2023 CVEs (page 104)
Page 104 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6304 | High | 7.2 | 2023-11-27 | A vulnerability was found in Tecno 4G Portable WiFi TR118 TR118-M30E-RR-D-EnFrArSwHaPo-OP-V008-20220830. It has been declared as critical. This vulnerability a… |
CVE-2023-6303 | Low | 2.4 | 2023-11-27 | A vulnerability was found in CSZCMS 1.3.0. It has been classified as problematic. This affects an unknown part of the file /admin/settings/ of the component Si… |
CVE-2023-6302 | Medium | 4.7 | 2023-11-27 | A vulnerability was found in CSZCMS 1.3.0 and classified as critical. Affected by this issue is some unknown functionality of the file \views\templates of the… |
CVE-2023-6301 | Low | 3.5 | 2023-11-27 | A vulnerability has been found in SourceCodester Best Courier Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown… |
CVE-2023-6300 | Low | 3.5 | 2023-11-27 | A vulnerability, which was classified as problematic, was found in SourceCodester Best Courier Management System 1.0. Affected is an unknown function. The mani… |
CVE-2023-49322 | High | 7.5 | 2023-11-27 | Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash. This affects WithSecur… |
CVE-2023-49321 | Medium | 5.3 | 2023-11-27 | Certain WithSecure products allow a Denial of Service because scanning a crafted file takes a long time, and causes the scanner to hang. This affects WithSecur… |
CVE-2023-6299 | Medium | 4.3 | 2023-11-26 | A vulnerability, which was classified as problematic, has been found in Apryse iText 8.0.1. This issue affects some unknown processing of the file PdfDocument… |
CVE-2023-6298 | Medium | 4.3 | 2023-11-26 | A vulnerability classified as problematic was found in Apryse iText 8.0.2. This vulnerability affects the function main of the file PdfDocument.java. The manip… |
CVE-2023-6297 | Medium | 4.3 | 2023-11-26 | A vulnerability classified as problematic has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file pati… |
CVE-2023-6296 | Medium | 4.3 | 2023-11-26 | A vulnerability was found in osCommerce 4. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /catalog/compare… |
CVE-2023-49312 | Critical | 9.1 | 2023-11-26 | Precision Bridge PrecisionBridge.exe (aka the thick client) before 7.3.21 allows an integrity violation in which the same license key is used on multiple syste… |
CVE-2023-6293 | High | 7.1 | 2023-11-24 | Prototype Pollution in GitHub repository robinbuschmann/sequelize-typescript prior to 2.1.6. |
CVE-2023-6277 | Medium | 6.5 | 2023-11-24 | An out-of-memory flaw was found in libtiff. Passing a crafted tiff file to TIFFOpen() API may allow a remote attacker to cause a denial of service via a craft… |
CVE-2023-49298 | High | 7.5 | 2023-11-24 | OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace fil… |
CVE-2023-48708 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw… |
CVE-2023-48707 | Medium | 5.0 | 2023-11-24 | CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. The `secretKey` value is an important key for HMAC SHA256 authentication… |
CVE-2023-48312 | Critical | 9.8 | 2023-11-24 | capsule-proxy is a reverse proxy for the capsule operator project. Affected versions are subject to a privilege escalation vulnerability which is based on a mi… |
CVE-2023-48712 | High | 7.1 | 2023-11-24 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. In affected versions there is a privilege escalation vulnerability through a non-admin… |
CVE-2023-48711 | Low | 3.7 | 2023-11-24 | google-translate-api-browser is an npm package which interfaces with the google translate web api. A Server-Side Request Forgery (SSRF) Vulnerability is presen… |
CVE-2023-6276 | Medium | 6.3 | 2023-11-24 | A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/ct/delete.php. The… |
CVE-2023-6275 | Low | 3.5 | 2023-11-24 | A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionali… |
CVE-2023-6274 | Medium | 6.3 | 2023-11-24 | A vulnerability was found in Byzoro Smart S80 up to 20231108. It has been declared as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2023-46575 | Critical | 9.8 | 2023-11-24 | A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and execute arbitrary c… |
CVE-2023-6251 | Low | 3.5 | 2023-11-24 | Cross-site Request Forgery (CSRF) in Checkmk < 2.2.0p15, < 2.1.0p37, <= 2.0.0p39 allow an authenticated attacker to delete user-messages for individual users. |
CVE-2023-48796 | High | 7.5 | 2023-11-24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler. The information exposed to unauthorized actors may includ… |
CVE-2023-44303 | High | 7.5 | 2023-11-24 | RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryption.exe) and main… |
CVE-2023-33706 | Medium | 6.5 | 2023-11-24 | SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIframe.jsp or a modifi… |
CVE-2023-26279 | Low | 3.3 | 2023-11-24 | IBM QRadar WinCollect Agent 10.0 through 10.1.7 could allow a local user to perform unauthorized actions due to improper encoding. IBM X-Force ID: 248160. |
CVE-2023-49216 | Medium | 5.4 | 2023-11-23 | Usedesk before 1.7.57 allows profile stored XSS. |
CVE-2023-49215 | Medium | 6.1 | 2023-11-23 | Usedesk before 1.7.57 allows filter reflected XSS. |
CVE-2023-49214 | Critical | 9.8 | 2023-11-23 | Usedesk before 1.7.57 allows chat template injection. |
CVE-2023-49213 | High | 8.8 | 2023-11-23 | The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP requests if a param… |
CVE-2023-47529 | Medium | 5.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in ThemeIsle Cloud Templates & Patterns collection.This issue affects Cloud Templates… |
CVE-2023-47244 | Medium | 5.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Omnisend Email Marketing for WooCommerce by Omnisend.This issue affects Email Marke… |
CVE-2023-49210 | Critical | 9.8 | 2023-11-23 | The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and accepts an opts argu… |
CVE-2023-5972 | High | 7.0 | 2023-11-23 | A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local user to crash the s… |
CVE-2023-49208 | Critical | 9.8 | 2023-11-23 | scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registration. |
CVE-2023-33202 | Medium | 5.5 | 2023-11-23 | Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This c… |
CVE-2023-6118 | High | 7.5 | 2023-11-23 | Path Traversal: '/../filedir' vulnerability in Neutron IP Camera allows Absolute Path Traversal. This issue affects IP Camera: before b1130.1.0.1. |
CVE-2023-4677 | High | 7.0 | 2023-11-23 | Cron log backup files contain administrator session IDs. It is trivial for any attacker who can reach the Pandora FMS Console to scrape the cron logs directory… |
CVE-2023-41812 | Medium | 5.7 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-41811 | Medium | 5.3 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41810 | Medium | 4.0 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41808 | High | 8.5 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows an unauthorised user to escalate and r… |
CVE-2023-41807 | Critical | 9.1 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability allows a user to escalate permissions on the… |
CVE-2023-41806 | High | 8.2 | 2023-11-23 | Improper Privilege Management vulnerability in Pandora FMS on all allows Privilege Escalation. This vulnerability causes that a bad privilege assignment could… |
CVE-2023-41792 | Medium | 5.9 | 2023-11-23 | Cross-Site Request Forgery (CSRF) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). This vulnerability allowed Javascript code to be execu… |
CVE-2023-41791 | High | 8.4 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41790 | High | 7.6 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |
CVE-2023-41789 | High | 7.6 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Thi… |
CVE-2023-41788 | High | 7.6 | 2023-11-23 | Unrestricted Upload of File with Dangerous Type vulnerability in Pandora FMS on all allows Accessing Functionality Not Properly Constrained by ACLs. This vulne… |
CVE-2023-41787 | Medium | 6.0 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |
CVE-2023-41786 | Medium | 6.8 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low… |
CVE-2023-4595 | High | 7.5 | 2023-11-23 | An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the serve… |
CVE-2023-4594 | Medium | 6.1 | 2023-11-23 | Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in… |
CVE-2023-4593 | Medium | 6.5 | 2023-11-23 | Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent di… |
CVE-2023-4406 | Medium | 6.1 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This… |
CVE-2023-43123 | Medium | 5.5 | 2023-11-23 | On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/dir… |
CVE-2023-3631 | Critical | 9.8 | 2023-11-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Medart Health Services Medart Notification Panel allows S… |
CVE-2023-3377 | Critical | 9.8 | 2023-11-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection… |
CVE-2023-28813 | High | 8.1 | 2023-11-23 | An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause… |
CVE-2023-28812 | Critical | 9.1 | 2023-11-23 | There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers… |
CVE-2023-44290 | High | 7.3 | 2023-11-23 | Dell Command | Monitor versions prior to 10.10.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-44289 | High | 7.3 | 2023-11-23 | Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-43086 | High | 7.3 | 2023-11-23 | Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local malicious user could potentially modify files i… |
CVE-2023-39253 | High | 7.3 | 2023-11-23 | Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator… |
CVE-2023-28811 | High | 7.4 | 2023-11-23 | There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could c… |
CVE-2023-41140 | High | 7.8 | 2023-11-23 | A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can leve… |
CVE-2023-41139 | High | 7.8 | 2023-11-23 | A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along wi… |
CVE-2023-29076 | Critical | 9.8 | 2023-11-23 | A maliciously crafted MODEL, SLDASM, SAT or CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 could cause memory corruption vulnerability. This v… |
CVE-2023-29075 | Critical | 9.8 | 2023-11-23 | A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage t… |
CVE-2023-29074 | Critical | 9.8 | 2023-11-23 | A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can levera… |
CVE-2023-29073 | Critical | 9.8 | 2023-11-23 | A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can le… |
CVE-2023-47839 | Medium | 6.5 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress… |
CVE-2023-47835 | Medium | 6.5 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plug… |
CVE-2023-47834 | Medium | 6.5 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versi… |
CVE-2023-47833 | Medium | 5.9 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress plugin <= 0.18.3 vers… |
CVE-2023-47790 | High | 7.1 | 2023-11-23 | Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in Poporon Pz-LinkCard plugin <= 2.4.8 versions. |
CVE-2023-47668 | Medium | 5.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions. |
CVE-2023-40002 | Medium | 6.5 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions. |
CVE-2023-30581 | High | 7.5 | 2023-11-23 | The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This… |
CVE-2023-23978 | Medium | 4.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions. |
CVE-2023-48107 | High | 8.8 | 2023-11-22 | Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_has_slash function i… |
CVE-2023-48105 | High | 7.5 | 2023-11-22 | An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the was… |
CVE-2023-47831 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in assorted[chips] DrawIt (draw.Io) plugin <= 1.1.3 versions. |
CVE-2023-47829 | Medium | 5.9 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codez Quick Call Button plugin <= 1.2.9 versions. |
CVE-2023-47821 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions. |
CVE-2023-47817 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions. |
CVE-2023-47816 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by… |
CVE-2023-47815 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra plugin <= 2.5.2 vers… |
CVE-2023-47814 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Waterloo Plugins BMI Calculator Plugin plugin <= 1.0.3 ve… |
CVE-2023-47813 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions. |
CVE-2023-47812 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns plugin <= 1.6.1 versions. |
CVE-2023-47811 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5… |
CVE-2023-47810 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin <= 1.3.0 versions. |
CVE-2023-47809 | Medium | 5.9 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions. |
CVE-2023-49146 | Medium | 6.1 | 2023-11-22 | DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions. |
CVE-2023-49102 | High | 8.8 | 2023-11-22 | NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. An attacker with th… |
CVE-2023-48706 | Low | 3.6 | 2023-11-22 | Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using… |