Skip to content
OpenAdvisories

Archive

8 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /8 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

111 results · Feed

  • Medium 6.5
    CVE-2023-47231

    WordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bainternet ShortCodes UI plugin <= 1.9.8 versions.

    Bainternet ShortCodes UI
  • Medium 6.5
    CVE-2023-47229

    WordPress Download Top 25 Social Icons Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vyas Dipen Top 25 Social Icons plugin <= 3.1 versions.

    Vyas Dipen Top 25 Social Icons
  • Medium 5.9
    CVE-2023-47228

    WordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions.

    Muneeb Layer Slider
  • Medium 5.9
    CVE-2023-47227

    WordPress Social Feed | All social media in one place Plugin <= 1.5.4.6 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Social Feed | All social media in one place plugin <= 1.5.4.6 versions.

    Web-Settler Social Feed | All social media in one place
  • Medium 5.9
    CVE-2023-47226

    WordPress Post Sliders & Post Grids Plugin <= 1.0.20 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin <= 1.0.20 versions.

    I Thirteen Web Solution Post Sliders & Post Grids
  • Medium 5.9
    CVE-2023-47223

    WordPress Basic Interactive World Map Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <= 2.0 versions.

    WP Map Plugins Basic Interactive World Map
  • Medium 6.5
    CVE-2023-47190

    WordPress Apollo13 Framework Extensions Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin <= 1.9.0 versions.

    apollo13themes Apollo13 Framework Extensions
  • Medium 5.9
    CVE-2023-47181

    WordPress IdeaPush Plugin <= 8.52 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson IdeaPush plugin <= 8.52 versions.

    Martin Gibson IdeaPush
  • Medium 6.4
    CVE-2023-3282

    Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine

    A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local attacker to execute programs with elevated privileges if the attacker has shell access to the engine.

    Palo Alto Networks Cortex XSOAR Network devices
  • High 8.2
    CVE-2023-5913

    A potential Privilege Escalation vulnerability in opentext Fortify ScanCentral DAST API.

    Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited to gain elevated privileges.This issue affects Fortify ScanCentral DAST versions 21.1, 21.2, 21.2.1, 22.1, 22.1.1, 22.2, 23.1.

    OpenText Fortify ScanCentral DAST
  • High 8.2
    CVE-2023-5760

    Time-of-check to time-of-use (TOCTOU) bug leads to full local privilege escalation.

    A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability which can be further exploited, allowing an attacker to gain full local privilege escalation on the…

    Avast/AVG Avast/Avg Antivirus
  • High 7.1
    CVE-2023-46643

    WordPress Download CloudNet360 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GARY JEZORSKI CloudNet360 plugin <= 3.2.0 versions.

    GARY JEZORSKI CloudNet360
  • Medium 5.9
    CVE-2023-46642

    WordPress SAHU TikTok Pixel for E-Commerce Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin <= 1.2.2 versions.

    sahumedia SAHU TikTok Pixel for E-Commerce
  • Medium 6.5
    CVE-2023-46640

    WordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in D. Relton Medialist plugin <= 1.3.9 versions.

    D. Relton Medialist
  • High 7.1
    CVE-2023-46627

    WordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions.

    Ashish Ajani WordPress Simple HTML Sitemap Web / CMS
  • High 7.1
    CVE-2023-32298

    WordPress Simple User Listing Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kathy Darling Simple User Listing plugin <= 1.9.2 versions.

    Kathy Darling Simple User Listing
  • High 7.5
    CVE-2023-5759

    Unauthenticated Remote Denial-of-Service via Buffer in Helix Core

    In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Reported by Jason Geffner.  

    Helix Helix Core
  • High 7.5
    CVE-2023-45319

    Unauthenticated Remote Denial-of-Service (Commit) in Helix Core

    In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner. 

    Helix Helix Core
  • Critical 9.0
    CVE-2023-45849

    Arbitrary Code Execution in Helix Core

    An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner.

    Helix Helix Core
  • High 8.8
    CVE-2023-47107

    PILOS account takeover through password reset poisoning

    PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname supplied within the request host header when building a password reset URL. It may be possible to m…

    THM-Health PILOS
  • Unscored —
    DRUPAL-CONTRIB-2023-051

    The GraphQL module enables you to build GraphQL APIs which can include data fetching through Queries and data updates (…

    drupal/graphql Packagist
  • High 7.1
    CVE-2023-46626

    WordPress FLOWFACT WP Connector Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FLOWFACT WP Connector plugin <= 2.1.7 versions.

    FLOWFACT FLOWFACT WP Connector
  • High 7.5
    CVE-2023-35767

    Unauthenticated Remote Denial-of-Service via Shutdown Function in Helix Core

    In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Jason Geffner.  

    Helix Helix Core Helix Swarm
  • Unscored —
    DRUPAL-CONTRIB-2023-050

    This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately ve…

    drupal/graphql Packagist
  • Medium 4.8
    CVE-2023-45140

    Group-based JIT MFA bypass on scp and sftp in The Bastion

    The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not …

    ovh the-bastion
  • Medium 5.5
    CVE-2023-5136

    Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX

    An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability by getting a user to open a specially crafted data file.

    NI VeriStand FlexLogger DIAdem
  • High 7.1
    CVE-2023-46621

    WordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin <= 1.4.11 versions.

    Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar
  • Medium 6.5
    CVE-2023-46613

    WordPress Add to Calendar Button Plugin < 1.5.1 is vulnerable to Cross Site Scripting (XSS)

    Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jens Kuerschner Add to Calendar Button plugin <= 1.5.1 versions.

    Jens Kuerschner Add to Calendar Button
  • Low —
    GHSA-475v-pq2g-fp9g

    s2n-quic potential denial of service via crafted stream frames

    ### Impact An issue in s2n-quic could result in unnecessary resource utilization when peers open streams beyond advertised limits. Impacted versions: <= v1.30.0. ### Patches The patch is included in v1.31.0 [1]. ### Workarounds There is no workaround. Applica…

    s2n-quic crates.io
  • High 8.3
    CVE-2023-6012

    Incorrect input data validation in Lanaccess ONSAFE MonitorHM Web Console

    An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could lead a remote attacker to exploit the checkbox element and perform remote code execution, compromising the entire infrast…

    Lanaccess ONSAFE MonitorHM
  • Unscored —
    CVE-2023-46759

    Permission control vulnerability in the call module. Successful exploitation of this vulnerability may affect service c…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-46758

    Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerabili…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-46757

    The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation o…

    Huawei HarmonyOS Network devices
  • Unscored —
    CVE-2023-46756

    Permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cau…

    Huawei HarmonyOS EMUI Network devices
  • Medium 5.3
    CVE-2023-46755

    Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerabili…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-46764

    Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause backgrou…

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-46763

    Vulnerability of background app permission management in the framework module. Successful exploitation of this vulnerab…

    Huawei HarmonyOS EMUI Network devices
  • High 7.5
    CVE-2023-46762

    Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause …

    Huawei HarmonyOS EMUI Network devices
  • Unscored —
    CVE-2023-46761

    Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause …

    Huawei HarmonyOS EMUI Network devices
  • High 7.5
    CVE-2023-46760

    Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause …

    Huawei HarmonyOS EMUI Network devices