Skip to content
OpenAdvisories

Archive

25 August 2023

Vulnerabilities first published on this day (UTC), newest first.

← July 2023 2023 / August /25 September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • High 7.5
    CVE-2023-40586

    go package github.com/corazawaf/coraza is vulnerable to denial of service

    OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Due to the misuse of `log.Fatalf`, the application using coraza crashed after receiving crafted requests from attackers. The application will immediately crash after receivi…

    corazawaf coraza github.com/corazawaf/coraza/v2 github.com/corazawaf/coraza/v3 Go
  • High 7.3
    CVE-2023-40585

    Unauthenticated access to Ironic API

    ironic-image is a container image to run OpenStack Ironic as part of Metal³. Prior to version capm3-v1.4.3, if Ironic is not deployed with TLS and it does not have API and Conductor split into separate services, access to the API is not protected by any authe…

    metal3-io ironic-image
  • High 7.5
    CVE-2023-40583

    libp2p nodes vulnerable to OOM attack

    libp2p is a networking stack and library modularized out of The IPFS Project, and bundled separately for other tools to use. In go-libp2p, by using signed peer records a malicious actor can store an arbitrary amount of data in a remote node’s memory. This mem…

    libp2p go-libp2p github.com/libp2p/go-libp2p Go
  • High 8.1
    CVE-2023-40580

    Freighter mnemonic phrase may be accessed by Javascript through a private API

    Freighter is a Stellar chrome extension. It may be possible for a malicious website to access the recovery mnemonic phrase when the Freighter wallet is unlocked. This vulnerability impacts access control to the mnemonic recovery phrase. This issue was patched…

    stellar freighter
  • High 7.8
    CVE-2023-40031 Public exploit

    Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convert

    Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Read::convert`. This issue may lead to arbitrary code execution. As of time of publication, no known patches are availabl…

    notepad-plus-plus notepad-plus-plus
  • High 7.8
    CVE-2019-13689

    Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perf…

    Google Chrome Browsers
  • High 7.1
    CVE-2023-32797

    WordPress video carousel slider with lightbox Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution video carousel slider with lightbox plugin <= 1.0.22 versions.

    I Thirteen Web Solution video carousel slider with lightbox
  • High 7.1
    CVE-2023-32603

    WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RedNao Donations Made Easy – Smart Donations plugin <= 4.0.12 versions.

    RedNao Donations Made Easy – Smart Donations
  • High 7.1
    CVE-2023-32598

    WordPress Featured Image Pro Post Grid Plugin <= 5.14 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in A. R. Jones Featured Image Pro Post Grid plugin <= 5.14 versions.

    A. R. Jones Featured Image Pro Post Grid
  • High 7.1
    CVE-2023-32518

    WordPress WP Chinese Conversion Plugin <= 1.1.16 is vulnerable to Cross Site Scripting (XSS)

    Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ono Oogami WP Chinese Conversion plugin <= 1.1.16 versions.

    Ono Oogami WP Chinese Conversion
  • High 7.7
    CVE-2023-3406

    Path traversal issue in M-Files Classic Web

    Path Traversal issue in M-Files Classic Web versions below 23.6.12695.3 and LTS Service Release Versions before 23.2 LTS SR3 allows authenticated user to read some restricted files on the web server

    M-Files M-Files Web
  • High 7.5
    CVE-2023-32756

    e-Excellence U-Office Force - Path Traversal

    e-Excellence U-Office Force has a path traversal vulnerability within its file uploading and downloading functions. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary system files, but can’t control system or disrupt service.

    e-Excellence U-Office Force
  • High 7.5
    GHSA-8qv2-5vq6-g2g7

    webpki: CPU denial of service in certificate path building

    When this crate is given a pathological certificate chain to validate, it will spend CPU time exponential with the number of candidate certificates at each step of path building. Both TLS clients and TLS servers that accept client certificate are affected. Th…

    webpki crates.io
  • High 7.5
    CVE-2023-40577

    Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpoint

    Alertmanager handles alerts sent by client applications such as the Prometheus server. An attacker with the permission to perform POST requests on the /api/v1/alerts endpoint could be able to execute arbitrary JavaScript code on the users of Prometheus Alertm…

    prometheus alertmanager prometheus-alertmanager promxy Debian Ubuntu Alpine Wolfi Go
  • High 7.8
    CVE-2023-24621

    Esoteric YamlBeans Unsafe Deserialization vulnerability

    An issue was discovered in Esoteric YamlBeans through 1.15. It allows untrusted deserialisation to Java classes by default, where the data and class are controlled by the author of the YAML document being processed.

    com.esotericsoftware.yamlbeans:yamlbeans Maven