Skip to content
OpenAdvisories

Archive

9 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /9 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

60 results · Clear filters · Feed

  • Medium 5.4
    CVE-2023-31086

    WordPress Simple Giveaways Plugin <= 2.46.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 versions.

    Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests
  • Medium 5.4
    CVE-2023-31088

    WordPress Floating Action Button Plugin <=1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Faraz Quazi Floating Action Button plugin <= 1.2.1 versions.

    Faraz Quazi Floating Action Button
  • Medium 4.3
    CVE-2023-31093

    WordPress Chronosly Events Calendar Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Chronosly Chronosly Events Calendar plugin <= 2.6.2 versions.

    Chronosly Chronosly Events Calendar
  • Medium 5.9
    CVE-2018-8863

    Philips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized Actor

    The HTTP header in Philips EncoreAnywhere contains data an attacker may be able to use to gain sensitive information.

    Philips EncoreAnywhere
  • Medium 5.4
    CVE-2023-31235

    WordPress Participants Database Plugin <= 2.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions.

    Roland Barker, xnau webdesign Participants Database
  • Medium 4.3
    CVE-2023-32092

    WordPress Community by PeepSo Plugin <= 6.0.9.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.9.0 versions.

    PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles
  • Medium 5.4
    CVE-2023-32093

    WordPress TPG Redirect Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <= 1.0.7 versions.

    Criss Swaim TPG Redirect
  • Medium 4.3
    CVE-2023-32125

    WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions.

    Daniel Powney Multi Rating
  • Medium 5.4
    CVE-2023-32500

    WordPress WoodMart Theme <= 7.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme <= 7.1.1 versions.

    Xtemos WoodMart - Multipurpose WooCommerce Theme Web / CMS
  • Medium 4.3
    CVE-2023-32501

    WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.6.1 versions.

    E4J s.r.l. VikBooking Hotel Booking Engine & PMS
  • Medium 4.3
    CVE-2023-32502

    WordPress Pro Mime Types Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Sybre Waaijer Pro Mime Types – Manage file media types plugin <= 1.0.7 versions.

    Sybre Waaijer Pro Mime Types – Manage file media types
  • Medium 4.3
    CVE-2023-32512

    WordPress ShortPixel Adaptive Images Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions.

    ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
  • Medium 5.3
    CVE-2023-32579

    WordPress Forget About Shortcode Buttons Plugin <= 2.1.2 is vulnerable to Broken Access Control

    Cross-Site Request Forgery (CSRF) vulnerability in Designs & Code Forget About Shortcode Buttons plugin <= 2.1.2 versions.

    Designs & Code Forget About Shortcode Buttons
  • Medium 5.4
    CVE-2023-32587

    WordPress WP Reactions Lite Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Reactions, LLC WP Reactions Lite plugin <= 1.3.8 versions.

    WP Reactions WP Reactions Lite
  • Medium 5.4
    CVE-2023-32592

    WordPress Sunny Search Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions.

    Palasthotel by Edward Bock, Katharina Rompf Sunny Search
  • Medium 4.3
    CVE-2023-32594

    WordPress Hyphenator Plugin <= 5.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Benedict B., Maciej Gryniuk Hyphenator plugin <= 5.1.5 versions.

    Benedict B., Maciej Gryniuk Hyphenator
  • Medium 4.3
    CVE-2023-32602

    WordPress CALL ME NOW Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LOKALYZE CALL ME NOW plugin <= 3.0 versions.

    LOKALYZE CALL ME NOW
  • Medium 4.3
    CVE-2023-32739

    WordPress WP Custom Cursors Plugin < 3.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions.

    Web_Trendy WP Custom Cursors | WordPress Cursor Plugin Web / CMS
  • Medium 5.4
    CVE-2023-32744

    WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions.

    woocommerce Product Recommendations
  • Medium 5.4
    CVE-2023-32745

    WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions.

    woocommerce AutomateWoo
  • Medium 5.4
    CVE-2023-32794

    WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Add-Ons plugin <= 6.1.3 versions.

    woocommerce Product Add-Ons
  • Medium 4.3
    CVE-2023-34024

    WordPress WP Full Auto Tags Manager Plugin <= 2.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Guillemant David WP Full Auto Tags Manager plugin <= 2.2 versions.

    Guillemant David WP Full Auto Tags Manager
  • Medium 5.4
    CVE-2023-34025

    WordPress LWS Hide Login Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions.

    LWS LWS Hide Login
  • Medium 4.3
    CVE-2023-34031

    WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions.

    Pascal Casier bbPress Toolkit
  • Medium 5.9
    CVE-2023-5954

    Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption

    HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

    HashiCorp Vault Enterprise Vault k3d Wolfi Go
  • Medium 6.5
    CVE-2023-5550

    Moodle: rce due to lfi risk in some misconfigured shared hosting environments

    In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server outside of the Moodle webroot could utilise a local file include to achieve remote code execution.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2023-5546 Public exploit

    Moodle: stored xss in quiz grading report via user id number

    ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.5
    CVE-2023-5544

    Moodle: stored xss and potential idor risk in wiki comments

    Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2023-34033

    WordPress Ajax Pagination and Infinite Scroll Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <= 2.0.1 versions.

    Malinky Ajax Pagination and Infinite Scroll
  • Medium 6.5
    CVE-2023-34169

    WordPress TS Webfonts for さくらのレンタルサーバ Plugin <= 3.1.2 is vulnerable to Broken Access Control

    Cross-Site Request Forgery (CSRF) vulnerability in SAKURA Internet Inc. TS Webfonts for さくらのレンタルサーバ plugin <= 3.1.2 versions.

    SAKURA internet TS Webfonts for さくらのレンタルサーバ
  • Medium 5.4
    CVE-2023-34171

    WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions.

    Alex Raven WP Report Post
  • Medium 4.7
    CVE-2023-5540

    Moodle: authenticated remote code execution risk in imscp

    A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2023-34177

    WordPress WP-Cache.com Plugin <= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions.

    Kenth Hagström WP-Cache.com
  • Medium 4.7
    CVE-2023-5539

    Moodle: authenticated remote code execution risk in lesson

    A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.4
    CVE-2023-34178

    WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11 versions.

    Groundhogg Groundhogg
  • Medium 4.3
    CVE-2023-34181

    WordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP-Cirrus plugin <= 0.6.11 versions.

    WP-Cirrus WP-Cirrus
  • Medium 5.4
    CVE-2023-34182

    WordPress LH Password Changer Plugin <= 1.55 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Peter Shaw LH Password Changer plugin <= 1.55 versions.

    Peter Shaw LH Password Changer
  • Medium 5.5
    CVE-2023-6054

    Tongda OA 2017 lock.php sql injection

    A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/manage/lock.php. The manipulation of the argument TERM_ID_STR leads to sql injection. The exploit has been disc…

    Tongda OA 2017
  • Medium 6.3
    CVE-2023-6053

    Tongda OA 2017 delete.php sql injection

    A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.9. Affected by this issue is some unknown functionality of the file general/system/censor_words/manage/delete.php. The manipulation of the argument DELETE_STR leads t…

    Tongda OA 2017
  • Medium 4.3
    CVE-2023-34371

    WordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions.

    Didier Sampaolo SpamReferrerBlock