CVEs published in June 2023
2,445 vulnerabilities, 292 critical, 16 exploited.
- eric martin simplemodal contact form (smcf), simplemodal contact form project contact form +1 moreWordPress SimpleModal Contact Form (SMCF) Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- connections-pro connections business directoryWordPress Connections Business Directory Plugin <= 10.4.36 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
lmdb-rscrates.ioimpl `FromMdbValue` for bool is unsoundNo score- zwaply cryptocurrency all-in-oneWordPress Cryptocurrency All-in-One Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- flyn san iframe shortcode, iframe shortcode project shortcode +1 moreWordPress IFrame Shortcode Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- fancythemes optin forms – simple list building plugin for wordpress, optin forms +1 moreWordPress Optin Forms Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- diagrams drawio, jgraph jgraph/drawio +1 moreDenial of Service in jgraph/drawio5.3 Medium
- cththemes theroofWordPress TheRoof Theme <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)7.1 High
- ameliabooking booking for appointments and events calendar – amelia, tms-outsource amelia +1 moreWordPress Amelia Plugin <= 1.0.75 is vulnerable to Cross Site Scripting (XSS)7.1 High
- plainware shiftcontroller, shiftcontroller employee shift scheduling +1 moreWordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Scripting (XSS)7.1 High
- pi websolution cancel order request / return order / repeat order / reorder for woocommerce, piwebsolution cancel order request \/ return order \/ repeat order \/ reorder for woocommerce +1 moreWordPress Cancel order request WooCommerce Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- checkmkUser-enumeration in RestAPI4.3 Medium
- wago 750-332, 750-362/xxx-xxx, 750-362\/000-001 firmware +26 more +28 moreWAGO: Series 750-3x/-8x prone to MODBUS server DoS7.5 High
- wago 750-331, 750-331 firmware, 750-332 +102 more +104 moreWAGO: DoS in multiple products in multiple versions using Codesys4.9 Medium
- wago 750-331, 750-331 firmware, 750-332 +102 more +104 moreWAGO: DoS in multiple versions of multiple products4.9 Medium
- pi websolution conditional cart fee, piwebsolution conditional cart fee \/ extra charge rule for woocommerce extra fees +1 moreWordPress Conditional extra fees for woocommerce Plugin <= 1.0.96 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- pi websolution order date, order pickup, order date time, pickup location, delivery date for woocommerce, piwebsolution pi-woocommerce-order-date-time-and-type +1 moreWordPress Order date time for WooCommerce Plugin <= 3.0.19 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- elliot sowersby, relywp coupon affiliates – woocommerce affiliate plugin, relywp coupon affiliates +1 moreWordPress Coupon Affiliates Plugin <= 5.4.3 is vulnerable to Cross Site Scripting (XSS)7.1 High
- pi websolution direct checkout, add to cart redirect, quick purchase button, buy now button, quick view button for woocommerce, piwebsolution add-to-cart-direct-checkout-for-woocommerce +1 moreWordPress Direct checkout, Add to cart redirect for Woocommerce Plugin <= 2.1.48 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- mediawikiAn issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x...6.1 Medium
- techtime user managementThe TechTime User Management components for Atlassian products allow stored XSS on the Bulk User...5.4 Medium
- malwarebytes binisoft windows firewall control** DISPUTED ** Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall...7.8 High
- talend data catalogTalend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in...7.5 High
- ateme flamingo xl firmware, flamingo xs firmware +1 moreAn issue in Ateme Flamingo XL v.3.6.20 and XS v.3.6.5 allows a remote authenticated attacker to...8.8 High
- h3c magic b1stw, magic b1stw firmware +1 moreH3C Magic B1STW B1STV100R012 was discovered to contain a stack overflow via the function...7.5 High
- phpgurukul student study center management systemPhpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting (XSS...4.8 Medium
- blogengine blogengine.netAn Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file,...9.8 Critical
- openwbCommand Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary...9.8 Critical
- redbull fc red bull salzburgThe laola.redbull application through 5.1.9-R for Android exposes the exported activity at...6.1 Medium
- wekan project wekanA stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75...5.4 Medium
- pluck-cms pluckCross Site Scripting (XSS) vulnerability in /admin.php in Pluck CMS 4.7.15 through 4.7.16-dev4...4.8 Medium
- multimcMultiMC Launcher <= 0.6.16 is vulnerable to Directory Traversal.7.5 High
- widevine trusted applicationWidevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagParseAndStoreData integer...9.8 Critical
- widevine trusted applicationWidevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer...9.8 Critical
- widevine trusted applicationWidevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_verify_keys total_len...9.8 Critical
- widevine trusted applicationWidevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_verify_keys prefix_len...9.8 Critical
- widevine trusted applicationWidevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_save_keys file_name_len integer...9.8 Critical
- widevine trusted applicationWidevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_save_keys feature_name_len...9.8 Critical
- tenda ac6 firmwareTenda AC6 AC1200 Smart Dual-Band WiFi Router 15.03.06.50_multi was discovered to contain a cross...5.4 Medium
- jfinaljFinal Server-Side Template Injection vulnerability9.8 Critical
- ibexa ezpublish platform, ezpublish legacy +1 moreCross Site Scripting vulnerabiltiy in eZ Systems AS eZPublish Platform v.5.4 and eZ Publish...5.4 Medium
- bluditBludit 3.9.2 is vulnerable to Remote Code Execution (RCE) via /admin/ajax/upload-images.8.8 High
- campcodes retro cellphone online store, retro cellphone online store project cellphone online store +1 moreCampcodes Retro Cellphone Online Store index.php sql injection6.3 Medium
ghostscriptOSS-FuzzHeap-buffer-overflow in uofsNo scorendpiOSS-FuzzHeap-buffer-overflow in ndpi_search_thrift_tcp_udpNo score- inex ixp managerINEX IXP-Manager before 6.3.1 allows XSS. list-preamble.foil.php, page-header-preamble.foil.php,...6.1 Medium
- artifex ghostscript, debian linux, fedoraproject fedora +2 moreArtifex Ghostscript through 10.01.2 mishandles permission validation for pipe devices (with the ...7.8 High
- it-novum openitcockpitit-novum openITCOCKPIT (aka open IT COCKPIT) 4.6.4 before 4.6.5 allows SQL Injection (by...8.8 High
- nettle project nettle, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreThe OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.9.8 Critical
- pythonThe legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger ...7.5 High
- Show moreLoading…