Skip to content
OpenAdvisories

Archive

21 April 2023

Vulnerabilities first published on this day (UTC), newest first.

← March 2023 2023 / April /21 May 2023 →
  1. 119
  2. 211
  3. 346
  4. 4165
  5. 5139
  6. 6111
  7. 799
  8. 820
  9. 915
  10. 1078
  11. 11239
  12. 12105
  13. 1342
  14. 14111
  15. 1565
  16. 1638
  17. 1786
  18. 18191
  19. 1994
  20. 2054
  21. 2161
  22. 2231
  23. 2326
  24. 24114
  25. 2599
  26. 2659
  27. 2772
  28. 28111
  29. 2913
  30. 303
All Critical High Medium Low Exploited only Public exploit

61 results · Feed

  • Medium 4.9
    CVE-2023-29912

    H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.

  • Medium 4.9
    CVE-2023-29913

    H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface…

  • Medium 4.9
    CVE-2023-29914

    H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /gof…

  • Medium 4.9
    CVE-2023-29905

    H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/…

  • Medium 4.9
    CVE-2023-29909

    H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /gof…

  • Medium 4.9
    CVE-2023-29917

    H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm.

  • Medium 4.9
    CVE-2023-29915

    H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm.

  • Medium 4.6
    CVE-2023-2202

    Improper Access Control in francoisjacquet/rosariosis

    Improper Access Control in GitHub repository francoisjacquet/rosariosis prior to 10.9.3.

    francoisjacquet francoisjacquet/rosariosis francoisjacquet/rosariosis Packagist
  • Medium 6.8
    CVE-2023-2228

    Cross-Site Request Forgery (CSRF) in modoboa/modoboa

    Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.

    modoboa modoboa/modoboa modoboa PyPI
  • Critical 9.1
    CVE-2023-2227 Scanner template EPSS 44%

    Improper Authorization in modoboa/modoboa

    Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.

    modoboa modoboa/modoboa modoboa PyPI
  • High 7.5
    CVE-2023-26557

    IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar arithmetic

    io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, which is not constant time for Cmp, modular exponentiation, or modular inverse. An example leak is in crypto/paillier/p…

    github.com/bnb-chain/tss-lib github.com/binance-chain/tss-lib Go
  • High 7.5
    CVE-2023-26101

    In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could …

  • Medium 6.1
    CVE-2023-26100

    In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. A threat actor could…

  • Critical 9.1
    CVE-2023-26556

    IO FinNet tss-lib vulnerable to timing attack from non-constant time scalar multiplication

    io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implementation in Go crypto/elliptic, which is not constant time (there is an if statement in a loop). One leak is in ecdsa/ke…

    github.com/binance-chain/tss-lib github.com/bnb-chain/tss-lib Go
  • High 8.8
    CVE-2023-26876 Public exploit

    SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via …

  • High 7.2
    CVE-2022-36963

    SolarWinds Platform Deserialization of Untrusted Data Vulnerability

    The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform admin account to execute arbitrary commands.

    SolarWinds Platform Command Injection Vulnerability SolarWinds Platform
  • Medium 6.1
    CVE-2022-48150 Public exploit

    Shopware vulnerable to cross-site scripting (XSS)

    Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.

    shopware/shopware Packagist
  • Medium 6.8
    CVE-2022-47930

    IO FinNet tss-lib vulnerable to replay attacks involving proofs

    An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemente…

    github.com/binance-chain/tss-lib github.com/bnb-chain/tss-lib Go
  • High 7.8
    CVE-2022-47505

    SolarWinds Platform Local Privilege Escalation Vulnerability

    The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.

    SolarWinds SolarWinds Platform
  • Medium 6.1
    CVE-2022-47509

    SolarWinds Platform Incorrect Input Neutralization Vulnerability

    The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.

    SolarWinds SolarWinds Platform
  • High 7.5
    CVE-2021-33589

    Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryptio…

    rnp rnp Debian Ubuntu