Skip to content
OpenAdvisories

Archive

17 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /17 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

31 results · Clear filters · Feed

  • High 7.4
    CVE-2023-40168

    Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop

    TurboWarp is a desktop application that compiles scratch projects to JavaScript. TurboWarp Desktop versions prior to version 1.8.0 allowed a malicious project or custom extension to read arbitrary files from disk and upload them to a remote server. The only r…

    TurboWarp desktop
  • High 7.1
    CVE-2023-40313

    Disable BeanShell Interpreter Remote Server Mode

    A BeanShell interpreter in remote server mode runs in OpenMNS Horizon versions earlier than 32.0.2 and in related Meridian versions which could allow arbitrary remote Java code execution. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, …

    The OpenNMS Group Meridian Horizon org.opennms:opennms-base-assembly Maven
  • High 7.4
    CVE-2023-40165

    Unauthorized gem replacement for full names ending in numbers on rubygems.org

    rubygems.org is the Ruby community's primary gem (library) hosting service. Insufficient input validation allowed malicious actors to replace any uploaded gem version that had a platform, version number, or gem name matching `/-\d/`, permanently replacing the…

    rubygems rubygems.org
  • High 8.4
    CVE-2023-4030

    A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the…

    Lenovo ThinkPad
  • High 7.8
    CVE-2023-3078

    An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an …

    Lenovo Universal Device Client (UDC)
  • High 7.5
    CVE-2023-2915 Public exploit EPSS 82%

    Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability

    The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function. If exploited, an unau…

    Rockwell Automation ThinManager® ThinServer™ ICS / OT
  • High 7.5
    CVE-2023-2914 EPSS 40%

    Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerabilitiy

    The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, an integer overflow condition exists in the affected products. When the ThinManager processes incoming messages, a read access violation occurs and termi…

    Rockwell Automation ThinManager® ThinServer™ ICS / OT
  • High 7.1
    CVE-2023-28693

    WordPress Advanced Youtube Channel Pagination Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Balasaheb Bhise Advanced Youtube Channel Pagination plugin <= 1.0 version.

    Balasaheb Bhise Advanced Youtube Channel Pagination
  • High 7.1
    CVE-2023-31072

    WordPress Advanced Category Template Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Praveen Goswami Advanced Category Template plugin <= 0.1 versions.

    Praveen Goswami Advanced Category Template
  • High 7.5
    CVE-2023-40272

    Apache Airflow Spark Provider Arbitrary File Read via JDBC

    Apache Airflow Spark Provider, versions before 4.1.3, is affected by a vulnerability that allows an attacker to pass in malicious parameters when establishing a connection giving an opportunity to read files on the Airflow server. It is recommended to upgrade…

    Apache Software Foundation Apache Airflow Spark Provider apache-airflow-providers-apache-spark PyPI
  • High 7.1
    CVE-2023-26530

    WordPress Updraft Plugin <= 0.6.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Paul Kehrer Updraft plugin <= 0.6.1 versions.

    Paul Kehrer Updraft
  • High 7.1
    CVE-2023-31074

    WordPress Extensions for Leaflet Map Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in hupe13 Extensions for Leaflet Map plugin <= 3.4.1 versions.

    hupe13 Extensions for Leaflet Map
  • High 8.5
    CVE-2023-3698

    A Command injection vulnerability was found on Printer service of ADM

    Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and delete files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI6…

    ASUSTOR ADM
  • High 8.5
    CVE-2023-3697

    A Command injection vulnerability was found on Printer service of ADM

    Printer service fails to adequately handle user input, allowing an remote unauthorized users to navigate beyond the intended directory structure and create files. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI6…

    ASUSTOR ADM
  • High 8.8
    CVE-2023-2910

    A Command injection vulnerability was found on Printer service of ADM

    Improper neutralization of special elements used in a command ('Command Injection') vulnerability in Printer service functionality in ASUSTOR Data Master (ADM) allows remote unauthorized users to execute arbitrary commands via unspecified vectors. Affected pr…

    ASUSTOR ADM
  • High 7.1
    CVE-2023-31076

    WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.6 versions.

    Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes
  • High 7.1
    CVE-2023-31071

    WordPress Modal Dialog Plugin <= 3.5.14 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Yannick Lefebvre Modal Dialog plugin <= 3.5.14 versions.

    Yannick Lefebvre Modal Dialog
  • High 7.1
    CVE-2023-30877

    WordPress XML for Google Merchant Center Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Maxim Glazunov XML for Google Merchant Center plugin <= 3.0.1 versions.

    Maxim Glazunov XML for Google Merchant Center
  • High 8.1
    CVE-2023-34217

    Second Order Command-injection Vulnerability in the Certificate-delete Function

    TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-delete function, which …

    Moxa EDR-G9010 Series TN-4900 Series NAT-102 Series ICS / OT
  • High 8.1
    CVE-2023-34216

    Second Order Command-injection Vulnerability in the Key-delete Function

    TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability derives from insufficient input validation in the key-delete function, which could …

    Moxa EDR-G9010 Series TN-4900 Series NAT-102 Series ICS / OT
  • High 7.2
    CVE-2023-34215

    Second Order Command-injection Vulnerability in the Certificate-generation Function

    TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the certification-generation function, which could potentially al…

    Moxa TN-5900 Series ICS / OT
  • High 8.1
    CVE-2023-4395

    Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

    Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

    cockpit-hq cockpit-hq/cockpit cockpit-hq/cockpit Packagist
  • High 7.2
    CVE-2023-34214

    Second Order Command-injection Vulnerability in the Certificate-generation Function

    TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command-injection vulnerability. This vulnerability stems from insufficient input validation in the certificate-generation function, wh…

    Moxa TN-4900 Series TN-5900 Series EDR-810 Series ICS / OT
  • High 8.8
    CVE-2023-34213

    Second Order Command-injection Vulnerability in the Key-generation Function

    TN-5900 Series firmware versions v3.3 and prior are vulnerable to command-injection vulnerability. This vulnerability stems from insufficient input validation and improper authentication in the key-generation function, which could potentially allow malicious …

    Moxa TN-5900 Series ICS / OT
  • High 8.8
    CVE-2023-33239

    Second Order Command-injection Vulnerability in the Key-generation Function

    TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from insufficient input validation in the key-generation function, which coul…

    Moxa EDR-G9010 Series TN-4900 Series NAT-102 Series ICS / OT
  • High 7.2
    CVE-2023-33238

    Command-injection Vulnerability in Certificate Management

    TN-4900 Series firmware versions v1.2.4 and prior and TN-5900 Series firmware versions v3.3 and prior are vulnerable to the command injection vulnerability. This vulnerability stems from inadequate input validation in the certificate management function, whic…

    Moxa EDR-G9010 Series TN-4900 Series NAT-102 Series ICS / OT
  • High 8.8
    CVE-2023-33237

    Authentication Bypass Without Administrator Privilege

    TN-5900 Series firmware version v3.3 and prior is vulnerable to improper-authentication vulnerability. This vulnerability arises from inadequate authentication measures implemented in the web API handler, allowing low-privileged APIs to execute restricted act…

    Moxa TN-5900 Series ICS / OT
  • High 7.5
    CVE-2023-36106

    PowerJob incorrect access control vulnerability

    An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the interface for querying via appId parameter to /container/list.

    tech.powerjob:powerjob Maven
  • High 7.2
    CVE-2023-31940

    SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary co…

  • High 7.2
    CVE-2023-31938

    SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary co…

  • High 7.2
    CVE-2023-31939

    SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary co…