CVEs published October 20, 2023
125 CVEs were published on October 20, 2023: 7 critical, 29 high.
- Published
- 125
- Critical
- 7
- High
- 29
- Medium
- 74
- Low
- 0
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- nothings stb
- 14
- realmag777 BEAR – Bulk Editor and Products Manager Professi…
- 10
- modoboa/modoboa · modoboa
- 3
- wpvividplugins WPvivid — Backup, Migration & Staging
- 3
- advancedcoding Comments – wpDiscuz
- 2
- inisev Social Media Share Buttons & Social Sharing Icons
- 2
- M-Files Web Companion
- 2
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- 2
- radykal Fancy Product Designer
- 2
- VMware Aria Operations for Logs
- 2
Critical 7
- CVE-2023-46117Inadequate validation of retrieved subdomains may lead to a Remote Code Execution in reconFTWsix2dez reconftw
- CVE-2023-5688Cross-site Scripting (XSS) - DOM in modoboa/modoboamodoboa/modoboa · modoboa
- CVE-2023-4488Dropbox Folder Share <= 1.9.7 - Unauthenticated Local File Inclusionhyno Dropbox Folder Share
- CVE-2020-36706Simple:Press – WordPress Forum Plugin <= 6.6.0 - Arbitrary File Uploadsimplepress Simple:Press Forum
- CVE-2023-5414Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Readicegram Email Subscribers & Newsletters – Email Marketing,…
- CVE-2023-34051VMware Aria Operations for Logs contains an authentication bypass vulnerability.VMware Aria Operations for Logs
- CVE-2023-37824Sitolog sitologapplicationconnect v7.8.a and before was discovered to contain a SQL injection vulnerability via the component /activate_hook
High 29
- CVE-2023-45681Out of bounds heap buffer write in stb_vorbisnothings stb
- CVE-2023-45679Attempt to free an uninitialized memory pointer in vorbis_deinit in stb_vorbisnothings stb
- CVE-2023-45677Heap buffer out of bounds write in start_decoder in stb_vorbisnothings stb
- CVE-2023-45676Multi-byte write heap buffer overflow in start_decoder in stb_vorbisnothings stb
- CVE-2023-45666Possible double-free or memory leak in stbi__load_gif_main in stb_imagenothings stb
- CVE-2023-45664Double-free in stbi__load_gif_main_outofmem in stb_imagenothings stb
- CVE-2023-45805Trojan Lockfilein pdmpdm-project pdm · pdm
- CVE-2023-5689Cross-site Scripting (XSS) - DOM in modoboa/modoboamodoboa/modoboa · modoboa
- CVE-2023-23373QUSBCam2QNAP Systems QUSBCam2
- CVE-2023-3487Integer overflow in Silicon Labs Gecko Bootloader leads to unbounded memory accesssilabs.com GSDK
- CVE-2023-34044Information disclosure vulnerability in bluetooth device-sharing functionalityVMware Workstation · VMware Fusion
- CVE-2021-4334Fancy Product Designer <= 4.6.9 - Insufficient Authorization to Arbitrary Options Update via fpd_update_optionsradykal Fancy Product Designer
- CVE-2022-4290Cyr to Lat <= 3.5 - Authenticated SQL Injectionivijanstefan Cyr to Lat Enhanced
- CVE-2023-4999Horizontal scrolling announcement <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcodegopiplus Horizontal scrolling announcement
- CVE-2022-2441ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to Remote Command Executionrickardw ImageMagick Engine
- CVE-2023-4386Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via querieswpdevteam Essential Blocks Pro · wpdevteam Gutenberg Essent…
- CVE-2022-3342Jetpack CRM <= 5.3.1 - Cross-Site Request Forgery and PHAR Deserializationautomattic Jetpack CRM – Clients, Leads, Invoices, Billing,…
- CVE-2020-36714Brizy < 1.0.126 - Authorization Bypass to Settings Updatesthemefusecom Brizy – Page Builder
- CVE-2022-4943miniOrange's Google Authenticator <= 5.6.5 - Missing Authorization to Plugin Settings Changecyberlord92 miniOrange 2FA – Two-Factor Authentication for…
- CVE-2023-5524M-Files Web Companion allows Remote Code Execution for some filetypesM-Files Web Companion
- CVE-2023-5523M-Files Web Companion allows Remote Code ExecutionM-Files Web Companion
- CVE-2023-2325Stored XSS Vulnerability in M-Files Classic WebM-Files Web
- CVE-2022-4712WP Cerber Security <= 9.1 - Unauthenticated Stored Cross-Site Scriptinggioni WP Cerber Security, Anti-spam & Malware Scan
- CVE-2023-4274The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 0.9.89.wpvividplugins Migration, Backup, Staging – WPvivid
- CVE-2023-5576Migration, Backup, Staging – WPvivid <= 0.9.91 - Google Drive Client Secret Exposurewpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2023-4402Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via productswpdevteam Essential Blocks Pro · wpdevteam Gutenberg Essent…
- CVE-2020-36698Security & Malware scan by CleanTalk <= 2.50 - Missing AuthorizationLogin Security, FireWall, Malware removal by CleanTalk
- CVE-2023-4598Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Blind SQL Injection via Shortcodeveronalabs SlimStat Analytics
- CVE-2023-39680Sollace Unicopia version 1.1.1 and before was discovered to deserialize untrusted data, allowing attackers to execute arbitrary code.
Medium, low and unrated 89
- CVE-2023-45682Wild address read in vorbis_decode_packet_rest in stb_vorbisnothings stb
- CVE-2023-45680Null pointer dereference in vorbis_deinit in stb_vorbisnothings stb
- CVE-2023-45678Off-by-one heap buffer write in start_decoder in stb_vorbisnothings stb
- CVE-2023-456750 byte write heap buffer overflow in start_decoder in stb_vorbisnothings stb
- CVE-2023-45667Null pointer dereference because of an uninitialized variable in stb_imagenothings stb
- CVE-2023-45663Disclosure of uninitialized memory in stbi__tga_load in stb_imagenothings stb
- CVE-2023-45662Multi-byte read heap buffer overflow in stbi__vertical_flip in stb_imagenothings stb
- CVE-2023-45661Wild address read in stbi__gif_load_next in stb_imagenothings stb
- CVE-2023-5682Tongda OA delete.php sql injectionTongda OA
- CVE-2023-5681Netentsec NS-ASG Application Security Gateway list_addr_fwresource_ip.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2023-5690Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa/modoboa · modoboa
- CVE-2023-5687Cross-Site Request Forgery (CSRF) in mosparo/mosparomosparo/mosparo
- CVE-2023-5686Heap-based Buffer Overflow in radareorg/radare2radareorg/radare2
- CVE-2023-3933Your Journey <= 1.9.8 - Prototype Pollution to Reflected Cross-Site Scriptingwiloke Your Journey
- CVE-2023-3962Winters <= 1.4.3 - Prototype Pollution to Reflected Cross-Site Scriptingmyshopkit Winters - WordPress Blog Theme
- CVE-2023-3965nsc <= 1.0 - Prototype Pollution to Reflected Cross-Site ScriptingNational Show Centre NSC WordPress Theme
- CVE-2023-5618Modern Footnotes <= 1.4.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeprismtechstudios Modern Footnotes
- CVE-2023-44483Apache Santuario: Private Key disclosure in debug-log outputApache Software Foundation Apache Santuario · org.apache.sa…
- CVE-2023-44256A server-side request forgery vulnerability [CWE-918] in Fortinet FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3 and before 7.0.8 Fortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2023-34045VMware Fusion installer local privilege escalationVMware Fusion
- CVE-2023-34046VMware Fusion TOCTOU local privilege escalation vulnerabilityVMware Fusion
- CVE-2023-4648WP Customer Reviews <= 3.6.6 - Authenticated (Administrator+) Stored Cross-Site Scriptingbompus WP Customer Reviews
- CVE-2022-3622Blog2Social <= 6.9.11 - Missing Authorization to Authenticated (Subscriber+) Settings Updatepr-gateway Blog2Social: Social Media Auto Post & Scheduler
- CVE-2023-4021Modern Events Calendar lite < 7.1.0 - Authenticated (Admin+) Stored Cross-Site Scriptingwebnus/ Modern Events Calendar Lite
- CVE-2023-5109WP Mailto Links – Protect Email Addresses <= 3.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeonlineoptimisation WP Mailto Links – Protect Email Addresses
- CVE-2023-5070Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Information Exposureinisev Social Media Share Buttons & Social Sharing Icons
- CVE-2023-5086Copy Anything to Clipboard <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeclipboardagency Copy Anything to Clipboard for WordPress –…
- CVE-2020-36759Woody code snippets <= 2.3.9 - Cross-Site Request Forgery Bypassthemeisle Woody Code Snippets – Insert PHP, CSS, JS, and He…
- CVE-2020-36758RSS Aggregator by Feedzy <= 3.4.2 - Cross-Site Request Forgery Bypassthemeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2023-5292Advanced Custom Fields: Extended <= 0.8.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodehwk-fr Advanced Custom Fields: Extended
- CVE-2020-36755Customizr <= 4.3.0 - Cross-Site Request Forgery Bypassnikeo Customizr
- CVE-2020-36754Paid Memberships Pro <= 2.4.2 - Cross-Site Request Forgery Bypassstrangerstudios Paid Memberships Pro – Content Restriction,…
- CVE-2020-36753Hueman <= 3.6.3 - Cross-Site Request Forgery Bypassnikeo Hueman
- CVE-2023-5602Social Media Share Buttons & Social Sharing Icons <= 2.8.5 - Cross-Site Request Forgeryinisev Social Media Share Buttons & Social Sharing Icons
- CVE-2021-4418Custom CSS, JS & PHP <= 2.0.7 - Cross-Site Request Forgery Bypassflippercode Custom css-js-php
- CVE-2023-5231Magic Action Box <= 2.17.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodepogidude Magic Action Box
- CVE-2023-4668Ad Inserter <= 2.7.30 - Unauthenticated Sensitive Information Exposure via ai-debug-processing-fespacetime Ad Inserter – Ad Manager & AdSense Ads
- CVE-2023-5121Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated (Administrator+) Stored Cross-Site Scriptingwpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2023-3996ARMember Lite - Membership Plugin <= 4.0.16 - Authenticated (Administrator+) Stored Cross-Site Scriptingreputeinfosystems ARMember – Membership Plugin, Content Res…
- CVE-2023-4941BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulationrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2023-3869wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Comment Rating Increase/Decreaseadvancedcoding Comments – wpDiscuz
- CVE-2023-5337Contact form Form For All <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeformforall Contact form Form For All – Easy to use, fast, 3…
- CVE-2023-4926BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletionrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2020-36751Coupon Creator <= 3.1 - Cross-Site Request Forgery Bypassbrianjessee Coupon Creator
- CVE-2023-5533AI ChatBot <= 4.8.9 and 4.9.2 - Missing Authorization on AJAX actionsquantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- CVE-2023-4796Booster for WooCommerce <= 7.1.0 - Authenticated (Subscriber+) Information Disclosure via Shortcodepluggabl Booster for WooCommerce – PDF Invoices, Abandoned…
- CVE-2023-3998wpDiscuz <= 7.6.3 - Insecure Direct Object Reference to Post Rating Increase/Decreaseadvancedcoding Comments – wpDiscuz
- CVE-2023-5615Skype Legacy Buttons <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderavanh Skype Legacy Buttons
- CVE-2023-5534AI ChatBot <= 4.8.9 and 4.9.2 - Cross-Site Request Forgery on AJAX actionsquantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…
- CVE-2023-4924BEAR <= 1.1.3.3 - Missing Authorization to Product Deletionrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2023-4923BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Deletionrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2023-4961Poptin <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodePoptin – Exit Pop Ups & Email Popups
- CVE-2023-4968WPLegalPages <= 2.9.2 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcodewplegalpages Privacy Policy Generator – WPLP Legal Pages
- CVE-2021-4335Fancy Product Designer <= 4.6.9 - Insufficient Authorization on Mulitple AJAX Actionsradykal Fancy Product Designer
- CVE-2023-4935BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Profile Creationrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2021-4353WooCommerce Dynamic Pricing and Discounts <= 2.4.1 - Unauthenticated Settings Import/ExportRightPress WooCommerce Dynamic Pricing and Discounts
- CVE-2023-4920BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Stored Cross-Site Scriptingrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2023-4937BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulationrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2023-4271Photospace Responsive <= 2.1.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingdeanoakley Photospace Responsive Gallery
- CVE-2023-4919iframe <= 4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'iframe' Shortcodewebvitaly iframe
- CVE-2023-5120Migration, Backup, Staging – WPvivid <= 0.9.89 - Authenticated Stored Cross-Site Scriptingwpvividplugins WPvivid — Backup, Migration & Staging
- CVE-2023-5200flowpaper <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodegetflowpaper flowpaper
- CVE-2023-4940BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulationrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2023-5050Leaflet Map <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebozdoz Leaflet Map
- CVE-2022-4954Waiting: One-click countdowns <= 0.6.2 - Authenticated (Administrator+) Cross-Site Scriptingpluginbuilders Waiting: One-click countdowns
- CVE-2023-4943BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulationrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2023-4975Website Builder by SeedProd <= 6.15.13.1 - Cross-Site Request Forgery to Settings UpdateWebsite Builder by SeedProd — Theme Builder, Landing Page B…
- CVE-2023-4947WooCommerce EAN Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) EAN UpdateYan&Co WooCommerce EAN Payment Gateway
- CVE-2023-4942BEAR <= 1.1.3.3 - Cross-Site Request Forgery to Product Manipulationrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2023-5308Podcast Subscribe Buttons <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesecondlinethemes Podcast Subscribe Buttons
- CVE-2023-4482Auto Amazon Links <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via stylemiunosoft Auto Amazon Links – Amazon Associates Affiliate P…
- CVE-2023-5071Sitekit <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sitekit_iframe' shortcodewebvitaly Sitekit
- CVE-2023-5668WhatsApp Share Button <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodealexmoss WhatsApp Share Button
- CVE-2023-5613Super Testimonials <= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodethemepoints Super Testimonial – Testimonial & Customer Revi…
- CVE-2023-5614Theme Switcha <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodespecialk Theme Switcha – Easily Switch Themes for Developme…
- CVE-2023-34052VMware Aria Operations for Logs contains a deserialization vulnerability.VMware Aria Operations for Logs
- CVE-2023-32786In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially plangchain
- CVE-2023-38191An issue was discovered in SuperWebMailer 9.00.0.01710.
- CVE-2023-40361SECUDOS Qiata (DOMOS OS) 4.13 has Insecure Permissions for the previewRm.sh daily cronjob.
- CVE-2023-43346Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scr
- CVE-2023-43353Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the e
- CVE-2023-43354Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the P
- CVE-2023-43355Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the p
- CVE-2023-43356Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the G
- CVE-2023-43357Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the T
- CVE-2023-45394Stored Cross-Site Scripting (XSS) vulnerability in the Company field in the "Request a Quote" Section of Small CRM v3.0 allows an attacker t
- CVE-2023-45471The QAD Search Server is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to, and including, 1.0.0.315 due to insufficient che
- CVE-2023-46277please (aka pleaser) through 0.5.4 allows privilege escalation through the TIOCSTI and/or TIOCLINUX ioctl.pleaser
- CVE-2023-46287XSS exists in NagVis before 1.9.38 via the select function in share/server/core/functions/html.php.