CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- ashanjay eventonEventON < 2.2 - Admin+ Stored XSS4.8 Medium
- solwininfotech user activity log, unknown user-activity-log-pro +1 moreUser Activity Log Pro < 2.3.4 - Unauthenticated Stored Cross-Site Scripting via User Agent5.4 Medium
- igexsolutions wpschoolpress, projectsandprograms school management system +1 moreWPSchoolPress < 2.2.5 - Teacher+ SQLi8.8 High
- funnelforms, unknown interactive contact form and multi step form builder with drag & drop editor +1 moreFunnelforms Free < 3.4 Unauthenticated Stored Cross-Site Scripting6.1 Medium
- shortpixel enable media replaceEnable Media Replace < 4.1.3 - Author+ PHP Object Injection8.8 High
- pagelayer, unknown page builder: pagelayer +1 morePageLayer < 1.7.8 - Author+ Stored XSS5.4 Medium
- ninja team file manager pro, ninjateam filester +1 moreFile Manager Pro < 1.8.1 - Admin+ Stored Cross-Site Scripting4.8 Medium
- tammersoft shared filesShared Files < 1.7.6 - Unauthenticated Stored Cross-Site Scripting6.1 Medium
- unknown vrm 360 3d model viewer, maurice vrm360 +1 moreVrm 360 3D Model Viewer <= 1.2.1 - Full Path Disclosure5.3 Medium
- unknown weaver xtreme theme supportWeaver Xtreme Theme Support < 6.3.1 - Admin+ PHP Object Injection7.2 High
- mpembed wp matterport shortcodeWP Matterport Shortcode < 2.1.7 - Reflected XSS6.1 Medium
- nextcloud calendar, kiteworks security-advisories +1 moreInviting excessive long email addresses to a calendar event makes the Nextcloud server unresponsive4.3 Medium
- nextcloud talk, kiteworks security-advisories +1 morePassword of talk conversations can be bruteforced in Nextcloud4.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreRate limiter not working reliable when Memcached is installed in Nextcloud4.3 Medium
- nextcloud server, kiteworks security-advisories +1 moreOAuth2 client_secret stored in plain text in the Nextcloud database6.5 Medium
- nextcloud mail, kiteworks security-advisories +1 moreRequire strict cookies for image proxy requests in Nextcloud Mail4.3 Medium
ubuntu-advantage-proTuxCare,ubuntu-advantage-toolsTuxCare +1 moreUpdate of alt-phpNo score- webauthn4j spring security, webauthn4j-spring-security +1 moreImproper signature counter value handling in webauthn4j-spring-security4.8 Medium
- crewjam samlCross site scripting via missing binding syntax validation In ACS location in github.com/crewjam/saml7.1 High
- silverstripe graphql, silverstripe-graphql +1 moreDenial of service vulnerability in silverstripe-graphql via recursive queries7.5 High
- south river technologies titan mft, titan sftp, southrivertech titan ftp server +1 more +3 moreInformation leak via default file permissions on Titan MFT and Titan SFTP servers4.9 Medium
- south river technologies titan mft, titan sftp, southrivertech titan sftp server +1 more +3 moreArbitrary file read via path traversal in Titan MFT and Titan SFTP servers6.5 Medium
- south river technologies titan mft, titan sftp, southrivertech titan sftp server +1 more +3 moreInformation leak via path traversal in Titan MFT and Titan SFTP servers4.3 Medium
- south river technologies titan mft, titan sftp, southrivertech titan sftp server +1 more +3 moreAuthentication bypass via session fixation in Titan MFT and Titan SFTP servers8.8 High
- south river technologies titan mft, titan sftp, southrivertech titan mfp server +2 moreArbitrary file write via WebDAV path traversal in Titan MFT and Titan SFTP servers7.2 High
- south river technologies titan mft, titan sftp, southrivertech titan sftp server +1 more +3 moreArbitrary file write via "zip slip" in Titan MFT and Titan SFTP servers9.1 Critical
iperf3Ubuntuiperf3 vulnerabilityNo score- cisco ios xe software, ios xe, ios xe web ui +2 more +4 moreCisco is aware of active exploitation of a previously unknown vulnerability in the web UI feature...10.0 Critical
- mahlamusa who hit the page – hit counter, who hit the page hit counter +1 moreWordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- devolutions serverImproper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and...6.5 Medium
- codedrafty mediabay – media library folders, codedraft mediabay - wordpress media library folders +1 moreWordPress Mediabay Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- opensc project opensc, red hat enterprise linux 7, enterprise linux 8 +2 more +4 moreOpensc: potential pin bypass when card tracks its own login state6.6 Medium
- gettimely timely booking button, timely - appointment software booking button +1 moreWordPress Timely Booking Button Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- tyche softwares abandoned cart lite for woocommerceWordPress Abandoned Cart Lite for WooCommerce Plugin <= 5.15.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- cytech buddymeetWordPress BuddyMeet Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- rewweb bbp style packWordPress bbp style pack Plugin <= 5.6.7 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- gopi ramasamy tiny carousel horizontal slider, gopiplus tiny carosel horizontal slider +1 moreWordPress Tiny Carousel Horizontal Slider Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- xydac ultimate taxonomy managerWordPress Ultimate Taxonomy Manager Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- pixelative google amp, pixelative, mohsin rafique amp wp – google amp for wordpress +1 moreWordPress AMP WP Plugin <= 1.5.15 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- tagbox taggboxWordPress Taggbox Plugin <= 2.9 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- gilles dumas which template fileWordPress which template file Plugin <= 4.6.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- 10 quality post galleryWordPress Post Gallery Plugin <= 2.3.12 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- alexey golubnichenko agp font awesome collectionWordPress AGP Font Awesome Collection Plugin <= 3.2.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- mailmunch mailchimp forms by mailmunch, mailchimp forms +1 moreWordPress MailChimp Forms by MailMunch Plugin <= 3.1.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- mailmunch constant contact forms by mailmunch, constant contact forms +1 moreWordPress Constant Contact Forms by MailMunch Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- info-d-74 open street map, infod74 wp open street map +1 moreWordPress WP Open Street Map Plugin <= 1.25 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- anurag deshmukh cpt shortcode generatorWordPress CPT Shortcode Generator Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- coresol snap pixelWordPress Snap Pixel Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- grafana google sheets, google-sheets-datasource +1 moreGoogle Sheets data source plugin for Grafana information disclosure vulnerability5.5 Medium
- ca-ret country access limitWordPress Caret Country Access Limit Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- Show moreLoading…