Skip to content
OpenAdvisories

Archive

20 December 2023

Vulnerabilities first published on this day (UTC), newest first.

← November 2023 2023 / December /20 January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

38 results · Clear filters · Feed

  • High 8.4
    CVE-2023-47784

    WordPress Slider Revolution Plugin <= 6.6.15 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a through 6.6.15.

    ThemePunch OHG Slider Revolution
  • High 7.6
    CVE-2023-49166

    WordPress MSync Plugin <= 1.0.0 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0.

    Magic Logix MSync
  • High 7.6
    CVE-2023-49161

    WordPress Bravo Translate Plugin <= 1.2 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Guelben Bravo Translate.This issue affects Bravo Translate: from n/a through 1.2.

    guelben Bravo Translate
  • High 7.1
    CVE-2023-26525

    WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy.This issue affects Dokan – Best WooCommerce Multivendor …

    wedevs Dokan – Best WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy Web / CMS
  • High 7.1
    CVE-2023-28788

    WordPress Advanced Page Visit Counter Plugin <= 6.4.2 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress.This issue affects Advanced Page Visit Counter – Most Wanted Anal…

    Page Visit Counter Advanced Page Visit Counter – Most Wanted Analytics Plugin for WordPress Web / CMS
  • High 8.5
    CVE-2023-29096

    WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.0 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BestWebSoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress.This issue affects Contact Form to DB by BestWebSoft – Messages Databa…

    bestwebsoft Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress Web / CMS
  • High 8.2
    CVE-2023-29432

    WordPress Houzez Theme < 2.8.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme.This issue affects Houzez - Real Estate WordPress Theme: from n/a before 2.8.3.

    Fave Themes Houzez - Real Estate WordPress Theme Web / CMS
  • High 8.5
    CVE-2023-30495

    WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Ultimate Addons for Contact Form 7.This issue affects Ultimate Addons for Contact Form 7: from n/a through 3.1.23.

    themefic Ultimate Addons for Contact Form 7
  • High 8.5
    CVE-2023-30750

    WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeMindsSolutions CM Popup Plugin for WordPress.This issue affects CM Popup Plugin for WordPress: from n/a through 1.5.10.

    CreativeMindsSolutions CM Popup Plugin for WordPress Web / CMS
  • High 7.6
    CVE-2023-30872

    WordPress BSK Forms Blacklist Plugin <= 3.6.2 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BannerSky BSK Forms Blacklist.This issue affects BSK Forms Blacklist: from n/a through 3.6.2.

    bannersky BSK Forms Blacklist
  • High 7.0
    CVE-2023-47118

    Heap buffer overflow in T64 codec decompression

    ClickHouse® is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the n…

    ClickHouse ClickHouse clickhouse Ubuntu
  • High 8.8
    CVE-2023-5007

    Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)

    Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'id' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

    Kashipara Student Information System
  • High 8.8
    CVE-2023-5011

    Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)

    Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursename' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

    Kashipara Student Information System
  • High 7.6
    CVE-2023-32743

    WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 5.7.1.

    woocommerce AutomateWoo
  • High 8.8
    CVE-2023-5010

    Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)

    Student Information System v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'coursecode' parameter of the marks.php resource does not validate the characters received and they are sent unfiltered to the database.

    Kashipara Student Information System
  • High 8.5
    CVE-2023-33209

    WordPress SEO Change Monitor Plugin <= 1.2 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CrawlSpider SEO Change Monitor – Track Website Changes.This issue affects SEO Change Monitor – Track Website Changes: from n/a through 1.2.

    CrawlSpider SEO Change Monitor – Track Website Changes
  • High 8.5
    CVE-2023-33330

    WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WooCommerce AutomateWoo.This issue affects AutomateWoo: from n/a through 4.9.50.

    woocommerce AutomateWoo
  • High 8.5
    CVE-2023-49825

    WordPress Soledad Theme <= 8.4.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce Wo…

    PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme Web / CMS
  • High 7.5
    CVE-2023-35914

    WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce Woo Subscriptions.This issue affects Woo Subscriptions: from n/a through 5.1.2.

    woocommerce Woo Subscriptions
  • High 7.6
    CVE-2023-35915

    WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported …

    Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo
  • High 7.5
    CVE-2023-35916

    WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo.This issue affects WooPayments – Fully Integrated Solution Built and Supported by Woo: from n/a through 5.9.0.

    Automattic WooPayments – Fully Integrated Solution Built and Supported by Woo
  • High 8.5
    CVE-2023-47852

    WordPress Link Whisper Free Plugin <= 0.6.5 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Link Whisper Link Whisper Free.This issue affects Link Whisper Free: from n/a through 0.6.5.

    Link Whisper Link Whisper Free
  • High 8.3
    CVE-2023-28782

    WordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in Rocketgenius Inc. Gravity Forms.This issue affects Gravity Forms: from n/a through 2.7.3.

    Rocketgenius Gravity Forms
  • High 8.1
    CVE-2023-35876

    WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Square.This issue affects WooCommerce Square: from n/a through 3.8.1.

    woocommerce WooCommerce Square Web / CMS
  • High 8.2
    CVE-2023-37871

    WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce GoCardless.This issue affects GoCardless: from n/a through 2.5.6.

    woocommerce GoCardless
  • High 7.5
    CVE-2023-50249

    Sentry's Astro SDK vulnerable to ReDoS

    Sentry-Javascript is official Sentry SDKs for JavaScript. A ReDoS (Regular expression Denial of Service) vulnerability has been identified in Sentry's Astro SDK 7.78.0-7.86.0. Under certain conditions, this vulnerability allows an attacker to cause excessive …

    getsentry sentry-javascript @sentry/astro npm
  • High 7.6
    CVE-2023-38519

    WordPress MainWP Plugin <= 4.4.3.3 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MainWP MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance.This issue affects MainWP Dashboard – WordPress Manager for Multiple Websites M…

    mainwp MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance mainwp/mainwp Web / CMS Packagist
  • High 8.3
    CVE-2023-40555

    WordPress Flatsome Theme <= 3.17.5 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme.This issue affects Flatsome | Multi-Purpose Responsive WooCommerce Theme: from n/a through 3.17.5.

    UX-themes Flatsome | Multi-Purpose Responsive WooCommerce Theme Web / CMS
  • High 7.4
    CVE-2023-46147

    WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.

    Themify Themify Ultra
  • High 7.6
    CVE-2023-47236

    WordPress iPages Flipbook Plugin <= 1.4.8 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum iPages Flipbook For WordPress.This issue affects iPages Flipbook For WordPress: from n/a through 1.4.8.

    Avirtum iPages Flipbook For WordPress Web / CMS
  • High 7.1
    CVE-2023-47507

    WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in Master Slider Master Slider Pro.This issue affects Master Slider Pro: from n/a through 3.6.5.

    Master slider Master Slider Pro
  • High 7.5
    CVE-2023-6562

    JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reacha…

    Kakadu Software Kakadu SDK
  • High 7.5
    CVE-2023-6912

    Brute force vulnerability in M-Files user authentication

    Lack of protection against brute force attacks in M-Files Server before 23.12.13205.0 allows an attacker unlimited authentication attempts, potentially compromising targeted M-Files user accounts by guessing passwords.

    M-Files M-Files Server
  • High 7.5
    CVE-2023-37544

    Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS

    Improper Authentication vulnerability in Apache Pulsar WebSocket Proxy allows an attacker to connect to the /pingpong endpoint without authentication. This issue affects Apache Pulsar WebSocket Proxy: from 2.8.0 through 2.8.*, from 2.9.0 through 2.9.*, from 2…

    Apache Software Foundation Apache Pulsar WebSocket Proxy org.apache.pulsar:pulsar-websocket Maven
  • High 7.6
    CVE-2023-0011

    Command Execution through Serial Interface of u-blox TOBY-L2

    A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the syste…

    u-blox TOBY-L2
  • High 8.8
    CVE-2023-6976

    Unrestricted Upload of File with Dangerous Type

    This vulnerability is capable of writing arbitrary files into arbitrary locations on the remote filesystem in the context of the server process.

    MLflow mlflow/mlflow mlflow PyPI
  • High 8.6
    CVE-2023-6974

    Server-Side Request Forgery (SSRF)

    A malicious user could use this issue to access internal HTTP(s) servers and in the worst case (ie: aws instance) it could be abuse to get a remote code execution on the victim machine.

    MLflow mlflow/mlflow mlflow PyPI
  • High 8.8
    CVE-2023-50986

    Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function.