Skip to content
OpenAdvisories

Archive

29 September 2023

Vulnerabilities first published on this day (UTC), newest first.

← August 2023 2023 / September /29 October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Low 3.7
    CVE-2023-5297

    Xinhu RockOA start backup

    A vulnerability was found in Xinhu RockOA 2.3.2. It has been classified as problematic. This affects the function start of the file task.php?m=sys|runt&a=beifen. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possib…

    Xinhu RockOA
  • Low —
    GHSA-hq58-p9mv-338c

    CometBFT's default for `BlockParams.MaxBytes` consensus parameter may increase block times and affect consensus participation

    ## Amulet Security Advisory for CometBFT: ASA-2023-002 **Component**: CometBFT **Criticality:** Low **Affected versions:** All **Affected users:** Validators, Chain Builders + Maintainers # Summary A default configuration in CometBFT has been found to be larg…

    github.com/cometbft/cometbft Go
  • Low 2.4
    CVE-2023-5287

    BEECMS cross site scripting

    ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, was found in BEECMS 4.0. This affects an unknown part of the file /admin/admin_content_tag.php?action=save_content. The manipulation of the argument tag leads to cross site …

  • Low 3.5
    CVE-2023-5286

    SourceCodester Expense Tracker App Category add_category.php cross site scripting

    A vulnerability, which was classified as problematic, has been found in SourceCodester Expense Tracker App v1. Affected by this issue is some unknown functionality of the file add_category.php of the component Category Handler. The manipulation of the argumen…

    SourceCodester Expense Tracker App
  • Low 3.5
    CVE-2023-5273

    SourceCodester Best Courier Management System manage_parcel_status.php cross site scripting

    A vulnerability classified as problematic was found in SourceCodester Best Courier Management System 1.0. This vulnerability affects unknown code of the file manage_parcel_status.php. The manipulation of the argument id leads to cross site scripting. The atta…

    SourceCodester Best Courier Management System
  • Low 2.7
    CVE-2023-5259

    ForU CMS cms_admin.php denial of service

    A vulnerability classified as problematic was found in ForU CMS. This vulnerability affects unknown code of the file /admin/cms_admin.php. The manipulation of the argument del leads to denial of service. The attack can be initiated remotely. The exploit has b…

    ForU CMS
  • Low 3.5
    CVE-2023-5257

    WhiteHSBG JNDIExploit HTTPServer.java handleFileRequest path traversal

    A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It has been rated as problematic. Affected by this issue is the function handleFileRequest of the file src/main/java/com/feihong/ldap/HTTPServer.java. The manipulation leads to path traversal.…

    WhiteHSBG JNDIExploit
  • Low 2.7
    CVE-2023-5194

    A system/user manager can demote / deactivate another manager

    Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager

    Mattermost Mattermost github.com/mattermost/mattermost-server/v6 github.com/mattermost/mattermost/server/v8 Go
  • Low 3.8
    CVE-2023-5159

    A User Manager role with user edit permissions could manage/update bots

    Mattermost fails to properly verify the permissions when managing/updating a bot allowing a User Manager role with user edit permissions to manage/update bots.

    Mattermost Mattermost github.com/mattermost/mattermost-server/v6 github.com/mattermost/mattermost/server/v8 Go
  • Low 3.0
    CVE-2023-3922

    URL Redirection to Untrusted Site ('Open Redirect') in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.1
    CVE-2023-2233

    Missing Authorization in GitLab

    An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1. It allows a project reporter to leak …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.5
    CVE-2023-3906

    Improper Validation of Specified Type of Input in GitLab

    An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy.

    GitLab GitLab Web / CMS
  • Low 3.1
    CVE-2023-3979

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your…

    GitLab GitLab gitlab Web / CMS Ubuntu