Critical
CVE-2023-31047
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,856
Reset filters
High
CVE-2023-30861
Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header
High
CVE-2023-32007
** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has
Critical
ghsa-83fm-w79m-64r5
Remote file access vulnerability in `mlflow server` and `mlflow ui` CLIs
High
CVE-2023-2356
Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.
High
CVE-2023-30628
Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior,
High
CVE-2023-30629
Incorrect success value returned in vyper
High
Exploited in attacks
CVE-2023-27524
Apache superset missing check for default SECRET_KEY
High
CVE-2023-30620
mindsdb arbitrary file write when extracting a remotely retrieved Tarball
High
CVE-2023-30798
MultipartParser denial of service with too many fields or files
High
CVE-2023-2228
Cross-Site Request Forgery (CSRF) in GitHub repository modoboa/modoboa prior to 2.1.0.
Critical
CVE-2023-2227
Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0.
Medium
CVE-2023-28458
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Organizers can trigger the overwriting (with the standard pretalx 404 page content) of an arbitrary file.
High
CVE-2023-28459
pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). Users were able to upload crafted HTML documents that trigger the reading of arbitrary files.
High
CVE-2023-30797
Lemur subject to insecure random generation
Medium
CVE-2023-30608
sqlparse contains a regular expression that is vulnerable to Regular Expression Denial of Service
Medium
CVE-2023-2160
Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.
Medium
CVE-2023-27525
Apache Superset vulnerable to Improper Authorization
Critical
CVE-2023-24831
Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3.
Critical
CVE-2023-22946
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as, limiting privileges. The application can execute code with the privileges of the submitti
Unrated
CVE-2023-30771
Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component on 0.13.3. iotdb-web-workbench is an optional component of IoTDB,
High
CVE-2021-34337
An issue was discovered in Mailman Core before 3.3.5. An attacker with access to the REST API could use timing attacks to determine the value of the configured REST API password and then make arbitrar
High
CVE-2023-28707
Apache Airflow Drill Provider vulnerable to improper input validation
Critical
CVE-2023-28706
Apache Airflow Hive Provider vulnerable to code injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.