Skip to content
OpenAdvisories

Archive

3 January 2024

Vulnerabilities first published on this day (UTC), newest first.

← December 2023 2024 / January /3 February 2024 →
  1. 115
  2. 2107
  3. 395
  4. 459
  5. 574
  6. 68
  7. 735
  8. 8197
  9. 9159
  10. 10178
  11. 11139
  12. 12129
  13. 1352
  14. 144
  15. 1566
  16. 16228
  17. 1785
  18. 1890
  19. 19108
  20. 2015
  21. 2114
  22. 2258
  23. 23147
  24. 2476
  25. 2574
  26. 26111
  27. 2717
  28. 2810
  29. 2994
  30. 3076
  31. 3192
All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.7
    CVE-2023-50253

    laf logs leak

    Laf is a cloud development platform. In the Laf version design, the log uses communication with k8s to quickly retrieve logs from the container without the need for additional storage. However, in version 1.0.0-beta.13 and prior, this interface does not verif…

    labring laf
  • Critical 9.8
    CVE-2023-51784

    Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager

    Improper Control of Generation of Code ('Code Injection') vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pi…

    Apache Software Foundation Apache InLong org.apache.inlong:manager-pojo Maven
  • Critical 9.6
    CVE-2023-52314

    Command injection in convert_shape_compare

    PaddlePaddle before 2.6.0 has a command injection in convert_shape_compare. This resulted in the ability to execute arbitrary commands on the operating system.

    PaddlePaddle PaddlePaddle paddlepaddle PyPI
  • Critical 9.6
    CVE-2023-52311

    Command injection in _wget_download

    PaddlePaddle before 2.6.0 has a command injection in _wget_download. This resulted in the ability to execute arbitrary commands on the operating system.

    PaddlePaddle PaddlePaddle paddlepaddle PyPI
  • Critical 9.6
    CVE-2023-52310

    Command injection in get_online_pass_interval

    PaddlePaddle before 2.6.0 has a command injection in get_online_pass_interval. This resulted in the ability to execute arbitrary commands on the operating system.

    PaddlePaddle PaddlePaddle paddlepaddle PyPI
  • Critical 9.8
    CVE-2023-50090

    Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write …

  • Critical 9.8
    CVE-2023-50921

    An issue was discovered on GL.iNet devices through 4.5.0. Attackers can invoke the add_user interface in the system mod…

  • Critical 9.6
    CVE-2023-39655

    CouchAuth host header injection vulnerability leaks the password reset token

    A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead t…

    @perfood/couch-auth npm
  • Critical 9.8
    CVE-2023-46308

    plotly.js prototype pollution vulnerability

    In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.

    plotly.js plotly/plotly.js npm Packagist
  • Critical 9.8
    CVE-2023-49442 EPSS 39%

    Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary…