Skip to content
OpenAdvisories

Archive

October 2023

Vulnerabilities first published in this month (UTC), newest first.

← September 2023 2023 / October November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

1,017 results · Clear filters · Feed

  • Medium 5.4
    CVE-2023-40009

    WordPress WP Pipes Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Pipes plugin <= 1.4.0 versions.

    ThimPress WP Pipes
  • Medium 6.5
    CVE-2023-32791

    Cross-Site Request Forgery on NXLog Manager

    Cross-Site Request Forgery (CSRF) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to manipulate and delete user accounts within the platform by sending a specifically crafted query to the server. The vulnerability is bas…

    NXLog NXLog Manager
  • Medium 4.6
    CVE-2023-32790

    XSS on NXLog Manager

    Cross-Site Scripting (XSS) vulnerability in NXLog Manager 5.6.5633 version. This vulnerability allows an attacker to inject a malicious JavaScript payload into the 'Full Name' field during a user edit, due to improper sanitization of the input parameter.

    NXLog NXLog Manager
  • Medium 4.3
    CVE-2023-39159

    WordPress Fraud Prevention For Woocommerce Plugin <= 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Fraud Prevention For Woocommerce plugin <= 2.1.5 versions.

    theDotstore Fraud Prevention For Woocommerce Web / CMS
  • Medium 4.3
    CVE-2023-40212

    WordPress WooCommerce Product Attachment Plugin <= 2.1.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in theDotstore Product Attachment for WooCommerce plugin <= 2.1.8 versions.

    theDotstore Product Attachment for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2023-40199

    WordPress WP Like Button Plugin <= 1.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab WP Like Button plugin <= 1.7.0 versions.

    CRUDLab WP Like Button
  • Medium 5.4
    CVE-2023-40198

    WordPress Easy Cookie Law Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Antsanchez Easy Cookie Law plugin <= 3.1 versions.

    Antsanchez Easy Cookie Law
  • Medium 6.5
    CVE-2023-42508

    JFrog Artifactory Improper header input validation leads to email manipulation sent from the platform

    JFrog Artifactory prior to version 7.66.0 is vulnerable to specific endpoint abuse with a specially crafted payload, which can lead to unauthenticated users being able to send emails with manipulated email body.

    jfrog artifactory
  • Medium 6.3
    CVE-2023-32671

    BuddyBoss XSS vulnerability

    A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a malicious javascript payload via POST request when sending an invitation.

    BuddyBoss BuddyBoss
  • Medium 5.4
    CVE-2023-32669

    Authorization Bypass on BuddyBoss

    Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).

    BuddyBoss BuddyBoss
  • Medium 6.5
    CVE-2023-40201

    WordPress Futurio Extra Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in FuturioWP Futurio Extra plugin <= 1.8.4 versions leads to activation of arbitrary plugin.

    futuriowp Futurio Extra
  • Medium 5.4
    CVE-2023-40202

    WordPress WP HTML Mail Plugin <= 3.4.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Hannes Etzelstorfer // codemiq WP HTML Mail plugin <= 3.4.1 versions.

    Hannes Etzelstorfer // codemiq WP HTML Mail
  • Medium 6.4
    CVE-2023-5350 Public exploit

    SQL Injection in salesagility/suitecrm

    SQL Injection in GitHub repository salesagility/suitecrm prior to 7.14.1.

    salesagility salesagility/suitecrm
  • Medium 5.4
    CVE-2023-40210

    WordPress SB Child List Plugin <= 4.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Sean Barton (Tortoise IT) SB Child List plugin <= 4.5 versions.

    Sean Barton (Tortoise IT) SB Child List
  • Medium 5.3
    CVE-2022-47892

    Information disclosure in NetMan 204

    All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials.

    Riello UPS NetMan 204
  • Medium 5.4
    CVE-2023-2830

    WordPress WP Testimonials Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Trustindex.Io WP Testimonials plugin <= 1.4.2 versions.

    Trustindex.io WP Testimonials
  • Medium 6.5
    CVE-2023-4100

    Multiple vulnerabilities in IDM Sistemas QSige

    Allows an attacker to perform XSS attacks stored on certain resources. Exploiting this vulnerability can lead to a DoS condition, among other actions.

    IDM Sistemas QSige QSige
  • Medium 5.4
    CVE-2023-39989

    WordPress Header Footer Code Manager Plugin <= 1.1.34 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in 99robots Header Footer Code Manager plugin <= 1.1.34 versions.

    99robots Header Footer Code Manager
  • Medium 4.3
    CVE-2023-39917

    WordPress Photo Gallery by Ays Plugin <= 5.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery plugin <= 5.2.6 versions.

    Photo Gallery Team Photo Gallery by Ays – Responsive Image Gallery
  • Medium 5.4
    CVE-2023-39165

    WordPress Sign-up Sheets Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets plugin <= 2.2.8 versions.

    Fetch Designs Sign-up Sheets
  • Medium 5.4
    CVE-2023-39923

    WordPress The Post Grid Plugin <= 7.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <= 7.2.7 versions.

    RadiusTheme The Post Grid
  • Medium 4.3
    CVE-2023-25989

    Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by Meks

    Cross-Site Request Forgery (CSRF) vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Me…

    Meks Meks Easy Ads Widget Meks Smart Social Widget Meks Smart Author Widget
  • Medium 6.7
    CVE-2023-0828

    Stored Cross Site Scripting in syslog section

    Cross-site Scripting (XSS) vulnerability in Syslog Section of Pandora FMS allows attacker to cause that users cookie value will be transferred to the attackers users server. This issue affects Pandora FMS v767 version and prior versions on all platforms.

    Artica PFMS Pandora FMS
  • Medium 6.7
    CVE-2023-24518

    Disabling the administrator's account through cross-site request forgery

    A Cross-site Request Forgery (CSRF) vulnerability in Pandora FMS allows an attacker to force authenticated users to send a request to a web application they are currently authenticated against. This issue affects Pandora FMS version 767 and earlier versions o…

    Artica PFMS Pandora FMS
  • Medium 5.4
    CVE-2023-25463

    WordPress wp tell a friend popup form Plugin <= 7.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy WP tell a friend popup form plugin <= 7.1 versions.

    Gopi Ramasamy WP tell a friend popup form
  • Medium 4.3
    CVE-2023-38390

    WordPress Mobile Address Bar Changer Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Anshul Labs Mobile Address Bar Changer plugin <= 3.0 versions.

    Anshul Labs Mobile Address Bar Changer
  • Medium 5.4
    CVE-2023-38396

    WordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Alain Gonzalez plugin <= 3.1.2 versions.

    Alain Gonzalez google-map-shortcode
  • Medium 4.3
    CVE-2023-37990

    WordPress Perelink Pro Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mike Perelink Pro plugin <= 2.1.4 versions.

    Mike Perelink Pro
  • Medium 4.3
    CVE-2023-38398

    WordPress Taboola Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Taboola plugin <= 2.0.1 versions.

    Taboola Taboola
  • Medium 5.4
    CVE-2022-46841

    WordPress Oxygen Builder Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <= 4.4 versions.

    Soflyy Oxygen Builder
  • Medium 5.4
    CVE-2023-38381

    WordPress WP-FlyBox Plugin <= 6.46 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Cyle Conoly WP-FlyBox plugin <= 6.46 versions.

    Cyle Conoly WP-FlyBox
  • Medium 4.3
    CVE-2023-37998

    WordPress Disabler Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Saas Disabler allows Cross Site Request Forgery.This issue affects Disabler: from n/a through 3.0.3.

    Saas Disabler
  • Medium 5.4
    CVE-2023-37996

    WordPress GTmetrix for WordPress Plugin <= 0.4.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in GTmetrix GTmetrix for WordPress plugin <= 0.4.7 versions.

    GTmetrix GTmetrix for WordPress Web / CMS
  • Medium 5.4
    CVE-2023-37992

    WordPress Smarty for WordPress Plugin <= 3.1.35 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions.

    PressPage Entertainment Smarty for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-37991

    WordPress WP Emoji One Plugin <= 0.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Monchito.Net WP Emoji One plugin <= 0.6.0 versions.

    Monchito.net WP Emoji One
  • Medium 4.3
    CVE-2023-37891

    WordPress Exit Popups & Onsite Retargeting by OptiMonk Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in OptiMonk OptiMonk: Popups, Personalization & A/B Testing plugin <= 2.0.4 versions.

    OptiMonk OptiMonk: Popups, Personalization & A/B Testing
  • Medium 6.1
    CVE-2023-28571

    Buffer Over-read in WLAN HOST

    Information disclosure in WLAN HOST while processing the WLAN scan descriptor list during roaming scan.

    Qualcomm Snapdragon
  • Medium 6.6
    CVE-2023-28539

    Buffer Copy Without Checking Size of Input in WLAN Host

    Memory corruption in WLAN Host when the firmware invokes multiple WMI Service Available command.

    Qualcomm Snapdragon
  • Medium 6.7
    CVE-2023-22384

    Buffer Copy Without Checking Size of Input in VR Service

    Memory Corruption in VR Service while sending data using Fast Message Queue (FMQ).

    Qualcomm Snapdragon
  • Medium 6.5
    CVE-2023-26150

    asyncua Improper Authentication vulnerability

    Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space without encryption and authentication. **Note:** This issue is a result of missing checks for services that require an act…

    python-opcua asyncua Ubuntu PyPI