Skip to content
OpenAdvisories

Archive

20 July 2023

Vulnerabilities first published on this day (UTC), newest first.

← June 2023 2023 / July /20 August 2023 →
  1. 138
  2. 2 
  3. 341
  4. 459
  5. 580
  6. 6204
  7. 758
  8. 824
  9. 98
  10. 10128
  11. 11278
  12. 12239
  13. 13114
  14. 1460
  15. 1512
  16. 1618
  17. 17102
  18. 18149
  19. 1965
  20. 2066
  21. 2169
  22. 2217
  23. 2319
  24. 2457
  25. 2598
  26. 2673
  27. 2775
  28. 2891
  29. 291
  30. 3011
  31. 3164
All Critical High Medium Low Exploited only Public exploit

66 results · Feed

  • Medium 6.4
    CVE-2022-28736

    There's a use-after-free vulnerability in grub_cmd_chainloader() function

    There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not have direct support from GRUB2. When executing chainloader more than once a use-a…

    GNU GNU GRUB grub2 grub2-signed Debian Ubuntu Azure Linux
  • Medium 6.7
    CVE-2022-28735

    The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. Allowing such …

    GNU GNU GRUB grub2 grub2-signed Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2022-28734

    Out-of-bounds write when handling split HTTP headers

    Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position. This can lead to a out-of-bound write further when parsing the HTTP request, writing a N…

    GNU GNU GRUB grub2 grub2-signed Debian Ubuntu Azure Linux
  • High 8.1
    CVE-2022-28733

    Integer underflow in grub_net_recv_ip4_packets

    Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value. Under certain circumstances the total_len value may end up wrapping around to a sma…

    GNU GNU GRUB grub2 grub2-signed Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2020-24275

    A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplyin…

  • Unscored —
    CVE-2023-34625

    ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. The implementation of the lock opening mec…

  • Critical 9.8
    CVE-2023-38408 Public exploit EPSS 80%

    The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remo…

    openssh openssh openssh-ssh1 openssh Debian Ubuntu Azure Linux Alpine Wolfi
  • Unscored —
    CVE-2023-38335

    Omnis Studio 10.22.00 has incorrect access control. It advertises a feature for making Omnis libraries "always private"…

  • Unscored —
    CVE-2023-38334

    Omnis Studio 10.22.00 has incorrect access control. It advertises an irreversible feature for locking classes within Om…

  • Unscored —
    CVE-2023-38617

    Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerabili…

  • Unscored —
    CVE-2023-38523

    The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, wit…

  • Unscored —
    CVE-2023-31753 Public exploit

    SQL injection vulnerability in diskusi.php in eNdonesia 8.7, allows an attacker to execute arbitrary SQL commands via t…

  • Unscored —
    CVE-2023-31462

    An issue was discovered in SteelSeries GG 36.0.0. An attacker can change values in an unencrypted database that is writ…

  • Unscored —
    CVE-2023-31461

    Attackers can exploit an open API listener on SteelSeries GG 36.0.0 to create a sub-application that will be executed a…

  • High 7.5
    CVE-2023-30200

    In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Ad…

  • Unscored —
    CVE-2023-37165

    Millhouse-Project v1.414 was discovered to contain a remote code execution (RCE) vulnerability via the component /add_p…

  • High 7.5
    CVE-2023-37649

    Cockpit CMS vulnerable to incorrect access control

    Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.

    cockpit-hq/cockpit Packagist
  • Medium 6.1
    CVE-2023-37602

    Alkacon OpenCMS arbitrary file upload vulnerability

    An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.

    org.opencms:opencms-core Maven
  • Unscored —
    CVE-2023-37600

    Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerabili…

  • Unscored —
    CVE-2023-37728 Scanner template

    IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter.

  • High 8.8
    CVE-2023-37650

    Cockpit CMS Cross-Site Request Forgery vulnerability

    A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.

    cockpit-hq/cockpit Packagist
  • Unscored —
    CVE-2023-37645 Scanner template EPSS 25%

    eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/r…

  • Unscored —
    CVE-2023-37601

    Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the compone…

  • Unscored —
    CVE-2023-37164 Public exploit

    Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the cat_id parameter at /shop/?module=sh…

  • Unscored —
    CVE-2021-39425

    SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to…

  • Unscored —
    CVE-2021-45094

    Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.