Skip to content
OpenAdvisories

Archive

22 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /22 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

27 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-38733

    IBM Robotic Process Automation information disclosure

    IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 server could allow an authenticated user to view sensitive information from installation logs. IBM X-Force Id: 262293.

    IBM Robotic Process Automation
  • Medium 6.6
    CVE-2023-38734

    IBM Robotic Process Automation privilege escalation

    IBM Robotic Process Automation 21.0.0 through 21.0.7.1 and 23.0.0 through 23.0.1 is vulnerable to incorrect privilege assignment when importing users from an LDAP directory. IBM X-Force ID: 262481.

    IBM Robotic Process Automation
  • Medium 5.5
    CVE-2023-37440

    Authenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure

    A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to conduct a server-side request forgery (SSRF) attack. A successful exploit allows an attacker to enumerate information ab…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.1
    CVE-2023-37439

    Reflected Cross Site Scripting in EdgeConnect SD-WAN Orchestrator Web Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37438

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37437

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37436

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37435

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37434

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37433

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37432

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37431

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37430

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.5
    CVE-2023-37429

    Authenticated SQL Injection Vulnerabilities in EdgeConnect SD-WAN Orchestrator Web-based Management Interface

    Multiple vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct SQL injection attacks against the EdgeConnect SD-WAN Orchestrator instance. An attacker could exploit the…

    Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Orchestrator
  • Medium 6.8
    CVE-2023-4212

    Trane Thermostats Injection

    ​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB st…

    Trane XL850 Thermostat Pivot Thermostat XL824 Thermostat
  • Medium 4.4
    CVE-2022-44730

    Apache XML Graphics Batik: Information disclosure vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. A malicious SVG can probe user profile / data and send it directly as parameter to a URL.

    Apache Software Foundation Apache XML Graphics Batik batik batik Debian Ubuntu Maven
  • Medium 4.3
    CVE-2023-38732

    IBM Robotic Process Automation information disclosure

    IBM Robotic Process Automation 21.0.0 through 21.0.7 server could allow an authenticated user to view sensitive information from application logs. IBM X-Force ID: 262289.

    IBM Robotic Process Automation
  • Medium 6.4
    CVE-2023-24517 Public exploit

    Remote Code Execution via Unrestricted File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue ( unrestricted file upload ) to execute arbitrary system commands. This issue affects Pandora FMS v767 v…

    Artica PFMS Pandora FMS
  • Medium 5.9
    CVE-2023-24516

    Stored Cross Site Scripting - Special Days Module

    Cross-site Scripting (XSS) vulnerability in the Pandora FMS Special Days component allows an attacker to use it to steal the session cookie value of admin users easily with little user interaction. This issue affects Pandora FMS v767 version and prior version…

    Artica PFMS Pandora FMS
  • Medium 6.3
    CVE-2023-24514

    Stored Cross Site Scripting Vulnerability in Visual Console Module

    Cross-site Scripting (XSS) vulnerability in Visual Console Module of Pandora FMS could be used to hijack admin users session cookie values, carry out phishing attacks, etc. This issue affects Pandora FMS v767 version and prior versions on all platforms.

    Artica PFMS Pandora FMS
  • Medium 5.2
    CVE-2023-24515

    Server side request forgery in api checker

    Server-Side Request Forgery (SSRF) vulnerability in API checker of Pandora FMS. Application does not have a check on the URL scheme used while retrieving API URL. Rather than validating the http/https scheme, the application allows other scheme such as file, …

    Artica PFMS Pandora FMS
  • Medium 6.5
    CVE-2020-18378

    A NULL pointer dereference was discovered in SExpressionWasmBuilder::makeBlock in wasm/wasm-s-parser.c in Binaryen 1.38…

    binaryen binaryen Debian Ubuntu
  • Medium 5.5
    CVE-2020-22916

    An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE…

  • Medium 6.5
    CVE-2020-22524

    Buffer Overflow vulnerability in FreeImage_Load function in FreeImage Library 3.19.0(r1828) allows attackers to cuase a…

    freeimage freeimage Debian Ubuntu
  • Medium 5.5
    CVE-2022-35205

    An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows…

    binutils binutils binutils Debian Ubuntu Azure Linux
  • Medium 6.1
    CVE-2022-45582

    Horizon Web Dashboard Open Redirect vulnerability

    Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.

    horizon horizon horizon Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2022-37050

    In Poppler 22.07.0, PDFDoc::savePageAs in PDFDoc.c callows attackers to cause a denial-of-service (application crashes …

    poppler poppler Debian Ubuntu