Skip to content
OpenAdvisories

Archive

8 June 2023

Vulnerabilities first published on this day (UTC), newest first.

← May 2023 2023 / June /8 July 2023 →
  1. 177
  2. 2143
  3. 321
  4. 47
  5. 573
  6. 6149
  7. 7185
  8. 840
  9. 9118
  10. 104
  11. 118
  12. 1284
  13. 13187
  14. 14120
  15. 1596
  16. 1679
  17. 179
  18. 1813
  19. 19116
  20. 2064
  21. 2132
  22. 22112
  23. 23192
  24. 245
  25. 2510
  26. 2695
  27. 2777
  28. 28160
  29. 2965
  30. 3083
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-34112

    JavaCPP project actions vulnerable to code injection

    JavaCPP Presets is a project providing Java distributions of native C++ libraries. All the actions in the `bytedeco/javacpp-presets` use the `github.event.head_commit.message​` parameter in an insecure way. For example, the commit message is used in a run sta…

    bytedeco javacpp-presets
  • Medium 5.8
    CVE-2023-34243

    Windows user name disclosure in TGstation

    TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Wi…

    tgstation tgstation-server
  • Medium 4.3
    CVE-2023-29401 Public exploit

    Improper handling of filenames in Content-Disposition HTTP header in github.com/gin-gonic/gin

    The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. F…

    github.com/gin-gonic/gin github.com/gin-gonic/gin github.com/gin-gonic/gin golang-github-gin-gonic-gin Debian Ubuntu Go
  • Medium 6.5
    CVE-2023-34096 Public exploit EPSS 63%

    Thruk has Path Traversal Vulnerability in panorama.pm

    Thruk is a multibackend monitoring webinterface which currently supports Naemon, Icinga, Shinken and Nagios as backends. In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a fi…

    sni Thruk
  • Medium 5.4
    CVE-2023-23480

    IBM Sterling Partner Engagement Manager cross-site scripting

    IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials dis…

    IBM Sterling Partner Engagement Manager
  • Medium 6.4
    CVE-2023-23481

    IBM Sterling Partner Engagement Manager cross-site scripting

    IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credenti…

    IBM Sterling Partner Engagement Manager
  • Medium 5.4
    CVE-2023-23482

    IBM Sterling Partner Engagement Manager clickjacking

    IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victi…

    IBM Sterling Partner Engagement Manager
  • Medium 5.4
    CVE-2023-33846

    IBM CICS TX cross-site scripting

    IBM TXSeries for Multiplatforms 8.1, 8.2, 9.1, CICS TX Standard, 11.1, CICS TX Advanced 10.1, and 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functiona…

    IBM CICS TX Advanced CICS TX Standard TXSeries for Multiplatforms
  • Medium 6.7
    CVE-2023-34567

    Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list at /goform/Se…

  • Medium 6.7
    CVE-2023-34568

    Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter time at /goform/Po…

  • Medium 6.7
    CVE-2023-34571

    Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter shareSpeed at /gof…

  • Medium 4.3
    CVE-2023-34958

    Incorrect access control in Chamilo 1.11.* up to 1.11.18 allows a student subscribed to a given course to download docu…

  • Medium 6.1
    CVE-2023-34961

    Chamilo v1.11.x up to v1.11.18 was discovered to contain a cross-site scripting (XSS) vulnerability via the /feedback/c…

  • Medium 6.5
    CVE-2023-34969

    D-Bus before 1.15.6 sometimes allows unprivileged users to crash dbus-daemon. If a privileged user with control over th…

    dbus dbus dbus Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2023-34959

    An issue in Chamilo v1.11.* up to v1.11.18 allows attackers to execute a Server-Side Request Forgery (SSRF) and obtain …

  • Medium 6.7
    CVE-2023-34570

    Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter devName at /goform…

  • Medium 6.5
    CVE-2023-32750 Public exploit

    Pydio Cells through 4.1.2 allows SSRF. For longer running processes, Pydio Cells allows for the creation of jobs, which…

  • Medium 5.4
    CVE-2023-32751 Public exploit

    Pydio Cells through 4.1.2 allows XSS. Pydio Cells implements the download of files using presigned URLs which are gener…