2023 CVEs (page 103)
Page 103 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-49047 | High | 7.5 | 2023-11-27 | Tenda AX1803 v1.0.0.1 contains a stack overflow via the devName parameter in the function formSetDeviceName. |
CVE-2023-49042 | Critical | 9.8 | 2023-11-27 | Heap Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the schedStartTime parameter or the schedEndTime p… |
CVE-2023-49040 | Critical | 9.8 | 2023-11-27 | An issue in Tneda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the adslPwd parameter in the form_fast_setting_internet_set function. |
CVE-2023-49028 | Medium | 5.4 | 2023-11-27 | Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitrary code via the user parameter in the l… |
CVE-2023-42000 | Critical | 9.8 | 2023-11-27 | Arcserve UDP prior to 9.2 contains a path traversal vulnerability in com.ca.arcflash.ui.server.servlet.FileHandlingServlet.doUpload(). An unauthenticated remot… |
CVE-2023-41999 | Critical | 9.8 | 2023-11-27 | An authentication bypass exists in Arcserve UDP prior to version 9.2. An unauthenticated, remote attacker can obtain a valid authentication identifier that all… |
CVE-2023-41998 | Critical | 9.8 | 2023-11-27 | Arcserve UDP prior to 9.2 contained a vulnerability in the com.ca.arcflash.rps.webservice.RPSService4CPMImpl interface. A routine exists that allows an attacke… |
CVE-2023-2707 | Medium | 4.8 | 2023-11-27 | The gAppointments WordPress plugin through 1.9.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2023-49046 | Critical | 9.8 | 2023-11-27 | Stack Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the devName parameter in the function formAddMacf… |
CVE-2023-49043 | Critical | 9.8 | 2023-11-27 | Buffer Overflow vulnerability in Tenda AX1803 v.1.0.0.1 allows a remote attacker to execute arbitrary code via the wpapsk_crypto parameter in the function from… |
CVE-2023-49029 | Medium | 6.1 | 2023-11-27 | Cross Site Scripting vulnerability in smpn1smg absis v.2017-10-19 and before allows a remote attacker to execute arbitrary code via the nama parameter in the l… |
CVE-2023-41257 | High | 8.8 | 2023-11-27 | A type confusion vulnerability exists in the way Foxit Reader 12.1.2.15356 handles field value properties. A specially crafted Javascript code inside a malici… |
CVE-2023-40194 | High | 8.8 | 2023-11-27 | An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to mistreatment of whitespace character… |
CVE-2023-39542 | High | 8.8 | 2023-11-27 | A code execution vulnerability exists in the Javascript saveAs API of Foxit Reader 12.1.3.15356. A specially crafted malformed file can create arbitrary files… |
CVE-2023-38573 | High | 8.8 | 2023-11-27 | A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles a signature field. A specially crafted Javascript code inside a malicious PD… |
CVE-2023-35985 | High | 8.8 | 2023-11-27 | An arbitrary file creation vulnerability exists in the Javascript exportDataObject API of Foxit Reader 12.1.3.15356 due to a failure to properly validate a dan… |
CVE-2023-32616 | High | 8.8 | 2023-11-27 | A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15356 handles 3D annotations. A specially crafted Javascript code inside a malicious PDF d… |
CVE-2023-31275 | High | 8.8 | 2023-11-27 | An uninitialized pointer use vulnerability exists in the functionality of WPS Office 11.2.0.11537 that handles Data elements in an Excel file. A specially craf… |
CVE-2023-6287 | Low | 3.3 | 2023-11-27 | Sensitive data exposure in Webconf in Tribe29 Checkmk Appliance before 1.6.8 allows local attacker to retrieve passwords via reading log files. |
CVE-2023-4931 | Medium | 6.3 | 2023-11-27 | Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL file… |
CVE-2023-4590 | High | 7.3 | 2023-11-27 | Buffer overflow vulnerability in Frhed hex editor, affecting version 1.6.0. This vulnerability could allow an attacker to execute arbitrary code via a long fil… |
CVE-2023-5871 | Medium | 5.3 | 2023-11-27 | A flaw was found in libnbd, due to a malicious Network Block Device (NBD), a protocol for accessing Block Devices such as hard disks over a Network. This issue… |
CVE-2023-5607 | High | 8.4 | 2023-11-27 | An improper limitation of a path name to a restricted directory (path traversal) vulnerability in the TACC ePO extension, for on-premises ePO servers, prior t… |
CVE-2023-43701 | Medium | 4.3 | 2023-11-27 | Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's… |
CVE-2023-42501 | Medium | 4.3 | 2023-11-27 | Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache… |
CVE-2023-40610 | Medium | 6.3 | 2023-11-27 | Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection tha… |
CVE-2023-6254 | High | 8.1 | 2023-11-27 | A Vulnerability in OTRS AgentInterface and ExternalInterface allows the reading of plain text passwords which are send back to the client in the server respons… |
CVE-2023-6202 | Medium | 4.3 | 2023-11-27 | Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user and knows the ID of… |
CVE-2023-49068 | High | 7.5 | 2023-11-27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1. … |
CVE-2023-48369 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the log size of server logs allowing an attacker sending specially crafted requests to different endpoints to potentially overflow th… |
CVE-2023-48268 | Medium | 4.3 | 2023-11-27 | Mattermost fails to limit the amount of data extracted from compressed archives during board import in Mattermost Boards allowing an attacker to consume excess… |
CVE-2023-47168 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly check a redirect URL parameter allowing for an open redirect was possible when the user clicked "Back to Mattermost" after providi… |
CVE-2023-45223 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly validate the "Show Full Name" option in a few endpoints in Mattermost Boards, allowing a member to get the full name of another us… |
CVE-2023-43754 | Medium | 4.3 | 2023-11-27 | Mattermost fails to check whether the “Allow users to view archived channels” setting is enabled during permalink previews display, allowing members to view… |
CVE-2023-40703 | Medium | 4.3 | 2023-11-27 | Mattermost fails to properly limit the characters allowed in different fields of a block in Mattermost Boards allowing a attacker to consume excessive resource… |
CVE-2023-35075 | Low | 3.1 | 2023-11-27 | Mattermost fails to use innerText / textContent when setting the channel name in the webapp during autocomplete, allowing an attacker to inject HTML to a vict… |
CVE-2023-47865 | Medium | 4.3 | 2023-11-27 | Mattermost fails to check if hardened mode is enabled when overriding the username and/or the icon when posting a post. If settings allowed integrations to ove… |
CVE-2023-25632 | Medium | 5.5 | 2023-11-27 | The Android Mobile Whale browser app before 3.0.1.2 allows the attacker to bypass its browser unlock function via 'Open in Whale' feature. |
CVE-2023-6313 | Low | 3.5 | 2023-11-27 | A vulnerability was found in SourceCodester URL Shortener 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality… |
CVE-2023-6312 | Medium | 4.7 | 2023-11-27 | A vulnerability was found in SourceCodester Loan Management System 1.0. It has been classified as critical. Affected is the function delete_user of the file de… |
CVE-2023-6311 | Medium | 4.7 | 2023-11-27 | A vulnerability was found in SourceCodester Loan Management System 1.0 and classified as critical. This issue affects the function delete_ltype of the file del… |
CVE-2023-6310 | Medium | 4.7 | 2023-11-27 | A vulnerability has been found in SourceCodester Loan Management System 1.0 and classified as critical. This vulnerability affects the function delete_borrower… |
CVE-2023-6309 | Medium | 5.5 | 2023-11-27 | A vulnerability, which was classified as critical, was found in moses-smt mosesdecoder up to 4.0. This affects an unknown part of the file contrib/iSenWeb/tran… |
CVE-2023-6308 | Medium | 6.3 | 2023-11-27 | A vulnerability, which was classified as critical, has been found in Xiamen Four-Faith Video Surveillance Management System 2016/2017. Affected by this issue i… |
CVE-2023-6307 | Medium | 6.3 | 2023-11-27 | A vulnerability classified as critical was found in jeecgboot JimuReport up to 1.6.1. Affected by this vulnerability is an unknown functionality of the file /d… |
CVE-2023-6306 | Medium | 6.3 | 2023-11-27 | A vulnerability classified as critical has been found in SourceCodester Free and Open Source Inventory Management System 1.0. Affected is an unknown function o… |
CVE-2023-6305 | Medium | 6.3 | 2023-11-27 | A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been rated as critical. This issue affects some unknow… |
CVE-2023-6304 | High | 7.2 | 2023-11-27 | A vulnerability was found in Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830. It has been declared as critical. This vulnerability a… |
CVE-2023-6303 | Low | 2.4 | 2023-11-27 | A vulnerability was found in CSZCMS 1.3.0. It has been classified as problematic. This affects an unknown part of the file /admin/settings/ of the component Si… |
CVE-2023-6302 | Medium | 4.7 | 2023-11-27 | A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the… |
CVE-2023-6301 | Low | 3.5 | 2023-11-27 | A vulnerability has been found in SourceCodester Best Courier Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown… |
CVE-2023-6300 | Low | 3.5 | 2023-11-27 | A vulnerability, which was classified as problematic, was found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function. The mani… |
CVE-2023-49322 | High | 7.5 | 2023-11-27 | Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash. This affects WithSecur… |
CVE-2023-49321 | Medium | 5.3 | 2023-11-27 | Certain WithSecure products allow a Denial of Service because scanning a crafted file takes a long time, and causes the scanner to hang. This affects WithSecur… |
CVE-2023-6299 | Medium | 4.3 | 2023-11-26 | A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1. This issue affects some unknown processing of the file PdfDocument… |
CVE-2023-6298 | Medium | 4.3 | 2023-11-26 | A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manip… |
CVE-2023-6297 | Medium | 4.3 | 2023-11-26 | A vulnerability classified as problematic has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file pati… |
CVE-2023-6296 | Medium | 4.3 | 2023-11-26 | A vulnerability was found in osCommerce 4. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /catalog/compare… |
CVE-2023-49312 | Critical | 9.1 | 2023-11-26 | Precision Bridge PrecisionBridge.exe (aka the thick client) before 7.3.21 allows an integrity violation in which the same license key is used on multiple syste… |
CVE-2023-6293 | High | 7.1 | 2023-11-24 | Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6. |
CVE-2023-6277 | Medium | 6.5 | 2023-11-24 | An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft… |
CVE-2023-49298 | High | 7.5 | 2023-11-24 | OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace fil… |
CVE-2023-48708 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw… |
CVE-2023-48707 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication… |
CVE-2023-48312 | Critical | 9.8 | 2023-11-24 | capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a mi… |
CVE-2023-48712 | High | 7.1 | 2023-11-24 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin… |
CVE-2023-48711 | Low | 3.7 | 2023-11-24 | google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) Vulnerability is presen… |
CVE-2023-6276 | Medium | 6.3 | 2023-11-24 | A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/ct/delete.php. The… |
CVE-2023-6275 | Low | 3.5 | 2023-11-24 | A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionali… |
CVE-2023-6274 | Medium | 6.3 | 2023-11-24 | A vulnerability was found in Byzoro Smart S80 up to 20231108. It has been declared as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2023-46575 | Critical | 9.8 | 2023-11-24 | A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary c… |
CVE-2023-6251 | Low | 3.5 | 2023-11-24 | Cross-site Request Forgery (CSRF) in Checkmk < 2.2.0p15, < 2.1.0p37, <= 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users. |
CVE-2023-48796 | High | 7.5 | 2023-11-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may includ… |
CVE-2023-44303 | High | 7.5 | 2023-11-24 | RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryption.exe) and main… |
CVE-2023-33706 | Medium | 6.5 | 2023-11-24 | SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modifi… |
CVE-2023-26279 | Low | 3.3 | 2023-11-24 | IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a local user to perform unauthorized actions due to improper encoding. IBM X-Force ID: 248160. |
CVE-2023-49216 | Medium | 5.4 | 2023-11-23 | Usedesk before 1.7.57 allows profile stored XSS. |
CVE-2023-49215 | Medium | 6.1 | 2023-11-23 | Usedesk before 1.7.57 allows filter reflected XSS. |
CVE-2023-49214 | Critical | 9.8 | 2023-11-23 | Usedesk before 1.7.57 allows chat template injection. |
CVE-2023-49213 | High | 8.8 | 2023-11-23 | The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param… |
CVE-2023-47529 | Medium | 5.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates… |
CVE-2023-47244 | Medium | 5.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marke… |
CVE-2023-49210 | Critical | 9.8 | 2023-11-23 | The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argu… |
CVE-2023-5972 | High | 7.0 | 2023-11-23 | A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local user to crash the s… |
CVE-2023-49208 | Critical | 9.8 | 2023-11-23 | scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration. |
CVE-2023-33202 | Medium | 5.5 | 2023-11-23 | Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This c… |
CVE-2023-6118 | High | 7.5 | 2023-11-23 | Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP Camera: before b1130.1.0.1. |
CVE-2023-4677 | High | 7.0 | 2023-11-23 | Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory… |
CVE-2023-41812 | Medium | 5.7 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-41811 | Medium | 5.3 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41810 | Medium | 4.0 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41808 | High | 8.5 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and r… |
CVE-2023-41807 | Critical | 9.1 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the… |
CVE-2023-41806 | High | 8.2 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could… |
CVE-2023-41792 | Medium | 5.9 | 2023-11-23 | Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be execu… |
CVE-2023-41791 | High | 8.4 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41790 | High | 7.6 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |
CVE-2023-41789 | High | 7.6 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41788 | High | 7.6 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-41787 | Medium | 6.0 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |