Skip to content
OpenAdvisories

Archive

18 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /18 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

29 results · Clear filters · Feed

  • Medium 5.4
    CVE-2023-36857

    Baker Hughes Bently Nevada 3500 System Authentication Bypass by Capture-replay

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a replay vulnerability which could allow an attacker to replay older captured packets of traffic to the device to gain access.

    Baker Hughes - Bently Nevada Bently Nevada 3500 System
  • Medium 6.8
    CVE-2023-34441

    Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive Information

    Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a cleartext transmission vulnerability which could allow an attacker to steal the authentication secret from communication traffic to the device and reuse it for arbitrary requests.

    Baker Hughes - Bently Nevada Bently Nevada 3500 System
  • Medium 5.3
    CVE-2023-45814

    Tokens cached in the AuthenticationService are susceptible to reuse in Bunkum

    Bunkum is an open-source protocol-agnostic request server for custom game servers. First, a little bit of background. So, in the beginning, Bunkum's `AuthenticationService` only supported injecting `IUser`s. However, as Refresh and SoundShapesServer implement…

    LittleBigRefresh Bunkum Bunkum NuGet
  • Medium 6.1
    CVE-2023-43801

    Path traversal in Arduino Create Agent

    Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the loc…

    arduino arduino-create-agent github.com/arduino/arduino-create-agent Go
  • Medium 6.1
    CVE-2023-43803

    Path traversal in Arduino Create Agent

    Arduino Create Agent is a package to help manage Arduino development. This vulnerability affects the endpoint `/v2/pkgs/tools/installed` and the way it handles plugin names supplied as user input. A user who has the ability to perform HTTP requests to the loc…

    arduino arduino-create-agent github.com/arduino/arduino-create-agent Go
  • Medium 4.6
    CVE-2023-45813

    Inefficient Regular Expression Complexity in TorBot

    Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows …

    DedSecInside TorBot torbot PyPI
  • Medium 6.8
    CVE-2023-30911

    HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service.

    Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out
  • Medium 6.5
    CVE-2023-20261

    A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retriev…

    Cisco Cisco SD-WAN vManage Network devices
  • Medium 6.1
    CVE-2023-5631 Exploited EPSS 76%

    Stored XSS vulnerability in Roundcube

    Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary Java…

    Roundcube Roundcubemail roundcube roundcube Debian Ubuntu
    KEV Oct 26, 2023
  • Medium 6.5
    CVE-2023-45628

    WordPress QR Twitter Widget Plugin <= 0.2.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions.

    QROkes QR Twitter Widget
  • Medium 5.9
    CVE-2023-45604

    WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions.

    Scott Reilly Get Custom Field Values
  • Medium 6.5
    CVE-2023-45607

    WordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions.

    Hector Cabrera WordPress Popular Posts Web / CMS
  • Medium 6.5
    CVE-2023-45608

    WordPress Smart Cookie Kit Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Nicola Modugno Smart Cookie Kit plugin <= 2.3.1 versions.

    Nicola Modugno Smart Cookie Kit
  • Medium 5.9
    CVE-2023-45073

    WordPress Mendeley Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <= 1.3.2 versions.

    Michael Koch Mendeley Plugin
  • Medium 6.5
    CVE-2023-31217

    WordPress User Location and IP Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions.

    MyTechTalky User Location and IP
  • Medium 5.9
    CVE-2023-45072

    WordPress Order auto complete for WooCommerce Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions.

    Kardi Order auto complete for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-45067

    WordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.

    Ashish Ajani WordPress Simple HTML Sitemap Web / CMS
  • Medium 4.6
    CVE-2023-32089

    Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description

    Pega Systems Pega Platform
  • Medium 4.6
    CVE-2023-32088

    Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation

    Pega Systems Pega Platform
  • Medium 4.6
    CVE-2023-32087

    Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation

    Pega Systems Pega Platform
  • Medium 6.5
    CVE-2023-45059

    WordPress Gumroad Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <= 3.1.0 versions.

    Gumroad Gumroad
  • Medium 5.9
    CVE-2023-45057

    WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions.

    Hitsteps Hitsteps Web Analytics
  • Medium 5.9
    CVE-2023-45056

    WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.

    100plugins Open User Map
  • Medium 5.9
    CVE-2023-45051

    WordPress Image vertical reel scroll slideshow Plugin <= 9.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions.

    Gopi Ramasamy Image vertical reel scroll slideshow
  • Medium 6.5
    CVE-2023-45049

    WordPress YouTube Playlist Player Plugin <= 4.6.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.7 versions.

    Ciprian Popescu YouTube Playlist Player
  • Medium 5.9
    CVE-2023-45008

    WordPress Comment Reply Email Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions.

    WPJohnny Comment Reply Email
  • Medium 4.3
    CVE-2023-4938

    BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation

    The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attacke…

    RealMag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Web / CMS
  • Medium 4.4
    CVE-2023-5621

    Thumbnail Slider With Lightbox <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Image Title

    The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authent…

    nik00726 Thumbnail Slider With Lightbox Web / CMS
  • Medium 4.3
    CVE-2023-3254

    Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset

    The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthentic…

    trustindex Widgets for Google Reviews Web / CMS