CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- reciply project reciplyreciply Plugin uploadImage.php unrestricted upload6.3 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.1 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service7.5 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- amazon opensearch, embysupport security +1 moreOpenSearch Issue with tenant read-only permissions5.4 Medium
- discourse discourse-calendar, calendar +1 moreImproper escaping of user input in discourse-calendar8.0 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- discourseUnauthenticated access to new private chat messages in Discourse7.5 High
- discoursePrevent unauthorized access to summary details in Discourse5.3 Medium
- discourseMalicious requests can fill up the log files resulting in a deinal of service in Discourse7.5 High
- discourseExposure of poll options and votes to unauthorized users in Discourse3.7 Low
- discourseCross-site Scripting via email preview when CSP disabled in Discourse8.0 High
- mantisbtDisclosure of project names to unauthorized users in MantisBT4.3 Medium
- eprosima fast-dds, fast dds +1 moreMalformed DATA submessage leads to bad-free error in Fast-DDS8.6 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- gofiber fiberCSRF Token Validation Vulnerability in fiber8.6 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- gofiber fiberCSRF Token Reuse Vulnerability in fiber10.0 Critical
- xwiki oauth identity, xwikisas identity-oauth +1 moreRemote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App10.0 Critical
- discourseArbitrary keys can be added to a topic's custom fields by any user in Discourse4.9 Medium
- unknown defender securityDefender Security < 4.1.0 - Protection Bypass (Hidden Login Page)5.3 Medium
- mpembed wp matterport shortcodeWP Matterport Shortcode < 2.1.8 - Contributor+ Stored XSS via shortcode5.4 Medium
- glenwpcoder drag and drop multiple file upload for woocommerce, codedropz drag and drop multiple file uploader +1 moreDrag and Drop Multiple File Upload < 1.1.1 - Unauthenticated Stored Cross-Site Scripting5.4 Medium
- awsm wp job openingsWP Job Openings < 3.4.3 - Sensitive Data Exposure via Directory Listing5.3 Medium
- ninja team file manager pro, ninjateam filester +1 moreFile Manager Pro < 1.8.1 - Admin+ Remote Code Execution7.2 High
- blubrry powerpress, powerpress podcasting plugin by blubrry +1 morePowerPress Podcasting < 11.0.12 - Contributor+ Stored XSS5.4 Medium
- sayandatta simple posts tickerSimple Posts Ticker < 1.1.6 - Admin+ Stored XSS4.8 Medium
- unknown dologin securityDoLogin Security < 3.7.1 - Subscriber+ IP Address leak6.5 Medium
- imagely nextgen gallery, unknown wordpress gallery plugin +1 moreNextGEN Gallery < 3.39 - Admin+ Local File Inclusion4.9 Medium
- solwininfotech user activity log, unknown user-activity-log-pro +1 moreUser Activity Log Pro < 2.3.4 - IP Spoofing7.5 High
- iptanus wordpress file uploadWordPress File Upload < 4.23.3 - Author+ Stored Cross-Site Scripting5.4 Medium
- automattic activitypubActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Title Disclosure4.3 Medium
- sayandatta simple posts tickerSimple Posts Ticker < 1.1.6 - Contributor+ Stored XSS5.4 Medium
- automattic activitypubActivityPub for WordPress < 1.0.1 - Contributor+ Stored XSS5.4 Medium
- automattic activitypubActivityPub for WordPress < 1.0.0 - Contributor+ Stored XSS5.4 Medium
- automattic activitypubActivityPub for WordPress < 1.0.0 - Subscriber+ Arbitrary Post Content Disclosure4.3 Medium
- 10web form maker, unknown form maker by 10web +1 moreForm-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload9.8 Critical
- wordpressWordPress < 6.3.2 - Unauthenticated Post Author Email Disclosure5.3 Medium
- unknown user avatar, wpexperts user avatar-reloaded +1 moreUser Avatar - Reloaded < 1.2.2 - Contributor+ Stored XSS5.4 Medium
- unknown active directory integration / ldap integration, miniorange active directory integration \/ ldap integration +1 moreActive Directory Integration < 4.1.10 - Unauthenticated Log Disclosure7.5 High
- imagely nextgen gallery, unknown wordpress gallery plugin +1 moreNextGEN Gallery < 3.39 - Admin+ Arbitrary File Read and Delete7.2 High
- themeum tutor lmsTutor LMS < 2.3.0 - Subscriber+ Stored Cross-Site Scripting5.4 Medium
- imagely nextgen gallery, unknown wordpress gallery plugin +1 moreNextGEN Gallery < 3.39 - Admin+ PHAR Deserialization7.5 High
- booking-wp-plugin bookly, unknown wordpress online booking and scheduling plugin +1 moreBookly < 22.4 - Admin+ SQLi7.2 High
- hoosoft magee shortcodesMagee Shortcodes <= 2.1.1 - Contributor+ Stored XSS via shortcode5.4 Medium
- sazzadh testimonial slider shortcodeTestimonial Slider Shortcode < 1.1.9 - Contributor+ Stored XSS5.4 Medium
- pagelayer, unknown page builder: pagelayer +1 morePageLayer < 1.7.7 - Unauthenticated Stored XSS6.1 Medium
- Show moreLoading…