Skip to content
OpenAdvisories

Archive

5 January 2024

Vulnerabilities first published on this day (UTC), newest first.

← December 2023 2024 / January /5 February 2024 →
  1. 115
  2. 2107
  3. 395
  4. 459
  5. 574
  6. 68
  7. 735
  8. 8197
  9. 9159
  10. 10178
  11. 11139
  12. 12129
  13. 1352
  14. 144
  15. 1566
  16. 16228
  17. 1785
  18. 1890
  19. 19108
  20. 2015
  21. 2114
  22. 2258
  23. 23147
  24. 2476
  25. 2574
  26. 26111
  27. 2717
  28. 2810
  29. 2994
  30. 3076
  31. 3192
All Critical High Medium Low Exploited only Public exploit

74 results · Feed

  • Medium 4.3
    CVE-2023-51668

    WordPress Inline Image Upload for BBPress Plugin <= 1.1.18 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Inline Image Upload for BBPress.This issue affects Inline Image Upload for BBPress: from n/a through 1.1.18.

    WP Zone Inline Image Upload for BBPress
  • Medium 4.3
    CVE-2023-51538

    WordPress Awesome Support Plugin <= 6.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin.This issue affects Awesome Support – WordPress HelpDesk & Support Plugin: from n/a through 6.1.5.

    Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin Web / CMS
  • Medium 5.4
    CVE-2023-51539

    WordPress Apollo13 Framework Extensions Plugin <= 1.9.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Apollo13Themes Apollo13 Framework Extensions.This issue affects Apollo13 Framework Extensions: from n/a through 1.9.1.

    apollo13themes Apollo13 Framework Extensions
  • Medium 4.3
    CVE-2023-52119

    WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building.This issue affects Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List …

    Icegram Icegram Engage – WordPress Lead Generation, Popup Builder, CTA, Optins and Email List Building Web / CMS
  • Medium 5.4
    CVE-2023-52120

    WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more.This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: from n/a through 8.5.2.

    Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more
  • Medium 5.4
    CVE-2023-52121

    WordPress NitroPack Plugin <= 1.10.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in NitroPack Inc. NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images.This issue affects NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & J…

    NitroPack NitroPack – Cache & Speed Optimization for Core Web Vitals, Defer CSS & JavaScript, Lazy load Images
  • Medium 4.3
    CVE-2023-52122

    WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6.

    PressTigers Simple Job Board
  • Medium 4.3
    CVE-2023-52123

    WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPChill Strong Testimonials.This issue affects Strong Testimonials: from n/a through 3.1.10.

    WP Chill Strong Testimonials
  • Medium 4.3
    CVE-2023-52127

    WordPress WPC Product Bundles for WooCommerce Plugin <= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Product Bundles for WooCommerce.This issue affects WPC Product Bundles for WooCommerce: from n/a through 7.3.1.

    wpclever WPC Product Bundles for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2023-52128

    WordPress White Label Plugin <= 2.9.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard.This issue affects White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard: from n/a through 2.9.0.

    WhiteWP White Label – WordPress Custom Admin, Custom Login Page, and Custom Dashboard Web / CMS
  • Medium 6.3
    CVE-2023-52129

    WordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Michael Winkler teachPress.This issue affects teachPress: from n/a through 9.0.4.

    Michael Winkler teachPress
  • Medium 4.3
    CVE-2023-52130

    WordPress Affiliates Manager Plugin <= 2.9.31 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in wp.Insider, wpaffiliatemgr Affiliates Manager.This issue affects Affiliates Manager: from n/a through 2.9.31.

    wp.insider, wpaffiliatemgr Affiliates Manager
  • Medium 4.3
    CVE-2023-52136

    WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget.This issue affects Custom Twitter Feeds – A Tweets Widget or X Feed Widget: from n/a through 2.1.2.

    Smash Balloon Custom Twitter Feeds – A Tweets Widget or X Feed Widget
  • Medium 4.3
    CVE-2023-52145

    WordPress Republish Old Posts Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Republish Old Posts.This issue affects Republish Old Posts: from n/a through 1.21.

    Marios Alexandrou Republish Old Posts
  • Medium 5.4
    CVE-2023-52149

    WordPress Floating Button Plugin <= 6.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Floating Button.This issue affects Floating Button: from n/a through 6.0.

    Wow-Company Floating Button
  • High 8.8
    CVE-2023-52150

    WordPress Dynamic Content for Elementor Plugin < 2.12.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Ovation S.R.L. Dynamic Content for Elementor.This issue affects Dynamic Content for Elementor: from n/a before 2.12.5.

    Ovation S.r.l. Dynamic Content for Elementor
  • Medium 4.3
    CVE-2023-52184

    WordPress WP Job Portal Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a through 2.0.6.

    WP Job Portal WP Job Portal – A Complete Job Board
  • High 7.5
    CVE-2023-51502

    WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)

    Authorization Bypass Through User-Controlled Key vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.6.1.

    woocommerce WooCommerce Stripe Payment Gateway Web / CMS
  • Medium 6.5
    CVE-2023-52178

    WordPress WP Affiliate Disclosure Plugin <= 1.2.7 is vulnerable to Cross-Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MojofyWP WP Affiliate Disclosure allows Stored XSS.This issue affects WP Affiliate Disclosure: from n/a through 1.2.7.

    MojofyWP WP Affiliate Disclosure
  • Medium 4.3
    CVE-2023-6493

    Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save

    The Depicter Slider – Responsive Image Slider, Video Slider & Post Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.6. This is due to missing or incorrect nonce validation on the 'save' function…

    Averta Depicter — Popup & Slider Builder Web / CMS
  • Low 3.9
    CVE-2023-41782

    DLL Hijacking Vulnerability in ZTE ZXCLOUD iRAI

    There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code.

    ZTE ZXCLOUD iRAI
  • Medium 4.9
    CVE-2023-7207

    Debian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE-2015-1197 patches whi…

    Debian Debian cpio cpio cpio Debian Ubuntu
  • Critical 9.8
    CVE-2020-13879

    IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.

  • Critical 9.8
    CVE-2020-13878

    IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write.

  • Critical 9.8
    CVE-2020-13880

    IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write.

  • High 7.5
    CVE-2023-50991

    Buffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a d…

  • Critical 9.8
    CVE-2023-50027

    SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allo…

  • Medium 5.9
    CVE-2023-52323

    PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption

    PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.

    jwt-tool pycryptodome pycryptodome pycryptodome Debian Ubuntu Wolfi PyPI
  • Critical 9.8
    CVE-2023-51277

    nbviewer-app (aka Jupyter Notebook Viewer) before 0.1.6 has the get-task-allow entitlement for release builds.

  • Medium 6.1
    CVE-2022-36677

    Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded doc…

  • Critical 9.8
    CVE-2024-22086

    handle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to…

  • Critical 9.8
    CVE-2024-22087

    route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, lea…

  • Critical 9.8
    CVE-2024-22088

    Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, becau…

  • Medium 6.1
    CVE-2024-22075

    Firefly III allows webhooks HTML Injection.

    Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.

    grumpydictator/firefly-iii Packagist