Skip to content
OpenAdvisories

Archive

28 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /28 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

73 results · Feed

  • Medium 5.3
    CVE-2023-38871

    Economizzer user enumeration vulnerability

    The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password functionalities. The app reacts differently when a user or email address is valid, and when it's not. This may allow an…

    gugoan/economizzer Packagist
  • Low 3.7
    CVE-2023-38872

    Economizzer Insecure Direct Object Reference vulnerability

    An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthenticated attacker to access cash book entry attachments of any other user, if they know the Id of the attachment.

    gugoan/economizzer Packagist
  • High 8.8
    CVE-2023-38874 EPSS 32%

    Economizzer remote code execution vulnerability

    A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023). A malicious attacker can upload a PHP web shell as an attachment when adding a new cash book entry. Afterwards,…

    gugoan/economizzer Packagist
  • Unscored —
    CVE-2023-30415

    Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via th…

  • Medium 5.1
    CVE-2023-44273

    gnark-crypto doesn't range check input values during ECDSA and EdDSA signature deserialization

    Consensys gnark-crypto through 0.11.2 allows Signature Malleability. This occurs because deserialisation of EdDSA and ECDSA signatures does not ensure that the data is in a certain interval.

    github.com/consensys/gnark-crypto Go
  • Unscored —
    CVE-2023-44276

    OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.

  • Unscored —
    CVE-2023-44275

    OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.

  • Medium 6.1
    CVE-2023-41447

    Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code …

  • Unscored —
    CVE-2023-41444

    An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privil…

  • High 8.8
    CVE-2023-41450

    An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to …

  • Medium 4.7
    CVE-2023-41911

    Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2).

  • Medium 6.1
    CVE-2023-41446

    Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code …

  • Unscored —
    CVE-2023-42222 Public exploit

    WebCatalog before 49.0 is vulnerable to Incorrect Access Control. WebCatalog calls the Electron shell.openExternal func…

  • Unscored —
    CVE-2023-43868

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via websGetVar function.

  • Unscored —
    CVE-2023-43872 Public exploit

    A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Si…

  • Unscored —
    CVE-2023-43863

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanDhcpplus function.

  • Medium 4.8
    CVE-2023-43879 Public exploit

    Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a craft…

  • Unscored —
    CVE-2023-43860

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function.

  • Unscored —
    CVE-2023-43876 Public exploit

    A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary …

  • Unscored —
    CVE-2023-43867

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanL2TP function.

  • High 7.5
    CVE-2023-43862

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formLanguageChange function.

  • Medium 5.4
    CVE-2023-43884

    Subrion CMS Cross-site Scripting vulnerability

    A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into 'Reference ID' parameter.

    intelliants/subrion Packagist
  • Unscored —
    CVE-2023-43873 Public exploit

    A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a …

  • Unscored —
    CVE-2023-43865

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPTP function.

  • Unscored —
    CVE-2023-43878 Public exploit

    Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via…

  • Unscored —
    CVE-2023-43871 Public exploit

    A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripti…

  • Unscored —
    CVE-2023-43323 Public exploit Scanner template

    mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP …

  • Unscored —
    CVE-2023-43861

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPPoE function.

  • Unscored —
    CVE-2023-43864

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard55 function.

  • Unscored —
    CVE-2023-43869

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard56 function.

  • Medium 5.4
    CVE-2023-43874 Public exploit

    Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code…

  • Unscored —
    CVE-2023-43866

    D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard7 function.

  • High 8.8
    CVE-2023-43226

    An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute…