Skip to content
OpenAdvisories

Archive

September 2023

Vulnerabilities first published in this month (UTC), newest first.

← August 2023 2023 / September October 2023 →
  1. 180
  2. 210
  3. 326
  4. 4153
  5. 5123
  6. 6162
  7. 767
  8. 854
  9. 915
  10. 1011
  11. 11118
  12. 12157
  13. 1360
  14. 1467
  15. 1579
  16. 169
  17. 1718
  18. 1855
  19. 1956
  20. 20127
  21. 2158
  22. 2241
  23. 233
  24. 248
  25. 2593
  26. 26166
  27. 27146
  28. 2873
  29. 2983
  30. 3056
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 10.0
    CVE-2023-43654 Public exploit Scanner template EPSS 42%

    TorchServe Server-Side Request Forgery

    TorchServe is a tool for serving and scaling PyTorch models in production. TorchServe default configuration lacks proper input validation, enabling third parties to invoke remote HTTP download requests and write files to the disk. This issue could be taken ad…

    pytorch serve torchserve PyPI
  • Critical 10.0
    CVE-2023-40044 Exploited · Ransomware Public exploit Scanner template EPSS 90%

    WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

    In WS_FTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WS_FTP Server operating system.

    Progress Software WS_FTP Server
    KEV Oct 5, 2023
  • Critical 9.8
    CVE-2023-40989 Public exploit

    SQL injection in jeecgboot

    SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted request to the report/jeecgboot/jmreport/queryFieldBySql component.

    org.jeecgframework.boot:jeecg-boot-common Maven
  • Critical 9.8
    CVE-2023-31719 Public exploit Scanner template EPSS 44%

    FUXA SQL Injection vulnerability

    FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.

    fuxa-server npm
  • Critical 10.0
    CVE-2023-2163 Public exploit

    Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation

    Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape.

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Critical 9.8
    CVE-2023-42793 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

    JetBrains TeamCity
    KEV Oct 4, 2023
  • Critical 9.8
    CVE-2023-33831 Public exploit Scanner template EPSS 26%

    A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA

    A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.

    @frangoteam/fuxa npm
  • Critical 10.0
    CVE-2023-41892 Public exploit Scanner template EPSS 94%

    Craft CMS Remote Code Execution vulnerability

    Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed i…

    craftcms cms craftcms/cms Packagist
  • Critical 9.9
    CVE-2023-3710 Public exploit Scanner template EPSS 49%

    Printer web page invalid command execution

    Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to…

    Honeywell PM23/43 PM42 PX45/65 ICS / OT
  • Critical 9.9
    CVE-2023-40029 Public exploit

    Cluster secret might leak in cluster details page in Argo CD

    Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored in`kubectl.kubernetes.io/last-applied-configuration` annotation. p…

    argoproj Argo CD github.com/argoproj/argo-cd github.com/argoproj/argo-cd/v2 Go
  • Critical 9.8
    CVE-2023-4634 Public exploit Scanner template EPSS 86%

    Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

    The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from …

    dglingren Media Library Assistant Web / CMS
  • Critical 9.8
    CVE-2023-39361 Public exploit Scanner template EPSS 89%

    Unauthenticated SQL Injection in graph_view.php in Cacti

    Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered in graph_view.php. Since guest users can access graph_view.php without authentication by default, if guest users are bei…

    Cacti cacti cacti cacti Debian Ubuntu Alpine
  • Critical 9.8
    CVE-2023-4696 Public exploit

    Improper Access Control in usememos/memos

    Improper Access Control in GitHub repository usememos/memos prior to 0.13.2.

    usememos usememos/memos github.com/usememos/memos Go