Skip to content
OpenAdvisories

Archive

7 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /7 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

95 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-6002

    Log Injection

    YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to forge log entries or inject malicious content into the logs.

    YugabyteDB YugabyteDB
  • Medium 5.3
    CVE-2023-6001

    Prometheus Metrics Accessible Pre-Authentication

    Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment.

    YugabyteDB YugabyteDB Anywhere
  • Medium 5.4
    CVE-2023-5982

    UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update

    The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.23.10. This is due to a lack of nonce validation and insufficient validation of the instance_id on th…

    David Anderson UpdraftPlus: WP Backup & Migration Plugin Web / CMS
  • Medium 4.4
    CVE-2023-5819

    Amazonify <= 0.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting

    The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with…

    garykeorkunian Amazonify Web / CMS
  • Medium 4.3
    CVE-2023-5818

    Amazonify <= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Update

    The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect nonce validation on the amazonifyOptionsPage() function. This makes it possible for unauthenticated…

    garykeorkunian Amazonify Web / CMS
  • Medium 6.5
    CVE-2023-4956

    Quay: clickjacking on config-editor page severity

    A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on another page when they intend to click on the top-level page. During the pentest, it has been detected t…

    Red Hat Red Hat Quay 3
  • Medium 6.8
    CVE-2023-5309

    Broken Session Management in Puppet Enterprise

    Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations.

    Puppet Puppet Enterprise
  • Medium 6.8
    CVE-2023-46252

    Cross-Site Scripting (XSS) via postMessage Handler in Squidex

    Squidex is an open source headless CMS and content management hub. Affected versions are missing origin verification in a postMessage handler which introduces a Cross-Site Scripting (XSS) vulnerability. The editor-sdk.js file defines three different class-lik…

    Squidex squidex
  • Medium 4.0
    CVE-2023-5998

    Out-of-bounds Read in gpac/gpac

    Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV.

    gpac gpac/gpac gpac gpac Debian Ubuntu
  • Medium 5.4
    CVE-2023-32966

    WordPress Jazz Popups Plugin <= 1.8.7 is vulnerable to Cross Site Request Forgery (CSRF) leading to Stored XSS

    Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through 1.8.7.

    CRUDLab Jazz Popups
  • Medium 4.3
    CVE-2022-47181

    WordPress Email Templates Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and…

    WPExperts.io Email Templates Customizer and Designer for WordPress and WooCommerce Web / CMS
  • Medium 5.4
    CVE-2023-46744

    Stored Cross-site Scripting in Squidex

    Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting (XSS) vulnerability enables privilege escalation of authenticated users. The SVG element filtering mechanism intended to stop XSS attacks thr…

    Squidex squidex
  • Medium 5.1
    CVE-2023-41798

    WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing.This issue affects Directorist – WordPress Business Directory Plugin with Classified Ads Listings: f…

    wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listings Web / CMS
  • Medium 5.8
    CVE-2022-38702

    WordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.

    Nakashima Masahiro WP CSV Exporter
  • Medium 5.8
    CVE-2022-42882

    WordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.

    Shambix Simple CSV/XLS Exporter
  • Medium 5.8
    CVE-2022-44738

    WordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.

    Patrick Robrecht Posts and Users Stats
  • Medium 5.9
    CVE-2022-45078

    WordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Solwin Infotech User Blocker.This issue affects User Blocker: from n/a through 1.5.5.

    Solwin Infotech User Blocker
  • Medium 4.7
    CVE-2022-45360

    WordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Scott Reilly Commenter Emails.This issue affects Commenter Emails: from n/a through 2.6.1.

    Scott Reilly Commenter Emails
  • Medium 6.1
    CVE-2022-45370

    WordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee WordPress Comments Import & Export.This issue affects WordPress Comments Import & Export: from n/a through 2.3.1.

    WebToffee WordPress Comments Import & Export Web / CMS
  • Medium 5.8
    CVE-2022-45348

    WordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in anmari amr users.This issue affects amr users: from n/a through 4.59.4.

    anmari amr users
  • Medium 6.1
    CVE-2022-45810

    WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce.This issue affects Icegram Express – Email Marketing, Newsletters and Automation for W…

    Icegram Icegram Express – Email Marketing, Newsletters and Automation for WordPress & WooCommerce Web / CMS
  • Medium 5.8
    CVE-2022-46821

    WordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.

    Jackmail & Sarbacane Emails & Newsletters with Jackmail
  • Medium 5.8
    CVE-2022-46804

    WordPress Export Users Data Distinct Plugin <= 1.3 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export Users Data Distinct: from n/a through 1.3.

    Narola Infotech Solutions LLP Export Users Data Distinct
  • Medium 6.1
    CVE-2022-46803

    WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin – Noptin.This issue affects Simple Newsletter Plugin – Noptin: from n/a through 1.9.5.

    Noptin Newsletter Team Simple Newsletter Plugin – Noptin
  • Medium 6.1
    CVE-2022-46809

    WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX – Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.

    WPDeveloper ReviewX – Multi-criteria Rating & Reviews for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2023-0898

    Uncontrolled Search Path Element in GE MiCOM S1 Agile

    General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application.

    General Electric MiCOM S1 Agile
  • Medium 6.1
    CVE-2022-46801

    WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.

    Paul Ryley Site Reviews
  • Medium 6.1
    CVE-2022-46802

    WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.

    WebToffee Product Reviews Import Export for WooCommerce Web / CMS
  • Medium 4.7
    CVE-2023-36527

    WordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft: from n/a through 1.4.0.

    bestwebsoft Post to CSV by BestWebSoft
  • Medium 4.7
    CVE-2023-23796

    WordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builder | Create Responsive Contact Forms: from n/a through 1.9.9.0.

    Muneeb Form Builder | Create Responsive Contact Forms
  • Medium 4.0
    CVE-2023-23678

    WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cookie Consent ( for GDPR, CCPA & ePrivacy ): from n/a through 2.2.5.

    WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy )
  • Medium 6.1
    CVE-2022-45357

    WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in Lenderd 1003 Mortgage Application.This issue affects 1003 Mortgage Application: from n/a through 1.75.

    Lenderd 1003 Mortgage Application
  • Medium 4.7
    CVE-2023-22719

    WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1.

    GiveWP GiveWP
  • Medium 5.5
    CVE-2023-4272

    Mali GPU Kernel Driver exposes sensitive data from freed memory

    A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory.

    Arm Valhall GPU Kernel Driver Arm 5th Gen GPU Architecture Kernel Driver Bifrost GPU Kernel Driver
  • Medium 5.8
    CVE-2022-47442

    WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV Injection

    Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.

    AyeCode UsersWP
  • Medium 4.5
    CVE-2023-0436

    Secret logging may occur in debug mode of Atlas Operator

    The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBUG mode logging is enabled. This issue affects MongoDB Atlas Kubernetes Operator versions: 1.5.0, 1.6…

    MongoDB MongoDB Atlas Kubernetes Operator
  • Medium 6.4
    CVE-2023-4888

    Simple Like Page Plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping on user supplied attributes. This …

    topdevs Simple Like Page Plugin – Fast & Privacy-Friendly Page Embeds Web / CMS
  • Medium 6.4
    CVE-2023-5660

    SendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.22.3.31 due to insufficient input sanitization and output escaping on user supplied attributes. T…

    brewlabs SendPress Newsletters Web / CMS
  • Medium 6.4
    CVE-2023-4842 Public exploit

    Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to, and including, 4.4.3 due to insufficient input sanitization and output escaping on user supplied att…

    Warfare Plugins Social Sharing Plugin – Social Warfare Web / CMS
  • Medium 6.4
    CVE-2023-5567

    QR Code Tag <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo…

    dspreen QR Code Tag Web / CMS