Skip to content
OpenAdvisories

Archive

18 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /18 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

24 results · Clear filters · Feed

  • High 7.5
    CVE-2023-34437

    Baker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical Resource

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality which could allow an attacker to access passwords stored on the device.

    Baker Hughes - Bently Nevada Bently Nevada 3500 System
  • High 7.5
    CVE-2023-45812

    Improper Check or Handling of Exceptional Conditions in apollo-router

    The Apollo Router is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation. Affected versions are subject to a Denial-of-Service (DoS) type vulnerability which causes the Router to panic and te…

    apollographql router apollo-router crates.io
  • High 7.3
    CVE-2023-43800

    Insufficient Verification of Data Authenticity in Arduino Create Agent

    Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A user who has the ability to perform HTTP requests to the localhost interface, or is able to bypass the CORS configuratio…

    arduino arduino-create-agent github.com/arduino/arduino-create-agent Go
  • High 7.1
    CVE-2023-43802

    Path traversal in Arduino Create Agent

    Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/upload` which handles request with the `filename` parameter. A user who has the ability to perform HTTP requests to the localhost interface, or is …

    arduino arduino-create-agent github.com/arduino/arduino-create-agent Go
  • High 8.1
    CVE-2023-4601

    Stack-based Buffer Overflow in NI System Configuration Software

    A stack-based buffer overflow vulnerability exists in NI System Configuration that could result in information disclosure and/or arbitrary code execution. Successful exploitation requires that an attacker can provide a specially crafted response. This affects…

    NI System Configuration
  • High 7.1
    CVE-2023-30781

    WordPress Tweeple Plugin <= 0.9.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Theme Blvd Tweeple plugin <= 0.9.5 versions.

    Theme Blvd Tweeple
  • High 7.1
    CVE-2023-45632

    WordPress Video Player Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado SpiderVPlayer plugin <= 1.5.22 versions.

    WebDorado SpiderVPlayer
  • High 7.1
    CVE-2023-45630

    WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.3 versions.

    wpdevart Gallery – Image and Video Gallery with Thumbnails
  • High 7.1
    CVE-2023-45602

    WordPress Ebook Store Plugin <= 5.785 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Shopfiles Ltd Ebook Store plugin <= 5.785 versions.

    Shopfiles Ebook Store
  • High 7.1
    CVE-2023-45071

    WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Stored Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.

    10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
  • High 7.1
    CVE-2023-45070

    WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin <= 1.15.18 versions.

    10Web Form Builder Team Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
  • High 7.1
    CVE-2023-45065

    WordPress Bulk NoIndex & NoFollow Toolkit Plugin <= 1.42 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Mad Fish Digital Bulk NoIndex & NoFollow Toolkit plugin <= 1.42 versions.

    Mad Fish Digital Bulk NoIndex & NoFollow Toolkit
  • High 7.5
    CVE-2023-45727 Exploited

    Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail …

    North Grid Proself Gateway Edition Proself Enterprise/Standard Edition Proself Mail Sanitize Edition
    KEV Dec 3, 2024
  • High 7.1
    CVE-2023-45064

    WordPress OPcache Dashboard Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <= 0.3.1 versions.

    Daisuke Takahashi(Extend Wings) OPcache Dashboard
  • High 7.1
    CVE-2023-45062

    WordPress Download canvasio3D Light Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <= 2.4.6 versions.

    Thomas Scholl canvasio3D Light
  • High 7.5
    CVE-2023-5632

    Unconditionally adding an event to the epoll causes excessive CPU consumption

    In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of…

    Eclipse Foundation Mosquitto mosquitto Debian
  • High 7.1
    CVE-2023-45054

    WordPress Product Category Tree Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions.

    AWESOME TOGI Product Category Tree
  • High 7.1
    CVE-2023-25476

    WordPress AmpedSense – AdSense Split Tester Plugin <= 4.68 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense – AdSense Split Tester plugin <= 4.68 versions.

    ezoic AmpedSense – AdSense Split Tester
  • High 7.2
    CVE-2023-5538 Public exploit

    MpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting

    The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att…

    burningx mpOperationLogs Web / CMS
  • High 7.7
    CVE-2023-39331

    A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traver…

    Node.js node nodejs-current nodejs-20 Alpine Wolfi
  • High 8.8
    CVE-2023-38545 Public exploit EPSS 78%

    This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2023-45383

    In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest …

  • High 7.5
    CVE-2023-42319

    go-ethereum vulnerable to denial of service via crafted GraphQL query

    Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] des…

    github.com/ethereum/go-ethereum Go
  • High 7.8
    CVE-2023-43250

    XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attacke…