Skip to content
OpenAdvisories

Archive

27 April 2023

Vulnerabilities first published on this day (UTC), newest first.

← March 2023 2023 / April /27 May 2023 →
  1. 119
  2. 211
  3. 346
  4. 4165
  5. 5139
  6. 6111
  7. 799
  8. 820
  9. 915
  10. 1078
  11. 11239
  12. 12105
  13. 1342
  14. 14111
  15. 1565
  16. 1638
  17. 1786
  18. 18191
  19. 1994
  20. 2054
  21. 2161
  22. 2231
  23. 2326
  24. 24114
  25. 2599
  26. 2659
  27. 2772
  28. 28111
  29. 2913
  30. 303
All Critical High Medium Low Exploited only Public exploit

33 results · Clear filters · Feed

  • Medium —
    GHSA-jgvc-jfgh-rjvv

    Chosen Ciphertext Attack in Jose4j

    ### Summary RSA1_5 in jose4j is susceptible to chosen ciphertext attacks. The attack allows to decrypt RSA1_5 or RSA_OAEP encrypted ciphertexts. It may be feasible to sign with affected keys. ### Severity Moderate - exploiting this ciphertext attack could res…

    org.bitbucket.b_c:jose4j Maven
  • Medium 5.3
    CVE-2023-27860

    IBM Maximo Asset Management information disclosure

    IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used in further attacks against the system. IBM X-Force ID: 249207.

    IBM Maximo Asset Management
  • Medium 6.7
    CVE-2023-2355

    Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Depl…

    Acronis Acronis Snap Deploy
  • Medium 6.1
    CVE-2023-28286

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Microsoft Edge (Chromium-based) Extended Stable Browsers
  • Medium 5.7
    CVE-2023-28261

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Microsoft Edge (Chromium-based) Extended Stable Browsers
  • Medium 6.5
    CVE-2023-2335

    Plaintext Password in Registry

    Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0.

    42gears surelock windows Windows
  • Medium 4.4
    CVE-2023-30852

    Pimcore Arbitrary File Read in Admin JS CSS files

    Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the …

    pimcore pimcore pimcore/pimcore Packagist
  • Medium 6.3
    CVE-2023-2348

    SourceCodester Service Provider Management System manage_user.php sql injection

    A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. …

    SourceCodester Service Provider Management System
  • Medium 6.3
    CVE-2023-2347

    SourceCodester Service Provider Management System manage_service.php sql injection

    A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql inje…

    SourceCodester Service Provider Management System
  • Medium 6.3
    CVE-2023-2346

    SourceCodester Service Provider Management System view_inquiry.php sql injection

    A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It …

    SourceCodester Service Provider Management System
  • Medium 6.3
    CVE-2023-2345

    SourceCodester Service Provider Management System improper authorization

    A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to improper authorizat…

    SourceCodester Service Provider Management System
  • Medium 6.3
    CVE-2023-2344

    SourceCodester Service Provider Management System HTTP POST Request sql injection

    A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Ha…

    SourceCodester Service Provider Management System
  • Medium 6.1
    CVE-2023-24966

    IBM WebSphere Application Server cross-site scripting

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within …

    IBM WebSphere Application Server
  • Medium 5.5
    CVE-2023-29950

    swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules…

    swftools Ubuntu
  • Medium 5.3
    CVE-2023-29489 Public exploit Scanner template EPSS 66%

    An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall…

  • Medium 5.5
    CVE-2023-29471

    Lightbend Alpakka Kafka logs credentials on debug level

    Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

    com.typesafe.akka:akka-stream-kafka_2.11 com.typesafe.akka:akka-stream-kafka_3 com.typesafe.akka:akka-stream-kafka_2.12 com.typesafe.akka:akka-stream-kafka_2.13 Maven
  • Medium 5.9
    CVE-2023-31290 Public exploit

    Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds bec…

  • Medium 5.3
    CVE-2023-31286

    User account enumeration in Serenity

    An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this use…

    Serenity.Net.Core Serenity.Net.Web NuGet
  • Medium 6.1
    CVE-2023-31285

    Cross Site Scripting (XSS) in Serenity

    An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be …

    Serenity.Net.Core Serenity.Net.Services NuGet
  • Medium 5.2
    CVE-2023-2328

    Cross-site Scripting (XSS) - Generic in pimcore/pimcore

    Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.8
    CVE-2023-2323

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.0
    CVE-2023-2342

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.1
    CVE-2023-2339

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.5
    CVE-2023-2336

    Path Traversal in pimcore/pimcore

    Path Traversal in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.2
    CVE-2023-2343

    Cross-site Scripting (XSS) - DOM in pimcore/pimcore

    Cross-site Scripting (XSS) - DOM in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.2
    CVE-2023-2322

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.0
    CVE-2023-2327

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.1
    CVE-2023-2340

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.4
    CVE-2023-30338

    Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary we…

  • Medium 6.1
    CVE-2023-25292 Public exploit

    Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated p…

  • Medium 4.9
    CVE-2023-22901

    ChangingTec MOTP - Path Traversal

    ChangingTec MOTP system has a path traversal vulnerability. A remote attacker with administrator’s privilege can exploit this vulnerability to access arbitrary system files.

    ChangingTec MOTP
  • Medium 6.3
    CVE-2022-38730

    Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start docker…

  • Medium 5.3
    CVE-2022-25091

    Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be di…