Skip to content
OpenAdvisories

Archive

8 March 2023

Vulnerabilities first published on this day (UTC), newest first.

← February 2023 2023 / March /8 April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-26489

    Guest-controlled out-of-bounds read/write on x86_64 in wasmtime

    wasmtime is a fast and secure runtime for WebAssembly. In affected versions wasmtime's code generator, Cranelift, has a bug on x86_64 targets where address-mode computation mistakenly would calculate a 35-bit effective address instead of WebAssembly's defined…

    bytecodealliance wasmtime wasmtime zellij Wolfi crates.io
  • Critical 9.6
    CVE-2023-27905

    Cross site scripting vulnerability in update-center2

    Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to provide a plugin for hosting.

    Jenkins Project Jenkins update-center2 org.jenkins-ci:update-center2 Web / CMS Maven
  • Critical 9.6
    CVE-2023-27898

    Cross-site Scripting vulnerability in Jenkins

    Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with the current version of Jenkins, resulting in a…

    Jenkins Project Jenkins org.jenkins-ci.main:jenkins-core Web / CMS Maven
  • Critical 9.8
    CVE-2023-1267

    SQLi in Ulkem Company's PtteM Kart

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart. This issue affects PtteM Kart: before 2.1.

    Ulkem Company PtteM Kart
  • Critical 9.8
    CVE-2023-0090 Public exploit

    Proofpoint Enterprise Protection webservices unauthenticated RCE

    The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-stan…

    Proofpoint Enterprise Protection
  • Critical 10.0
    CVE-2023-1283

    Code Injection in builderio/qwik

    Code Injection in GitHub repository builderio/qwik prior to 0.21.0.

    BuilderIO builderio/qwik @builder.io/qwik npm
  • Critical 9.8
    CVE-2023-24773

    SQL Injection in Funadmin

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.

    funadmin/funadmin Packagist
  • Critical 9.8
    CVE-2023-24777

    SQL Injection in Funadmin

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.

    funadmin/funadmin Packagist
  • Critical 9.8
    CVE-2023-24782

    SQL Injection in Funadmin

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.

    funadmin/funadmin Packagist
  • Critical 10.0
    CVE-2023-27482 Scanner template EPSS 72%

    homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for…

    home-assistant core supervisor
  • Critical 9.8
    CVE-2023-22889

    SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation. This could lead to r…

  • Critical 9.8
    CVE-2023-26261

    In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the ses…

  • Critical 9.8
    CVE-2023-26922

    SQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via th…

  • Critical 9.0
    CVE-2021-33351

    Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 all…

  • Critical 9.8
    CVE-2021-33352

    An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitr…

  • Critical 9.8
    CVE-2021-33353

    Directory Traversal vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows a…