Skip to content
OpenAdvisories

Archive

6 March 2023

Vulnerabilities first published on this day (UTC), newest first.

← February 2023 2023 / March /6 April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • High 8.2
    CVE-2023-27472

    HTML tags in entity names in the tree view are not sanitised in quickentity-editor-next

    quickentity-editor-next is an open source, system local, video game asset editor. In affected versions HTML tags in entity names are not sanitised (XSS vulnerability). Allows arbitrary code execution within the browser sandbox, among other things, simply from…

    atampy25 quickentity-editor-next
  • High 8.0
    CVE-2023-27474

    HTML Injection in Password Reset email to custom Reset URL in directus

    Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. An attacker could exploit this to …

    directus directus directus npm
  • High 8.5
    CVE-2023-22857

    Stored cross-site scripting in BlogEngine.NET version 3.3.8.0

    A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an injection of a malicious payload into a blog post.

    BlogEngine.NET BlogEngine.NET
  • High 8.5
    CVE-2023-22856

    Stored cross-site scripting in BlogEngine.NET version 3.3.8.0

    A stored Cross-site Scripting (XSS) vulnerability in BlogEngine.NET 3.3.8.0, allows injection of arbitrary JavaScript in the security context of a blog visitor through an upload of a specially crafted file.

    BlogEngine.NET BlogEngine.NET
  • High 7.5
    CVE-2023-26111

    node-static and @nubosoftware/node-static vulnerable to Directory Traversal

    All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to improper file path sanitization in the startsWith() method in the servePath function.

    @nubosoftware/node-static node-static npm
  • High 7.5
    CVE-2023-26106

    dot-lens vulnerable to Prototype Pollution

    All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.

    dot-lens npm
  • High 8.8
    CVE-2023-0093

    Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third …

    Okta Advanced Server Access
  • High 7.2
    CVE-2023-1211 Public exploit

    SQL Injection in phpipam/phpipam

    SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.

    phpipam phpipam/phpipam
  • High 8.8
    CVE-2023-24789

    jeecg-boot contains SQL Injection vulnerability

    jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.

    org.jeecgframework.boot:jeecg-boot-parent Maven
  • High 8.8
    CVE-2023-24217 Public exploit

    AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.

  • High 8.8
    CVE-2023-24763

    In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to …

  • High 7.5
    CVE-2023-27891

    Insufficient Session Expiration in pretix

    rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. The fixed versions are 4.15.1, 4.16.1, and 4.17.1.

    pretix PyPI
  • High 8.6
    CVE-2022-4904

    A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string,…

    nodejs c-ares grpc c-ares Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2022-3424

    A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl funct…

    linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  • High 7.5
    CVE-2022-45142

    The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!…

    heimdal heimdal heimdal heimdal Debian Ubuntu Azure Linux Alpine Wolfi
  • High 7.5
    CVE-2021-36396 Public exploit

    Moodle vulnerable to Server-Side Request Forgery

    In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 7.5
    CVE-2021-36395

    Moodle vulnerable to Uncontrolled Resource Consumption

    In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 8.8
    CVE-2019-8720 Exploited

    A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lea…

    qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu Alpine
    KEV May 23, 2022