Skip to content
OpenAdvisories

Archive

October 2023

Vulnerabilities first published in this month (UTC), newest first.

← September 2023 2023 / October November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

1,017 results · Clear filters · Feed

  • Medium 4.6
    CVE-2023-45813

    Inefficient Regular Expression Complexity in TorBot

    Torbot is an open source tor network intelligence tool. In affected versions the `torbot.modules.validators.validate_link function` uses the python-validators URL validation regex. This particular regular expression has an exponential complexity which allows …

    DedSecInside TorBot torbot PyPI
  • Medium 6.8
    CVE-2023-30911

    HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service.

    Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out
  • Medium 6.5
    CVE-2023-20261

    A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retriev…

    Cisco Cisco SD-WAN vManage Network devices
  • Medium 6.1
    CVE-2023-5631 Exploited EPSS 76%

    Stored XSS vulnerability in Roundcube

    Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary Java…

    Roundcube Roundcubemail roundcube roundcube Debian Ubuntu
    KEV Oct 26, 2023
  • Medium 6.5
    CVE-2023-45628

    WordPress QR Twitter Widget Plugin <= 0.2.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in QROkes QR Twitter Widget plugin <= 0.2.3 versions.

    QROkes QR Twitter Widget
  • Medium 5.9
    CVE-2023-45604

    WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Reilly Get Custom Field Values plugin <= 4.0.1 versions.

    Scott Reilly Get Custom Field Values
  • Medium 6.5
    CVE-2023-45607

    WordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Hector Cabrera WordPress Popular Posts plugin <= 6.3.2 versions.

    Hector Cabrera WordPress Popular Posts Web / CMS
  • Medium 6.5
    CVE-2023-45608

    WordPress Smart Cookie Kit Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Nicola Modugno Smart Cookie Kit plugin <= 2.3.1 versions.

    Nicola Modugno Smart Cookie Kit
  • Medium 5.9
    CVE-2023-45073

    WordPress Mendeley Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Koch Mendeley Plugin plugin <= 1.3.2 versions.

    Michael Koch Mendeley Plugin
  • Medium 6.5
    CVE-2023-31217

    WordPress User Location and IP Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions.

    MyTechTalky User Location and IP
  • Medium 5.9
    CVE-2023-45072

    WordPress Order auto complete for WooCommerce Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Kardi Order auto complete for WooCommerce plugin <= 1.2.0 versions.

    Kardi Order auto complete for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-45067

    WordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.

    Ashish Ajani WordPress Simple HTML Sitemap Web / CMS
  • Medium 4.6
    CVE-2023-32089

    Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description

    Pega Systems Pega Platform
  • Medium 4.6
    CVE-2023-32088

    Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation

    Pega Systems Pega Platform
  • Medium 4.6
    CVE-2023-32087

    Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation

    Pega Systems Pega Platform
  • Medium 6.5
    CVE-2023-45059

    WordPress Gumroad Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Gumroad plugin <= 3.1.0 versions.

    Gumroad Gumroad
  • Medium 5.9
    CVE-2023-45057

    WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hitsteps Web Analytics plugin <= 5.86 versions.

    Hitsteps Hitsteps Web Analytics
  • Medium 5.9
    CVE-2023-45056

    WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.

    100plugins Open User Map
  • Medium 5.9
    CVE-2023-45051

    WordPress Image vertical reel scroll slideshow Plugin <= 9.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Image vertical reel scroll slideshow plugin <= 9.0 versions.

    Gopi Ramasamy Image vertical reel scroll slideshow
  • Medium 6.5
    CVE-2023-45049

    WordPress YouTube Playlist Player Plugin <= 4.6.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Ciprian Popescu YouTube Playlist Player plugin <= 4.6.7 versions.

    Ciprian Popescu YouTube Playlist Player
  • Medium 5.9
    CVE-2023-45008

    WordPress Comment Reply Email Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPJohnny Comment Reply Email plugin <= 1.0.3 versions.

    WPJohnny Comment Reply Email
  • Medium 4.3
    CVE-2023-4938

    BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulation

    The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for authenticated attacke…

    RealMag777 BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net Web / CMS
  • Medium 4.4
    CVE-2023-5621

    Thumbnail Slider With Lightbox <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Image Title

    The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Title field in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authent…

    nik00726 Thumbnail Slider With Lightbox Web / CMS
  • Medium 4.3
    CVE-2023-3254

    Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Reset

    The Widgets for Google Reviews plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.9. This is due to missing or incorrect nonce validation within setup_no_reg_header.php. This makes it possible for unauthentic…

    trustindex Widgets for Google Reviews Web / CMS
  • Medium 5.3
    CVE-2023-3042

    CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8

    In dotCMS, versions mentioned, a flaw in the NormalizationFilter does not strip double slashes (//) from URLs, potentially enabling bypasses for XSS and access controls. An example affected URL is https://demo.dotcms.com//html/portlet/ext/files/edit_text_inc.…

    dotCMS dotCMS Core
  • Medium 5.3
    CVE-2023-45810

    OpenFGA denial of service

    OpenFGA is a flexible authorization/permission engine built for developers and inspired by Google Zanzibar. Affected versions of OpenFGA are vulnerable to a denial of service attack. When a number of `ListObjects` calls are executed, in some scenarios, those …

    openfga openfga github.com/openfga/openfga Go
  • Medium 5.9
    CVE-2023-22130

    Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that …

    Oracle Sun ZFS Storage Appliance Kit (AK) Software
  • Medium 6.3
    CVE-2023-22127

    Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, I…

    Oracle Outside In Technology
  • Medium 5.5
    CVE-2023-22129

    Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…

    Oracle Solaris Operating System
  • Medium 5.3
    CVE-2023-22126

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…

    Oracle WebCenter Content
  • Medium 5.4
    CVE-2023-22125

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 5.4
    CVE-2023-22124

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 5.4
    CVE-2023-22123

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 5.4
    CVE-2023-22121

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 5.9
    CVE-2023-22122

    Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrast…

    Oracle Banking Trade Finance
  • Medium 5.4
    CVE-2023-22117

    Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: In…

    Oracle FLEXCUBE Universal Banking
  • Medium 6.5
    CVE-2023-22118

    Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: In…

    Oracle FLEXCUBE Universal Banking
  • Medium 5.9
    CVE-2023-22119

    Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: In…

    Oracle FLEXCUBE Universal Banking
  • Medium 4.9
    CVE-2023-22114

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…

    Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux
  • Medium 4.9
    CVE-2023-22115

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affecte…

    Oracle MySQL Server percona-server-5.6 percona-xtradb-cluster-5.6 Ubuntu Azure Linux