Skip to content
OpenAdvisories

Archive

August 2023

Vulnerabilities first published in this month (UTC), newest first.

← July 2023 2023 / August September 2023 →
  1. 184
  2. 256
  3. 3150
  4. 457
  5. 526
  6. 619
  7. 7115
  8. 8254
  9. 9102
  10. 10133
  11. 11155
  12. 123
  13. 1329
  14. 14136
  15. 1595
  16. 16104
  17. 1779
  18. 1859
  19. 197
  20. 2014
  21. 2163
  22. 22191
  23. 2361
  24. 2465
  25. 2586
  26. 266
  27. 2713
  28. 2877
  29. 2952
  30. 30119
  31. 31104
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-4596 Public exploit Scanner template EPSS 14%

    Forminator <= 1.24.6 - Unauthenticated Arbitrary File Upload

    The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. This makes it possible…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Critical 9.8
    CVE-2023-34039 Public exploit Scanner template EPSS 67%

    Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key …

  • Critical 9.6
    CVE-2023-41265 Exploited · Ransomware Public exploit Scanner template EPSS 88%

    An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and ea…

    KEV Dec 7, 2023
  • Critical 9.8
    CVE-2023-36281 Public exploit

    langchain vulnerable to arbitrary code execution

    An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt. This is related to __subclasses__ or a template.

    langchain PyPI
  • Critical 9.8
    CVE-2023-38035 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an…

    ivanti MobileIron Sentry Network devices
    KEV Aug 22, 2023
  • Critical 9.8
    CVE-2023-36845 Exploited Public exploit Scanner template EPSS 95%

    Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable

    A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker …

    Juniper Networks Junos OS Network devices
    KEV Nov 13, 2023
  • Critical 9.8
    CVE-2023-2917 Public exploit EPSS 72%

    Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability

    The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability.  Due to an improper input validation, a path traversal vulnerability exists, via the filename field, when the ThinManager processes a certain function. I…

    Rockwell Automation ThinManager® ThinServer™ ICS / OT
  • Critical 10.0
    CVE-2023-35082 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted f…

    ivanti EPMM Network devices
    KEV Jan 18, 2024
  • Critical 9.8
    CVE-2023-3452 Public exploit Scanner template

    Canto <= 3.0.4 - Unauthenticated Remote File Inclusion

    The Canto plugin for WordPress is vulnerable to Remote File Inclusion in versions up to, and including, 3.0.4 via the 'wp_abspath' parameter. This allows unauthenticated attackers to include and execute arbitrary remote code on the server, provided that allow…

    flightbycanto Canto Web / CMS
  • Critical 9.4
    CVE-2023-3824 Public exploit EPSS 22%

    Buffer overflow and overread in phar_dir_read()

    In PHP version 8.0.* before 8.0.30,  8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.

    PHP Group PHP php5 php7.0 Debian Ubuntu Azure Linux Alpine
  • Critical 9.0
    CVE-2023-35085 Public exploit

    An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Mo…

    Ubiquiti UniFi Access Points UniFi Switches Network devices
  • Critical 9.6
    CVE-2023-33242 Public exploit

    Lindell17 TSS Abort Mishandling

    Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt (256 in total) because of not adhering to the paper's security proof's assumption rega…

    Lindell TSS Implementations Wallet
  • Critical 9.1
    CVE-2023-39526 Public exploit

    PrestaShopSQL manager vulnerability (potential RCE)

    PrestaShop is an open source e-commerce web application. Versions prior to 1.7.8.10, 8.0.5, and 8.1.1 are vulnerable to remote code execution through SQL injection and arbitrary file write in the back office. Versions 1.7.8.10, 8.0.5, and 8.1.1 contain a patc…

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • Critical 9.8
    CVE-2023-39143 Public exploit Scanner template EPSS 80%

    PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delet…

  • Critical 9.8
    CVE-2023-29689 Public exploit EPSS 53%

    PyroCMS remote code execution vulnerability

    PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. This vulnerability allows a malicious attacker to send customized commands to the server and execute arbitrary code on…

    pyrocms/pyrocms Packagist
  • Critical 9.8
    CVE-2022-39986 Public exploit Scanner template EPSS 99%

    RaspAP Command Injection vulnerability

    A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id parameter in /ajax/openvpn/activate_ovpncfg.php and /ajax/openvpn/del_ovpncfg.php.

    billz/raspap-webgui Packagist