Skip to content
OpenAdvisories

Archive

November 2023

Vulnerabilities first published in this month (UTC), newest first.

← October 2023 2023 / November December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

1,080 results · Clear filters · Feed

  • Medium 5.9
    CVE-2023-41792

    Lack of Authorization and Stored XSS Via SNMP Trap Editor Page

    Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be executed in the SNMP Trap Editor. This issue affects Pandora FMS: from 700 through 773.

    Pandora FMS Pandora FMS
  • Medium 6.0
    CVE-2023-41787

    Arbitrary File Read

    Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows access to files with sensitive information. This issue affects Pandora FMS: from 700 through 772.

    Pandora FMS Pandora FMS
  • Medium 6.8
    CVE-2023-41786

    Database backups availability by low-privileged users

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low privileges to download database backups. This issue affects Pandora FMS: from 700 through 772.

    Pandora FMS Pandora FMS
  • Medium 6.1
    CVE-2023-4594

    Cross-site Scripting in BVRP Software SLmail

    Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in the MailAdmin_dll.htm file.

    BVRP Software SLmail
  • Medium 6.5
    CVE-2023-4593

    Path Traversal in BVRP Software SLmail

    Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent directory via any filename, such as a multiple ..%2F value affecting the 'dodoc' parameter in the /Mai…

    BVRP Software SLmail
  • Medium 6.1
    CVE-2023-4406

    XSS in KC Group's E-Commerce Software

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This issue affects E-Commerce Software: through 20231123.  NOTE: The vendor was contacted early about this…

    KC Group E-Commerce Software
  • Medium 5.5
    CVE-2023-43123

    Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files

    On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/directory permissions can lead to information disclosure. Of note, this does not impact modern MacOS Op…

    Apache Software Foundation Apache Storm org.apache.storm:storm-core Maven
  • Medium 5.3
    CVE-2023-47668 Public exploit

    WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions.

    stellarwp Membership Plugin – Restrict Content
  • Medium 5.5
    CVE-2023-33202

    Bouncy Castle Denial of Service (DoS)

    Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7…

    bouncycastle bouncycastle gradle-8 gradle-stage0 Debian Ubuntu Wolfi Maven
  • Medium 6.5
    CVE-2023-40002

    WordPress Booster for WooCommerce Plugin <= 7.1.1 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions.

    Pluggabl Booster for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-23978

    WordPress WP Client Reports Plugin <= 1.0.16 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions.

    SwitchWP WP Client Reports
  • Medium 6.5
    CVE-2023-47839

    WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress plugin <= 3.3.26 versions.

    impleCode eCommerce Product Catalog Plugin for WordPress Web / CMS
  • Medium 6.5
    CVE-2023-47835

    WordPress ARI Stream Quiz Plugin <= 1.2.32 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plugin <= 1.2.32 versions.

    ARI Soft ARI Stream Quiz – WordPress Quizzes Builder Web / CMS
  • Medium 6.5
    CVE-2023-47834

    WordPress Quiz And Survey Master Plugin <= 8.1.13 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versions.

    ExpressTech Systems Quiz And Survey Master
  • Medium 5.9
    CVE-2023-47833

    WordPress Theater for WordPress Plugin <= 0.18.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress plugin <= 0.18.3 versions.

    Jeroen Schmit Theater for WordPress Web / CMS
  • Medium 6.5
    CVE-2023-47831

    WordPress DrawIt (draw.io) Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in assorted[chips] DrawIt (draw.Io) plugin <= 1.1.3 versions.

    assorted[chips] DrawIt (draw.io)
  • Medium 5.9
    CVE-2023-47829

    WordPress Quick Call Button Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codez Quick Call Button plugin <= 1.2.9 versions.

    Codez Quick Call Button
  • Medium 6.5
    CVE-2023-47821

    WordPress Email Encoder Bundle Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions.

    Jannis Thuemmig Email Encoder
  • Medium 6.5
    CVE-2023-47817

    WordPress Daily Prayer Time Plugin <= 2023.10.13 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions.

    mmrs151 Daily Prayer Time
  • Medium 6.5
    CVE-2023-47816

    WordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <= 1.7.0.13 versions.

    Charitable Donations & Fundraising Team Donation Forms by Charitable
  • Medium 6.5
    CVE-2023-47815

    WordPress BP Profile Shortcodes Extra Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra plugin <= 2.5.2 versions.

    Venutius BP Profile Shortcodes Extra
  • Medium 6.5
    CVE-2023-47814

    WordPress BMI Calculator Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Waterloo Plugins BMI Calculator Plugin plugin <= 1.0.3 versions.

    Waterloo Plugins BMI Calculator Plugin
  • Medium 6.5
    CVE-2023-47813

    WordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions.

    GrandSlambert Better RSS Widget
  • Medium 6.5
    CVE-2023-47812

    WordPress Bamboo Columns Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns plugin <= 1.6.1 versions.

    Bamboo Mcr Bamboo Columns
  • Medium 6.5
    CVE-2023-47811

    WordPress Anywhere Flash Embed Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5 versions.

    Suresh Kumar Mukhiya Anywhere Flash Embed
  • Medium 6.5
    CVE-2023-47810

    WordPress Ajax Domain Checker Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin <= 1.3.0 versions.

    Asdqwe Dev Ajax Domain Checker
  • Medium 5.9
    CVE-2023-47809

    WordPress Accordion Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions.

    Themepoints Accordion
  • Medium 6.5
    CVE-2023-47808

    WordPress Add Widgets to Page Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versions.

    Christina Uechi Add Widgets to Page
  • Medium 6.5
    CVE-2023-47786

    WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions.

    LayerSlider LayerSlider
  • Medium 5.9
    CVE-2023-47759

    WordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty allows DOM-Based XSS.This issue affects Chaty: from n/a through <= 3.1.2.

    Premio Chaty
  • Medium 6.5
    CVE-2023-6265

    DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal

    ** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' parameter allowing an authenticated attacker with access to the web management interface to delete arbit…

    DrayTek Vigor2960 Network devices
  • Medium 4.3
    CVE-2023-47825

    WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra plugin <= 6.4 versions.

    TienCOP WP EXtra
  • Medium 5.4
    CVE-2023-47824

    WordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1.3.8 versions.

    wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator
  • Medium 4.3
    CVE-2023-47819

    WordPress Easy Call Now by ThikShare Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions.

    Dang Ngoc Binh Easy Call Now by ThikShare
  • Medium 6.2
    CVE-2023-25682

    IBM Sterling B2B Integrator information disclosure

    IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 stores potentially sensitive information in log files that could be read by a local user. IBM X-Force ID: 247034.

    IBM Sterling B2B Integrator Standard Edition
  • Medium 5.4
    CVE-2023-39925

    WordPress Community by PeepSo Plugin <= 6.1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions.

    PeepSo Download Community by PeepSo
  • Medium 4.3
    CVE-2023-47792

    WordPress Big File Uploads Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions.

    Infinite Uploads Big File Uploads – Increase Maximum File Upload Size
  • Medium 4.3
    CVE-2023-47791

    WordPress Leadster Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions.

    Leadster Leadster
  • Medium 4.3
    CVE-2022-36777

    IBM Cloud Pak for Security information disclosure

    IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authenticated user to obtain sensitive version information that could aid in further attacks against the system. IBM X-Force I…

    IBM Cloud Pak for Security QRadar Suite Software
  • Medium 4.3
    CVE-2023-47775

    WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions.

    gVectors Team Comments — wpDiscuz