Skip to content
OpenAdvisories

Archive

9 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /9 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

60 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-47238

    WordPress Top 10 Plugin <= 3.3.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions.

    WebberZone Top 10 – WordPress Popular posts by WebberZone Web / CMS
  • Medium 5.4
    CVE-2023-47237

    WordPress WP Google My Business Auto Publish Plugin <= 3.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson Auto Publish for Google My Business plugin <= 3.7 versions.

    Martin Gibson Auto Publish for Google My Business
  • Medium 5.4
    CVE-2023-46614

    WordPress WP Helper Premium Plugin <= 4.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions.

    Mat Bao WP Helper Premium
  • Medium 4.3
    CVE-2023-34386

    WordPress WPC Smart Wishlist for WooCommerce Plugin <= 4.7.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions.

    wpclever WPC Smart Wishlist for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2023-31087

    WordPress JS Job Manager Plugin <=2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions.

    JoomSky JS Job Manager
  • Medium 5.4
    CVE-2023-34002

    WordPress WP Inventory Manager Plugin <= 2.1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin <= 2.1.0.13 versions.

    WP Inventory Manager WP Inventory Manager
  • Medium 5.4
    CVE-2023-25975

    WordPress Etsy Shop Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Frédéric Sheedy Etsy Shop plugin <= 3.0.3 versions.

    Frédéric Sheedy Etsy Shop
  • Medium 5.3
    CVE-2023-45284

    Incorrect detection of reserved device names on Windows in path/filepath

    On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserved names "COM" and "LPT" followed by superscript 1, 2, or 3, are incorrectly reported as local. With …

    Go standard library path/filepath golang stdlib Debian Ubuntu Azure Linux Go
  • Medium 4.3
    CVE-2023-36688

    WordPress Simple Site Verify Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)

    Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Mann Simple Site Verify plugin <= 1.0.7 versions.

    Michael Mann Simple Site Verify
  • Medium 5.4
    CVE-2023-25994

    WordPress Publish to Schedule Plugin <= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.4.2 versions.

    Alex Benfica Publish to Schedule
  • Medium 5.5
    CVE-2023-6039

    Kernel: use-after-free in drivers/net/usb/lan78xx.c in lan78xx_disconnect

    A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when the LAN78XX USB device detaches.

    Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2023-6052

    Tongda OA 2017 delete.php sql injection

    A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. Affected is an unknown function of the file general/system/censor_words/module/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has …

    Tongda OA 2017
  • Medium 6.8
    CVE-2023-47612

    A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cint…

    Telit Cinterion EHS6 EHS8 PDS8
  • Medium 5.0
    CVE-2023-4218

    XXE in eclipse.platform / Eclipse IDE

    In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any evil project or update an open project with a vulnerable file (for example for review a foreign reposi…

    Eclipse Foundation org.eclipse.core.runtime Eclipse IDE org.eclipse.pde Ubuntu Maven
  • Medium 4.4
    CVE-2023-47613

    A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinteri…

    Telit Cinterion EHS6 EHS8 PDS8
  • Medium 5.6
    CVE-2023-26156

    chromedriver Command Injection vulnerability

    Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This could lead to unauthorized access and potentially malicious actions on the host system. **Note:** An…

    chromedriver npm
  • Medium 5.9
    CVE-2023-20902

    Timing attack risk in Harbor

    A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below,  Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network access to create jobs/stop job tasks and retrieve job task information.

    Harbor Project github.com/goharbor/harbor Go
  • Medium 5.4
    CVE-2023-45885

    NASA Open MCT Cross Site Scripting vulnerability

    Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in the flexibleLayout plugin.

    openmct npm
  • Medium 6.5
    CVE-2023-45884

    NASA Open MCT Cross Site Request Forgery (CSRF) vulnerability

    Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLayout plugin.

    openmct npm
  • Medium 6.1
    CVE-2023-47488

    Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive informat…