Skip to content
OpenAdvisories

Archive

14 December 2023

Vulnerabilities first published on this day (UTC), newest first.

← November 2023 2023 / December /14 January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

62 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-49847

    WordPress Annual Archive Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Annual Archive allows Stored XSS.This issue affects Annual Archive: from n/a through 1.6.0.

    twinpictures Annual Archive
  • Medium 6.5
    CVE-2023-50368

    WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.15.2 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Shortcodes and extra features for Phlox theme allows Stored XSS.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.1…

    Averta Shortcodes and extra features for Phlox theme
  • Medium 6.5
    CVE-2023-50369

    WordPress Alma – Pay in installments or later for WooCommerce Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alma Alma – Pay in installments or later for WooCommerce allows Stored XSS.This issue affects Alma – Pay in installments or later for WooCommerce: from n/a t…

    Alma Alma – Pay in installments or later for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2023-50370

    WordPress Livemesh Addons for WPBakery Page Builder Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh WPBakery Page Builder Addons by Livemesh allows Stored XSS.This issue affects WPBakery Page Builder Addons by Livemesh: from n/a through 3.5.

    Livemesh WPBakery Page Builder Addons by Livemesh
  • Medium 5.3
    CVE-2023-48631

    Denial of Service of regular expression in package @adobe/css-tools

    @adobe/css-tools versions 4.3.1 and earlier are affected by an Improper Input Validation vulnerability that could result in a denial of service while attempting to parse CSS.

    Adobe Not a product @adobe/css-tools npm
  • Medium 5.4
    CVE-2023-6571

    Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow

    Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow

    kubeflow kubeflow/kubeflow
  • Medium 6.5
    CVE-2023-50371

    WordPress Advanced Page Visit Counter Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress allows Stored XSS.This issue affects Advanced Page Visit Counter …

    Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress Web / CMS
  • Medium 4.7
    CVE-2023-46750

    Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability when "form" authentication is used in Apache Shiro. Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+.

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • Medium 6.5
    CVE-2023-25644

    Denial of Service Vulnerability in Some ZTE Mobile Internet Products

    There is a denial of service vulnerability in some ZTE mobile internet products. Due to insufficient validation of Web interface parameter, an attacker could use the vulnerability to perform a denial of service attack.

    ZTE MC801A1 MC801A
  • Medium 4.2
    CVE-2023-1904

    In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during th…

    Octopus Deploy Octopus Server
  • Medium 5.9
    CVE-2023-25642

    Two Vulnerabilities in Some ZTE Mobile Internet Products

    There is a buffer overflow vulnerability in some ZTE mobile internet producsts. Due to insufficient validation of tcp port parameter, an authenticated attacker could use the vulnerability to perform a denial of service attack. 

    ZTE MC801A1 MC801A
  • Medium 4.3
    CVE-2023-25651

    SQL Injection Vulnerability in Some ZTE Mobile Internet Products

    There is a SQL injection vulnerability in some ZTE mobile internet products. Due to insufficient input validation of SMS interface parameter, an authenticated attacker could use the vulnerability to execute SQL injection and cause information leak.

    ZTE Mobile Internet Products
  • Medium 6.5
    CVE-2023-25650

    Arbitrary File Download Vulnerability in ZTE ZXCLOUD iRAI

    There is an arbitrary file download vulnerability in ZXCLOUD iRAI. Since the backend does not escape special strings or restrict paths, an attacker with user permission could access the download interface by modifying the request parameter, causing arbitrary …

    ZTE ZXCLOUD iRAI
  • Medium 6.5
    CVE-2023-25648

    Weak Folder Permission Vulnerability in ZTE ZXCLOUD iRAI

    There is a weak folder permission vulnerability in ZTE's ZXCLOUD iRAI product. Due to weak folder permission, an attacker with ordinary user privileges could construct a fake DLL to execute command to escalate local privileges.

    ZTE ZXCLOUD iRAI
  • Medium 5.3
    CVE-2023-6407

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that coul…

    Schneider Electric Easy UPS Online Monitoring Software ICS / OT
  • Medium 6.5
    CVE-2023-5630

    A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install …

    Schneider Electric Trio E-Series Ethernet Data Radio Trio Q-Series Ethernet Data Radio Trio J-Series Ethernet Data Radio ICS / OT
  • Medium 6.2
    CVE-2023-45184 Public exploit

    IBM i Access Client Solutions

    IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270.

    IBM i Access Client Solutions
  • Medium 5.9
    CVE-2022-43843

    IBM Spectrum Scale information disclosure

    IBM Spectrum Scale 5.1.5.0 through 5.1.5.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 239080.

    IBM Spectrum Scale
  • Medium 5.4
    CVE-2023-50137

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50100

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50102

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).

    com.jfinal:jfinal Maven
  • Medium 5.4
    CVE-2023-50101

    Cross-site Scripting in JFinalcms

    JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.

    com.jfinal:jfinal Maven