Skip to content
OpenAdvisories

Archive

3 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /3 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • High 7.6
    CVE-2023-27999

    An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 7.2.0, 7.1.0 th…

    Fortinet FortiADC Network devices
  • High 7.1
    CVE-2023-22640

    A out-of-bounds write vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.10, FortiOS 6.4.…

    Fortinet FortiOS FortiProxy Network devices
  • High 8.2
    CVE-2023-25827

    Cross-site Scripting in OpenTSDB

    Due to insufficient validation of parameters reflected in error messages by the legacy HTTP query API and the logging endpoint, it is possible to inject and execute malicious JavaScript within the browser of a targeted OpenTSDB user. This issue shares the sam…

    OpenTSDB OpenTSDB net.opentsdb:opentsdb Maven
  • High 7.1
    CVE-2023-23830

    WordPress ProfilePress Plugin <= 4.5.4 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team ProfilePress plugin <= 4.5.4 versions.

    ProfilePress Membership Team ProfilePress
  • High 7.5
    CVE-2023-29163

    BIG-IP UDP Profile vulnerability

    When UDP profile with idle timeout set to immediate or the value 0 is configured on a virtual server, undisclosed traffic can cause TMM to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Network devices
  • High 7.2
    CVE-2023-28742

    BIG-IP iQuery mesh vulnerability

    When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Network devices
  • High 7.1
    CVE-2023-28724

    NGINX Management Suite vulnerability

    NGINX Management Suite default file permissions are set such that an authenticated attacker may be able to modify sensitive files on NGINX Instance Manager and NGINX API Connectivity Manager.   Note: Software versions which have reached End of Technical Suppo…

    F5 NGINX Instance Manager NGINX API Connectivity Manager NGINX Security Monitoring Network devices
  • High 8.1
    CVE-2023-28656

    NGINX Management Suite vulnerability

    NGINX Management Suite may allow an authenticated attacker to gain access to configuration objects outside of their assigned environment.   Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 NGINX Instance Manager NGINX API Connectivity Manager NGINX Security Monitoring Network devices
  • High 7.5
    CVE-2023-27378

    BIG-IP TMUI XSS vulnerability

    Multiple reflected cross-site scripting (XSS) vulnerabilities exist in undisclosed pages of the BIG-IP Configuration utility which allow an attacker to run JavaScript in the context of the currently logged-in user.  Note: Software versions which have reached …

    F5 BIG-IP Network devices
  • High 7.4
    CVE-2023-24461

    BIG-IP Edge Client for Windows and macOS vulnerability

    An improper certificate validation vulnerability exists in the BIG-IP Edge Client for Windows and macOS and may allow an attacker to impersonate a BIG-IP APM system.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

    F5 BIG-IP Edge Client Network devices Browsers
  • High 7.1
    CVE-2023-1385

    Improper JPAKE implementation allows offline PIN brute-forcing due to the initialization of random values to a known va…

    amazon Insignia TV with FireOS Fire TV Stick 3rd gen
  • High 7.1
    CVE-2023-23790

    WordPress Pods Plugin <= 2.9.10.2 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin <= 2.9.10.2 versions.

    Pods Framework Team Pods – Custom Content Types and Fields
  • High 7.8
    CVE-2020-22429

    redox-os v0.1.0 was discovered to contain a use-after-free bug via the gethostbyaddr() function at /src/header/netdb/mo…

  • High 7.8
    CVE-2017-11197 Public exploit

    In CyberArk Viewfinity 5.5.10.95 and 6.x before 6.1.1.220, a low privilege user can escalate to an administrative user …