Skip to content
OpenAdvisories

Archive

9 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /9 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

100 results · Feed

  • High 7.1
    CVE-2023-36024

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Microsoft Edge (Chromium-based) Extended Stable Browsers
  • High 7.3
    CVE-2023-36014

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • Medium 5.4
    CVE-2023-31086

    WordPress Simple Giveaways Plugin <= 2.46.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 versions.

    Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests
  • Medium 5.4
    CVE-2023-31088

    WordPress Floating Action Button Plugin <=1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Faraz Quazi Floating Action Button plugin <= 1.2.1 versions.

    Faraz Quazi Floating Action Button
  • Medium 4.3
    CVE-2023-31093

    WordPress Chronosly Events Calendar Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Chronosly Chronosly Events Calendar plugin <= 2.6.2 versions.

    Chronosly Chronosly Events Calendar
  • Medium 5.9
    CVE-2018-8863

    Philips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized Actor

    The HTTP header in Philips EncoreAnywhere contains data an attacker may be able to use to gain sensitive information.

    Philips EncoreAnywhere
  • Medium 5.4
    CVE-2023-31235

    WordPress Participants Database Plugin <= 2.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.

    Roland Barker, xnau webdesign Participants Database
  • Medium 4.3
    CVE-2023-32092

    WordPress Community by PeepSo Plugin <= 6.0.9.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.9.0 versions.

    PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles
  • Medium 5.4
    CVE-2023-32093

    WordPress TPG Redirect Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <= 1.0.7 versions.

    Criss Swaim TPG Redirect
  • Medium 4.3
    CVE-2023-32125

    WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.

    Daniel Powney Multi Rating
  • Medium 5.4
    CVE-2023-32500

    WordPress WoodMart Theme <= 7.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme <= 7.1.1 versions.

    Xtemos WoodMart - Multipurpose WooCommerce Theme Web / CMS
  • Medium 4.3
    CVE-2023-32501

    WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.6.1 versions.

    E4J s.r.l. VikBooking Hotel Booking Engine & PMS
  • Medium 4.3
    CVE-2023-32502

    WordPress Pro Mime Types Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Sybre Waaijer Pro Mime Types – Manage file media types plugin <= 1.0.7 versions.

    Sybre Waaijer Pro Mime Types – Manage file media types
  • Low 3.3
    CVE-2023-5543

    Moodle: duplicating a bigbluebutton activity assigns the same meeting id

    When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting.

    moodle Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-32512

    WordPress ShortPixel Adaptive Images Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions.

    ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
  • Medium 5.3
    CVE-2023-32579

    WordPress Forget About Shortcode Buttons Plugin <= 2.1.2 is vulnerable to Broken Access Control

    Cross-Site Request Forgery (CSRF) vulnerability in Designs & Code Forget About Shortcode Buttons plugin <= 2.1.2 versions.

    Designs & Code Forget About Shortcode Buttons
  • Medium 5.4
    CVE-2023-32587

    WordPress WP Reactions Lite Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Reactions, LLC WP Reactions Lite plugin <= 1.3.8 versions.

    WP Reactions WP Reactions Lite
  • Medium 5.4
    CVE-2023-32592

    WordPress Sunny Search Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.

    Palasthotel by Edward Bock, Katharina Rompf Sunny Search
  • Medium 4.3
    CVE-2023-32594

    WordPress Hyphenator Plugin <= 5.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Benedict B., Maciej Gryniuk Hyphenator plugin <= 5.1.5 versions.

    Benedict B., Maciej Gryniuk Hyphenator
  • High 8.1
    CVE-2023-4379

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2023-32602

    WordPress CALL ME NOW Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LOKALYZE CALL ME NOW plugin <= 3.0 versions.

    LOKALYZE CALL ME NOW
  • Medium 4.3
    CVE-2023-32739

    WordPress WP Custom Cursors Plugin < 3.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.

    Web_Trendy WP Custom Cursors | WordPress Cursor Plugin Web / CMS
  • Medium 5.4
    CVE-2023-32744

    WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions.

    woocommerce Product Recommendations
  • Medium 5.4
    CVE-2023-32745

    WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions.

    woocommerce AutomateWoo
  • Medium 5.4
    CVE-2023-32794

    WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Add-Ons plugin <= 6.1.3 versions.

    woocommerce Product Add-Ons
  • Medium 4.3
    CVE-2023-34024

    WordPress WP Full Auto Tags Manager Plugin <= 2.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Guillemant David WP Full Auto Tags Manager plugin <= 2.2 versions.

    Guillemant David WP Full Auto Tags Manager
  • Medium 5.4
    CVE-2023-34025

    WordPress LWS Hide Login Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions.

    LWS LWS Hide Login
  • Medium 4.3
    CVE-2023-34031

    WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.

    Pascal Casier bbPress Toolkit
  • Medium 5.9
    CVE-2023-5954

    Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

    HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

    HashiCorp Vault Enterprise Vault k3d Wolfi Go
  • Low 3.3
    CVE-2023-5551

    Moodle: forum summary report shows students from other groups when in separate groups mode

    Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2023-5550

    Moodle: rce due to lfi risk in some misconfigured shared hosting environments

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5549

    Moodle: insufficient capability checks when updating the parent of a course category

    Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capability to manage.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5548

    Moodle: cache poisoning risk with endpoint revision numbers

    Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5547

    Moodle: xss risk when previewing data in course upload tool

    The course upload preview contained an XSS risk for users uploading unsafe data.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2023-5546 Public exploit

    Moodle: stored xss in quiz grading report via user id number

    ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Low 3.3
    CVE-2023-5545

    Moodle: auto-populated h5p author name causes a potential information leak

    H5P metadata automatically populated the author with the user's username, which could be sensitive information.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2023-5544

    Moodle: stored xss and potential idor risk in wiki comments

    Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2023-34033

    WordPress Ajax Pagination and Infinite Scroll Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <= 2.0.1 versions.

    Malinky Ajax Pagination and Infinite Scroll
  • Medium 6.5
    CVE-2023-34169

    WordPress TS Webfonts for さくらのレンタルサーバ Plugin <= 3.1.2 is vulnerable to Broken Access Control

    Cross-Site Request Forgery (CSRF) vulnerability in SAKURA Internet Inc. TS Webfonts for さくらのレンタルサーバ plugin <= 3.1.2 versions.

    SAKURA internet TS Webfonts for さくらのレンタルサーバ
  • Low 3.3
    CVE-2023-5542

    Moodle: students can view other users in "only see own membership" groups

    Students in "Only see own membership" groups could see other students in the group, which should be hidden.

    moodle/moodle moodle Web / CMS Ubuntu Packagist