conversation passwords can be bypassed, as there was an endpoint validating the conversation password without registering bruteforce …

    Nextcloud security-advisories
  • Medium 4.3
    CVE-2023-45148

    Rate limiter not working reliable when Memcached is installed in Nextcloud

    Nextcloud is an open source home cloud server. When Memcached is used as `memcache.distributed` the rate limiting in Nextcloud Server could be reset unexpectedly resetting the rate count earlier than intended. Users are advised to upgrade to versions 25.0.11,…

    Nextcloud security-advisories
  • Medium 6.5
    CVE-2023-45151

    OAuth2 client_secret stored in plain text in the Nextcloud database

    Nextcloud server is an open source home cloud platform. Affected versions of Nextcloud stored OAuth2 tokens in plaintext which allows an attacker who has gained access to the server to potentially elevate their privilege. This issue has been addressed and use…

    Nextcloud security-advisories
  • Medium 4.3
    CVE-2023-45660

    Require strict cookies for image proxy requests in Nextcloud Mail

    Nextcloud mail is an email app for the Nextcloud home server platform. In affected versions a missing check of origin, target and cookies allows for an attacker to abuse the proxy endpoint to denial of service a third server. It is recommended that the Nextcl…

    Nextcloud security-advisories
  • Medium 4.8
    CVE-2023-45669

    Improper signature counter value handling in webauthn4j-spring-security

    WebAuthn4J Spring Security provides Web Authentication specification support for Spring applications. Affected versions are subject to improper signature counter value handling. A flaw was found in webauthn4j-spring-security-core. When an authneticator return…

    webauthn4j webauthn4j-spring-security com.webauthn4j:webauthn4j-spring-security-core Maven
  • Medium 4.3
    CVE-2023-46087

    WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mahlamusa Who Hit The Page – Hit Counter plugin <= 1.4.14.3 versions.

    Mahlamusa Who Hit The Page – Hit Counter
  • Medium 5.9
    CVE-2023-46066

    WordPress Mediabay Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Codedrafty Mediabay – Media Library Folders plugin <= 1.6 versions.

    Codedrafty Mediabay – Media Library Folders
  • Medium 5.9
    CVE-2023-44987

    WordPress Timely Booking Button Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Timely - Appointment software Timely Booking Button plugin <= 2.0.2 versions.

    Timely - Appointment software Timely Booking Button
  • Medium 5.9
    CVE-2023-44986

    WordPress Abandoned Cart Lite for WooCommerce Plugin <= 5.15.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tyche Softwares Abandoned Cart Lite for WooCommerce plugin <= 5.15.2 versions.

    Tyche Softwares Abandoned Cart Lite for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-44985

    WordPress BuddyMeet Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributo+) Stored Cross-Site Scripting (XSS) vulnerability in Cytech BuddyMeet plugin <= 2.2.0 versions.

    Cytech BuddyMeet
  • Medium 6.5
    CVE-2023-44984

    WordPress bbp style pack Plugin <= 5.6.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Robin Wilson bbp style pack plugin <= 5.6.7 versions.

    Robin Wilson bbp style pack
  • Medium 5.9
    CVE-2023-44229

    WordPress Tiny Carousel Horizontal Slider Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Tiny Carousel Horizontal Slider plugin <= 8.1 versions.

    Gopi Ramasamy Tiny Carousel Horizontal Slider
  • Medium 4.3
    CVE-2023-45836

    WordPress Ultimate Taxonomy Manager Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in XYDAC Ultimate Taxonomy Manager plugin <= 2.0 versions.

    XYDAC Ultimate Taxonomy Manager
  • Medium 5.4
    CVE-2023-45831

    WordPress AMP WP Plugin <= 1.5.15 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress plugin <= 1.5.15 versions.

    Pixelative, Mohsin Rafique AMP WP – Google AMP For WordPress Web / CMS
  • Medium 5.4
    CVE-2023-45763

    WordPress Taggbox Plugin <= 2.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Taggbox plugin <= 2.9 versions.

    Taggbox Taggbox
  • Medium 4.3
    CVE-2023-45753

    WordPress which template file Plugin <= 4.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gilles Dumas which template file plugin <= 4.6.0 versions.

    Gilles Dumas which template file
  • Medium 4.3
    CVE-2023-45752

    WordPress Post Gallery Plugin <= 2.3.12 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in 10 Quality Post Gallery plugin <= 2.3.12 versions.

    10 Quality Post Gallery
  • Medium 4.3
    CVE-2023-45749

    WordPress AGP Font Awesome Collection Plugin <= 3.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Alexey Golubnichenko AGP Font Awesome Collection plugin <= 3.2.4 versions.

    Alexey Golubnichenko AGP Font Awesome Collection
  • Medium 4.3
    CVE-2023-45748

    WordPress MailChimp Forms by MailMunch Plugin <= 3.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in MailMunch MailChimp Forms by MailMunch plugin <= 3.1.4 versions.

    mailmunch MailChimp Forms by MailMunch
  • Medium 5.4
    CVE-2023-45647

    WordPress Constant Contact Forms by MailMunch Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in MailMunch Constant Contact Forms by MailMunch plugin <= 2.0.10 versions.

    mailmunch Constant Contact Forms by MailMunch
  • Medium 5.4
    CVE-2023-45645

    WordPress WP Open Street Map Plugin <= 1.25 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in InfoD74 WP Open Street Map plugin <= 1.25 versions.

    InfoD74 WP Open Street Map
  • Medium 4.3
    CVE-2023-45643

    WordPress CPT Shortcode Generator Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions.

    Anurag Deshmukh CPT Shortcode Generator
  • Medium 5.4
    CVE-2023-45642

    WordPress Snap Pixel Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Hassan Ali Snap Pixel plugin <= 1.5.7 versions.

    Hassan Ali Snap Pixel
  • Medium 5.5
    CVE-2023-4457

    Google Sheets data source plugin for Grafana information disclosure vulnerability

    Grafana is an open-source platform for monitoring and observability. The Google Sheets data source plugin for Grafana, versions 0.9.0 to 1.2.2 are vulnerable to an information disclosure vulnerability. The plugin did not properly sanitize error messages, maki…

    Grafana google-sheets-datasource github.com/grafana/google-sheets-datasource Go
  • Medium 5.4
    CVE-2023-45641

    WordPress Caret Country Access Limit Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Caret Inc. Caret Country Access Limit plugin <= 1.0.2 versions.

    Caret Caret Country Access Limit
  • Medium 4.3
    CVE-2023-45639

    WordPress Sort SearchResult By Title Plugin <= 10.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Codex-m Sort SearchResult By Title plugin <= 10.0 versions.

    Codex-m Sort SearchResult By Title
  • Medium 6.5
    CVE-2023-45638

    WordPress Eupago Gateway For Woocommerce Plugin <= 3.1.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in euPago Eupago Gateway For Woocommerce plugin <= 3.1.9 versions.

    Eupago Eupago Gateway For Woocommerce Web / CMS
  • Medium 5.4
    CVE-2023-45656

    WordPress Lazy Load for Videos Plugin <= 2.18.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kevin Weber Lazy Load for Videos plugin <= 2.18.2 versions.

    Kevin Weber Lazy Load for Videos
  • Medium 4.3
    CVE-2023-45655

    WordPress PixFields Plugin <= 0.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PixelGrade PixFields plugin <= 0.7.0 versions.

    pixelgrade PixFields
  • Medium 4.3
    CVE-2023-45654

    WordPress Comments Ratings Plugin <= 1.1.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions.

    pixelgrade Comments Ratings
  • Medium 6.7
    CVE-2023-4822

    Grafana privilege escalation vulnerability

    Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Or…

    Grafana Grafana Enterprise grafana github.com/grafana/grafana Web / CMS Ubuntu Go
  • Medium 4.3
    CVE-2023-45653

    WordPress Video Playlist For YouTube Plugin <= 6.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Video Playlist For YouTube plugin <= 6.0 versions.

    Galaxy Weblinks Video Playlist For YouTube
  • Medium 4.3
    CVE-2023-45651

    WordPress WP Attachments Plugin <= 5.0.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi WP Attachments allows Cross Site Request Forgery.This issue affects WP Attachments: from n/a through 5.0.11.

    Marco Milesi WP Attachments
  • Medium 4.3
    CVE-2023-4834

    In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an…

    Helmholz Red Lion Europe myREX24.virtual myREX24
  • Medium 4.3
    CVE-2023-45650

    WordPress HTML5 Maps Plugin <= 1.7.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fla-shop.Com HTML5 Maps plugin <= 1.7.1.4 versions.

    Fla-shop.com HTML5 Maps
  • Medium 6.1
    CVE-2023-4620

    Booking Calendar < 9.7.3.1 - Unauthenticated Stored XSS

    The Booking Calendar WordPress plugin before 9.7.3.1 does not sanitize and escape some of its booking from data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators

    Web / CMS
  • Medium 5.4
    CVE-2023-45629

    WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.

    wpdevart Gallery – Image and Video Gallery with Thumbnails
  • Medium 4.3
    CVE-2023-45606

    WordPress Simple URLs Plugin <= 120 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Lasso Simple URLs plugin <= 120 versions.

    Lasso Simple URLs
  • Medium 4.3
    CVE-2023-45605

    WordPress Feed Statistics Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Christopher Finke Feed Statistics plugin <= 4.1 versions.

    Christopher Finke Feed Statistics
  • Medium 5.1
    CVE-2023-5595

    Denial of Service in gpac/gpac

    Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV.

    gpac gpac/gpac gpac gpac Debian Ubuntu