Skip to content
OpenAdvisories

Archive

5 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /5 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-4485

    ARDEREG Sistemas SCADA SQL Injection

    ARDEREG ​Sistema SCADA Central versions 2.203 and prior login page are vulnerable to an unauthenticated blind SQL injection attack. An attacker could manipulate the application's SQL query logic to extract sensitive information or perform unauthorized actions…

    ARDEREG Sistemas SCADA
  • Critical 9.8
    CVE-2023-39361 Public exploit Scanner template EPSS 89%

    Unauthenticated SQL Injection in graph_view.php in Cacti

    Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are bei…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2023-4178

    Authentication Bypass in Neutron Smart VMS

    Authentication Bypass by Spoofing vulnerability in Neutron Neutron Smart VMS allows Authentication Bypass. This issue affects Neutron Smart VMS: before b1130.1.0.1.

    Neutron Neutron Smart VMS
  • Critical 9.8
    CVE-2023-4531

    SQLi in Mestavs E-commerce Software

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mestav Software E-commerce Software allows SQL Injection. This issue affects E-commerce Software: before 20230901 .

    Mestav Software E-commerce Software
  • Critical 9.8
    CVE-2023-4034

    SQLi in Smartrise Document Management System

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Digita Information Technology Smartrise Document Management System allows SQL Injection. This issue affects Smartrise Document Management System: before Hvl-…

    Digita Information Technology Smartrise Document Management System
  • Critical 9.8
    CVE-2023-3616

    SQLi in Mava Softwares Hotel Management System

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mava Software Hotel Management System allows SQL Injection. This issue affects Hotel Management System: before 2.0.

    Mava Software Hotel Management System
  • Critical 9.8
    CVE-2023-35072

    SQLi in Coyav Travels Proagent

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Coyav Travel Proagent allows SQL Injection. This issue affects Proagent: before 20230904 .

    Coyav Travel Proagent
  • Critical 9.8
    CVE-2023-35068

    SQLi in BMAs Personnel Tracking System

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BMA Personnel Tracking System allows SQL Injection. This issue affects Personnel Tracking System: before 20230904.

    BMA Personnel Tracking System
  • Critical 9.8
    CVE-2023-35065

    SQLi in Osofts Paint Production Management

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Osoft Paint Production Management allows SQL Injection. This issue affects Paint Production Management: before 2.1.

    Osoft Paint Production Management
  • Critical 9.8
    CVE-2023-3374

    Privilege Escalation in Bookreen

    Incomplete List of Disallowed Inputs vulnerability in Unisign Bookreen allows Privilege Escalation. This issue affects Bookreen: before 3.0.0.

    Unisign Bookreen
  • Critical 9.8
    CVE-2023-40743

    Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getService

    ** UNSUPPORTED WHEN ASSIGNED ** When integrating Apache Axis 1.x in an application, it may not have been obvious that looking up a service through "ServiceFactory.getService" allows potentially dangerous lookup mechanisms such as LDAP. When passing untrusted …

    Apache Software Foundation Apache Axis axis org.apache.axis:axis Debian Ubuntu Maven
  • Critical 9.8
    CVE-2023-28581

    Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Firmware

    Memory corruption in WLAN Firmware while parsing receieved GTK Keys in GTK KDE.

    Qualcomm Snapdragon
  • Critical 9.8
    CVE-2023-28562

    Buffer Copy Without Checking Size of Input in QESL

    Memory corruption while handling payloads from remote ESL.

    Qualcomm Snapdragon
  • Critical 9.8
    CVE-2023-36361

    Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter.

  • Critical 9.0
    CVE-2017-9453

    BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass.