Cross-site Scripting (XSS) – DOM in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2023-0607
Cross-site Scripting (XSS) – Stored in GitHub repository projectsend/projectsend prior to r1606.
CVE-2023-0606
Cross-site Scripting (XSS) – Reflected in GitHub repository ampache/ampache prior to 5.5.7.
CVE-2023-0599
Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another Metasploit Pro user using a specially crafted request. Note that in most deployments, all Metasploit Pro users tend to enjoy privileges equivalent to local administrator.
CVE-2023-0593
A path traversal vulnerability affects yaffshiv YAFFS filesystem extractor. By crafting a malicious YAFFS file, an attacker could force yaffshiv to write outside of the extraction directory. This issue affects yaffshiv up to version 0.1 included, which is the most recent at time of publication.
CVE-2023-0592
A path traversal vulnerability affects jefferson’s JFFS2 filesystem extractor. By crafting malicious JFFS2 files, attackers could force jefferson to write outside of the extraction directory.This issue affects jefferson: before 0.4.1.