CVEs published June 7, 2023
185 CVEs were published on June 7, 2023: 36 critical, 62 high. 2 are now in CISA KEV.
- Published
- 185
- Critical
- 36
- High
- 62
- Medium
- 73
- Low
- 9
- Unrated
- 5
- Now in CISA KEV
- 2
- Fix available
- 83
Most affected products
- GitLab
- 11
- SourceCodester Online Discussion Forum Site
- 10
- stylemix Directory Listings WordPress plugin – uListing
- 9
- nmedia Frontend File Manager Plugin
- 8
- PTC Vuforia Studio
- 6
- labibahmed42 WP Quick FrontEnd Editor – WordPress Plugin
- 4
- Aria Operations for Networks
- 3
- eyecix JobSearch WP Job Board
- 3
- kingthemes Page Builder: KingComposer – Free Drag and Drop…
- 3
- Wireshark Foundation Wireshark
- 3
Critical 36
- CVE-2023-20887Aria Operations for Networks contains a command injection vulnerability.Aria Operations for Networks
- CVE-2021-4380Pinterest Automatic <= 4.14.3 - Unuathenticated Arbitrary Options UpdateValvePress Pinterest Automatic
- CVE-2020-36705Adning Advertising <= 1.5.5 - Arbitrary File Uploadtunafish Adning Advertising
- CVE-2021-4381uListing <= 1.6.6 - Unauthenticated Options Changes via wp_routestylemix Directory Listings WordPress plugin – uListing
- CVE-2020-36727Newsletter Manager <= 1.5.1 - Insecure Deserializationf1logic Newsletter Manager
- CVE-2020-36726Ultimate Reviews < 2.1.33 - PHP Object Injectionrustaurius Ultimate Reviews
- CVE-2021-4374WordPress Automatic Plugin <= 3.53.2 - Unauthenticated Arbitrary Options UpdateValvePress WordPress Automatic Plugin
- CVE-2021-4370uListing <= 1.6.6 - Missing Authorizationstylemix Directory Listings WordPress plugin – uListing
- CVE-2020-36724Wordable <= 3.1.1 - Authentication BypassWordable – Export Google Docs to WordPress
- CVE-2016-15033Delete All Comments <= 2.0 - Arbitrary File UploadGanesh Chandra Delete All Comments
- CVE-2021-4368Frontend File Manager <= 18.2 - Authenticated Settings Change leading to Arbitrary File Uploadnmedia Frontend File Manager Plugin
- CVE-2020-36718GDPR CCPA Compliance Support <= 2.3 - PHP Object Injectionninjateam GDPR CCPA Compliance & Cookie Consent Banner
- CVE-2020-36719ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Arbitrary Plugin Installation, Activation and DeactivationListingPro - WordPress Directory & Listing Theme
- CVE-2020-36713MStore API <= 2.1.5 - Authentication Bypassinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2021-4360Controlled Admin Access < 1.5.6 - Privilege Escalationwaseem_senjer Controlled Admin Access
- CVE-2019-25141Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Updatesmub Easy WP SMTP – WordPress SMTP and Email Logs: Gmail, O…
- CVE-2021-4362The Kiwi Social Share plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the kiwi_social_share_wpkube Social Sharing Plugin – Kiwi
- CVE-2021-4356Frontend File Manager <= 18.2 - Unauthenticated Arbitrary File Downloadnmedia Frontend File Manager Plugin
- CVE-2021-4357uListing <= 1.6.6 - Unauthenticated Arbitrary Post/Page Deletionstylemix Directory Listings WordPress plugin – uListing
- CVE-2020-36708Epsilon Framework Themes (Various Versions) - Function Injectionmachothemes Antreas · machothemes NatureMag Lite +14
- CVE-2019-25138User Submitted Posts <= 20190312 - Unauthenticated Arbitrary File Uploadspecialk User Submitted Posts – Enable Users to Submit Post…
- CVE-2021-4346uListing <= 1.6.6 - Unauthenticated Arbitrary Account Changesstylemix Directory Listings WordPress plugin – uListing
- CVE-2021-4347Advanced Shipment Tracking for WooCommerce <= 3.2.6 - Authenticated WordPress Options Changezorem Advanced Shipment Tracking for WooCommerce
- CVE-2021-4343uListing <= 1.6.6 - Unauthenticated Arbitrary Account Creationstylemix Directory Listings WordPress plugin – uListing
- CVE-2021-4341uListing <= 1.6.6 - Unauthenticated Wordpress Options Changes via AJAXstylemix Directory Listings WordPress plugin – uListing
- CVE-2021-4340uListing <= 1.6.6 - Unauthenticated SQL Injectionstylemix Directory Listings WordPress plugin – uListing
- CVE-2023-30400An issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18.
- CVE-2023-31114An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300.
- CVE-2023-31116An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300.
- CVE-2023-33282Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials.
- CVE-2023-33496xxl-rpc v1.7.0 was discovered to contain a deserialization vulnerability via the component com.xxl.rpc.core.remoting.net.impl.netty.codec.Necom.xuxueli:xxl-rpc-core
- CVE-2023-33553An issue in Planet Technologies WDRT-1800AX v1.01-CP21 allows attackers to bypass authentication and escalate privileges to root via manipul
- CVE-2023-33556TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the staticGw parameter at /setting/se
- CVE-2023-33604Imperial CMS v7.5 was discovered to contain an arbitrary file deletion vulnerability via the DelspReFile function in /sp/ListSp.php.
- CVE-2023-33863SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow.
- CVE-2023-33864StreamReader::ReadFromExternal in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow.
High 62
- CVE-2023-34239Unfiltered paths in gradiogradio-app gradio · gradio
- CVE-2023-2904CVE-2023-2904HID Global SAFE
- CVE-2023-27881PTC Vuforia Studio Unrestricted Upload of File with Dangerous TypePTC Vuforia Studio
- CVE-2023-25177Delta Electronics CNCSoft-B DOPSoft Stack-based buffer overflowDelta Electronics CNCSoft-B DOPSoft
- CVE-2023-24014Delta Electronics CNCSoft-B DOPSoft Heap-based buffer overflowDelta Electronics CNCSoft-B DOPSoft
- CVE-2023-1709Datalogics Library APDFL Stack-based Buffer OverflowSiemens JT2Go · Siemens Teamcenter Visualization +1
- CVE-2023-2866Advantech WebAccess Insufficient Type DistinctionAdvantech WebAccess/SCADA
- CVE-2023-34237Remote code execution via specially crafted script settings in SABnzbdsabnzbd
- CVE-2023-34108Manipulation of Internal Dovecot Variables in mailcow via crafted Passwordsmailcow-dockerized
- CVE-2023-20889Aria Operations for Networks contains an information disclosure vulnerability.Aria Operations for Networks
- CVE-2023-20888Aria Operations for Networks contains an authenticated deserialization vulnerability.Aria Operations for Networks
- CVE-2021-4337Multiple XforWooCommerce Add-On Plugins (Various Versions) - Missing AuthorizationXforWooCommerce Package Quantity Discount · XforWooComme… +6
- CVE-2023-2186On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send a specially crafted broadcast message iTriangle MicroWorks SCADA Data Gateway
- CVE-2020-36731Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Updatewpdesk Flexible Checkout Fields for WooCommerce – WooCommer…
- CVE-2021-4382Recently <= 3.0.4 - Arbitrary File Upload to Remote Code Exectutionhcabrera Recently
- CVE-2022-4950Cool Plugins (Various Versions) - Arbitrary Plugin Installation and Activationnarinder-singh The Events Calendar Events Notification B… +8
- CVE-2019-25150Email Templates <= 1.3 - HTML Injectionsaadiqbal Email Templates Customizer and Designer for WordP…
- CVE-2021-4383WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injectionlabibahmed42 WP Quick FrontEnd Editor – WordPress Plugin
- CVE-2020-36730CMP <= 3.8.1 - Missing AuthorizationCMP – Coming Soon & Maintenance Plugin by NiteoThemes
- CVE-2022-4949AdSanity < 1.8.2 - Authenticated Arbitrary File Uploadhttps://adsanityplugin.com/ AdSanity
- CVE-2019-25149Gallery Images Ape <= 2.0.6 - Authenticated Plugin Deactivationgalleryape Gallery Images Ape
- CVE-2020-36725TI WooCommerce Wishlist <= 1.21.11 and TI WooCommerce Wishlist Pro <= 1.21.4 - Arbitrary Options UpdateTemplateInvaders TI WooCommerce Wishlist Pro · templateinva…
- CVE-2021-4373Better Search <= 2.5.2 - Cross-Site Request Forgery to Settings Importajay Better Search – Relevant search results for WordPress
- CVE-2019-25147Pretty Links <= 2.1.9 - Unauthenticated Stored Cross-Site Scripting via track_linksupercleanse PrettyLinks – Affiliate Links, Link Branding,…
- CVE-2019-25146DELUCKS SEO < 2.1.8 - Stored Cross Site ScriptingDELUCKS SEO
- CVE-2021-4365Frontend File Manager <= 18.2 - Unauthenticated Stored Cross-Site Scriptingnmedia Frontend File Manager Plugin
- CVE-2020-36717Kali Forms <= 2.1.1 - Cross-Site Request Forgerywpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2020-36720Kali Forms <= 2.1.1 - Missing Authorization to Settings Updatewpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2019-25145Contact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injectionsmub Contact Form & SMTP Plugin for WordPress by PirateForms
- CVE-2020-36716WP Activity Log <= 4.0.1 - Missing Authorizationmelapress WP Activity Log
- CVE-2020-36715Login/Signup Popup < 1.5 - Missing Authorizationxootix Login & Register Customizer – Popup | Slider | Inlin…
- CVE-2020-36712Kali Forms <= 2.1.1 - Unauthenticated Arbitrary Post Deletionwpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2019-25142Mesmerize <= 1.6.89 & Materialis <= 1.0.172 - Authenticated Arbitrary Options Updateextendthemes Materialis · extendthemes Mesmerize
- CVE-2021-4361JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Updateeyecix JobSearch WP Job Board
- CVE-2019-25140Coming Soon Page & Maintenance Mode <= 1.8.1 - Stored Cross Site Scriptingwpshopmart Coming Soon Page & Maintenance Mode
- CVE-2021-4358WP DSGVO Tools (GDPR) <= 3.1.23 - Unauthenticated Stored Cross-Site Scriptinglegalweb WP DSGVO Tools
- CVE-2021-4355Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosureuscnanbu Welcart e-Commerce
- CVE-2021-4354PWA for WP & AMP <= 1.7.32 - Arbitrary File Uploadmagazine3 PWA for WP – Progressive Web Apps Made Simple
- CVE-2020-36707Coming Soon & Maintenance Mode Page <= 1.57 - Cross-Site Request Forgeryhookandhook Coming Soon & Maintenance Mode Page & Under Con…
- CVE-2023-3124Elementor Pro <= 3.11.6 - Authenticated(Subscriber+) Privilege Escalation via update_page_optionhttps://elementor.com/ Elementor Website Builder Pro
- CVE-2021-4350Frontend File Manager <= 18.2 - Unauthenticated HTML Injection leading to Spam Emailsnmedia Frontend File Manager Plugin
- CVE-2020-36701Page Builder: KingComposer < 2.9.4 - Arbitrary File Uploadkingthemes Page Builder: KingComposer – Free Drag and Drop…
- CVE-2021-4348Ultimate GDPR & CCPA <= 2.4 - Unauthenticated Settings Import & Exportcreateit-pl Ultimate GDPR & CCPA Compliance Toolkit for Wor…
- CVE-2021-4349Process Steps Template Designer <= 1.2.1 - Cross-Site Request Forgerynarinder-singh Process Steps Template Designer
- CVE-2020-36700Page Builder: KingComposer < 2.9.4 - Authorization Bypass due to Improper Access Controlkingthemes Page Builder: KingComposer – Free Drag and Drop…
- CVE-2021-4339uListing <= 1.6.6 - Unauthenticated Information Disclosurestylemix Directory Listings WordPress plugin – uListing
- CVE-2020-36697WP GDPR <= 2.1.1 - Missing Authorization Checkskoenhuybrechts WP GDPR
- CVE-2020-36696Product Input Fields for WooCommerce <= 1.2.6 - Missing Authorizationtychesoftwares Product Input Fields for WooCommerce
- CVE-2023-2198An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.7 before 15.10.8, all versions starting from 15.11 beforGitLab
- CVE-2023-2199An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 befoGitLab
- CVE-2023-2442An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 befoGitLab
- CVE-2023-31115An issue was discovered in the Shannon RCS component in Samsung Exynos Modem 5123 and 5300.
- CVE-2023-33284Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability.
- CVE-2023-33498alist <=3.16.3 is vulnerable to Incorrect Access Control.github.com/alist-org/alist/v3
- CVE-2023-33510Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters.org.jeecgframework.p3:jeecg-p3-biz-chat
- CVE-2023-33536TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/WlanMa
- CVE-2023-33537TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a buffer overflow via the component /userRpm/FixMap
- CVE-2023-33538TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 was discovered to contain a command injection vulnerability via the component
- CVE-2023-33601An arbitrary file upload vulnerability in /admin.php?c=upload of phpok v6.4.100 allows attackers to execute arbitrary code via a crafted PHP
- CVE-2023-33781An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file.
- CVE-2023-33782D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function.
- CVE-2023-33865RenderDoc before 1.27 allows local privilege escalation via a symlink attack.
Medium, low and unrated 87
- CVE-2023-34238 Local File Inclusion vulnerability in Gatsbygatsbyjs gatsby · gatsby
- CVE-2023-31200PTC Vuforia Studio Cross-Site Request ForgeryPTC Vuforia Studio
- CVE-2023-29502PTC Vuforia Studio Path TraversalPTC Vuforia Studio
- CVE-2023-29152PTC Vuforia Studio Improper AuthorizationPTC Vuforia Studio
- CVE-2023-24476PTC Vuforia Studio Improper AuthorizationPTC Vuforia Studio
- CVE-2023-29168PTC Vuforia Studio Insufficiently Protected CredentialsPTC Vuforia Studio
- CVE-2023-33849IBM CICS TX information disclosureIBM TXSeries for Multiplatforms · IBM CICS TX Standard +1
- CVE-2023-1864FANUC ROBOGUIDE-HandlingPRO Path TraversalFANUC ROBOGUIDE-HandlingPRO
- CVE-2023-33848IBM CICS TX information disclosureIBM TXSeries for Multiplatforms · IBM CICS TX Standard +1
- CVE-2023-3152SourceCodester Online Discussion Forum Site view_post.php sql injectionSourceCodester Online Discussion Forum Site
- CVE-2023-29345Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2023-3151SourceCodester Online Discussion Forum Site manage_user.php sql injectionSourceCodester Online Discussion Forum Site
- CVE-2023-3150SourceCodester Online Discussion Forum Site manage_post.php sql injectionSourceCodester Online Discussion Forum Site
- CVE-2023-34109User input results in Unbounded resource consumption in @zxcvbn-ts/corezxcvbn-ts zxcvbn
- CVE-2023-34234Governor proposal creation may be blocked by frontrunning in OpenZeppelinopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2023-3149SourceCodester Online Discussion Forum Site manage_user.php sql injectionSourceCodester Online Discussion Forum Site
- CVE-2023-3148SourceCodester Online Discussion Forum Site manage_post.php sql injectionSourceCodester Online Discussion Forum Site
- CVE-2023-3147SourceCodester Online Discussion Forum Site view_category.php sql injectionSourceCodester Online Discussion Forum Site
- CVE-2023-3146SourceCodester Online Discussion Forum Site manage_category.php sql injectionSourceCodester Online Discussion Forum Site
- CVE-2023-3145SourceCodester Online Discussion Forum Site sql injectionSourceCodester Online Discussion Forum Site
- CVE-2023-3144SourceCodester Online Discussion Forum Site manage_post.php cross site scriptingSourceCodester Online Discussion Forum Site
- CVE-2023-2878Kubernetes secrets-store-csi-driver discloses service account tokens in logsKubernetes secrets-store-csi-driver · sigs.k8s.io/secrets-s…
- CVE-2023-3143SourceCodester Online Discussion Forum Site manage_post.php cross site scriptingSourceCodester Online Discussion Forum Site
- CVE-2020-36728Adning Advertising <= 1.5.5 - Unauthenticated Arbitrary File Deletion via Path Traversaltunafish Adning Advertising
- CVE-2021-4379WooCommerce Multi Currency <= 2.1.17 - Missing Authorizationvillatheme CURCY - WooCommerce Multi Currency - Currency Sw…
- CVE-2023-3140KNIME Hub Web Application is vulnerable to clickjackingKNIME Business Hub
- CVE-2023-2541Sensitive information disclosure in KNIME Hub Web ApplicationKNIME Business Hub
- CVE-2023-30576Apache Guacamole: Use-after-free in handling of RDP audio input bufferApache Software Foundation Apache Guacamole
- CVE-2023-30575Apache Guacamole: Incorrect calculation of Guacamole protocol element lengthsApache Software Foundation Apache Guacamole
- CVE-2023-0976 A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/TTrellix Agent
- CVE-2023-1388 A heap-based overflow vulnerability in TA prior to version 5.7.9 allows a remote user to alter the page heap in the macmnsvc process memoryTrellix Agent
- CVE-2023-2187On Triangle MicroWorks' SCADA Data Gateway version <= v5.01.03, an unauthenticated attacker can send broadcast events to any user via the WeTriangle MicroWorks SCADA Data Gateway
- CVE-2023-0667Wireshark MSMMS parsing buffer overflowWireshark Foundation Wireshark
- CVE-2023-0668Wireshark IEEE-C37.118 parsing buffer overflowWireshark Foundation Wireshark
- CVE-2023-0666Wireshark RTPS Parsing Buffer OverflowWireshark Foundation Wireshark
- CVE-2019-25151Funnel Builder <= 1.3.0 - Arbitrary Plugin Activationbrainstormforce CartFlows – Funnel Builder & Checkout Plugi…
- CVE-2020-36729Slideshow, Image Slider by 2J <= 1.3.31 - Authorization Bypass2j-slideshow Slideshow, Image Slider by
- CVE-2021-4377Doneren met Mollie <= 2.8.4 - Information Disclosurendijkstra Doneren met Mollie
- CVE-2021-4378WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Stored Cross-Site Scriptinglabibahmed42 WP Quick FrontEnd Editor – WordPress Plugin
- CVE-2021-4376WooCommerce Multi Currency <= 2.1.17 - Missing Authorizationvillatheme CURCY – Multi Currency for WooCommerce – Smoothl…
- CVE-2021-4375Welcart e-Commerce < 2.2.8 - Missing Capabilities Check to Information Disclosureuscnanbu Welcart e-Commerce
- CVE-2023-3126B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Information Disclosurewebwizardsdev B2BKing — Ultimate WooCommerce B2B and Wholes…
- CVE-2020-36722Visual Composer <= 26.0 - Multiple Cross-Site Scriptingvisualcomposer Visual Composer Website Builder
- CVE-2021-4369Frontend File Manager <= 18.2 - Unauthenticated Content Injectionnmedia Frontend File Manager Plugin
- CVE-2021-4371WP Quick FrontEnd Editor <= 5.5 - Authenticated Settings Changelabibahmed42 WP Quick FrontEnd Editor – WordPress Plugin
- CVE-2021-4372WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Stored Cross-Site ScriptingRightPress WooCommerce Dynamic Pricing and Discounts
- CVE-2020-36723ListingPro - WordPress Directory & Listing Theme < 2.6.1 - Sensitive Information DisclosureListingPro - WordPress Directory & Listing Theme
- CVE-2023-3125B2BKing <= 4.6.00 - Missing Authorization to Authenticated(Subscriber+) Price Modificationwebwizardsdev B2BKing — Ultimate WooCommerce B2B and Wholes…
- CVE-2019-25148WP HTML Mail < 2.9.1 - HTML Injectionhaet Email Template Designer – WP HTML Mail
- CVE-2020-36721Epsilon Framework Themes (Various Versions) - Unauthenticated Plugin Activation/Deactivationwpchill Brilliance · silkalns Newspaper X +1
- CVE-2021-4366PWA for WP & AMP < = 1.7.32 - Missing Authorizationmagazine3 PWA for WP – Progressive Web Apps Made Simple
- CVE-2021-4367Flo Forms – Easy Drag & Drop Form Builder <= 1.0.35 - Options Change to Stored Cross-Site Scriptingflothemesplugins Flo Forms – Easy Drag & Drop Form Builder
- CVE-2019-25144WP HTML Mail < 2.2.11 - HTML injectiona3rev WP Email Template
- CVE-2019-25143GDPR Cookie Compliance <= 4.0.2 - Missing Authorizationmooveagency GDPR Cookie Compliance – Cookie Banner, Cookie…
- CVE-2021-4364JobSearch WP Job Board < = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() functioneyecix JobSearch WP Job Board
- CVE-2021-4359Frontend File Manager Plugin <= 18.2 - Unauthenticated Arbitrary Post Deletionnmedia Frontend File Manager Plugin
- CVE-2021-4363WP Quick FrontEnd Editor <= 5.5 - Reflected Cross-Site Scriptinglabibahmed42 WP Quick FrontEnd Editor – WordPress Plugin
- CVE-2020-36710WPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosuretabrisrp WPS Hide Login
- CVE-2022-4948FlyingPress <= 3.9.6 - Missing AuthorizationFlyingWeb FlyingPress
- CVE-2020-36711Avada <= 6.2.2 - Authenticated (Contributor+) Cross-Site ScriptingThemeFusion Avada | Website Builder For WordPress & WooComm…
- CVE-2020-36709Page Builder: KingComposer < 2.9.4 - Stored Cross-Site Scriptingkingthemes Page Builder: KingComposer – Free Drag and Drop…
- CVE-2019-25139Coming Soon Page & Maintenance Mode <= 1.8.1 - Unauthenticated Settings Resetwpshopmart Coming Soon Page & Maintenance Mode
- CVE-2021-4352JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings Changeeyecix JobSearch WP Job Board
- CVE-2021-4351Frontend File Manager <= 18.2 - Unauthenticated Post Meta Changenmedia Frontend File Manager Plugin
- CVE-2020-36704Fruitful < 3.8.2 - Stored Cross-Site Scriptingfruitfulcode Fruitful
- CVE-2021-4345uListing <= 1.6.6 - Unauthenticated Arbitrary Roles and Capabilities Creation/Deletionstylemix Directory Listings WordPress plugin – uListing
- CVE-2020-36702Spectra – WordPress Gutenberg Blocks <= 1.14.7 - Missing Authorizationbrainstormforce Spectra Gutenberg Blocks – Website Builder…
- CVE-2020-36703Elementor Website Builder <= 2.9.7 - Authenticated Stored Cross-Site Scriptingelemntor Elementor Website Builder – more than just a page…
- CVE-2021-4344Frontend File Manager <= 18.2 - Privilege Escalationnmedia Frontend File Manager Plugin
- CVE-2020-36699Quick Page/Post Redirect Plugin <= 5.1.9 - Redirect Security Bypassanadnet Quick Page/Post Redirect Plugin
- CVE-2021-4338404 to 301 <= 3.0.7 - Missing Authorization to Redirect Creationjoelcj91 404 to 301 – Redirect, Log and Notify 404 Errors
- CVE-2021-33223An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php fil
- CVE-2021-46889The 10Web Photo Gallery plugin through 1.5.69 for WordPress allows XSS via theme_id for bwg_frontend_data.
- CVE-2022-25834In Percona XtraBackup (PXB) through 2.2.24 and 3.x through 8.0.27-19, a crafted filename on the local file system could trigger unexpected c
- CVE-2022-31693VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver.
- CVE-2023-0121Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2023-0508Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') in GitLabGitLab
- CVE-2023-1825Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2023-2001An issue has been discovered in GitLab CE/EE affecting all versions before 15.10.8, all versions starting from 15.11 before 15.11.7, all verGitLab
- CVE-2023-2013An issue has been discovered in GitLab CE/EE affecting all versions starting from 1.2 before 15.10.8, all versions starting from 15.11 beforGitLab
- CVE-2023-2015An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.8 before 15.10.8, all versions starting from 15.11 befoGitLab
- CVE-2023-2485Incorrect Privilege Assignment in GitLabGitLab
- CVE-2023-2530A privilege escalation allowing remote code execution was discovered in the orchestration service.Puppet Enterprise
- CVE-2023-2589An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.8, all versions starting from 15.11 before GitLab
- CVE-2023-3142Cross-site Scripting (XSS) - Stored in microweber/microwebermicroweber/microweber
- CVE-2023-33283Marval MSM through 14.19.0.12476 uses a static encryption key for secrets.
- CVE-2023-33595CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.