Skip to content
OpenAdvisories

Archive

28 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /28 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-43654 Public exploit Scanner template EPSS 42%

    TorchServe Server-Side Request Forgery

    TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken ad…

    pytorch serve torchserve PyPI
  • High 8.8
    CVE-2023-5217 Exploited Public exploit EPSS 49%

    Electron affected by libvpx's heap buffer overflow in vp8 encoding

    Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

    Google Chrome libvpx chromium Browsers Debian Ubuntu Alpine npm
    KEV Oct 2, 2023
  • Medium 6.5
    CVE-2023-38873 Public exploit

    Economizzer vulnerable to Clickjacking

    The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking. Clickjacking, also known as a "UI redress attack", is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or…

    gugoan/economizzer Packagist
  • Unscored —
    CVE-2023-42222 Public exploit

    WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal func…

  • Unscored —
    CVE-2023-43872 Public exploit

    A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Si…

  • Medium 4.8
    CVE-2023-43879 Public exploit

    Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a craft…

  • Unscored —
    CVE-2023-43876 Public exploit

    A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary …

  • Unscored —
    CVE-2023-43873 Public exploit

    A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a …

  • Unscored —
    CVE-2023-43878 Public exploit

    Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via…

  • Unscored —
    CVE-2023-43871 Public exploit

    A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripti…

  • Unscored —
    CVE-2023-43323 Public exploit Scanner template

    mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP …

  • Medium 5.4
    CVE-2023-43874 Public exploit

    Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code…