CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- lenovo thinkpad x1 fold gen 1, thinkpad x1 fold gen 1 firmware +1 moreAn SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an...6.7 Medium
- microfocus service management automation x, asset management x, opentext asset management x (amx) +1 more +3 morePotential open redirect vulnerability in opentext SMAX and AMX product.8.2 High
- g5theme grid plus, grid plus – unlimited grid layout +1 moreGrid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Delete5.4 Medium
- spicethemes carousel, recent post slider and banner slider, carousel\, recent post slider and banner slider +1 moreCarousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- buzzsprout, molehill buzzsprout podcasting +1 moreBuzzsprout Podcasting <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- themepoints accordion, accordions – responsive accordion & faq plugin for wordpress +1 moreAccordion <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- seedprod rafflepress, smub giveaways and contests by rafflepress – get more website traffic, email subscribers, and social followers +1 moreGiveaways and Contests by RafflePress <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- simple shortcodes project shortcodes, simplethemes simple shortcodes +1 moreSimple Shortcodes <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- g5theme grid plus, grid plus – unlimited grid layout +1 moreGrid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcode8.8 High
- datafeedr ads by datafeedr.comAds by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Execution9.0 Critical
- bloafer php to page, php to page project to page +1 morePHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode9.9 Critical
- amitsukapure shortcode menu, shortcode menu project shortcod menu +1 moreShortcode Menu <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- sevenspark bellows accordion menuBellows Accordion Menu <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- matthewschwartz google maps made simpleGoogle Maps made Simple <= 0.6 - Authenticated (Subscriber+) SQL Injection via Shortcode8.8 High
- fareharbor, fareharbor for wordpress +1 moreFareHarbor for WordPress <= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- maca134 wp simple galleriesWP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object Injection8.8 High
arrowOSS-FuzzHeap-buffer-overflow in arrow::Status arrow::Result<std::__1::unique_ptr<arrow::Buffer, std::__1::defaulNo score- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 moreImproper Access Control in mintplex-labs/anything-llm8.1 High
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anythingllm +1 moreImproper Input Validation in mintplex-labs/anything-llm9.1 Critical
martin-mbtilescrates.io`martin-mbtiles` has been renamed to `mbtiles`No score- hallo welt! gmbh bluespicePotential XSS on user preferences page2.1 Low
- pimcore pimcore/admin-ui-classic-bundle, admin classic bundle +1 moreUnverified Password Change in pimcore/admin-ui-classic-bundle4.3 Medium
- mlsoft tco!stream, tco\!stream +1 moreMLSoft TCO!stream Remote Code Execution Vulnerability7.2 High
- yettiesoft vestcertYettiesoft VestCert Remote Code Execution Vulnerability8.4 High
- dream security magicline4nx, dreamsecurity magicline 4.0 +1 moreDreamSecurity MagicLine Buffer Overflow Vulnerability9.8 Critical
- six apart ltd. movable type cloud edition (version 7), movable type premium, movable type premium advanced +4 more +6 moreCross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker...5.4 Medium
- inkdropInkdrop prior to v5.6.0 allows a local attacker to conduct a code injection attack by having a...7.8 High
- kubernetesWindows kube-proxy LoadBalancer contention5.8 Medium
- dolibarr, dolibarr dolibarr/dolibarr, erp\/crm +2 moreCross-site Scripting (XSS) - Stored in dolibarr/dolibarr4.8 Medium
distro-infoDebiandistro-info - database updateNo scoredistro-info-dataDebiandistro-info-data - database updateNo score- vareille tinyfiledialogstinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a...9.8 Critical
- securepoint openvpn-clientThe installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows...7.8 High
- color demoiccmaxIn International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp...6.5 Medium
- color demoiccmaxIn International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut...6.5 Medium
- craterapp crater/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin...7.2 High
- opencrxOpenCRX allows a remote attacker to execute arbitrary code via a crafted request9.8 Critical
- minicalAn issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted...8.8 High
- govee led strip firmwareAn issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via...7.5 High
- bestpractical request trackerBest Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a...7.5 High
- mnbvcxz131421 douhaocmsCross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to...8.8 High
- best practical solutions request trackerBest Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure...7.5 High
- best practical solutions request trackerBest Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information...7.5 High
- viva-project openvivaA stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2...5.4 Medium
- vareille tinyfiledialogstinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows shell metacharacters in titles,...7.5 High
- liquidfilesHTML and SMTP Injection in LiquidFiles5.4 Medium
- wp-plugins the hackers dietThe Hackers Diet Plugin HTTP POST Request ajax_blurb.php sql injection6.3 Medium
- almosteffortless secure-files plugin, wp-plugins secure files +1 morealmosteffortless secure-files Plugin secure-files.php sf_downloads path traversal5.5 Medium
- ibm iIBM i privilege escalation7.4 High
- ibm iIBM i privilege escalation4.9 Medium
- Show moreLoading…