Skip to content
OpenAdvisories

Archive

4 February 2023

Vulnerabilities first published on this day (UTC), newest first.

← January 2023 2023 / February /4 March 2023 →
  1. 1120
  2. 250
  3. 3117
  4. 416
  5. 53
  6. 6187
  7. 784
  8. 875
  9. 9125
  10. 1074
  11. 115
  12. 1216
  13. 13119
  14. 14203
  15. 1594
  16. 16172
  17. 17101
  18. 1814
  19. 199
  20. 2051
  21. 2185
  22. 2261
  23. 2357
  24. 2452
  25. 2518
  26. 2621
  27. 27145
  28. 28115
All Critical High Medium Low Exploited only Public exploit

16 results · Feed

  • High 8.1
    CVE-2022-45786

    Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection

    There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest G…

    Apache Software Foundation Apache AGE apache-age-python github.com/apache/age/drivers/golang PyPI Go
  • Medium 6.1
    CVE-2023-22849

    Apache Sling App CMS: XSS in CMS Reference / UI Components

    An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.4 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in mult…

    Apache Software Foundation Apache Sling App CMS org.apache.sling:org.apache.sling.cms Maven
  • Unscored —
    RUSTSEC-2023-0126

    Aliasing violation in `OrdSet` insertion

    Inserting into an `im::OrdSet` (for example by collecting an iterator into one) can violate Rust's aliasing rules: Miri reports a stacked borrows violation in `sized_chunks::Chunk::force_copy()`, which is called during insertion, where a shared borrow is inva…

    im crates.io
  • Medium 6.3
    CVE-2019-25101

    OnShift TurboGears HTTP Header controllers.py response splitting

    A vulnerability classified as critical has been found in OnShift TurboGears 1.0.11.10. This affects an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting. It is possible t…

    OnShift TurboGears turbogears PyPI
  • Low 3.5
    CVE-2018-25080 Public exploit

    MobileDetect Example session_example.php initLayoutType cross site scripting

    A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType of the file examples/session_example.php of the component Example. The manipulation of the argument $_SERVER['PHP_SELF'…

    mobiledetect/mobiledetectlib Packagist
  • Medium 6.3
    CVE-2023-0675

    Calendar Event Management System sql injection

    A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the argument start/end leads to sql injection. It is possible to initiate the attack remotely. The exploi…

  • Medium 4.3
    CVE-2023-0674

    XXL-JOB New Password updatePwd cross-site request forgery

    A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery…

    com.xuxueli:xxl-job Maven
  • Medium 5.0
    CVE-2023-0673

    SourceCodester Online Eyewear Shop sql injection

    A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file oews/?p=products/view_product.php. The manipulation of the argument id leads to sql injection. T…

    SourceCodester Online Eyewear Shop
  • Medium 4.3
    CVE-2018-25079

    Segmentio is-url index.js redos

    A vulnerability was found in Segmentio is-url up to 1.2.2. It has been rated as problematic. Affected by this issue is some unknown functionality of the file index.js. The manipulation leads to inefficient regular expression complexity. The attack may be laun…

    Segmentio is-url is-url npm
  • Low 3.5
    CVE-2015-10072

    NREL api-umbrella-web Flash Message cross site scripting

    A vulnerability classified as problematic was found in NREL api-umbrella-web 0.7.1. This vulnerability affects unknown code of the component Flash Message Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. Upgrading…

    NREL api-umbrella-web
  • Low —
    GHSA-4q83-7cq4-p6wg

    `tokio::io::ReadHalf<T>::unsplit` is Unsound

    `tokio::io::ReadHalf<T>::unsplit` can violate the `Pin` contract The soundness issue is described in the [tokio/issues#5372](https://github.com/tokio-rs/tokio/issues/5372) Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf) is un…

    tokio crates.io
  • Critical 9.9
    CVE-2023-0671

    Code Injection in froxlor/froxlor

    Code Injection in GitHub repository froxlor/froxlor prior to 2.0.10.

    froxlor froxlor/froxlor froxlor/froxlor Packagist
  • Medium 4.4
    CVE-2023-0677

    Cross-site Scripting (XSS) - Reflected in phpipam/phpipam

    Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to v1.5.1.

    phpipam phpipam/phpipam
  • Low 2.4
    CVE-2023-0676 Scanner template

    Cross-site Scripting (XSS) - Reflected in phpipam/phpipam

    Cross-site Scripting (XSS) - Reflected in GitHub repository phpipam/phpipam prior to 1.5.1.

    phpipam phpipam/phpipam
  • High 7.5
    CVE-2023-0678 Scanner template EPSS 37%

    Missing Authorization in phpipam/phpipam

    Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1.

    phpipam phpipam/phpipam
  • High 7.5
    CVE-2023-25193

    hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks duri…

    openjdk-lts openjdk-9 openjdk-13 openjdk11 Debian Ubuntu Azure Linux Alpine Wolfi