Skip to content
OpenAdvisories

Archive

October 2023

Vulnerabilities first published in this month (UTC), newest first.

← September 2023 2023 / October November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

1,017 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-44146

    WordPress Checkfront Online Booking System Plugin <= 3.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Checkfront Inc. Checkfront Online Booking System plugin <= 3.6 versions.

    Checkfront Checkfront Online Booking System
  • Medium 5.4
    CVE-2023-41950

    WordPress Laposta Signup Basic Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Laposta - Roel Bousardt Laposta Signup Basic plugin <= 1.4.1 versions.

    Laposta - Roel Bousardt Laposta Signup Basic
  • Medium 4.3
    CVE-2023-40607

    WordPress CLUEVO LMS, E-Learning Platform Plugin <= 1.10.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CLUEVO CLUEVO LMS, E-Learning Platform plugin <= 1.10.0 versions.

    cluevo CLUEVO LMS, E-Learning Platform
  • Medium 5.4
    CVE-2023-41801

    WordPress AWP Classifieds Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions.

    AWP Classifieds Team Ad Directory & Listings by AWP Classifieds
  • Medium 5.4
    CVE-2023-41732

    WordPress CP Blocks Plugin <= 1.0.20 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CodePeople CP Blocks plugin <= 1.0.20 versions.

    codepeople CP Blocks
  • Medium 5.4
    CVE-2023-41659

    WordPress Responsive Gallery Grid Plugin <= 2.3.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Jules Colle, BDWM Responsive Gallery Grid plugin <= 2.3.10 versions.

    Jules Colle, BDWM Responsive Gallery Grid
  • Medium 5.4
    CVE-2023-41654

    WordPress authLdap Plugin <= 2.5.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Andreas Heigl authLdap plugin <= 2.5.8 versions.

    Andreas Heigl authLdap
  • Medium 4.3
    CVE-2023-41650

    WordPress Remove/hide Author, Date, Category Like Entry-Meta Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin <= 2.1 versions.

    Venugopal Remove/hide Author, Date, Category Like Entry-Meta
  • Medium 6.8
    CVE-2023-42445

    Possible local file exfiltration by XML External entity injection

    Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, when Gradle parses XML files, resolving XML external entities is not disabled. Combined with an Out Of Band XXE attack (OOB-XXE), just parsing X…

    gradle gradle gradle gradle Debian Ubuntu
  • Medium 5.3
    CVE-2023-43058

    IBM Robotic Process Automation privilege escalation

    IBM Robotic Process Automation 23.0.9 is vulnerable to privilege escalation that affects ownership of projects. IBM X-Force ID: 247527.

    IBM Robotic Process Automation
  • Medium 5.4
    CVE-2023-29235

    WordPress Maintenance Switch Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fugu Maintenance Switch plugin <= 1.5.2 versions.

    Fugu Maintenance Switch
  • Medium 4.3
    CVE-2023-28791

    WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions.

    Gangesh Matta Simple Org Chart
  • Medium 5.4
    CVE-2023-27615

    WordPress WP Super Minify Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dipak C. Gajjar WP Super Minify plugin <= 1.5.1 versions.

    Dipak C. Gajjar WP Super Minify
  • Medium 5.4
    CVE-2023-27448

    WordPress MakeStories (for Google Web Stories) Plugin <= 2.8.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in MakeStories Team MakeStories (for Google Web Stories) plugin <= 2.8.0 versions.

    MakeStories Team MakeStories (for Google Web Stories)
  • Medium 5.4
    CVE-2023-25033

    WordPress Social Share Boost Plugin <= 4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Sumo Social Share Boost plugin <= 4.5 versions.

    Sumo Social Share Boost
  • Medium 4.3
    CVE-2022-47175

    WordPress Royal Elementor Addons Plugin <= 1.3.75 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions.

    P Royal Royal Elementor Addons and Templates
  • Medium 4.3
    CVE-2023-25480

    WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.24.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions.

    Bold Grid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
  • Medium 4.3
    CVE-2023-40671

    WordPress DX-auto-save-images Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in 大侠wp DX-auto-save-images plugin <= 1.4.0 versions.

    大侠WP DX-auto-save-images
  • Medium 4.3
    CVE-2023-40008

    WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gangesh Matta Simple Org Chart plugin <= 2.3.4 versions.

    Gangesh Matta Simple Org Chart
  • Medium 5.3
    CVE-2023-4469

    Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information Exposure

    The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it possible for unauthentic…

    bestwebsoft Profile Extra Fields by BestWebSoft Web / CMS
  • Medium 6.3
    CVE-2015-10126

    Easy2Map Photos Plugin sql injection

    A vulnerability classified as critical was found in Easy2Map Photos Plugin 1.0.1 on WordPress. This vulnerability affects unknown code. The manipulation leads to sql injection. The attack can be initiated remotely. Upgrading to version 1.1.0 is able to addres…

  • Medium 4.3
    CVE-2023-40556

    WordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Greg Ross Schedule Posts Calendar plugin <= 5.2 versions.

    Greg Ross Schedule Posts Calendar
  • Medium 5.4
    CVE-2023-44764 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Installation or Settings).

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44762 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a crafted script to the Tags from Settings - Tags.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44770 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to the Organizer - Spare alias.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44761 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a local attacker to execute arbitrary code via a crafted script to the Forms of the Data objects.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44765 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arbitrary code via a crafted script to Plural Handle of the Data Objects from System & Settings.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-44771 Public exploit

    Zenario CMS Cross-site Scripting vulnerability

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script to the Page Layout.

    tribalsystems/zenario Packagist
  • Medium 5.4
    CVE-2023-44766 Public exploit

    ConcreteCMS Cross-site Scripting vulnerability

    A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the SEO - Extra from Page Settings. NOTE: the vendor disputes this because this SEO-related header change can only be made …

    concrete5/concrete5 Packagist
  • Medium 4.3
    CVE-2015-10125

    WP Ultimate CSV Importer Plugin cross-site request forgery

    A vulnerability classified as problematic has been found in WP Ultimate CSV Importer Plugin 3.7.2 on WordPress. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to ve…

  • Medium 5.5
    CVE-2023-45243

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Prote…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 17
  • Medium 5.5
    CVE-2023-45242

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Prote…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 17
  • Medium 4.4
    CVE-2023-45241

    Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Cloud Agent (L…

    Acronis Acronis Cyber Protect Cloud Agent Acronis Cyber Protect 16
  • Medium 5.5
    CVE-2023-45240

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linu…

    Acronis Acronis Agent
  • Medium 5.5
    CVE-2023-44214

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linu…

    Acronis Acronis Agent
  • Medium 6.2
    CVE-2023-5441

    NULL Pointer Dereference in vim/vim

    NULL Pointer Dereference in GitHub repository vim/vim prior to 20d161ace307e28690229b68584f2d84556f8960.

    vim vim/vim vim vim Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2023-40745

    Libtiff: integer overflow in tiffcp.c

    LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service (application crash) or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Azure Linux
  • Medium 6.5
    CVE-2023-41175

    Libtiff: potential integer overflow in raw2tiff.c

    A vulnerability was found in libtiff due to multiple potential integer overflows in raw2tiff.c. This flaw allows remote attackers to cause a denial of service or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer o…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Azure Linux
  • Medium 6.5
    CVE-2023-42755

    Kernel: rsvp: out-of-bounds read in rsvp_classify()

    A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2023-42754

    Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()

    A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allo…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux