Skip to content
OpenAdvisories

Archive

30 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /30 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

111 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-48323

    WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross Site Request Forgery.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.4.

    Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin Web / CMS
  • Medium 5.4
    CVE-2023-48330

    WordPress Bulk Comment Remove Plugin <= 2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2.

    Mike Strand Bulk Comment Remove
  • Medium 4.3
    CVE-2023-48331

    WordPress MyBookTable Bookstore Plugin <= 3.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Stormhill Media MyBookTable Bookstore by Stormhill Media allows Cross Site Request Forgery.This issue affects MyBookTable Bookstore by Stormhill Media: from n/a through 3.3.4.

    Stormhill Media MyBookTable Bookstore by Stormhill Media
  • Medium 5.4
    CVE-2023-48334

    WordPress League Table Plugin <= 1.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in DAEXT League Table allows Cross Site Request Forgery.This issue affects League Table: from n/a through 1.13.

    daext League Table
  • Medium 5.4
    CVE-2023-6137

    WordPress Frontier Post Plugin <= 6.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in finnj Frontier Post allows Cross Site Request Forgery.This issue affects Frontier Post: from n/a through 6.1.

    finnj Frontier Post
  • Medium 5.4
    CVE-2023-48744

    WordPress Availability Calendar Plugin <= 1.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Offshore Web Master Availability Calendar allows Cross Site Request Forgery.This issue affects Availability Calendar: from n/a through 1.2.6.

    Offshore Web Master Availability Calendar
  • Medium 6.5
    CVE-2023-32291

    WordPress MonsterInsights Pro Plugin <= 8.14.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MonsterInsights Pro allows Stored XSS.This issue affects MonsterInsights Pro: from n/a through 8.14.1.

    MonsterInsights MonsterInsights Pro
  • Medium 6.5
    CVE-2023-40674

    WordPress Simple URLs Plugin <= 118 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management allows Stored XSS.This issue affects Simple URLs – Link Cloaking, Product …

    Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management
  • Medium 5.9
    CVE-2023-40680

    WordPress Yoast SEO Plugin <= 21.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects Yoast SEO: from n/a through 21.0.

    Team Yoast Yoast SEO
  • Medium 5.9
    CVE-2023-41127

    WordPress Evergreen Content Poster Plugin <= 1.3.6.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Evergreen Content Poster Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media allows Stored XSS.This issue affects Evergreen C…

    Evergreen Content Poster Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media
  • Medium 5.9
    CVE-2023-41128

    WordPress WP Roadmap Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design WP Roadmap – Product Feedback Board allows Stored XSS.This issue affects WP Roadmap – Product Feedback Board: from n/a through 1.0.8.

    Iqonic Design WP Roadmap – Product Feedback Board
  • Medium 5.9
    CVE-2023-41136

    WordPress Simple Long Form Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laurence/OhMyBox.Info Simple Long Form allows Stored XSS.This issue affects Simple Long Form: from n/a through 2.2.2.

    Laurence/OhMyBox.info Simple Long Form
  • Medium 6.5
    CVE-2023-45050

    WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a throu…

    Automattic Jetpack – WP Security, Backup, Speed, & Growth
  • Medium 6.5
    CVE-2023-47505 EPSS 28%

    WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor.Com Elementor allows Cross-Site Scripting (XSS).This issue affects Elementor: from n/a through 3.16.4.

    Elementor.com Elementor
  • Medium 6.5
    CVE-2023-47777

    WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.This issue affects WooCommerce: from n/a through 8.1.1; WooCommerce Blocks: from n/a …

    Automattic WooCommerce WooCommerce Blocks Web / CMS
  • Medium 6.5
    CVE-2023-47850

    WordPress Community by PeepSo Plugin <= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Networ…

    PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles
  • Medium 6.5
    CVE-2023-47851

    WordPress Bootstrap Shortcodes Ultimate Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate allows Stored XSS.This issue affects Bootstrap Shortcodes Ultimate: from n/a through 4.3.1.

    Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate
  • Medium 6.5
    CVE-2023-47854

    WordPress Parallax Image Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Howard Ehrenberg Parallax Image allows Stored XSS.This issue affects Parallax Image: from n/a through 1.7.1.

    Howard Ehrenberg Parallax Image
  • Medium 6.5
    CVE-2023-48289

    WordPress Import Spreadsheets from Microsoft Excel Plugin <= 10.1.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Stored XSS.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through…

    SpreadsheetConverter Import Spreadsheets from Microsoft Excel
  • Medium 5.9
    CVE-2023-48329

    WordPress Fast Custom Social Share by CodeBard Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard Fast Custom Social Share by CodeBard allows Stored XSS.This issue affects Fast Custom Social Share by CodeBard: from n/a through 1.1.1.

    CodeBard Fast Custom Social Share by CodeBard
  • Medium 6.5
    CVE-2023-48336

    WordPress Easy Social Icons Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cybernetikz Easy Social Icons allows Stored XSS.This issue affects Easy Social Icons: from n/a through 3.2.4.

    cybernetikz Easy Social Icons
  • Medium 5.9
    CVE-2023-48737

    WordPress TriPay Payment Gateway Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Trijaya Digital Grup TriPay Payment Gateway allows Stored XSS.This issue affects TriPay Payment Gateway: from n/a through 3.2.7.

    PT Trijaya Digital Grup TriPay Payment Gateway
  • Medium 5.8
    CVE-2023-48743

    WordPress Simply Exclude Plugin <= 2.0.6.6 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Menard Simply Exclude allows Reflected XSS.This issue affects Simply Exclude: from n/a through 2.0.6.6.

    Paul Menard Simply Exclude
  • Medium 4.7
    CVE-2021-36806

    A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sopho…

    Sophos Sophos Email Appliance Network devices
  • Medium 6.5
    CVE-2023-49620

    Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

    Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve a…

    Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler-api org.apache.dolphinscheduler:dolphinscheduler-common Maven
  • Medium 6.7
    CVE-2023-49700

    Buffer Copy Without Checking size of input in IMS

    Security best practices violations, a string operation in Streamingmedia will write past the end of fixed-size destination buffer if the source buffer is too large.

    ASR Falcon
  • Medium 6.7
    CVE-2023-49699

    Out-of-bounds access a buffer in IMS

    Memory Corruption in IMS while calling VoLTE Streamingmedia Interface

    ASR Falcon
  • Medium 4.3
    CVE-2023-49076

    Pimcore missing token/header to prevent CSRF

    Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in vers…

    pimcore customer-data-framework
  • Medium 6.8
    CVE-2023-49087

    Validation of SignedInfo

    xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on th…

    simplesamlphp xml-security simplesamlphp/saml2 simplesamlphp/xml-security Packagist
  • Medium 4.3
    CVE-2023-49094

    Symbolicator Server Side Request Forgery vulnerability

    Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response cou…

    getsentry symbolicator
  • Medium 4.3
    CVE-2023-5772

    Debug Log Manager <= 2.2.0 - Cross-Site Request Forgery

    The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated at…

    qriouslad Debug Log Manager – Conveniently Monitor and Inspect Errors Web / CMS