Skip to content
OpenAdvisories

Archive

18 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /18 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

74 results · Feed

  • High 7.1
    CVE-2023-45064

    WordPress OPcache Dashboard Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Daisuke Takahashi(Extend Wings) OPcache Dashboard plugin <= 0.3.1 versions.

    Daisuke Takahashi(Extend Wings) OPcache Dashboard
  • High 7.1
    CVE-2023-45062

    WordPress Download canvasio3D Light Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Thomas Scholl canvasio3D Light plugin <= 2.4.6 versions.

    Thomas Scholl canvasio3D Light
  • High 7.5
    CVE-2023-5632

    Unconditionally adding an event to the epoll causes excessive CPU consumption

    In Eclipse Mosquito before and including 2.0.5, establishing a connection to the mosquitto server without sending data causes the EPOLLOUT event to be added, which results excessive CPU consumption. This could be used by a malicious actor to perform denial of…

    Eclipse Foundation Mosquitto mosquitto Debian
  • Medium 6.5
    CVE-2023-45059

    WordPress Gumroad Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <= 3.1.0 versions.

    Gumroad Gumroad
  • Medium 5.9
    CVE-2023-45057

    WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions.

    Hitsteps Hitsteps Web Analytics
  • Medium 5.9
    CVE-2023-45056

    WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.

    100plugins Open User Map
  • High 7.1
    CVE-2023-45054

    WordPress Product Category Tree Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in AWESOME TOGI Product Category Tree plugin <= 2.5 versions.

    AWESOME TOGI Product Category Tree
  • Medium 5.9
    CVE-2023-45051

    WordPress Image vertical reel scroll slideshow Plugin <= 9.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions.

    Gopi Ramasamy Image vertical reel scroll slideshow
  • Medium 6.5
    CVE-2023-45049

    WordPress YouTube Playlist Player Plugin <= 4.6.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.7 versions.

    Ciprian Popescu YouTube Playlist Player
  • High 7.1
    CVE-2023-25476

    WordPress AmpedSense – AdSense Split Tester Plugin <= 4.68 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ezoic AmpedSense – AdSense Split Tester plugin <= 4.68 versions.

    ezoic AmpedSense – AdSense Split Tester
  • Medium 5.9
    CVE-2023-45008

    WordPress Comment Reply Email Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions.

    WPJohnny Comment Reply Email
  • Medium 4.3
    CVE-2023-4938

    BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation

    The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attacke…

    RealMag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Web / CMS
  • Medium 4.4
    CVE-2023-5621

    Thumbnail Slider With Lightbox <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Image Title

    The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authent…

    nik00726 Thumbnail Slider With Lightbox Web / CMS
  • Medium 4.3
    CVE-2023-3254

    Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset

    The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthentic…

    trustindex Widgets for Google Reviews Web / CMS
  • High 7.2
    CVE-2023-5538 Public exploit

    MpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting

    The MpOperationLogs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the IP Request Headers in versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att…

    burningx mpOperationLogs Web / CMS
  • High 7.7
    CVE-2023-39331

    A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6. The new path traver…

    Node.js node nodejs-current nodejs-20 Alpine Wolfi
  • Unscored —
    CVE-2023-39332

    Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects. In Node.js environments, …

    Node.js node nodejs-current nodejs-20 Alpine Wolfi
  • Unscored —
    CVE-2023-38552

    When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can inte…

    Node.js node nodejs nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Unscored —
    CVE-2023-35083

    Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on…

    ivanti Endpoint Manager Network devices
  • Unscored —
    CVE-2023-35084

    Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022…

    ivanti Endpoint Manager Network devices
  • High 8.8
    CVE-2023-38545 Public exploit EPSS 78%

    This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the h…

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Unscored —
    CVE-2023-38546

    This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of …

    curl curl curl curl Debian Ubuntu Azure Linux Alpine Wolfi
  • Unscored —
    CVE-2023-46007

    Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.ph…

  • Unscored —
    CVE-2023-46005

    Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_branch.p…

  • Unscored —
    CVE-2023-46004

    Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function.

  • Unscored —
    CVE-2023-46006

    Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_user.php.

  • Unscored —
    CVE-2023-46009

    gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c.

    gifsicle gifsicle Debian Ubuntu
  • Unscored —
    CVE-2023-45958

    Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_p…

  • High 7.5
    CVE-2023-45383

    In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest …

  • Critical 9.8
    CVE-2023-45911

    An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user w…

  • Unscored —
    CVE-2023-45912

    WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers…

  • Unscored —
    CVE-2023-45909

    zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.

  • High 7.5
    CVE-2023-42319

    go-ethereum vulnerable to denial of service via crafted GraphQL query

    Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumption and daemon hang) via a crafted GraphQL query. NOTE: the vendor's position is that the "graphql endpoint [is not] des…

    github.com/ethereum/go-ethereum Go
  • High 7.8
    CVE-2023-43250

    XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow. There is a User Mode Write AV via a crafted image file. Attacke…