Skip to content
OpenAdvisories

Archive

20 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /20 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

127 results · Feed

  • Unscored —
    CVE-2023-38876

    A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to e…

  • Unscored —
    CVE-2023-38875 Scanner template

    A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to e…

  • High 8.8
    CVE-2023-38887

    File Upload vulnerability in Dolibarr ERP CRM

    File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via the extension filtering and renaming functions.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Critical 9.6
    CVE-2023-38888

    Cross Site Scripting vulnerability in Dolibarr ERP CRM

    Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the REST API module, related to analyseVarsForSqlAndScriptsInjection and testSqlAndScriptInject.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • High 7.2
    CVE-2023-38886 EPSS 30%

    Dolibarr allows a remote privileged attacker to execute arbitrary code via a crafted command/script

    An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.

    dolibarr dolibarr/dolibarr Ubuntu Packagist
  • Unscored —
    CVE-2023-36109 Public exploit

    Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_st…

    iotjs Ubuntu
  • Unscored —
    CVE-2023-36234

    Cross Site Scripting (XSS) vulnerability in Netbox 3.5.1, allows attackers to execute arbitrary code via Name field in …

  • Unscored —
    CVE-2023-40930 Public exploit

    An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via moun…

  • Unscored —
    CVE-2023-40619

    phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code executio…

    phppgadmin phppgadmin Debian Ubuntu
  • Unscored —
    CVE-2023-40618

    A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Vis…

  • Unscored —
    CVE-2023-41484

    An issue in cimg.eu Cimg Library v2.9.3 allows an attacker to obtain sensitive information via a crafted JPEG file.

  • Unscored —
    CVE-2023-41902

    An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to es…

  • Critical 9.8
    CVE-2023-42322

    Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.

  • Unscored —
    CVE-2023-42331

    A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads…

  • Unscored —
    CVE-2023-42334

    An Indirect Object Reference (IDOR) in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to escala…

  • Unscored —
    CVE-2023-42335

    Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to exe…

  • Unscored —
    CVE-2023-42464

    A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. When p…

    netatalk netatalk netatalk Debian Ubuntu Alpine
  • Unscored —
    CVE-2023-42321

    Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary c…

  • Unscored —
    CVE-2023-42147

    An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component.

  • Critical 9.8
    CVE-2023-43371

    Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/c…

    hoteldruid hoteldruid Debian Ubuntu
  • High 8.0
    CVE-2023-43204

    D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50…

  • High 8.0
    CVE-2023-43206

    D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_…

  • Medium 5.4
    CVE-2023-43376

    A cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute …

    hoteldruid hoteldruid Debian Ubuntu
  • Medium 5.4
    CVE-2023-43377

    A cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attacker…

    hoteldruid hoteldruid Debian Ubuntu
  • High 8.0
    CVE-2023-43207

    D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_up…

  • Critical 9.8
    CVE-2023-43375

    Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the a…

    hoteldruid hoteldruid Debian Ubuntu
  • Medium 5.3
    CVE-2023-43617

    Cros secrets may be disclosed to untrusted relay

    An issue was discovered in Croc through 9.6.5. When a custom shared secret is used, the sender and receiver may divulge parts of this secret to an untrusted Relay, as part of composing a room name.

    croc github.com/schollz/croc/v9 github.com/schollz/croc/v6 github.com/schollz/croc Alpine Wolfi Go
  • Unscored —
    CVE-2023-43197

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.a…

  • Medium 5.5
    CVE-2023-43616

    Sender can cause a receiver to overwrite files during ZIP extraction in Croc

    An issue was discovered in Croc through 9.6.5. A sender can cause a receiver to overwrite files during ZIP extraction.

    croc github.com/schollz/croc/v9 github.com/schollz/croc/v6 github.com/schollz/croc Alpine Wolfi Go
  • Unscored —
    CVE-2023-43200

    D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.dat…

  • Medium 4.7
    CVE-2023-43621

    Croc may expose secret to local users

    An issue was discovered in Croc through 9.6.5. The shared secret, located on a command line, can be read by local users who list all processes and their arguments.

    croc github.com/schollz/croc/v9 github.com/schollz/croc/v6 github.com/schollz/croc Alpine Wolfi Go
  • Unscored —
    CVE-2023-43137

    TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL ru…

  • Unscored —
    CVE-2023-43134

    There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive…

  • Critical 9.8
    CVE-2023-43373 Scanner template

    Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid…

    hoteldruid hoteldruid Debian Ubuntu
  • Unscored —
    CVE-2023-43135

    There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attack…

  • High 7.8
    CVE-2023-43619

    Croc sender may send dangerous new files to receiver

    An issue was discovered in Croc through 9.6.5. A sender may send dangerous new files to a receiver, such as executable content or a .ssh/authorized_keys file.

    croc github.com/schollz/croc github.com/schollz/croc/v8 github.com/schollz/croc/v9 Alpine Wolfi Go
  • Medium 5.3
    CVE-2023-43618

    Croc requires senders to provide local IP addresses in cleartext

    An issue was discovered in Croc through 9.6.5. The protocol requires a sender to provide its local IP addresses in cleartext via an ips? message.

    croc github.com/schollz/croc github.com/schollz/croc/v8 github.com/schollz/croc/v9 Alpine Wolfi Go
  • Unscored —
    CVE-2023-43138

    TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT r…

  • High 8.0
    CVE-2023-43202

    D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_down…

  • Unscored —
    CVE-2023-43196

    D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp …