Skip to content
OpenAdvisories

Archive

22 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /22 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Medium 6.5
    CVE-2023-43640

    TaxonWorks SQL injection vulnerability

    TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerability was found in TaxonWorks that allows authenticated attackers to extract arbitrary data from the TaxonWorks database…

    SpeciesFileGroup taxonworks
  • Medium 6.3
    CVE-2023-42812

    Galaxy vulnerable to Server Side Request Forgery during data imports

    Galaxy is an open-source platform for FAIR data analysis. Prior to version 22.05, Galaxy is vulnerable to server-side request forgery, which allows a malicious to issue arbitrary HTTP/HTTPS requests from the application server to internal hosts and read their…

    galaxyproject galaxy
  • Medium 4.7
    CVE-2023-42811

    AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure

    aes-gcm is a pure Rust implementation of the AES-GCM. Starting in version 0.10.0 and prior to version 0.10.3, in the AES GCM implementation of decrypt_in_place_detached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification…

    RustCrypto AEADs aes-gcm crates.io
  • Medium 4.5
    CVE-2023-23766

    Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling

    An incorrect comparison vulnerability was identified in GitHub Enterprise Server that allowed commit smuggling by displaying an incorrect diff in a re-opened Pull Request. To do so, an attacker would need write access to the repository. This vulnerability aff…

    GitHub Enterprise Server
  • Medium 6.0
    CVE-2023-5002

    Pgadmin4: remote code execution by an authenticated user

    A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. Versions of pgAdmin prior to 7.6 failed to properly control the server code exec…

    pgadmin4 PyPI
  • Medium 6.4
    CVE-2023-4774

    WP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The WP-Matomo Integration (WP-Piwik) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wp-piwik' shortcode in versions up to, and including, 1.0.28 due to insufficient input sanitization and output escaping on user supplied attributes…

    matomoteam Connect Matomo – Analytics Dashboard for WordPress Web / CMS
  • Medium 6.4
    CVE-2023-4716

    Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up to, and including, 3.10 due to insufficient input sanitization and output escaping on user supplied attributes. This m…

    dglingren Media Library Assistant Web / CMS
  • Medium 5.5
    CVE-2023-43090

    Gnome-shell: screenshot tool allows viewing open windows when session is locked

    A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.

    gnome-shell Debian
  • Medium 6.1
    CVE-2023-43770 Exploited Public exploit EPSS 64%

    Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with craf…

    roundcube roundcube Debian Ubuntu
    KEV Feb 12, 2024
  • Medium 5.5
    CVE-2023-43771

    In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program.