Skip to content
OpenAdvisories

Archive

12 December 2023

Vulnerabilities first published on this day (UTC), newest first.

← November 2023 2023 / December /12 January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

54 results · Clear filters · Feed

  • Medium 6.8
    CVE-2023-42476

    Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence

    SAP Business Objects Web Intelligence - version 420, allows an authenticated attacker to inject JavaScript code into Web Intelligence documents which is then executed in the victim’s browser each time the vulnerable page is visited. Successful exploitation ca…

    SAP SAP BusinessObjects Web Intelligence
  • Medium 6.2
    GHSA-26hr-q2wp-rvc5

    User with permission to write actions can impersonate another user when auth token is configured in environment variable

    ### Impact When lakeFS is configured with **ALL** of the following: - Configuration option `auth.encrypt.secret_key` passed through environment variable - Actions enabled via configuration option `actions.enabled` (default enabled) then a user who can configu…

    github.com/treeverse/lakefs Go
  • Medium 5.5
    CVE-2023-42884

    This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.2, iO…

    Apple macOS iOS and iPadOS tvOS macOS iOS
  • Medium 5.5
    CVE-2015-2179

    xaviershay-dm-rails Gem for Ruby exposes sensitive information via the process table

    The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments.

    xaviershay-dm-rails RubyGems
  • Medium 6.1
    CVE-2023-28604

    Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting

    The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {content} use cases that may be edge cases.

    sitegeist/fluid-components Packagist
  • Medium 4.3
    CVE-2023-36652

    A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated at…

  • Medium 5.3
    CVE-2023-31048

    Exposure of Sensitive Information in OPC UA .NET Standard Reference Server

    The OPC UA .NET Standard Reference Server before 1.4.371.86. places sensitive information into an error message that may be seen remotely.

    OPCFoundation.NetStandard.Opc.Ua.Core OPCFoundation.NetStandard.Opc.Ua.Server NuGet
  • Medium 6.5
    CVE-2023-41115

    An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x bef…

  • Medium 4.3
    CVE-2023-41113

    An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x bef…

  • Medium 4.3
    CVE-2023-41116

    An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x bef…

  • Medium 6.5
    CVE-2023-41120

    An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x bef…

  • Medium 6.5
    CVE-2023-41114

    An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x bef…

  • Medium 5.3
    CVE-2023-49990

    Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.

    espeak-ng espeak-ng espeak-ng Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2022-44543

    TYPO3 Extension femanager vulnerable to Broken Access Control

    The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechani…

    in2code/femanager Packagist