Skip to content
OpenAdvisories

Archive

November 2023

Vulnerabilities first published in this month (UTC), newest first.

← October 2023 2023 / November December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

615 results · Clear filters · Feed

  • High 8.8
    CVE-2023-42917 Exploited

    A memory corruption vulnerability was addressed with improved locking. This issue is fixed in iOS 17.1.2 and iPadOS 17.…

    Apple macOS iOS and iPadOS Safari macOS iOS Browsers Debian Ubuntu Wolfi
    KEV Dec 4, 2023
  • High 7.5
    CVE-2023-47279

    Delta Electronics InfraSuite Device Master Path Traversal

    In Delta Electronics InfraSuite Device Master v.1.0.7, A vulnerability exists that allows an unauthenticated attacker to disclose user information through a single UDP packet, obtain plaintext credentials, or perform NTLM relaying.

    Delta Electronics InfraSuite Device Master ICS / OT
  • High 8.8
    CVE-2023-46690

    Delta Electronics InfraSuite Device Master Path Traversal

    In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an attacker to write to any file to any location of the filesystem, which could lead to remote code execution.

    Delta Electronics InfraSuite Device Master ICS / OT
  • High 7.5
    CVE-2023-5909

    Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx

    KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect.

    Rockwell Automation PTC Software Toolbox GE Gigital Browsers ICS / OT
  • High 7.5
    CVE-2023-49735

    Apache Tiles: Unvalidated input may lead to path traversal and XXE

    ** UNSUPPORTED WHEN ASSIGNED ** The value set as the DefaultLocaleResolver.LOCALE_KEY attribute on the session was not validated while resolving XML definition files, leading to possible path traversal and eventually SSRF/XXE when passing user-controlled data…

    Apache Software Foundation Apache Tiles struts:struts tiles Debian Ubuntu Maven
  • High 7.1
    CVE-2023-47870

    WordPress wpForo Forum Plugin <= 2.2.6 is vulnerable to Broken Access Control and Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpFo…

    gVectors Team wpForo Forum
  • High 7.1
    CVE-2023-47521

    WordPress Q2W3 Post Order Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Bond, AndreSC Q2W3 Post Order allows Reflected XSS.This issue affects Q2W3 Post Order: from n/a through 1.2.8.

    Max Bond, AndreSC Q2W3 Post Order
  • High 7.1
    CVE-2023-38400

    WordPress Enfold Theme <= 5.6.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold - Responsive Multi-Purpose Theme allows Reflected XSS.This issue affects Enfold - Responsive Multi-Purpose Theme: from n/a through 5.6.4.

    Kriesi Enfold - Responsive Multi-Purpose Theme
  • High 7.1
    CVE-2023-47844

    WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4.

    Lim Kai Yang Grab & Save
  • High 7.5
    CVE-2023-31176

    Insufficient entropy vulnerability could lead to authentication bypass

    An Insufficient Entropy vulnerability in the Schweitzer Engineering Laboratories SEL-451 could allow an unauthenticated remote attacker to brute-force session tokens and bypass authentication.  See product Instruction Manual Appendix A dated 20230830 for more…

    Schweitzer Engineering Laboratories SEL-451
  • High 7.1
    CVE-2023-47848

    WordPress Tainacan Plugin <= 0.20.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tainacan.Org Tainacan allows Reflected XSS.This issue affects Tainacan: from n/a through 0.20.4.

    Tainacan.org Tainacan
  • High 7.1
    CVE-2023-47876

    WordPress Perfmatters Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Perfmatters allows Reflected XSS.This issue affects Perfmatters: from n/a through 2.1.6.

    Perfmatters perfmatters
  • High 7.1
    CVE-2023-48272

    WordPress Maspik – Spam blacklist Plugin <= 0.9.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Maspik – Spam Blacklist allows Stored XSS.This issue affects Maspik – Spam Blacklist: from n/a through 0.9.2.

    yonifre Maspik – Spam blacklist
  • High 7.1
    CVE-2023-48746

    WordPress Community by PeepSo Plugin <= 6.2.6.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Reflected XSS.This issue affects Community by PeepSo – Social Net…

    PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles
  • High 7.1
    CVE-2023-48748

    WordPress Salient Core Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Theme nectar Salient Core allows Reflected XSS.This issue affects Salient Core: from n/a through 2.0.2.

    Theme nectar Salient Core
  • High 7.1
    CVE-2023-48752

    WordPress Happyforms Plugin <= 1.25.9 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms allows Reflected XSS.This issue affects Form bu…

    Happyforms Form builder to get in touch with visitors, grow your email list and collect payments — Happyforms
  • High 7.1
    CVE-2023-48278

    WordPress WP Forms Puzzle Captcha Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to XSS

    Cross-Site Request Forgery (CSRF) vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Stored XSS.This issue affects WP Forms Puzzle Captcha: from n/a through 4.1.

    Nitin Rathod WP Forms Puzzle Captcha
  • High 7.1
    CVE-2023-46086

    WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin allows Reflected XSS.This issue affects affiliate-toolkit – WordPress Affiliate Plug…

    SERVIT Software Solutions affiliate-toolkit – WordPress Affiliate Plugin Web / CMS
  • High 8.6
    CVE-2023-6360 Public exploit Scanner template EPSS 63%

    The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in t…

    Web / CMS
  • High 7.5
    CVE-2023-40211 Scanner template

    WordPress Post Grid Plugin <= 2.2.50 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in PickPlugins Post Grid Combo – 36+ Gutenberg Blocks.This issue affects Post Grid Combo – 36+ Gutenberg Blocks: from n/a through 2.2.50.

    PickPlugins Post Grid Combo – 36+ Gutenberg Blocks
  • High 7.5
    CVE-2023-44150

    WordPress ProfilePress Plugin <= 4.13.2 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin…

    ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress
  • High 7.6
    CVE-2023-48742

    WordPress License Manager for WooCommerce Plugin <= 2.2.10 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LicenseManager License Manager for WooCommerce license-manager-for-woocommerce allows SQL Injection.This issue affects License Manager for WooCommerce: from …

    LicenseManager License Manager for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-33333

    WordPress Complianz and Complianz Premium plugins - Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS)

    Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Scripting (XSS).This issue affects Complianz: from n/a through 6.4.4; Complianz Premium: from n/a through 6.4.6.1.

    Really Simple Plugins Complianz Complianz Premium
  • High 7.1
    CVE-2023-36682

    WordPress Schema Pro Plugin <= 2.7.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC Schema Pro allows Cross Site Request Forgery.This issue affects Schema Pro: from n/a through 2.7.7.

    Brainstorm Force US Schema Pro
  • High 8.4
    CVE-2023-6071

    An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a …

    Trellix ESM
  • High 7.1
    CVE-2023-38474

    WordPress Campaign Monitor for WordPress Plugin <= 2.8.12 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Reflected XSS.This issue affects Campaign Monitor for WordPress: from n/a through 2.8.12.

    Campaign Monitor Campaign Monitor for WordPress Web / CMS
  • High 7.1
    CVE-2023-48322

    WordPress eDoc Employee Job Application Plugin <= 1.13 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Application – Best WordPress Job Manager for Employees allows Reflected XSS.This issue affects eDoc Employee Job Applicat…

    eDoc Intelligence eDoc Employee Job Application – Best WordPress Job Manager for Employees Web / CMS
  • High 7.1
    CVE-2023-48326

    WordPress Events Manager Plugin <= 6.4.5 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager allows Reflected XSS.This issue affects Events Manager: from n/a through 6.4.5.

    Pixelite Events Manager
  • High 7.2
    CVE-2023-49701

    Out-of-bounds access a buffer in SIM management

    Memory Corruption in SIM management while USIMPhase2init

    ASR Falcon
  • High 8.3
    CVE-2023-49077

    mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation

    Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the…

    mailcow mailcow-dockerized
  • High 8.6
    CVE-2023-49095

    nexkey allows arbitrary users to impersonate any remote user due to missing signature validation

    nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.

    nexryai nexkey
  • High 7.2
    CVE-2023-49081

    aiohttp's ClientSession is vulnerable to CRLF injection via version

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP versio…

    aio-libs aiohttp py3-cassandra-medusa aiohttp Debian Ubuntu Wolfi PyPI
  • High 8.1
    CVE-2023-49097

    ZITADEL vulnerable account takeover via malicious host header injection

    ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten a…

    zitadel zitadel github.com/zitadel/zitadel Go
  • High 7.8
    CVE-2023-5247

    Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA …

    Mitsubishi Electric GX Works3 MELSOFT Navigator MELSOFT iQ AppPortal ICS / OT
  • High 8.8
    CVE-2023-37928 EPSS 60%

    A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZ…

    Zyxel NAS326 firmware NAS542 firmware Network devices
  • High 8.8
    CVE-2023-37927

    The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C…

    Zyxel NAS326 firmware NAS542 firmware Network devices
  • High 7.5
    CVE-2023-35137

    An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.1…

    Zyxel NAS326 firmware NAS542 firmware Network devices
  • High 7.2
    CVE-2023-46956

    SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary…

  • High 8.8
    CVE-2023-49052 Public exploit

    Microweber file upload vulnerability

    File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the created forms component.

    microweber/microweber Packagist
  • High 7.5
    CVE-2023-40458

    AceManager DOS Vulnerability

    Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a Denial of Service (DoS) condition for ACEManager without impairing other router functions. This condition…

    Sierra Wireless ALEOS tinyxml Ubuntu