2023 CVEs (page 101)
Page 101 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6424 | Medium | 6.3 | 2023-11-30 | A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in pers… |
CVE-2023-6423 | Medium | 6.3 | 2023-11-30 | A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in pers… |
CVE-2023-6422 | Medium | 6.3 | 2023-11-30 | A vulnerability has been discovered in BigProf Online Clinic Management System 2.2, which does not sufficiently encode user-controlled input, resulting in pers… |
CVE-2023-6420 | Medium | 6.5 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via signup2.php in the emailadd parameter, the exploitation… |
CVE-2023-6419 | Medium | 6.5 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script version 1.0 that allows a XSS via editprofile.php in multiple parameters, the exploitation… |
CVE-2023-6418 | Critical | 9.8 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via videos.php in the id parameter… |
CVE-2023-6417 | Critical | 9.8 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via update.php in the id parameter… |
CVE-2023-6416 | Critical | 9.8 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signup2.php in the emailadd pa… |
CVE-2023-6415 | Critical | 9.8 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via signin.php in the user paramet… |
CVE-2023-6414 | Critical | 9.8 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via perfil.php in the id and user… |
CVE-2023-6413 | Critical | 9.8 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photos.php in the id and user… |
CVE-2023-6412 | Critical | 9.8 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via photo.php in multiple paramete… |
CVE-2023-6411 | Critical | 9.8 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via home.php in the update paramet… |
CVE-2023-6410 | Critical | 9.8 | 2023-11-30 | A vulnerability has been reported in Voovi Social Networking Script that affects version 1.0 and consists of a SQL injection via editprofile.php in multiple pa… |
CVE-2023-6136 | Medium | 5.3 | 2023-11-30 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.0. |
CVE-2023-6027 | Medium | 6.1 | 2023-11-30 | A critical flaw has been identified in elijaa/phpmemcachedadmin affecting version 1.3.0, specifically related to a stored XSS vulnerability. This vulnerability… |
CVE-2023-6026 | Critical | 9.8 | 2023-11-30 | A Path traversal vulnerability has been reported in elijaa/phpmemcachedadmin affecting version 1.3.0. This vulnerability allows an attacker to delete files sto… |
CVE-2023-5966 | Medium | 4.7 | 2023-11-30 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the extension deployment form, which coul… |
CVE-2023-5965 | Medium | 4.7 | 2023-11-30 | An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbi… |
CVE-2023-4770 | Medium | 6.5 | 2023-11-30 | An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218. This vul… |
CVE-2023-48964 | High | 7.5 | 2023-11-30 | Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/WifiMacFilterSet. |
CVE-2023-48963 | High | 7.5 | 2023-11-30 | Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/wifiSSIDget. |
CVE-2023-48914 | High | 8.8 | 2023-11-30 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add. |
CVE-2023-48913 | High | 8.8 | 2023-11-30 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete. |
CVE-2023-48912 | High | 8.8 | 2023-11-30 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit. |
CVE-2023-48742 | High | 7.6 | 2023-11-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LicenseManager License Manager for WooCommerce license-ma… |
CVE-2023-48281 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Super Blog Me Broken Link Checker for YouTube allows Cross Site Request Forgery.This issue affects Broken Li… |
CVE-2023-48279 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Seraphinite Solutions Seraphinite Post .DOCX Source allows Cross Site Request Forgery.This issue affects Ser… |
CVE-2023-47827 | Medium | 6.5 | 2023-11-30 | Incorrect Authorization vulnerability in NicheAddons Events Addon for Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affe… |
CVE-2023-47645 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login… |
CVE-2023-37867 | Low | 3.7 | 2023-11-30 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in YetAnotherStarsRating.Com YASR – Yet Another Star Rating Plugin for WordPress.This issue aff… |
CVE-2023-36685 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC CartFlows Pro allows Cross Site Request Forgery.This issue affects CartFlows Pro: fr… |
CVE-2023-36682 | High | 7.1 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force US LLC Schema Pro allows Cross Site Request Forgery.This issue affects Schema Pro: from n/a… |
CVE-2023-34030 | Medium | 6.5 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Request Forgery.T… |
CVE-2023-33333 | High | 7.1 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Complianz, Really Simple Plugins Complianz Premium allows Cross-Site Scripting (XSS).T… |
CVE-2023-6137 | Medium | 5.4 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in finnj Frontier Post allows Cross Site Request Forgery.This issue affects Frontier Post: from n/a through 6.1. |
CVE-2023-6071 | High | 8.4 | 2023-11-30 | An Improper Neutralization of Special Elements used in a command vulnerability in ESM prior to version 11.6.9 allows a remote administrator to execute arbitra… |
CVE-2023-48744 | Medium | 5.4 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Offshore Web Master Availability Calendar allows Cross Site Request Forgery.This issue affects Availability… |
CVE-2023-48334 | Medium | 5.4 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in DAEXT League Table allows Cross Site Request Forgery.This issue affects League Table: from n/a through 1.13. |
CVE-2023-48331 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Stormhill Media MyBookTable Bookstore by Stormhill Media allows Cross Site Request Forgery.This issue affect… |
CVE-2023-48330 | Medium | 5.4 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Mike Strand Bulk Comment Remove allows Cross Site Request Forgery.This issue affects Bulk Comment Remove: fr… |
CVE-2023-48323 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Awesome Support Team Awesome Support – WordPress HelpDesk & Support Plugin allows Cross Site Request Forgery… |
CVE-2023-48284 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in WebToffee Decorator – WooCommerce Email Customizer allows Cross Site Request Forgery.This issue affects Deco… |
CVE-2023-48283 | Medium | 4.3 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Testimonials Showcase allows Cross Site Request Forgery.This issue affects Simple Testimo… |
CVE-2023-48282 | Medium | 5.4 | 2023-11-30 | Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio Taxonomy filter allows Cross Site Request Forgery.This issue affects Taxonomy filter: from n… |
CVE-2023-41128 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iqonic Design WP Roadmap – Product Feedback Board allows… |
CVE-2023-41127 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Evergreen Content Poster Evergreen Content Poster – Auto… |
CVE-2023-40680 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Team Yoast Yoast SEO allows Stored XSS.This issue affects… |
CVE-2023-40674 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lasso Simple URLs – Link Cloaking, Product Displays, and… |
CVE-2023-38474 | High | 7.1 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Re… |
CVE-2023-32291 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MonsterInsights Pro allows Stored XSS.This issue affects… |
CVE-2023-49733 | Critical | 9.8 | 2023-11-30 | Improper Restriction of XML External Entity Reference vulnerability in Apache Cocoon.This issue affects Apache Cocoon: from 2.2.0 before 2.3.0. Users are reco… |
CVE-2023-48329 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard Fast Custom Social Share by CodeBard allows Stor… |
CVE-2023-48326 | High | 7.1 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager allows Reflected XSS.This issue a… |
CVE-2023-48322 | High | 7.1 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eDoc Intelligence eDoc Employee Job Application – Best Wo… |
CVE-2023-48289 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft E… |
CVE-2023-47854 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Howard Ehrenberg Parallax Image allows Stored XSS.This is… |
CVE-2023-47851 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Akhtarujjaman Shuvo Bootstrap Shortcodes Ultimate allows… |
CVE-2023-47850 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PeepSo Community by PeepSo – Social Network, Membership… |
CVE-2023-47777 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce, Automattic WooCommerce Blocks all… |
CVE-2023-47505 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor.Com Elementor allows Cross-Site Scripting (XSS)… |
CVE-2023-45050 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Jetpack – WP Security, Backup, Speed, & Growth… |
CVE-2023-41136 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Laurence/OhMyBox.Info Simple Long Form allows Stored XSS… |
CVE-2023-48743 | Medium | 5.8 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Menard Simply Exclude allows Reflected XSS.This issu… |
CVE-2023-48737 | Medium | 5.9 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Trijaya Digital Grup TriPay Payment Gateway allows Sto… |
CVE-2023-48336 | Medium | 6.5 | 2023-11-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cybernetikz Easy Social Icons allows Stored XSS.This issu… |
CVE-2023-49620 | Medium | 6.5 | 2023-11-30 | Before DolphinScheduler version 3.1.0, the login user could delete UDF function in the resource center unauthorized (which almost used in sql task), with unaut… |
CVE-2023-49701 | High | 7.2 | 2023-11-30 | Memory Corruption in SIM management while USIMPhase2init |
CVE-2023-49700 | Medium | 6.7 | 2023-11-30 | Security best practices violations, a string operation in Streamingmedia will write past the end of fixed-size destination buffer if the source buffer is too l… |
CVE-2023-49699 | Medium | 6.7 | 2023-11-30 | Memory Corruption in IMS while calling VoLTE Streamingmedia Interface |
CVE-2023-49095 | High | 8.6 | 2023-11-30 | nexkey is a microblogging platform. Insufficient validation of ActivityPub requests received in inbox could allow any user to impersonate another user in certa… |
CVE-2023-49081 | High | 7.2 | 2023-11-30 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation made it possible for an attacker to modify the HTTP request… |
CVE-2023-49077 | High | 8.3 | 2023-11-30 | Mailcow: dockerized is an open source groupware/email suite based on docker. A Cross-Site Scripting (XSS) vulnerability has been identified within the Quaranti… |
CVE-2023-49052 | High | 8.8 | 2023-11-30 | File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload function in the crea… |
CVE-2023-49087 | Medium | 6.8 | 2023-11-30 | xml-security is a library that implements XML signatures and encryption. Validation of an XML signature requires verification that the hash value of the relate… |
CVE-2023-49076 | Medium | 4.3 | 2023-11-30 | Customer-data-framework allows management of customer data within Pimcore. There are no tokens or headers to prevent CSRF attacks from occurring, therefore an… |
CVE-2023-47418 | Critical | 9.8 | 2023-11-30 | Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface in the service management function to ex… |
CVE-2023-5275 | Low | 2.5 | 2023-11-30 | Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by… |
CVE-2023-5274 | Low | 2.5 | 2023-11-30 | Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition on the function by… |
CVE-2023-49097 | High | 8.1 | 2023-11-30 | ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link s… |
CVE-2023-49094 | Medium | 4.3 | 2023-11-30 | Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET… |
CVE-2023-47464 | High | 8.8 | 2023-11-30 | Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via the upload API function. |
CVE-2023-47463 | Critical | 9.8 | 2023-11-30 | Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arbitrary code via a crafted script to the… |
CVE-2023-5772 | Medium | 4.3 | 2023-11-30 | The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or i… |
CVE-2023-5247 | High | 7.8 | 2023-11-30 | Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA Engineering Software Products allows a m… |
CVE-2023-4474 | Critical | 9.8 | 2023-11-30 | The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG… |
CVE-2023-4473 | Critical | 9.8 | 2023-11-30 | A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could al… |
CVE-2023-37928 | High | 8.8 | 2023-11-30 | A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.2… |
CVE-2023-37927 | High | 8.8 | 2023-11-30 | The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG… |
CVE-2023-35138 | Critical | 9.8 | 2023-11-30 | A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware versi… |
CVE-2023-35137 | High | 7.5 | 2023-11-30 | An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(A… |
CVE-2023-3741 | Critical | 9.8 | 2023-11-30 | An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execute any command on the device. |
CVE-2023-49694 | High | 7.8 | 2023-11-29 | A low-privileged OS user with access to a Windows host where NETGEAR ProSAFE Network Management System is installed can create arbitrary JSP files in a Tomc… |
CVE-2023-49693 | Critical | 9.8 | 2023-11-29 | NETGEAR ProSAFE Network Management System has Java Debug Wire Protocol (JDWP) listening on port 11611 and it is remotely accessible by unauthenticated users… |
CVE-2023-40458 | High | 7.5 | 2023-11-29 | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Sierra Wireless, Inc ALEOS could potentially allow a remote attacker to trigger a Deni… |
CVE-2023-49091 | High | 8.8 | 2023-11-29 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Cosmos-server is vuln… |
CVE-2023-49082 | Medium | 5.3 | 2023-11-29 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Improper validation makes it possible for an attacker to modify the HTTP reques… |
CVE-2023-48952 | High | 7.5 | 2023-11-29 | An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SE… |
CVE-2023-48951 | High | 7.5 | 2023-11-29 | An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement. |
CVE-2023-48950 | High | 7.5 | 2023-11-29 | An issue in the box_col_len function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT stateme… |