Skip to content
OpenAdvisories

Archive

28 November 2023

Vulnerabilities first published on this day (UTC), newest first.

← October 2023 2023 / November /28 December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.8
    CVE-2022-41678 Public exploit Scanner template EPSS 86%

    Apache ActiveMQ: Insufficient API restrictions on Jolokia allow authenticated users to perform RCE

    Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution.  In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandler#handlePos…

    Apache Software Foundation Apache ActiveMQ activemq activemq Debian Ubuntu Maven
  • High 8.8
    CVE-2023-4226 Public exploit

    Chamilo LMS File Upload Functionality Remote Code Execution

    Unrestricted file upload in `/main/inc/ajax/work.ajax.php` in Chamilo LMS <= v1.11.24 allows authenticated attackers with learner role to obtain remote code execution via uploading of PHP files.

    chamilo Chamilo
  • High 8.1
    CVE-2023-4220 Public exploit Scanner template EPSS 76%

    Chamilo LMS Unauthenticated Big Upload File Remote Code Execution

    Unrestricted file upload in big file upload functionality in `/main/inc/lib/javascript/bigupload/inc/bigUpload.php` in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via…

    chamilo Chamilo
  • Critical 9.8
    CVE-2023-48022 Public exploit Scanner template EPSS 84%

    Ray has arbitrary code execution via jobs submission API

    Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictl…

    ray PyPI
  • Unscored —
    CVE-2023-46944 Public exploit

    An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Vi…

  • High 8.2
    CVE-2023-45539 Public exploit

    HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive inf…

    haproxy haproxy haproxy Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2023-49313 Public exploit

    A dylib injection vulnerability in XMachOViewer 0.04 allows attackers to compromise integrity. By exploiting this, unau…

  • Unscored —
    CVE-2023-49314 Public exploit

    Asana Desktop 2.1.0 on macOS allows code injection because of specific Electron Fuses. There is inadequate protection a…