Skip to content
OpenAdvisories

Archive

November 2023

Vulnerabilities first published in this month (UTC), newest first.

← October 2023 2023 / November December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

2,490 results · Feed

  • Medium 4.3
    CVE-2023-48284

    WordPress Decorator – WooCommerce Email Customizer Plugin <= 1.2.7 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Decorator – WooCommerce Email Customizer: from n/a through 1.2.7.

    WebToffee Decorator – WooCommerce Email Customizer Web / CMS
  • Medium 4.3
    CVE-2023-48323

    WordPress Awesome Support Plugin <= 6.1.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross Site Request Forgery.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.4.

    Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin Web / CMS
  • Medium 5.4
    CVE-2023-48330

    WordPress Bulk Comment Remove Plugin <= 2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: from n/a through 2.

    Mike Strand Bulk Comment Remove
  • Medium 4.3
    CVE-2023-48331

    WordPress MyBookTable Bookstore Plugin <= 3.3.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Stormhill Media MyBookTable Bookstore by Stormhill Media allows Cross Site Request Forgery.This issue affects MyBookTable Bookstore by Stormhill Media: from n/a through 3.3.4.

    Stormhill Media MyBookTable Bookstore by Stormhill Media
  • Medium 5.4
    CVE-2023-48334

    WordPress League Table Plugin <= 1.13 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in DAEXT League Table allows Cross Site Request Forgery.This issue affects League Table: from n/a through 1.13.

    daext League Table
  • Medium 5.4
    CVE-2023-6137

    WordPress Frontier Post Plugin <= 6.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in finnj Frontier Post allows Cross Site Request Forgery.This issue affects Frontier Post: from n/a through 6.1.

    finnj Frontier Post
  • High 8.4
    CVE-2023-6071

    An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a …

    Trellix ESM
  • Medium 5.4
    CVE-2023-48744

    WordPress Availability Calendar Plugin <= 1.2.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Offshore Web Master Availability Calendar allows Cross Site Request Forgery.This issue affects Availability Calendar: from n/a through 1.2.6.

    Offshore Web Master Availability Calendar
  • Medium 6.5
    CVE-2023-32291

    WordPress MonsterInsights Pro Plugin <= 8.14.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MonsterInsights Pro allows Stored XSS.This issue affects MonsterInsights Pro: from n/a through 8.14.1.

    MonsterInsights MonsterInsights Pro
  • High 7.1
    CVE-2023-38474

    WordPress Campaign Monitor for WordPress Plugin <= 2.8.12 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Reflected XSS.This issue affects Campaign Monitor for WordPress: from n/a through 2.8.12.

    Campaign Monitor Campaign Monitor for WordPress Web / CMS
  • Medium 6.5
    CVE-2023-40674

    WordPress Simple URLs Plugin <= 118 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management allows Stored XSS.This issue affects Simple URLs – Link Cloaking, Product …

    Lasso Simple URLs – Link Cloaking, Product Displays, and Affiliate Link Management
  • Medium 5.9
    CVE-2023-40680

    WordPress Yoast SEO Plugin <= 21.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects Yoast SEO: from n/a through 21.0.

    Team Yoast Yoast SEO
  • Medium 5.9
    CVE-2023-41127

    WordPress Evergreen Content Poster Plugin <= 1.3.6.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Evergreen Content Poster Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media allows Stored XSS.This issue affects Evergreen C…

    Evergreen Content Poster Evergreen Content Poster – Auto Post and Schedule Your Best Content to Social Media
  • Medium 5.9
    CVE-2023-41128

    WordPress WP Roadmap Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design WP Roadmap – Product Feedback Board allows Stored XSS.This issue affects WP Roadmap – Product Feedback Board: from n/a through 1.0.8.

    Iqonic Design WP Roadmap – Product Feedback Board
  • Medium 5.9
    CVE-2023-41136

    WordPress Simple Long Form Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laurence/OhMyBox.Info Simple Long Form allows Stored XSS.This issue affects Simple Long Form: from n/a through 2.2.2.

    Laurence/OhMyBox.info Simple Long Form
  • Medium 6.5
    CVE-2023-45050

    WordPress Jetpack Plugin <= 12.8-a.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth allows Stored XSS.This issue affects Jetpack – WP Security, Backup, Speed, & Growth: from n/a throu…

    Automattic Jetpack – WP Security, Backup, Speed, & Growth
  • Medium 6.5
    CVE-2023-47505 EPSS 28%

    WordPress Elementor Website Builder Plugin <= 3.16.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor.Com Elementor allows Cross-Site Scripting (XSS).This issue affects Elementor: from n/a through 3.16.4.

    Elementor.com Elementor
  • Medium 6.5
    CVE-2023-47777

    WordPress WooCommerce and WooCommerce Blocks plugins - Auth. Cross-Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks allows Stored XSS.This issue affects WooCommerce: from n/a through 8.1.1; WooCommerce Blocks: from n/a …

    Automattic WooCommerce WooCommerce Blocks Web / CMS
  • Medium 6.5
    CVE-2023-47850

    WordPress Community by PeepSo Plugin <= 6.2.2.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles allows Stored XSS.This issue affects Community by PeepSo – Social Networ…

    PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles
  • Critical 9.8
    CVE-2023-49733

    Apache Cocoon's StreamGenerator is vulnerable to XXE injection

    Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.

    Apache Software Foundation Apache Cocoon org.apache.cocoon:cocoon Maven
  • Medium 6.5
    CVE-2023-47851

    WordPress Bootstrap Shortcodes Ultimate Plugin <= 4.3.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate allows Stored XSS.This issue affects Bootstrap Shortcodes Ultimate: from n/a through 4.3.1.

    Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate
  • Medium 6.5
    CVE-2023-47854

    WordPress Parallax Image Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Howard Ehrenberg Parallax Image allows Stored XSS.This issue affects Parallax Image: from n/a through 1.7.1.

    Howard Ehrenberg Parallax Image
  • Medium 6.5
    CVE-2023-48289

    WordPress Import Spreadsheets from Microsoft Excel Plugin <= 10.1.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Stored XSS.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through…

    SpreadsheetConverter Import Spreadsheets from Microsoft Excel
  • High 7.1
    CVE-2023-48322

    WordPress eDoc Employee Job Application Plugin <= 1.13 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Application – Best WordPress Job Manager for Employees allows Reflected XSS.This issue affects eDoc Employee Job Applicat…

    eDoc Intelligence eDoc Employee Job Application – Best WordPress Job Manager for Employees Web / CMS
  • High 7.1
    CVE-2023-48326

    WordPress Events Manager Plugin <= 6.4.5 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager allows Reflected XSS.This issue affects Events Manager: from n/a through 6.4.5.

    Pixelite Events Manager
  • Medium 5.9
    CVE-2023-48329

    WordPress Fast Custom Social Share by CodeBard Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard Fast Custom Social Share by CodeBard allows Stored XSS.This issue affects Fast Custom Social Share by CodeBard: from n/a through 1.1.1.

    CodeBard Fast Custom Social Share by CodeBard
  • Medium 6.5
    CVE-2023-48336

    WordPress Easy Social Icons Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cybernetikz Easy Social Icons allows Stored XSS.This issue affects Easy Social Icons: from n/a through 3.2.4.

    cybernetikz Easy Social Icons
  • Medium 5.9
    CVE-2023-48737

    WordPress TriPay Payment Gateway Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Trijaya Digital Grup TriPay Payment Gateway allows Stored XSS.This issue affects TriPay Payment Gateway: from n/a through 3.2.7.

    PT Trijaya Digital Grup TriPay Payment Gateway
  • Medium 5.8
    CVE-2023-48743

    WordPress Simply Exclude Plugin <= 2.0.6.6 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Menard Simply Exclude allows Reflected XSS.This issue affects Simply Exclude: from n/a through 2.0.6.6.

    Paul Menard Simply Exclude
  • Medium 4.7
    CVE-2021-36806

    A reflected XSS vulnerability allows an open redirect when the victim clicks a malicious link to an error page on Sopho…

    Sophos Sophos Email Appliance Network devices
  • Medium 6.5
    CVE-2023-49620

    Apache DolphinScheduler: Authenticated users could delete UDFs in resource center they were not authorized for

    Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unauthorized access vulnerability (IDOR), but after version 3.1.0 we fixed this issue. We mark this cve a…

    Apache Software Foundation Apache DolphinScheduler org.apache.dolphinscheduler:dolphinscheduler-api org.apache.dolphinscheduler:dolphinscheduler-common Maven
  • Critical 9.8
    CVE-2022-45135

    Apache Cocoon: SQL injection in DatabaseCookieAuthenticatorAction

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are recommended to upgrade to version 2.3.0, which fixes the issue.

    Apache Software Foundation Apache Cocoon org.apache.cocoon:cocoon Maven
  • High 7.2
    CVE-2023-49701

    Out-of-bounds access a buffer in SIM management

    Memory Corruption in SIM management while USIMPhase2init

    ASR Falcon
  • High 8.3
    CVE-2023-49077

    mailcow-dockerized XSS Vulnerability in Quarantine UI Allows Unauthorized Access and Data Manipulation

    Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quarantine UI of the system. This vulnerability poses a significant threat to administrators who utilize the…

    mailcow mailcow-dockerized
  • Medium 6.7
    CVE-2023-49700

    Buffer Copy Without Checking size of input in IMS

    Security best practices violations, a string operation in Streamingmedia will write past the end of fixed-size destination buffer if the source buffer is too large.

    ASR Falcon
  • High 8.6
    CVE-2023-49095

    nexkey allows arbitrary users to impersonate any remote user due to missing signature validation

    nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certain circumstances. This issue has been patched in version 12.122.2.

    nexryai nexkey
  • Medium 6.7
    CVE-2023-49699

    Out-of-bounds access a buffer in IMS

    Memory Corruption in IMS while calling VoLTE Streamingmedia Interface

    ASR Falcon
  • High 7.2
    CVE-2023-49081

    aiohttp's ClientSession is vulnerable to CRLF injection via version

    aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request (e.g. to insert a new header) or create a new HTTP request if the attacker controls the HTTP versio…

    aio-libs aiohttp py3-cassandra-medusa python-aiohttp Debian Ubuntu Wolfi PyPI
  • Medium 4.3
    CVE-2023-49076

    Pimcore missing token/header to prevent CSRF

    Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an attacker could abuse this vulnerability to create new customers. This issue has been patched in vers…

    pimcore customer-data-framework
  • Medium 6.8
    CVE-2023-49087

    Validation of SignedInfo

    xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the related XML-document matches a specific DigestValue-value, but also that the cryptographic signature on th…

    simplesamlphp xml-security simplesamlphp/saml2 simplesamlphp/xml-security Packagist