Skip to content
OpenAdvisories

Archive

December 2023

Vulnerabilities first published in this month (UTC), newest first.

← November 2023 2023 / December January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

1,040 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-46104

    Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb

    Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets.   This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.4
    CVE-2023-5432

    Jquery news ticker <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Jquery news ticker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'jquery-news-ticker' shortcode in versions up to, and including, 3.1 due to insufficient input sanitization and output escaping on user supplied attributes. This make…

    gopiplushotmailcom Jquery news ticker Web / CMS
  • Medium 6.4
    CVE-2023-5413

    Image horizontal reel scroll slideshow <= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'ihrss-gallery' shortcode in versions up to, and including, 13.3 due to insufficient input sanitization and output escaping on user supplied attri…

    Gopiplus Image horizontal reel scroll slideshow Web / CMS
  • Medium 4.3
    CVE-2023-42015

    IBM UrbanCode Deploy HTML injection

    IBM UrbanCode Deploy (UCD) 7.1 through 7.1.2.14, 7.2 through 7.2.3.7, and 7.3 through 7.3.2.2 is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosu…

    IBM UrbanCode Deploy
  • Medium 4.3
    CVE-2019-25157

    Ethex Contracts Monthly Jackpot EthexJackpot.sol access control

    A vulnerability was found in Ethex Contracts. It has been classified as critical. This affects an unknown part of the file EthexJackpot.sol of the component Monthly Jackpot Handler. The manipulation leads to improper access controls. It is possible to initiat…

    Ethex Contracts
  • Medium 4.3
    CVE-2014-125107

    Corveda PHPSandbox String protection mechanism

    A vulnerability was found in Corveda PHPSandbox 1.3.4 and classified as critical. Affected by this issue is some unknown functionality of the component String Handler. The manipulation leads to protection mechanism failure. The attack may be launched remotely…

    Corveda PHPSandbox corveda/phpsandbox Packagist
  • Medium 5.4
    CVE-2023-6488

    WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'su_button', 'su_members', and 'su_tabs' shortcodes in all versions up to, and including, 7.0.0 due to insufficient input sanitiz…

    gn_themes WP Shortcodes Plugin — Shortcodes Ultimate Web / CMS
  • Medium 5.3
    CVE-2023-44982 Scanner template

    WordPress WP Retina 2x Plugin <= 6.4.5 is vulnerable to Sensitive Data Exposure

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina).This issue affects Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina): from n/a through 6.4.5.

    Jordy Meow Perfect Images (Manage Image Sizes, Thumbnails, Replace, Retina)
  • Medium 6.5
    CVE-2023-49006

    Phpsysinfo Cross Site Request Forgery (CSRF) vulnerability

    Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file.

    phpsysinfo phpsysinfo/phpsysinfo phpsysinfo Debian Ubuntu Packagist
  • Medium 6.1
    CVE-2023-49489 Scanner template

    Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive i…

  • Medium 6.3
    CVE-2023-46212

    WordPress WP EXtra Plugin <= 6.2 is vulnerable to Broken Access Control

    Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a through 6.2.

    TienCOP WP EXtra
  • Medium 6.6
    CVE-2023-46154

    WordPress e2pdf Plugin <= 1.20.18 is vulnerable to PHP Object Injection

    Deserialization of Untrusted Data vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress.This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.18.

    E2Pdf.com E2Pdf – Export To Pdf Tool for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-47754

    WordPress Delete Duplicate Posts Plugin <= 4.8.9 is vulnerable to Broken Access Control

    Missing Authorization vulnerability in Clever plugins Delete Duplicate Posts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Delete Duplicate Posts: from n/a through 4.8.9.

    Clever plugins Delete Duplicate Posts
  • Medium 4.3
    CVE-2023-48751

    WordPress Participants Database Plugin <= 2.5.5 is vulnerable to Broken Access Control

    Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database:…

    Roland Barker, xnau webdesign Participants Database
  • Medium 5.3
    CVE-2022-45809

    WordPress Thumbs Rating Plugin <= 5.0.0 is vulnerable to Race Condition

    Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.0.0.

    Ricard Torres Thumbs Rating
  • Medium 4.6
    CVE-2023-6927

    Keycloak: open redirect via "form_post.jwt" jarm response mode

    A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134.

    Red Hat Red Hat Single Sign-On 7 RHEL-8 based Middleware Containers Red Hat Single Sign-On 7.6 for RHEL 8 Maven
  • Medium 5.4
    CVE-2023-49821

    WordPress LiveChat Plugin <= 4.5.15 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in LiveChat LiveChat – WP live chat plugin for WordPress.This issue affects LiveChat – WP live chat plugin for WordPress: from n/a through 4.5.15.

    LiveChat LiveChat – WP live chat plugin for WordPress Web / CMS
  • Medium 4.3
    CVE-2023-49763

    WordPress CSprite Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Creatomatic Ltd CSprite.This issue affects CSprite: from n/a through 1.1.

    Creatomatic CSprite
  • Medium 5.4
    CVE-2023-49761

    WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Gravity Master Product Enquiry for WooCommerce.This issue affects Product Enquiry for WooCommerce: from n/a through 3.0.

    Gravity Master Product Enquiry for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2023-49760

    WordPress WPsoonOnlinePage Plugin <= 1.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Giannopoulos Kostas WPsoonOnlinePage.This issue affects WPsoonOnlinePage: from n/a through 1.9.

    Giannopoulos Kostas WPsoonOnlinePage
  • Medium 5.4
    CVE-2023-49759

    WordPress WooDiscuz – WooCommerce Comments Plugin <= 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team WooDiscuz – WooCommerce Comments.This issue affects WooDiscuz – WooCommerce Comments: from n/a through 2.3.0.

    gVectors Team WooDiscuz – WooCommerce Comments Web / CMS
  • Medium 5.4
    CVE-2023-49163

    WordPress teachPress Plugin <= 9.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.5.

    Michael Winkler teachPress
  • Medium 4.3
    CVE-2023-49155

    WordPress Button Generator – easily Button Builder Plugin <= 2.3.8 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Button Generator – easily Button Builder.This issue affects Button Generator – easily Button Builder: from n/a through 2.3.8.

    Wow-Company Button Generator – easily Button Builder
  • Medium 4.3
    CVE-2023-49153

    WordPress Add to Cart Text Changer and Customize Button, Add Custom Icon Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon.This issue affects Add to Cart Text Changer and Customize Button, Add Custom Icon: from n/a through 2.0.

    Saiful Islam Add to Cart Text Changer and Customize Button, Add Custom Icon
  • Medium 5.4
    CVE-2023-49148

    WordPress Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates Plugin <= 3.0.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates.This issue affects Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates: from n/a through 3.0.5.

    Kulwant Nagi Affiliate Booster – Pros & Cons, Notice, and CTA Blocks for Affiliates
  • Medium 4.3
    CVE-2023-48781

    WordPress MkRapel Regiones y Ciudades de Chile para WC Plugin <= 4.3.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC.This issue affects MkRapel Regiones y Ciudades de Chile para WC: from n/a through 4.3.0.

    Marketing Rapel MkRapel Regiones y Ciudades de Chile para WC
  • Medium 5.4
    CVE-2023-48778

    WordPress Product Size Chart For WooCommerce Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Product Size Chart For WooCommerce.This issue affects Product Size Chart For WooCommerce: from n/a through 1.1.5.

    villatheme Product Size Chart For WooCommerce Web / CMS
  • Medium 5.4
    CVE-2023-48773

    WordPress WooCommerce Login Redirect Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Doctor WooCommerce Login Redirect.This issue affects WooCommerce Login Redirect: from n/a through 2.2.4.

    WP Doctor WooCommerce Login Redirect Web / CMS
  • Medium 5.5
    CVE-2023-46686

    A reliance on untrusted inputs in a security decision could be exploited by a privileged user to configure the Gallaghe…

    Gallagher Command Centre Diagnostics Service
  • Medium 4.3
    CVE-2023-23584

    An observable response discrepancy in the Gallagher Command Centre RESTAPI allows an insufficiently-privileged user to …

    Gallagher Command Centre Server
  • Medium 4.3
    CVE-2023-23576

    Incorrect behavior order in the Command Centre Server could allow privileged users to gain physical access to the site …

    Gallagher Command Centre Server
  • Medium 5.4
    CVE-2023-23570

    Client-Side enforcement of Server-Side security for the Command Centre server could be bypassed and lead to invalid con…

    Gallagher Command Centre
  • Medium 5.4
    CVE-2023-48772

    WordPress Prevent Landscape Rotation Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Arul Prasad J Prevent Landscape Rotation.This issue affects Prevent Landscape Rotation: from n/a through 2.0.

    Arul Prasad J Prevent Landscape Rotation
  • Medium 4.3
    CVE-2023-48769

    WordPress Chat Bubble Plugin <= 2.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back.This issue affects Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, …

    Blue Coral Chat Bubble – Floating Chat with Contact Chat Icons, Messages, Telegram, Email, SMS, Call me back
  • Medium 6.8
    CVE-2023-6355

    Incorrect selection of fuse values in the Controller 7000 platform allows an attacker to bypass some protection mechani…

    Gallagher Controller 7000
  • Medium 4.3
    CVE-2023-48768

    WordPress Quantity Plus Minus Button for WooCommerce by CodeAstrology Plugin <= 1.1.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology.This issue affects Quantity Plus Minus Button for WooCommerce by CodeAstrology: from n/a through 1.1.9.

    CodeAstrology Team Quantity Plus Minus Button for WooCommerce by CodeAstrology Web / CMS
  • Medium 4.9
    CVE-2023-40691

    IBM Cloud Pak for Business Automation information disclosure

    IBM Cloud Pak for Business Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 may reveal sensitive information contained in application configuration to developer and administrator use…

    IBM Cloud Pak for Business Automation
  • Medium 4.3
    CVE-2023-6289 Public exploit

    Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export

    The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.

    Web / CMS
  • Medium 4.8
    CVE-2023-5005

    Autocomplete Location field Contact Form 7 < 3.0 - Admin+ Store Cross-Site Scripting

    The Autocomplete Location field Contact Form 7 WordPress plugin before 3.0, autocomplete-location-field-contact-form-7-pro WordPress plugin before 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p…

    Web / CMS
  • Medium 5.4
    GHSA-4h72-34j6-j8x7

    Maloja error page XSS vulnerability

    ### Impact The error page for a missing path echoes the path back to the user. If this contains HTML, an attacker could execute a script on the user's machine inside the Maloja context and perform authorized actions like scrobbling or deleting scrobbles. This…

    malojaserver PyPI