2023 CVEs (page 101)
Page 101 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48326 | High | 7.1 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager allows Reflected XSS.This issue a… |
CVE-2023-48322 | High | 7.1 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Application – Best Wo… |
CVE-2023-48289 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft E… |
CVE-2023-47854 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Howard Ehrenberg Parallax Image allows Stored XSS.This is… |
CVE-2023-47851 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate allows… |
CVE-2023-47850 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership… |
CVE-2023-47777 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks all… |
CVE-2023-47505 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor.Com Elementor allows Cross-Site Scripting (XSS)… |
CVE-2023-45050 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth… |
CVE-2023-41136 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laurence/OhMyBox.Info Simple Long Form allows Stored XSS… |
CVE-2023-48743 | Medium | 5.8 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Menard Simply Exclude allows Reflected XSS.This issu… |
CVE-2023-48737 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Trijaya Digital Grup TriPay Payment Gateway allows Sto… |
CVE-2023-48336 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cybernetikz Easy Social Icons allows Stored XSS.This issu… |
CVE-2023-49620 | Medium | 6.5 | 2023-11-30 | Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unaut… |
CVE-2023-49701 | High | 7.2 | 2023-11-30 | Memory Corruption in SIM management while USIMPhase2init |
CVE-2023-49700 | Medium | 6.7 | 2023-11-30 | Security best practices violations, a string operation in Streamingmedia will write past the end of fixed-size destination buffer if the source buffer is too l… |
CVE-2023-49699 | Medium | 6.7 | 2023-11-30 | Memory Corruption in IMS while calling VoLTE Streamingmedia Interface |
CVE-2023-49095 | High | 8.6 | 2023-11-30 | nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certa… |
CVE-2023-49081 | High | 7.2 | 2023-11-30 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request… |
CVE-2023-49077 | High | 8.3 | 2023-11-30 | Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quaranti… |
CVE-2023-49052 | High | 8.8 | 2023-11-30 | File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the crea… |
CVE-2023-49087 | Medium | 6.8 | 2023-11-30 | xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the relate… |
CVE-2023-49076 | Medium | 4.3 | 2023-11-30 | Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an… |
CVE-2023-47418 | Critical | 9.8 | 2023-11-30 | Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service management function to ex… |
CVE-2023-5275 | Low | 2.5 | 2023-11-30 | Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by… |
CVE-2023-5274 | Low | 2.5 | 2023-11-30 | Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by… |
CVE-2023-49097 | High | 8.1 | 2023-11-30 | ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link s… |
CVE-2023-49094 | Medium | 4.3 | 2023-11-30 | Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET… |
CVE-2023-47464 | High | 8.8 | 2023-11-30 | Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function. |
CVE-2023-47463 | Critical | 9.8 | 2023-11-30 | Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the… |
CVE-2023-5772 | Medium | 4.3 | 2023-11-30 | The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or i… |
CVE-2023-5247 | High | 7.8 | 2023-11-30 | Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a m… |
CVE-2023-4474 | Critical | 9.8 | 2023-11-30 | The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG… |
CVE-2023-4473 | Critical | 9.8 | 2023-11-30 | A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could al… |
CVE-2023-37928 | High | 8.8 | 2023-11-30 | A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.2… |
CVE-2023-37927 | High | 8.8 | 2023-11-30 | The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG… |
CVE-2023-35138 | Critical | 9.8 | 2023-11-30 | A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware versi… |
CVE-2023-35137 | High | 7.5 | 2023-11-30 | An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(A… |
CVE-2023-3741 | Critical | 9.8 | 2023-11-30 | An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the device. |
CVE-2023-49694 | High | 7.8 | 2023-11-29 | A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomc… |
CVE-2023-49693 | Critical | 9.8 | 2023-11-29 | NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users… |
CVE-2023-40458 | High | 7.5 | 2023-11-29 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a Deni… |
CVE-2023-49091 | High | 8.8 | 2023-11-29 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vuln… |
CVE-2023-49082 | Medium | 5.3 | 2023-11-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP reques… |
CVE-2023-48952 | High | 7.5 | 2023-11-29 | An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SE… |
CVE-2023-48951 | High | 7.5 | 2023-11-29 | An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. |
CVE-2023-48950 | High | 7.5 | 2023-11-29 | An issue in the box_col_len function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT stateme… |
CVE-2023-48949 | High | 7.5 | 2023-11-29 | An issue in the box_add function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. |
CVE-2023-48948 | High | 7.5 | 2023-11-29 | An issue in the box_div function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. |
CVE-2023-48947 | High | 7.5 | 2023-11-29 | An issue in the cha_cmp function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. |
CVE-2023-48946 | High | 7.5 | 2023-11-29 | An issue in the box_mpy function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. |
CVE-2023-48945 | High | 7.5 | 2023-11-29 | A stack overflow in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2023-44383 | Medium | 5.4 | 2023-11-29 | October is a Content Management System (CMS) and web platform to assist with development workflow. A user with access to the media manager that stores SVG file… |
CVE-2023-49083 | Medium | 5.9 | 2023-11-29 | cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling `load_pem_pkcs7_certificates` or `load_der_pkcs… |
CVE-2023-49079 | Critical | 9.3 | 2023-11-29 | Misskey is an open source, decentralized social media platform. Misskey's missing signature validation allows arbitrary users to impersonate any remote user. T… |
CVE-2023-6218 | High | 7.2 | 2023-11-29 | In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a privilege escalation path associated with gr… |
CVE-2023-6217 | High | 7.1 | 2023-11-29 | In Progress MOVEit Transfer versions released before 2022.0.9 (14.0.9), 2022.1.10 (14.1.10), 2023.0.7 (15.0.7), a reflected cross-site scripting (XSS) vulnera… |
CVE-2023-48882 | Medium | 4.8 | 2023-11-29 | A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2023-48881 | Medium | 4.8 | 2023-11-29 | A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2023-48880 | Medium | 4.8 | 2023-11-29 | A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2023-49090 | Medium | 6.8 | 2023-11-29 | CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, pos… |
CVE-2023-49674 | Medium | 4.3 | 2023-11-29 | A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission to connect to an at… |
CVE-2023-49673 | High | 8.8 | 2023-11-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to connect to an attacker… |
CVE-2023-49656 | Critical | 9.8 | 2023-11-29 | Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2023-49655 | High | 8.8 | 2023-11-29 | A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML file from the Jenki… |
CVE-2023-49654 | Critical | 9.8 | 2023-11-29 | Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system. |
CVE-2023-49653 | Medium | 6.5 | 2023-11-29 | Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to access a… |
CVE-2023-49652 | Low | 2.7 | 2023-11-29 | Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/Configure permission (w… |
CVE-2023-40626 | High | 7.5 | 2023-11-29 | The language file parsing process could be manipulated to expose environment variables. Environment variables might contain sensible information. |
CVE-2023-6378 | High | 7.1 | 2023-11-29 | A serialization vulnerability in logback receiver component part of logback version 1.4.11 allows an attacker to mount a Denial-Of-Service attack by sending… |
CVE-2023-6351 | High | 8.8 | 2023-11-29 | Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (C… |
CVE-2023-6350 | High | 8.8 | 2023-11-29 | Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted avif file. (C… |
CVE-2023-6348 | High | 8.8 | 2023-11-29 | Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2023-6347 | High | 8.8 | 2023-11-29 | Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2023-6346 | High | 8.8 | 2023-11-29 | Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-6345 | Critical | 9.6 | 2023-11-29 | Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2023-6070 | Medium | 4.3 | 2023-11-29 | A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary content, potentially… |
CVE-2023-45484 | Critical | 9.8 | 2023-11-29 | Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the shareSpeed parameter in the function fromSetWifiGuestBasic. |
CVE-2023-45483 | Critical | 9.8 | 2023-11-29 | Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the time parameter in the function compare_parentcontrol_time. |
CVE-2023-45482 | Critical | 9.8 | 2023-11-29 | Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info. |
CVE-2023-45481 | Critical | 9.8 | 2023-11-29 | Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the firewallEn parameter in the function SetFirewallCfg. |
CVE-2023-45480 | Critical | 9.8 | 2023-11-29 | Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the src parameter in the function sub_47D878. |
CVE-2023-45479 | Critical | 9.8 | 2023-11-29 | Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the list parameter in the function sub_49E098. |
CVE-2023-47462 | Critical | 9.8 | 2023-11-29 | Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary code via the file sharing function. |
CVE-2023-46887 | High | 7.5 | 2023-11-29 | In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability. |
CVE-2023-46886 | Critical | 9.1 | 2023-11-29 | Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal. Background template management allows arbitrary modification of the template file, allow… |
CVE-2023-24294 | High | 7.5 | 2023-11-29 | Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::SetDeviceIdentificat… |
CVE-2023-23325 | Critical | 9.8 | 2023-11-29 | Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter. |
CVE-2023-23324 | Critical | 9.8 | 2023-11-29 | Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account. |
CVE-2023-46944 | High | 7.8 | 2023-11-28 | An issue in GitKraken GitLens before v.14.0.0 allows an attacker to execute arbitrary code via a crafted file to the Visual Studio Codes workspace trust compon… |
CVE-2023-49092 | Medium | 5.9 | 2023-11-28 | RustCrypto/RSA is a portable RSA implementation in pure Rust. Due to a non-constant-time implementation, information about the private key is leaked through ti… |
CVE-2023-48193 | Critical | 9.8 | 2023-11-28 | Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function… |
CVE-2023-29066 | Low | 3.2 | 2023-11-28 | The FACSChorus software does not properly assign data access privileges for operating system user accounts. A non-administrative OS account can modify informat… |
CVE-2023-29065 | Medium | 4.1 | 2023-11-28 | The FACSChorus software database can be accessed directly with the privileges of the currently logged-in user. A threat actor with physical access could potent… |
CVE-2023-29064 | Medium | 4.1 | 2023-11-28 | The FACSChorus software contains sensitive information stored in plaintext. A threat actor could gain hardcoded secrets used by the application, which include… |
CVE-2023-29063 | Low | 2.4 | 2023-11-28 | The FACSChorus workstation does not prevent physical access to its PCI express (PCIe) slots, which could allow a threat actor to insert a PCI card designed for… |
CVE-2023-29062 | Low | 3.8 | 2023-11-28 | The Operating System hosting the FACSChorus application is configured to allow transmission of hashed user credentials upon user action without adequately vali… |
CVE-2023-29061 | Medium | 5.2 | 2023-11-28 | There is no BIOS password on the FACSChorus workstation. A threat actor with physical access to the workstation can potentially exploit this vulnerability to a… |
CVE-2023-45539 | High | 8.2 | 2023-11-28 | HAProxy before 2.8.2 accepts # as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impac… |
CVE-2023-30590 | High | 7.5 | 2023-11-28 | The generateKeys() API function returned from crypto.createDiffieHellman() only generates missing (or outdated) keys, that is, it only generates a private key… |