Skip to content
OpenAdvisories

Archive

19 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /19 November 2023 →
  1. 18
  2. 281
  3. 3138
  4. 4107
  5. 562
  6. 672
  7. 72
  8. 824
  9. 985
  10. 10256
  11. 11111
  12. 1288
  13. 1364
  14. 1430
  15. 1511
  16. 16168
  17. 17163
  18. 1874
  19. 19105
  20. 20125
  21. 2115
  22. 2226
  23. 2353
  24. 24122
  25. 25213
  26. 2690
  27. 2797
  28. 2813
  29. 2918
  30. 30171
  31. 31121
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • High 8.6
    CVE-2023-41898 Public exploit

    Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android

    Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited nat…

    home-assistant core
  • Medium 5.0
    CVE-2023-34050 Public exploit

    Spring AMQP Deserialization Vulnerability

    In spring AMQP versions 1.0.0 to 2.4.16 and 3.0.0 to 3.0.9 , allowed list patterns for deserializable class names were added to Spring AMQP, allowing users to lock down deserialization of data in messages from untrusted sources; however by default, when no al…

    Spring Spring AMQP
  • Critical 9.8
    CVE-2023-5204 Public exploit Scanner template

    AI ChatBot <= 4.8.9 - Unauthenticated SQL Injection via qc_wpbo_search_response

    The ChatBot plugin for WordPress is vulnerable to SQL Injection via the $strid parameter in versions up to, and including, 4.8.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This mak…

    Quantum Cloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services Web / CMS
  • High 8.8
    CVE-2023-46229 Public exploit EPSS 42%

    LangChain Server Side Request Forgery vulnerability

    LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server.

    langchain PyPI
  • High 7.5
    CVE-2023-45277 Public exploit

    Yamcs Path Traversal vulnerability

    Yamcs 5.8.6 is vulnerable to directory traversal (issue 1 of 2). The vulnerability is in the storage functionality of the API and allows one to escape the base directory of the buckets, freely navigate system directories, and read arbitrary files.

    org.yamcs:yamcs Maven
  • Unscored —
    CVE-2023-45992 Public exploit

    A vulnerability in the web-based interface of the RUCKUS Cloudpath product on version 5.12 build 5538 or before to coul…

  • Medium 5.2
    CVE-2023-43340 Public exploit

    Evolution CMS Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in evolution v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected into the cmsadmin, cmsadminemail, cmspassword and cmspasswordconfim parameters

    evolutioncms/evolution Packagist
  • Medium 6.1
    CVE-2023-43875 Public exploit

    Subrion CMS vulnerable to Cross-site Scripting

    Multiple Cross-Site Scripting (XSS) vulnerabilities in installation of Subrion CMS v.4.2.1 allows a local attacker to execute arbitrary web scripts via a crafted payload injected into the dbhost, dbname, dbuser, adminusername and adminemail.

    intelliants/subrion Packagist
  • Unscored —
    CVE-2023-43359 Public exploit

    Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a cr…

  • Medium 5.4
    CVE-2023-43342 Public exploit

    Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary c…

  • Medium 6.1
    CVE-2023-43341 Public exploit

    Evolution CMS Cross-site Scripting vulnerability

    Cross-site scripting (XSS) vulnerability in evolution evo v.3.2.3 allows a local attacker to execute arbitrary code via a crafted payload injected uid parameter.

    evolutioncms/evolution Packagist
  • Unscored —
    CVE-2023-43345 Public exploit

    Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary c…

  • Medium 5.4
    CVE-2023-43344 Public exploit

    Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary c…