Skip to content
OpenAdvisories

Archive

23 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /23 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-47244

    WordPress Email Marketing for WooCommerce by Omnisend Plugin <= 1.13.8 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marketing for WooCommerce by Omnisend: from n/a through 1.13.8.

    Omnisend Email Marketing for WooCommerce by Omnisend Web / CMS
  • Medium 5.3
    CVE-2023-47529 Public exploit

    WordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates & Patterns collection: from n/a through 1.2.2.

    themeisle Cloud Templates & Patterns collection
  • Medium 5.7
    CVE-2023-41812

    Uploading executables via the file manager

    Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulnerability allowed PHP executable files to be uploaded through the file manager. This issue affects Pa…

    Pandora FMS Pandora FMS
  • Medium 5.3
    CVE-2023-41811

    Stored XSS Via Site News Page

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the news section of the web console. This …

    Pandora FMS Pandora FMS
  • Medium 4.0
    CVE-2023-41810

    Stored XSS Via Dashboard Panel

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in some Widgets' text box. This issue affects…

    Pandora FMS Pandora FMS
  • Medium 5.9
    CVE-2023-41792

    Lack of Authorization and Stored XSS Via SNMP Trap Editor Page

    Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issue affects Pandora FMS: from 700 through 773.

    Pandora FMS Pandora FMS
  • Medium 6.0
    CVE-2023-41787

    Arbitrary File Read

    Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows access to files with sensitive information. This issue affects Pandora FMS: from 700 through 772.

    Pandora FMS Pandora FMS
  • Medium 6.8
    CVE-2023-41786

    Database backups availability by low-privileged users

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low privileges to download database backups. This issue affects Pandora FMS: from 700 through 772.

    Pandora FMS Pandora FMS
  • Medium 6.1
    CVE-2023-4594

    Cross-site Scripting in BVRP Software SLmail

    Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in the MailAdmin_dll.htm file.

    BVRP Software SLmail
  • Medium 6.5
    CVE-2023-4593

    Path Traversal in BVRP Software SLmail

    Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent directory via any filename, such as a multiple ..%2F value affecting the 'dodoc' parameter in the /Mai…

    BVRP Software SLmail
  • Medium 6.1
    CVE-2023-4406

    XSS in KC Group's E-Commerce Software

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123.  NOTE: The vendor was contacted early about this…

    KC Group E-Commerce Software
  • Medium 5.5
    CVE-2023-43123

    Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files

    On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Op…

    Apache Software Foundation Apache Storm org.apache.storm:storm-core Maven
  • Medium 5.3
    CVE-2023-47668 Public exploit

    WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.

    stellarwp Membership Plugin – Restrict Content
  • Medium 5.5
    CVE-2023-33202

    Bouncy Castle Denial of Service (DoS)

    Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7…

    bouncycastle bouncycastle gradle-8 gradle-stage0 Debian Ubuntu Wolfi Maven