Skip to content
OpenAdvisories

Archive

30 May 2023

Vulnerabilities first published on this day (UTC), newest first.

← April 2023 2023 / May /30 June 2023 →
  1. 139
  2. 281
  3. 378
  4. 487
  5. 542
  6. 69
  7. 74
  8. 8185
  9. 9252
  10. 10210
  11. 11101
  12. 1290
  13. 13 
  14. 1411
  15. 15147
  16. 1695
  17. 1757
  18. 1891
  19. 1927
  20. 2023
  21. 217
  22. 2284
  23. 2399
  24. 2486
  25. 2578
  26. 2688
  27. 2724
  28. 2834
  29. 2934
  30. 30151
  31. 31120
All Critical High Medium Low Exploited only Public exploit

61 results · Clear filters · Feed

  • Medium 4.4
    CVE-2023-32685

    Clipboard based cross-site scripting (blocked with default CSP) in Kanboard

    Kanboard is project management software that focuses on the Kanban methodology. Due to improper handling of elements under the `contentEditable` element, maliciously crafted clipboard content can inject arbitrary HTML tags into the DOM. A low-privileged attac…

    kanboard kanboard
  • Medium 5.9
    CVE-2023-32691

    ginuerzh/gost vulnerable to Timing Attack

    gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparison function. Untrusted input, sourced from a HTTP header, is compared directly with a s…

    ginuerzh gost github.com/ginuerzh/gost Go
  • Medium 6.5
    CVE-2023-34204

    imapsync through 2.229 uses predictable paths under /tmp and /var/tmp in its default mode of operation. Both of these a…

  • Medium 6.7
    CVE-2023-0779

    net: shell: Improper input validation

    At the most basic level, an invalid pointer can be input that crashes the device, but with more knowledge of the device’s memory layout, further exploitation is possible.

    zephyrproject-rtos Zephyr
  • Medium 5.5
    CVE-2023-33656

    A memory leak vulnerability exists in NanoMQ 0.17.2. The vulnerability is located in the file message.c. An attacker co…

  • Medium 6.1
    CVE-2023-28350

    An issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized b…

  • Medium 4.6
    CVE-2023-28345

    An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the …

  • Medium 6.1
    CVE-2023-32218

    Avaya IX Workforce Engagement - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

    Avaya IX Workforce Engagement v15.2.7.1195 - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

    Avaya IX Workforce Engagement
  • Medium 5.3
    CVE-2023-31186

    Avaya IX Workforce Engagement - User Enumeration - CWE-204: Observable Response Discrepancy

    Avaya IX Workforce Engagement v15.2.7.1195 - User Enumeration - Observable Response Discrepancy

    Avaya IX Workforce Engagement
  • Medium 6.5
    CVE-2023-31187

    Avaya IX Workforce Engagement - CWE-522: Insufficiently Protected Credentials

    Avaya IX Workforce Engagement v15.2.7.1195 - CWE-522: Insufficiently Protected Credentials

    Avaya IX Workforce Engagement
  • Medium 6.2
    CVE-2023-31184

    ROZCOM client

    ROZCOM client CWE-798: Use of Hard-coded Credentials

    ROZCOM client
  • Medium 5.3
    CVE-2023-2952

    XRA dissector infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injecti…

    Wireshark Foundation Wireshark wireshark wireshark Debian Ubuntu
  • Medium 6.3
    CVE-2023-2984

    Path Traversal: '\..\filename' in pimcore/pimcore

    Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.5
    CVE-2023-2983

    Privilege Defined With Unsafe Actions in pimcore/pimcore

    Privilege Defined With Unsafe Actions in GitHub repository pimcore/pimcore prior to 10.5.23.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.4
    CVE-2023-2972

    Prototype Pollution in antfu/utils

    Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.

    antfu antfu/utils @antfu/utils npm
  • Medium 5.5
    CVE-2023-23561

    Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive …

  • Medium 6.1
    CVE-2023-23956 Public exploit

    A user can supply malicious HTML and JavaScript code that will be executed in the client browser

  • Medium 5.4
    CVE-2022-36244

    Multiple Stored Cross-Site Scripting Vulnerabilities on Shop Beat Services

    Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 suffers from Multiple Stored Cross-Site Scripting (XSS) vulnerabilities via Shop Beat Control Panel found at www.shopbeat.co.za controlpanel.shopbeat.co.za.

    Shop Beat studio
  • Medium 5.3
    CVE-2022-36243

    Directory Traversal on Shop Beat Services

    Shop Beat Solutions (pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Directory Traversal via server.shopbeat.co.za. Information Exposure Through Directory Listing vulnerability in "studio" software of Shop Beat. This issue affects: Shop B…

    Shop Beat studio
  • Medium 5.4
    CVE-2022-36249

    Shop Beat Services Vulnerable To Bypass 2FA via APIs

    Shop Beat Solutions (Pty) LTD Shop Beat Media Player 2.5.95 up to 3.2.57 is vulnerable to Bypass 2FA via APIs. For Controlpanel Lite. "After login we are directly able to use the bearer token or jsession ID to access the apis instead of entering the 2FA code.…

    Shop Beat studio
  • Medium 5.5
    CVE-2022-47028

    An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary d…