Skip to content
OpenAdvisories

Archive

1 December 2023

Vulnerabilities first published on this day (UTC), newest first.

← November 2023 2023 / December /1 January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2023-44382

    October CMS safe mode bypass using Twig sandbox escape

    October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to pro…

    October CMS october october/system Packagist
  • Critical 9.8
    CVE-2023-5636

    Malicious File Upload in ArslanSoft's Education Portal

    Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection. This issue affects Education Portal: before v1.1.

    ArslanSoft Education Portal
  • Critical 9.8
    CVE-2023-5634

    SQLi in ArslanSoft's Education Portal

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ArslanSoft Education Portal allows SQL Injection. This issue affects Education Portal: before v1.1.

    ArslanSoft Education Portal
  • Critical 9.8
    CVE-2023-48842 Public exploit

    D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter a…

  • Critical 9.8
    CVE-2023-48886

    A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted R…

  • Critical 9.8
    CVE-2023-48887

    Jupiter allows attackers to execute arbitrary commands via sending a crafted RPC request

    A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.

    org.jupiter-rpc:jupiter-rpc Maven
  • Critical 9.8
    CVE-2023-49371

    RuoYi vulnerable to SQL injection vulnerability

    RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.

    com.ruoyi:ruoyi Maven