Skip to content
OpenAdvisories

Archive

July 2023

Vulnerabilities first published in this month (UTC), newest first.

← June 2023 2023 / July August 2023 →
  1. 138
  2. 2 
  3. 341
  4. 459
  5. 580
  6. 6204
  7. 758
  8. 824
  9. 98
  10. 10128
  11. 11278
  12. 12239
  13. 13114
  14. 1460
  15. 1512
  16. 1618
  17. 17102
  18. 18149
  19. 1965
  20. 2066
  21. 2169
  22. 2217
  23. 2319
  24. 2457
  25. 2598
  26. 2673
  27. 2775
  28. 2891
  29. 291
  30. 3011
  31. 3164
All Critical High Medium Low Exploited only Public exploit

11 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-35078 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or r…

    ivanti Endpoint Manager Mobile Network devices
    KEV Jul 25, 2023
  • Critical 9.8
    CVE-2023-34478 Public exploit

    Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.

    Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack that results in an authentication bypass when used together with APIs or other web frameworks that route requests based on non-normalized requests. Mitigation: Update …

    Apache Software Foundation Apache Shiro shiro shiro Debian Ubuntu Maven
  • Critical 9.8
    CVE-2023-37903 Public exploit

    Sandbox Escape in vm2

    vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has ar…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2023-38408 Public exploit EPSS 80%

    The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remo…

    openssh openssh openssh-ssh1 openssh Debian Ubuntu Azure Linux Alpine Wolfi
  • Critical 9.8
    CVE-2023-3519 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Unauthenticated remote code execution

    Citrix NetScaler ADC  NetScaler Gateway Network devices
    KEV Jul 19, 2023
  • Critical 9.1
    CVE-2023-30799 Public exploit

    MikroTik RouterOS Administrator Privilege Escalation

    MikroTik RouterOS stable before 6.49.7 and long-term through 6.48.6 are vulnerable to a privilege escalation issue. A remote and authenticated attacker can escalate privileges from admin to super-admin on the Winbox or HTTP interface. The attacker can abuse t…

    MikroTik RouterOS Network devices
  • Critical 9.1
    CVE-2023-34034 Public exploit

    Access Control Bypass in Spring Security

    Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux, and the potential for a security bypass.

    org.springframework.security:spring-security-config Maven
  • Critical 9.8
    CVE-2023-34124 Public exploit Scanner template EPSS 50%

    The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authenticati…

    SonicWall GMS Analytics Network devices
  • Critical 9.8
    CVE-2023-37582 Public exploit Scanner template EPSS 90%

    Apache RocketMQ: Possible remote code execution when using the update configuration function

    The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. When NameServer address are leaked on the extranet and lack permission verification, an attacker can ex…

    Apache Software Foundation Apache RocketMQ org.apache.rocketmq:rocketmq-namesrv Maven
  • Critical 9.8
    CVE-2023-24489 Exploited Public exploit Scanner template EPSS 97%

    A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, cou…

    Citrix Citrix ShareFile Storage Zones Controller Network devices
    KEV Aug 16, 2023
  • Critical 10.0
    CVE-2022-4361 Public exploit

    Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC

    Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL val…

    Keycloak Keycloak org.keycloak:keycloak-services Maven