High
CVE-2023-47117
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,336
Reset filters
Medium
CVE-2023-47037
We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then.
Medium
CVE-2023-46136
Werkzeug DoS: High resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning
Medium
CVE-2021-46898
views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but this does not consider a protocol-relative URL (e.g., //examp
High
CVE-2023-45815
Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins context
Medium
CVE-2023-45803
urllib3's request body not stripped after redirect from 303 status changes request method to GET
Medium
CVE-2023-28635
Defining resource name as integer may give unintended access in vantage6
Critical
ghsa-4mqg-h5jf-j9m7
TorchServe Pre-Auth Remote Code Execution
Critical
CVE-2023-26145
This affects versions of the package pydash before 6.0.0. A number of pydash methods such as pydash.objects.invoke() and pydash.collections.invoke_map() accept dotted paths (Deep Path Strings) to targ
Medium
CVE-2023-41048
plone.namedfile allows users to handle `File` and `Image` fields targeting, but not depending on, Plone Dexterity content. Prior to versions 5.6.1, 6.0.3, 6.1.3, and 6.2.1, there is a stored cross sit
High
CVE-2023-42457
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally
Critical
CVE-2019-19450
ReportLab vulnerable to remote code execution via paraparser
High
CVE-2023-42443
Vyper vulnerable to memory corruption in certain builtins utilizing `msize`
Medium
CVE-2023-41885
Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumeration
Medium
CVE-2023-40611
Apache Airflow, versions before 2.7.1, is affected by a vulnerability that allows authenticated and DAG-view authorized Users to modify some DAG run detail values when submitting notes. This could hav
Medium
CVE-2023-20897
Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return. After receiving several bad packets on the request server equal to the number of worker threads, the master will become unrespons
Medium
CVE-2023-40170
cross-site inclusion (XSSI) of files in jupyter-server
Medium
CVE-2023-39968
Open Redirect Vulnerability in jupyter-server
High
CVE-2023-38201
Keylime registrar and (untrusted) Agent can be bypassed by an attacker
High
CVE-2023-40273
The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the s
Critical
CVE-2023-38686
Sydent does not verify email server certificates
High
CVE-2023-34457
MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML form
High
CVE-2023-36814
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
Medium
CVE-2023-29159
Starlette has Path Traversal vulnerability in StaticFiles
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.