Skip to content
OpenAdvisories

Archive

6 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /6 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-39967

    Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio

    WireMock is a tool for mocking HTTP services. When certain request URLs like “@127.0.0.1:1234" are used in WireMock Studio configuration fields, the request might be forwarded to an arbitrary service reachable from WireMock’s instance. There are 3 identified …

    wiremock wiremock
  • Critical 9.8
    CVE-2023-41330

    Unsafe deserialization in knplabs/knp-snappy

    knplabs/knp-snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. ## Issue On March 17th the vulnerability CVE-2023-28115 was disclosed, allowing an attacker to gain remote code execution through PHAR deserializatio…

    KnpLabs snappy knplabs/knp-snappy Packagist
  • Critical 10.0
    CVE-2023-20238 EPSS 15%

    A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco …

    Cisco Cisco BroadWorks Network devices
  • Critical 9.1
    CVE-2021-36023

    Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

    Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remo…

    Adobe Adobe Commerce magento/community-edition magento/project-community-edition Packagist
  • Critical 9.1
    CVE-2023-4589

    Insufficient verification of data authenticity vulnerability in Delinea Secret Server

    Insufficient verification of data authenticity vulnerability in Delinea Secret Server, in its v10.9.000002 version. An attacker with an administrator account could perform software updates without proper integrity verification mechanisms. In this scenario, th…

    Delinea Secret Server
  • Critical 9.8
    CVE-2023-4634 Public exploit Scanner template EPSS 86%

    Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

    The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from …

    dglingren Media Library Assistant Web / CMS