Skip to content
OpenAdvisories

Archive

26 July 2023

Vulnerabilities first published on this day (UTC), newest first.

← June 2023 2023 / July /26 August 2023 →
  1. 138
  2. 2 
  3. 341
  4. 459
  5. 580
  6. 6204
  7. 758
  8. 824
  9. 98
  10. 10128
  11. 11278
  12. 12239
  13. 13114
  14. 1460
  15. 1512
  16. 1618
  17. 17102
  18. 18149
  19. 1965
  20. 2066
  21. 2169
  22. 2217
  23. 2319
  24. 2457
  25. 2598
  26. 2673
  27. 2775
  28. 2891
  29. 291
  30. 3011
  31. 3164
All Critical High Medium Low Exploited only Public exploit

20 results · Clear filters · Feed

  • Medium 5.5
    CVE-2023-38606 Exploited

    This issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6.8, iOS 15.7.8 and i…

    Apple macOS iOS and iPadOS watchOS macOS iOS
    KEV Jul 26, 2023
  • Medium 6.6
    CVE-2023-28014

    HCL BigFix Mobile can be affected by a cross-site scripting (XSS) vulnerability

    HCL BigFix Mobile is vulnerable to a cross-site scripting attack. An authenticated attacker could inject malicious scripts into the application.

    HCL Software HCL BigFix Mobile
  • Medium 5.4
    CVE-2023-28012

    HCL BigFix Mobile can be affected by a command injection vulnerability

    HCL BigFix Mobile is vulnerable to a command injection attack. An authenticated attacker could run arbitrary shell commands on the WebUI server.

    HCL Software HCL BigFix Mobile
  • Medium 6.5
    CVE-2023-28013

    HCL Verse is susceptible to a Reflected Cross-Site Scripting (XSS) Vulnerability

    HCL Verse is susceptible to a Reflected Cross Site Scripting (XSS) vulnerability. By tricking a user into entering crafted markup a remote, unauthenticated attacker could execute script in a victim's web browser to perform operations as the victim and/or stea…

    HCL Software HCL Verse
  • Medium 6.1
    CVE-2023-3414

    Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps

    A cross-site request forgery vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 ver…

    ServiceNow Jenkins plug-in for ServiceNow DevOps io.jenkins.plugins:servicenow-devops Web / CMS Maven
  • Medium 4.3
    CVE-2023-30949

    CVE-2023-30949

    A missing origin validation in Slate sandbox could be exploited by a malicious user to modify the page's content, which could lead to phishing attacks.

    Palantir com.palantir.slate:slate
  • Medium 4.3
    CVE-2023-3622

    Access Control Bypass Vulnerability in the SolarWinds Platform

    Access Control Bypass Vulnerability in the SolarWinds Platform that allows an underprivileged user to read arbitrary resource

    SolarWinds SolarWinds Platform
  • Medium 4.3
    CVE-2023-39156

    CSRF vulnerability in Bazaar Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Bazaar SCM tags.

    Jenkins Project Jenkins Bazaar Plugin org.jenkins-ci.plugins:bazaar Web / CMS Maven
  • Medium 4.2
    CVE-2023-39154

    Incorrect permission checks in Qualys Web App Scanning Connector Plugin allow capturing credentials

    Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configure permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another …

    Jenkins Project Jenkins Qualys Web App Scanning Connector Plugin com.qualys.plugins:qualys-was Web / CMS Maven
  • Medium 5.4
    CVE-2023-39153

    CSRF vulnerability in GitLab Authentication Plugin

    A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users into logging in to the attacker's account.

    Jenkins Project Jenkins Gitlab Authentication Plugin org.jenkins-ci.plugins:gitlab-oauth Web / CMS Maven
  • Medium 6.5
    CVE-2023-39152

    Incorrect control flow in Jenkins Gradle Plugin breaks credentials masking in the build log

    Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asterisks) in the build log in some circumstances.

    Jenkins Project Jenkins Gradle Plugin org.jenkins-ci.plugins:gradle Web / CMS Maven
  • Medium 5.2
    CVE-2023-39261

    In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions

    JetBrains IntelliJ IDEA
  • Medium 4.7
    CVE-2023-38672

    FPE in paddle.linalg.matrix_power

    FPE in paddle.trace in PaddlePaddle before 2.5.0. This flaw can cause a runtime crash and a denial of service.

    PaddlePaddle PaddlePaddle paddlepaddle PyPI
  • Medium 4.7
    CVE-2023-38670

    Null pointer dereference in paddle.flip

    Null pointer dereference in paddle.flip in PaddlePaddle before 2.5.0. This resulted in a runtime crash and denial of service.

    PaddlePaddle PaddlePaddle paddlepaddle PyPI
  • Medium 5.8
    CVE-2023-32468

    Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability.…

    Dell ECS Streamer
  • Medium 5.0
    CVE-2023-1401

    Insertion of Sensitive Information Into Sent Data in GitLab

    An issue has been discovered in GitLab DAST scanner affecting all versions starting from 3.0.29 before 4.0.5, in which the DAST scanner leak cross site cookies on redirect during authorization.

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2023-20891

    VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability

    The VMware Tanzu Application Service for VMs and Isolation Segment contain an information disclosure vulnerability due to the logging of credentials in hex encoding in platform system audit logs. A malicious non-admin user who has access to the platform syste…

    VMware Isolation segment VMware Tanzu Application Service for VMs
  • Medium 5.4
    CVE-2023-3946

    A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated a…

    Trellix Trellix EPO
  • Medium 5.4
    CVE-2023-37692

    Stored Cross-Site Scripting October CMS

    An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.

    october/october Packagist
  • Medium 6.1
    CVE-2022-31456

    A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML…