Skip to content
OpenAdvisories

Archive

10 July 2023

Vulnerabilities first published on this day (UTC), newest first.

← June 2023 2023 / July /10 August 2023 →
  1. 138
  2. 2 
  3. 341
  4. 459
  5. 580
  6. 6204
  7. 758
  8. 824
  9. 98
  10. 10128
  11. 11278
  12. 12239
  13. 13114
  14. 1460
  15. 1512
  16. 1618
  17. 17102
  18. 18149
  19. 1965
  20. 2066
  21. 2169
  22. 2217
  23. 2319
  24. 2457
  25. 2598
  26. 2673
  27. 2775
  28. 2891
  29. 291
  30. 3011
  31. 3164
All Critical High Medium Low Exploited only Public exploit

58 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-3579

    HadSky User cross-site request forgery

    A vulnerability, which was classified as problematic, has been found in HadSky 7.11.8. Affected by this issue is some unknown functionality of the component User Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotel…

  • Medium 5.5
    CVE-2023-3578 Scanner template

    DedeCMS co_do.php server-side request forgery

    A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file co_do.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed…

  • Medium 5.4
    CVE-2023-24395

    WordPress Contact Form 7 Redirect & Thank You Page Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Scott Paterson Contact Form 7 Redirect & Thank You Page plugin <= 1.0.3 versions.

    Scott Paterson Contact Form 7 Redirect & Thank You Page
  • Medium 5.3
    CVE-2023-35699

    Cleartext Storage on Disk in the SICK ICR890-4 could allow an unauthenticated attacker with local access to the device …

    SICK ICR890-4
  • Medium 5.3
    CVE-2023-35698

    Observable Response Discrepancy in the SICK ICR890-4 could allow a remote attacker to identify valid usernames for the …

    SICK ICR890-4
  • Medium 5.3
    CVE-2023-35697

    Improper Restriction of Excessive Authentication Attempts in the SICK ICR890-4 could allow a remote attacker to brute-f…

    SICK ICR890-4
  • Medium 5.0
    CVE-2023-35887 Public exploit

    Apache MINA SSHD: Information disclosure bugs with RootedFilesystem

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache MINA. In SFTP servers implemented using Apache MINA SSHD that use a RootedFileSystem, logged users may be able to discover "exists/does not exist" in…

    Apache Software Foundation Apache MINA SSHD sonarqube org.apache.sshd:sshd-core Wolfi Maven
  • Medium 6.3
    CVE-2023-3574

    Improper Authorization in pimcore/customer-data-framework

    Improper Authorization in GitHub repository pimcore/customer-data-framework prior to 3.4.1.

    pimcore Pimcore Customer Data Framework pimcore/customer-management-framework-bundle Packagist
  • Medium 6.3
    CVE-2023-3568

    Open Redirect in alextselegidis/easyappointments

    Open Redirect in GitHub repository alextselegidis/easyappointments prior to 1.5.0.

    Alex Tselegidis alextselegidis/easyappointments
  • Medium 6.2
    CVE-2021-42079

    SSRF vulnerability in OSNEXUS QuantaStor before 6.0.0.355

    An authenticated administrator is able to prepare an alert that is able to execute an SSRF attack. This is exclusively with POST requests. POC Step 1: Prepare the SSRF with a request like this: GET /qstorapi/alertConfigSet?senderEmailAddress=a&smtpServerIpAdd…

    Osnexus QuantaStor
  • Medium 5.9
    CVE-2023-1901

    HCI send_sync Dangling Semaphore Reference Re-use

    The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential R…

    zephyrproject-rtos Zephyr
  • Medium 6.8
    CVE-2023-2234

    BT HCI host union variant confusion

    Union variant confusion allows any malicious BT controller to execute arbitrary code on the Zephyr host.

    zephyrproject-rtos Zephyr
  • Medium 5.9
    CVE-2023-1902

    HCI Connection Creation Dangling State Reference Re-use

    The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious HCI Controller to cause the use of a dangling reference in the host layer, leading to a crash (DoS) or potential RCE o…

    zephyrproject-rtos Zephyr
  • Medium 5.9
    CVE-2023-0359

    ipv6: Missing ipv6 nullptr-check in handle_ra_input

    A missing nullptr-check in handle_ra_input can cause a nullptr-deref.

    zephyrproject-rtos Zephyr
  • Medium 6.5
    CVE-2023-28955

    IBM Watson Knowledge Catalog denial of service

    IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 could allow an authenticated user send a specially crafted request that could cause a denial of service. IBM X-Force ID: 251704.

    IBM Watson Knowledge Catalog on Cloud Pak for Data
  • Medium 5.9
    CVE-2023-27540

    IBM Watson CP4D Data Stores denial of service

    IBM Watson CP4D Data Stores 4.6.0 does not properly allocate resources without limits or throttling which could allow a remote attacker with information specific to the system to cause a denial of service. IBM X-Force ID: 248924.

    IBM Watson CP4D Data Stores
  • Medium 5.9
    CVE-2023-30442

    IBM Db2 denial of service

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 federated server is vulnerable to a denial of service as the server may crash when using a specially crafted wrapper using certain options. IBM X-Force ID: 253202.

    IBM DB2 for Linux, UNIX and Windows Linux Windows
  • Medium 6.5
    CVE-2023-37288

    SmartBPM.NET - Path Traversal

    SmartBPM.NET component has a vulnerability of path traversal within its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.

    SmartSoft SmartBPM.NET