Skip to content
OpenAdvisories

Archive

9 March 2023

Vulnerabilities first published on this day (UTC), newest first.

← February 2023 2023 / March /9 April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 7.8
    CVE-2023-0621

    CVE-2023-0621

    Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds read vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in reads past the end of allocated data structures. An at…

    Horner Automation Cscape Envision RV
  • High 7.8
    CVE-2023-0623

    CVE-2023-0623

    Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An …

    Horner Automation Cscape Envision RV
  • High 7.8
    CVE-2023-0622

    CVE-2023-0622

    Cscape Envision RV version 4.60 is vulnerable to an out-of-bounds write vulnerability when parsing project (i.e. HMI) files. The product lacks proper validation of user-supplied data, which could result in writes past the end of allocated data structures. An …

    Horner Automation Cscape Envision RV
  • High 8.1
    CVE-2023-27490

    Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth

    NextAuth.js is an open source authentication solution for Next.js applications. `next-auth` applications using OAuth provider versions before `v4.20.1` have been found to be subject to an authentication vulnerability. A bad actor who can read traffic on the v…

    nextauthjs next-auth next-auth npm
  • High —
    GHSA-6w5f-5wgr-qjg5

    Constellation allows Emergency shell access during initramfs boot phase

    ### Impact An active attacker could let the boot fail on purpose in the initramfs, dropping the serial console into an emergency shell. This gives attackers with access to the serial console full control over the VM. ### Patches The issue has been patched in …

    github.com/edgelesssys/constellation/v2 github.com/edgelesssys/constellation Go
  • High 7.1
    CVE-2023-25814

    Arbitrary File Read Vulnerability in metersphere

    metersphere is an open source continuous testing platform. In versions prior to 2.7.1 a user who has permission to create a resource file through UI operations is able to append a path to their submission query which will be read by the system and displayed t…

    metersphere metersphere
  • High 8.6
    CVE-2023-25573 Scanner template EPSS 52%

    Improper access control to download file in metersphere

    metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. This issue may expose all files…

    metersphere metersphere
  • High 7.3
    CVE-2023-1294

    SourceCodester File Tracker Manager System POST Parameter login.php sql injection

    A vulnerability was found in SourceCodester File Tracker Manager System 1.0. It has been classified as critical. Affected is an unknown function of the file /file_manager/login.php of the component POST Parameter Handler. The manipulation of the argument user…

    SourceCodester File Tracker Manager System
  • High 7.3
    CVE-2023-26109

    node-bluetooth-serial-port is vulnerable to Buffer Overflow via the findSerialPortChannel

    All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.

    node-bluetooth-serial-port npm
  • High 7.3
    CVE-2023-26110

    node-bluetooth is vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation

    All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input length validation.

    node-bluetooth npm
  • High 8.7
    CVE-2023-0050 EPSS 92%

    An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting f…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.8
    CVE-2023-27986

    emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailt…

    xemacs21-packages xemacs21 emacs emacs Debian Ubuntu Azure Linux Alpine
  • High 7.8
    CVE-2023-27985

    emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto:…

    xemacs21-packages xemacs21 emacs emacs Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2023-26948

    onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/downlo…

  • High 8.6
    CVE-2023-20049

    Cisco IOS XR Software for ASR 9000 Series Routers Bidirectional Forwarding Detection Denial of Service Vulnerability

    A vulnerability in the bidirectional forwarding detection (BFD) hardware offload feature of Cisco IOS XR Software for Cisco ASR 9000 Series Aggregation Services Routers, ASR 9902 Compact High-Performance Routers, and ASR 9903 Compact High-Performance Routers …

    Cisco Cisco IOS XR Software iOS Network devices
  • High 7.7
    CVE-2022-3767

    Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers t…

    GitLab DAST gitlab Ubuntu