Skip to content
OpenAdvisories

Archive

April 2023

Vulnerabilities first published in this month (UTC), newest first.

← March 2023 2023 / April May 2023 →
  1. 119
  2. 211
  3. 346
  4. 4165
  5. 5139
  6. 6111
  7. 799
  8. 820
  9. 915
  10. 1078
  11. 11239
  12. 12105
  13. 1342
  14. 14111
  15. 1565
  16. 1638
  17. 1786
  18. 18191
  19. 1994
  20. 2054
  21. 2161
  22. 2231
  23. 2326
  24. 24114
  25. 2599
  26. 2659
  27. 2772
  28. 28111
  29. 2913
  30. 303
All Critical High Medium Low Exploited only Public exploit

1,148 results · Clear filters · Feed

  • Medium 5.3
    CVE-2020-4729

    IBM Safer Payments denial of service

    IBM Counter Fraud Management for Safer Payments 5.7.0.00 through 5.7.0.10, 6.0.0.00 through 6.0.0.07, 6.1.0.00 through 6.1.0.05, and 6.2.0.00 through 6.2.1.00 could allow an authenticated attacker under special circumstances to send multiple specially crafted…

    IBM Safer Payments
  • Medium 6.5
    CVE-2023-27556

    IBM Safer Payments denial of service

    IBM Counter Fraud Management for Safer Payments 6.1.0.00, 6.2.0.00, 6.3.0.00 through 6.3.1.03, 6.4.0.00 through 6.4.2.02 and 6.5.0.00 does not properly allocate resources without limits or throttling which could allow a remote attacker to cause a denial of se…

    IBM Safer Payments
  • Medium 6.1
    CVE-2020-23647

    Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbi…

  • Medium 6.1
    CVE-2020-21643

    Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback paramet…

  • Medium 5.4
    CVE-2023-28476

    Stored cross site scripting on tags

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-28471

    Stored cross site scripting via container name

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.

    concrete5/concrete5 Packagist
  • Medium 5.4
    CVE-2023-28474

    Stored cross site scripting on saved presets

    Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.

    concrete5/concrete5 Packagist
  • Medium 5.3
    CVE-2023-28821

    Missing rate limit for password resets

    Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.

    concrete5/concrete5 Packagist
  • Medium 5.5
    CVE-2023-28477

    Stored cross site scripting on API integration

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via the name parameter.

    concrete5/concrete5 Packagist
  • Medium 6.1
    CVE-2023-28475

    Reflected cross site scripting

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply form because msgID was not sanitized.

    concrete5/concrete5 Packagist
  • Medium 5.3
    CVE-2023-28472

    Concrete CMS missing secure cookie parameters

    Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for ccmPoll cookies.

    concrete5/concrete5 Packagist
  • Medium 5.9
    CVE-2023-31485

    GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-t…

    libgitlab-api-v4-perl libgitlab-api-v4-perl Debian Ubuntu
  • Medium 6.3
    CVE-2023-2361

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.1
    CVE-2023-30454

    An issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the /Security/Transactions/T…

  • Medium 5.4
    CVE-2023-30123

    wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.

  • Medium 6.1
    CVE-2023-30125

    EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).

  • Medium 5.4
    CVE-2023-30405 EPSS 29%

    A cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to exe…

  • Medium 6.5
    CVE-2023-26782

    An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interfac…

  • Medium —
    GHSA-jgvc-jfgh-rjvv

    Chosen Ciphertext Attack in Jose4j

    ### Summary RSA1_5 in jose4j is susceptible to chosen ciphertext attacks. The attack allows to decrypt RSA1_5 or RSA_OAEP encrypted ciphertexts. It may be feasible to sign with affected keys. ### Severity Moderate - exploiting this ciphertext attack could res…

    org.bitbucket.b_c:jose4j Maven
  • Medium 5.3
    CVE-2023-27860

    IBM Maximo Asset Management information disclosure

    IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could disclose sensitive information in an error message. This information could be used in further attacks against the system. IBM X-Force ID: 249207.

    IBM Maximo Asset Management
  • Medium 6.7
    CVE-2023-2355

    Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Depl…

    Acronis Acronis Snap Deploy
  • Medium 6.1
    CVE-2023-28286

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Microsoft Edge (Chromium-based) Extended Stable Browsers
  • Medium 5.7
    CVE-2023-28261

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Microsoft Edge (Chromium-based) Extended Stable Browsers
  • Medium 6.5
    CVE-2023-2335

    Plaintext Password in Registry

    Plaintext Password in Registry vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve Admin user credentials This issue affects surelock windows: from 2.3.12 through 2.40.0.

    42gears surelock windows Windows
  • Medium 4.4
    CVE-2023-30852

    Pimcore Arbitrary File Read in Admin JS CSS files

    Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint that is accessible by an authenticated administrator user is vulnerable to arbitrary JavaScript and CSS file read via the …

    pimcore pimcore pimcore/pimcore Packagist
  • Medium 6.3
    CVE-2023-2348

    SourceCodester Service Provider Management System manage_user.php sql injection

    A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. …

    SourceCodester Service Provider Management System
  • Medium 6.3
    CVE-2023-2347

    SourceCodester Service Provider Management System manage_service.php sql injection

    A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/services/manage_service.php. The manipulation of the argument id leads to sql inje…

    SourceCodester Service Provider Management System
  • Medium 6.3
    CVE-2023-2346

    SourceCodester Service Provider Management System view_inquiry.php sql injection

    A vulnerability was found in SourceCodester Service Provider Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/inquiries/view_inquiry.php. The manipulation of the argument id leads to sql injection. It …

    SourceCodester Service Provider Management System
  • Medium 6.3
    CVE-2023-2345

    SourceCodester Service Provider Management System improper authorization

    A vulnerability was found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /classes/Master.php?f=delete_inquiry. The manipulation leads to improper authorizat…

    SourceCodester Service Provider Management System
  • Medium 6.3
    CVE-2023-2344

    SourceCodester Service Provider Management System HTTP POST Request sql injection

    A vulnerability has been found in SourceCodester Service Provider Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=save_service of the component HTTP POST Request Ha…

    SourceCodester Service Provider Management System
  • Medium 6.1
    CVE-2023-24966

    IBM WebSphere Application Server cross-site scripting

    IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within …

    IBM WebSphere Application Server
  • Medium 5.5
    CVE-2023-29950

    swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules…

    swftools Ubuntu
  • Medium 5.3
    CVE-2023-29489 Public exploit Scanner template EPSS 66%

    An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall…

  • Medium 5.5
    CVE-2023-29471

    Lightbend Alpakka Kafka logs credentials on debug level

    Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain cleartext login is configured). This occurs in akka.kafka.internal.KafkaConsumerActor.

    com.typesafe.akka:akka-stream-kafka_2.11 com.typesafe.akka:akka-stream-kafka_3 com.typesafe.akka:akka-stream-kafka_2.12 com.typesafe.akka:akka-stream-kafka_2.13 Maven
  • Medium 5.9
    CVE-2023-31290 Public exploit

    Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds bec…

  • Medium 5.3
    CVE-2023-31286

    User account enumeration in Serenity

    An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When a password reset request occurs, the server response leaks the existence of users. If one tries to reset a password of a non-existent user, an error message indicates that this use…

    Serenity.Net.Core Serenity.Net.Web NuGet
  • Medium 6.1
    CVE-2023-31285

    Cross Site Scripting (XSS) in Serenity

    An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. When users upload temporary files, some specific file endings are not allowed, but it is possible to upload .html or .htm files containing an XSS payload. The resulting link can be …

    Serenity.Net.Core Serenity.Net.Services NuGet
  • Medium 5.2
    CVE-2023-2328

    Cross-site Scripting (XSS) - Generic in pimcore/pimcore

    Cross-site Scripting (XSS) - Generic in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.8
    CVE-2023-2323

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 4.0
    CVE-2023-2342

    Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

    Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.21.

    pimcore pimcore/pimcore pimcore/pimcore Packagist