Skip to content
OpenAdvisories

Archive

27 July 2023

Vulnerabilities first published on this day (UTC), newest first.

← June 2023 2023 / July /27 August 2023 →
  1. 138
  2. 2 
  3. 341
  4. 459
  5. 580
  6. 6204
  7. 758
  8. 824
  9. 98
  10. 10128
  11. 11278
  12. 12239
  13. 13114
  14. 1460
  15. 1512
  16. 1618
  17. 17102
  18. 18149
  19. 1965
  20. 2066
  21. 2169
  22. 2217
  23. 2319
  24. 2457
  25. 2598
  26. 2673
  27. 2775
  28. 2891
  29. 291
  30. 3011
  31. 3164
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • High 7.8
    CVE-2022-43701

    Insecure directory permissions on installer files

    When the installation directory does not have sufficiently restrictive file permissions, an attacker can modify files in the installation directory to cause execution of malicious code.

    Arm Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5
  • High 8.7
    GHSA-wxf3-4fvj-vqqx

    Unsafe plugins can be installed via pack import by tenant admins

    ### Summary Unsafe plugins (for instance `sql-list`) can be installed in subdomain tenants via pack import even if unsafe plugin installation for tenants is disables ### Details I have an example https://bot20230704.saltcorn.com/view/all_plugins It's publicly…

    @saltcorn/cli npm
  • High 8.1
    CVE-2023-38510

    Tolgee Lacks Permission Check for API Key for some endpoints

    Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassing permission checks…

    tolgee tolgee-platform
  • High 7.5
    CVE-2023-38505

    DietPi-Dashboard Insufficient TLS Handshake Pool

    DietPi-Dashboard is a web dashboard for the operating system DietPi. The dashboard only allows for one TLS handshake to be in process at a given moment. Once a TCP connection is established in HTTPS mode, it will assume that it should be waiting for a handsha…

    ravenclaw900 DietPi-Dashboard
  • High 7.5
    CVE-2023-38504

    Sails DoS vulnerability for apps with sockets enabled

    Sails is a realtime MVC Framework for Node.js. In Sails apps prior to version 1.5.7,, an attacker can send a virtual request that will cause the node process to crash. This behavior was fixed in Sails v1.5.7. As a workaround, disable the sockets hook and remo…

    balderdashy sails sails npm
  • High 8.4
    CVE-2023-38495

    Crossplane vulnerable to possible image tampering from missing image validation for Packages

    Crossplane is a framework for building cloud native control planes without needing to write code. In versions prior to 1.11.5, 1.12.3, and 1.13.0, Crossplane's image backend does not validate the byte contents of Crossplane packages. As such, Crossplane does …

    crossplane crossplane github.com/crossplane/crossplane Go
  • High 7.3
    CVE-2023-38489

    Kirby vulnerable to Insufficient Session Expiration after a password change

    Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user accounts (unless Kirby's API and Panel are disabled in the config). It can only be abused if a Kirby use…

    getkirby kirby getkirby/cms Packagist
  • High 7.1
    CVE-2023-37894

    WordPress Variation Images Gallery for WooCommerce Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RadiusTheme Variation Images Gallery for WooCommerce plugin <= 2.3.3 versions.

    RadiusTheme Variation Images Gallery for WooCommerce Web / CMS
  • High 8.3
    CVE-2023-3975

    OS Command Injection in jgraph/drawio

    OS Command Injection in GitHub repository jgraph/drawio prior to 21.5.0.

    jgraph jgraph/drawio
  • High 7.1
    CVE-2023-38488

    Kirby vulnerable to field injection in the KirbyData text storage handler

    Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to u…

    getkirby kirby getkirby/cms Packagist
  • High 7.1
    CVE-2023-37975

    WordPress Variation Swatches for WooCommerce Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RadiusTheme Variation Swatches for WooCommerce plugin <= 2.3.7 versions.

    RadiusTheme Variation Swatches for WooCommerce Web / CMS
  • High 7.1
    CVE-2023-37976

    WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Radio Forge Muses Player with Skins plugin <= 2.5 versions.

    Radio Forge Radio Forge Muses Player with Skins
  • High 7.1
    CVE-2023-37977

    WordPress WPFunnels Plugin <= 2.7.16 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFunnels Team Drag & Drop Sales Funnel Builder for WordPress – WPFunnels plugin <= 2.7.16 versions.

    WPFunnels Drag & Drop Sales Funnel Builder for WordPress – WPFunnels Web / CMS
  • High 7.1
    CVE-2023-37979 Public exploit Scanner template

    WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.

    Saturday Drive Ninja Forms Contact Form
  • High 7.1
    CVE-2023-37981

    WordPress Authors List Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPKube Authors List plugin <= 2.0.2 versions.

    WPKube Authors List
  • High 8.8
    CVE-2023-38600 Public exploit

    The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, tvOS 16.6, macOS Ventura…

    Apple macOS iOS and iPadOS watchOS macOS iOS Browsers Debian Ubuntu