Skip to content
OpenAdvisories

Archive

22 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /22 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

99 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-27446

    WordPress DeepL Pro API translation Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.1.4 versions.

    Fluenx DeepL API translation plugin
  • Medium 4.3
    CVE-2023-27633

    WordPress Customify Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions.

    pixelgrade Customify – Intuitive Website Styling
  • Medium 5.4
    CVE-2023-28747

    WordPress CBX Currency Converter Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in codeboxr CBX Currency Converter plugin <= 3.0.3 versions.

    Codeboxr CBX Currency Converter
  • Medium 4.3
    CVE-2023-28749

    WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions.

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 4.0
    CVE-2023-43081

    PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in …

    Dell PowerProtect Agent for File System
  • Medium 5.7
    CVE-2023-3104

    Missing Authentication for Critical Function in Unitree Robotics A1

    Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication.

    Unitree Robotics A1
  • Medium 4.3
    CVE-2023-6189

    Improper Permission Handling in M-Files Server

    Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API methods.

    M-Files M-Files Server
  • Medium 5.7
    CVE-2023-6117

    M-Files REST API allows Denial of Service

    A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23.11.13156.0 which allows attackers to execute DoS attacks.

    M-Files M-Files Server
  • Medium 6.5
    CVE-2023-46673

    Elasticsearch Improper Handling of Exceptional Conditions

    It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulate Pipeline API.

    Elastic Elasticsearch elasticsearch org.elasticsearch:elasticsearch Ubuntu Maven
  • Medium 5.4
    CVE-2023-6011

    Stored XSS in Geodi

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geodi allows Stored XSS. This issue affects Geodi: before 8.0.0.27396.

    DECE Software Geodi
  • Medium 6.5
    CVE-2023-2446

    UserPro <= 5.1.1 - Sensitive Information Disclosure via Shortcode

    The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is due to insufficient restriction on sensitive user meta values that can be called via that shortcode.…

    Web / CMS
  • Medium 6.1
    CVE-2023-2447

    UserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposure

    The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce validation on the 'export_users' function. This makes it possible for unauthenticated attackers to …

    Web / CMS
  • Medium 4.3
    CVE-2022-35638

    IBM Sterling B2B Integrator cross-site request forgery

    IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website t…

    IBM Sterling B2B Integrator
  • Medium 5.9
    CVE-2021-37937

    Elasticsearch privilege escalation

    An issue was found with how API keys are created with the Fleet-Server service account. When an API key is created with a service account, it is possible that the API key could be created with higher privileges than intended. Using this vulnerability, a compr…

    Elastic Elasticsearch elasticsearch Ubuntu
  • Medium 6.6
    CVE-2021-22142

    Kibana Reporting vulnerabilities

    Kibana contains an embedded version of the Chromium browser that the Reporting feature uses to generate the downloadable reports. If a user with permissions to generate reports is able to render arbitrary HTML with this browser, they may be able to leverage k…

    Elastic Kibana
  • Medium 6.6
    CVE-2021-22150

    Kibana code execution issue

    It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana serve…

    Elastic Kibana
  • Medium 6.1
    CVE-2023-47380

    Cross-site Scripting in Admidio

    Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS).

    admidio/admidio Packagist
  • Medium 6.5
    CVE-2023-47467

    Directory Traversal in jeecg-boot

    Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure.

    org.jeecgframework.boot:jeecg-boot-common Maven
  • Medium 6.1
    CVE-2023-49146

    Cross-site Scripting in DOMSanitizer

    DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions.

    rhukster/dom-sanitizer Packagist