Skip to content
OpenAdvisories

Archive

October 2023

Vulnerabilities first published in this month (UTC), newest first.

← September 2023 2023 / October November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

1,017 results · Clear filters · Feed

  • Medium 6.1
    CVE-2023-5758

    When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a refle…

    Mozilla Firefox for iOS iOS Browsers
  • Medium 4.7
    CVE-2023-43510

    Authenticated Remote Command Injection in ClearPass Policy Manager Web-Based Management Interface Leading to Partial System Compromise

    A vulnerability in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as a non-privileged u…

    Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager
  • Medium 5.8
    CVE-2023-43509

    Unauthenticated Endpoint Allows Sending Arbitrary OnGuard Notifications

    A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to send notifications to computers that are running ClearPass OnGuard. These notifications can then be used to phish users or tric…

    Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager
  • Medium 6.3
    CVE-2023-43508

    Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management Interface

    Vulnerabilities in the web-based management interface of ClearPass Policy Manager allow an attacker with read-only privileges to perform actions that change the state of the ClearPass Policy Manager instance. Successful exploitation of these vulnerabilities a…

    Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Manager
  • Medium 4.9
    CVE-2023-42031

    IBM CICS TX denial of service

    IBM TXSeries for Multiplatforms, 8.1, 8.2, and 9.1, CICS TX Standard CICS TX Advanced 10.1 and 11.1 could allow a privileged user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 266016.

    IBM CICS TX Advanced CICS TX Standard TXSeries for Multiplatforms
  • Medium 6.3
    CVE-2023-5753

    Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem

    Potential buffer overflows in the Bluetooth subsystem due to asserts being disabled in /subsys/bluetooth/host/hci_core.c

    zephyrproject-rtos Zephyr
  • Medium 6.5
    CVE-2023-46128

    Exposure of hashed user passwords via REST API in Nautobot

    Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed u…

    nautobot nautobot nautobot PyPI
  • Medium 6.4
    CVE-2023-5744

    Very Simple Google Maps <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Very Simple Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vsgmap' shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes.…

    masterk Very Simple Google Maps Web / CMS
  • Medium 6.4
    CVE-2023-5740

    Live Chat with Facebook Messenger <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Live Chat with Facebook Messenger plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'messenger' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplie…

    Ninja Team Live Chat with Facebook Messenger Web / CMS
  • Medium 4.9
    CVE-2023-5126

    Delete Me <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Delete Me plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'plugin_delete_me' shortcode in versions up to, and including, 3.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possib…

    cmc3215 Delete Me Web / CMS
  • Medium 6.4
    CVE-2023-5110

    BSK PDF Manager <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bsk-pdfm-category-dropdown' shortcode in versions up to, and including, 3.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. Th…

    bannersky BSK PDF Manager Web / CMS
  • Medium 6.4
    CVE-2023-5085

    Advanced Menu Widget <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Advanced Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'advMenu' shortcode in versions up to, and including, 0.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it po…

    johnnypea Advanced Menu Widget Web / CMS
  • Medium 6.4
    CVE-2023-5127

    WP Font Awesome <= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The WP Font Awesome plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping on 'icon' user supplied attribute. This makes it possible f…

    zayedbaloch WP Font Awesome Web / CMS
  • Medium 5.5
    CVE-2023-5745

    Reusable Text Blocks <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode

    The Reusable Text Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'text-blocks' shortcode in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i…

    richardgabriel Reusable Text Blocks Web / CMS
  • Medium 6.5
    CVE-2023-46069

    WordPress Ajax Archive Calendar Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Osmansorkar Ajax Archive Calendar plugin <= 2.6.7 versions.

    Osmansorkar Ajax Archive Calendar
  • Medium 5.9
    CVE-2023-46068

    WordPress Maileon Plugin <= 2.16.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in XQueue GmbH Maileon for WordPress plugin <= 2.16.0 versions.

    XQueue Maileon for WordPress Web / CMS
  • Medium 5.9
    CVE-2023-45833

    WordPress LeadSquared Suite Plugin <= 0.7.4 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LeadSquared Suite plugin <= 0.7.4 versions.

    LeadSquared LeadSquared Suite
  • Medium 6.5
    CVE-2023-45829

    WordPress Newsletter & Bulk Email Sender Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin for WordPress plugin <= 2.0.1 versions.

    HappyBox Newsletter & Bulk Email Sender – Email Newsletter Plugin for WordPress Web / CMS
  • Medium 5.9
    CVE-2023-45832

    WordPress WP GoToWebinar Plugin <= 14.45 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson WP GoToWebinar plugin <= 14.45 versions.

    Martin Gibson WP GoToWebinar
  • Medium 5.9
    CVE-2023-45768

    WordPress Next Page Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Stephanie Leary Next Page plugin <= 1.5.2 versions.

    Stephanie Leary Next Page
  • Medium 5.9
    CVE-2023-45767

    WordPress Simple Tweet Plugin <= 1.4.0.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Wokamoto Simple Tweet plugin <= 1.4.0.2 versions.

    wokamoto Simple Tweet
  • Medium 5.9
    CVE-2023-45764

    WordPress Scroll post excerpt Plugin <= 8.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Scroll post excerpt plugin <= 8.0 versions.

    Gopi Ramasamy Scroll post excerpt
  • Medium 5.9
    CVE-2023-39924

    WordPress Simple File List Plugin <= 6.1.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mitchell Bennis Simple File List plugin <= 6.1.9 versions.

    Mitchell Bennis Simple File List
  • Medium 5.9
    CVE-2023-45758

    WordPress Amministrazione Trasparente Plugin <= 8.0.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi Amministrazione Trasparente plugin <= 8.0.2 versions.

    Marco Milesi Amministrazione Trasparente
  • Medium 5.9
    CVE-2023-25032

    WordPress Print, PDF, Email by PrintFriendly Plugin <= 5.5.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Print, PDF, Email by PrintFriendly plugin <= 5.5.1 versions.

    Print, PDF, & Email by PrintFriendly Print, PDF, Email by PrintFriendly
  • Medium 5.9
    CVE-2023-45755

    WordPress BuddyPress Global Search Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BuddyBoss BuddyPress Global Search plugin <= 1.2.1 versions.

    BuddyBoss BuddyPress Global Search
  • Medium 5.9
    CVE-2023-45754

    WordPress Easy Testimonial Slider and Form Plugin <= 1.0.18 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form allows Stored XSS.This issue affects Easy Testimonial Slider and Form: from n/a through 1.0.18.

    I Thirteen Web Solution Easy Testimonial Slider and Form
  • Medium 5.9
    CVE-2023-45747

    WordPress WP Lightbox 2 Plugin <= 3.0.6.5 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Syed Balkhi WP Lightbox 2 plugin <= 3.0.6.5 versions.

    Syed Balkhi WP Lightbox 2
  • Medium 6.5
    CVE-2023-45646

    WordPress PDF Block Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Henryholtgeerts PDF Block plugin <= 1.1.0 versions.

    Henryholtgeerts PDF Block
  • Medium 5.9
    CVE-2023-45644

    WordPress CPT Shortcode Generator Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anurag Deshmukh CPT Shortcode Generator plugin <= 1.0 versions.

    Anurag Deshmukh CPT Shortcode Generator
  • Medium 6.5
    CVE-2023-45640

    WordPress WP ULike Plugin <= 4.6.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TechnoWich WP ULike – Most Advanced WordPress Marketing Toolkit plugin <= 4.6.8 versions.

    TechnoWich WP ULike – Most Advanced WordPress Marketing Toolkit Web / CMS
  • Medium 5.8
    CVE-2023-45634

    WordPress Copy Or Move Comments Plugin <= 5.0.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Biztechc Copy or Move Comments plugin <= 5.0.4 versions.

    biztechc Copy or Move Comments
  • Medium 4.3
    CVE-2023-46204

    WordPress Duplicate Theme Plugin <= 0.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Muller Digital Inc. Duplicate Theme plugin <= 0.1.6 versions.

    Muller Digital Duplicate Theme
  • Medium 4.3
    CVE-2023-46202

    WordPress Auto Login New User After Registration Plugin <= 1.9.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Jeff Sherk Auto Login New User After Registration plugin <= 1.9.6 versions.

    Jeff Sherk Auto Login New User After Registration
  • Medium 5.4
    CVE-2023-46198

    WordPress Appointment Calendar Plugin <= 2.9.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Scientech It Solution Appointment Calendar plugin <= 2.9.6 versions.

    Scientech It Solution Appointment Calendar
  • Medium 4.3
    CVE-2023-46193

    WordPress Internal Link Building Plugin <= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions.

    Internet Marketing Ninjas Internal Link Building
  • Medium 4.3
    CVE-2023-46191

    WordPress Open Graph Metabox Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Niels van Renselaar Open Graph Metabox plugin <= 1.4.4 versions.

    Niels van Renselaar Open Graph Metabox
  • Medium 4.3
    CVE-2023-46190

    WordPress Novo-Map : your WP posts on custom google maps Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Novo-media Novo-Map : your WP posts on custom google maps plugin <= 1.1.2 versions.

    Novo-media Novo-Map : your WP posts on custom google maps
  • Medium 4.3
    CVE-2023-46189

    WordPress Google Calendar Events Plugin <= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Simple Calendar – Google Calendar Plugin <= 3.2.5 versions.

    Simple Calendar Simple Calendar – Google Calendar Plugin
  • Medium 4.3
    CVE-2023-46152

    WordPress WOLF Plugin <= 1.0.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in realmag777 WOLF – WordPress Posts Bulk Editor and Manager Professional plugin <= 1.0.7.1 versions.

    RealMag777 WOLF – WordPress Posts Bulk Editor and Manager Professional Web / CMS