2023 CVEs (page 104)
Page 104 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41786 | Medium | 6.8 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pandora FMS on all allows File Discovery. This vulnerability allows users with low… |
CVE-2023-4595 | High | 7.5 | 2023-11-23 | An information exposure vulnerability has been found, the exploitation of which could allow a remote user to retrieve sensitive information stored on the serve… |
CVE-2023-4594 | Medium | 6.1 | 2023-11-23 | Stored XSS vulnerability. This vulnerability could allow an attacker to store a malicious JavaScript payload via GET and POST methods on multiple parameters in… |
CVE-2023-4593 | Medium | 6.5 | 2023-11-23 | Path traversal vulnerability whose exploitation could allow an authenticated remote user to bypass SecurityManager's intended restrictions and list a parent di… |
CVE-2023-4406 | Medium | 6.1 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KC Group E-Commerce Software allows Reflected XSS. This… |
CVE-2023-43123 | Medium | 5.5 | 2023-11-23 | On unix-like systems, the temporary directory is shared between all user. As such, writing to this directory using APIs that do not explicitly set the file/dir… |
CVE-2023-3631 | Critical | 9.8 | 2023-11-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Medart Health Services Medart Notification Panel allows S… |
CVE-2023-3377 | Critical | 9.8 | 2023-11-23 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veribilim Software Computer Veribase allows SQL Injection… |
CVE-2023-28813 | High | 8.1 | 2023-11-23 | An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause… |
CVE-2023-28812 | Critical | 9.1 | 2023-11-23 | There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers… |
CVE-2023-44290 | High | 7.3 | 2023-11-23 | Dell Command | Monitor versions prior to 10.10.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-44289 | High | 7.3 | 2023-11-23 | Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit… |
CVE-2023-43086 | High | 7.3 | 2023-11-23 | Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. A local malicious user could potentially modify files i… |
CVE-2023-39253 | High | 7.3 | 2023-11-23 | Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. A local authenticated non-administrator… |
CVE-2023-28811 | High | 7.4 | 2023-11-23 | There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could c… |
CVE-2023-41140 | High | 7.8 | 2023-11-23 | A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can leve… |
CVE-2023-41139 | High | 7.8 | 2023-11-23 | A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. This vulnerability, along wi… |
CVE-2023-29076 | Critical | 9.8 | 2023-11-23 | A maliciously crafted MODEL, SLDASM, SAT or CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 could cause memory corruption vulnerability. This v… |
CVE-2023-29075 | Critical | 9.8 | 2023-11-23 | A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can leverage t… |
CVE-2023-29074 | Critical | 9.8 | 2023-11-23 | A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. A malicious actor can levera… |
CVE-2023-29073 | Critical | 9.8 | 2023-11-23 | A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. A malicious actor can le… |
CVE-2023-47839 | Medium | 6.5 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress… |
CVE-2023-47835 | Medium | 6.5 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ARI Soft ARI Stream Quiz – WordPress Quizzes Builder plug… |
CVE-2023-47834 | Medium | 6.5 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master plugin <= 8.1.13 versi… |
CVE-2023-47833 | Medium | 5.9 | 2023-11-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress plugin <= 0.18.3 vers… |
CVE-2023-47790 | High | 7.1 | 2023-11-23 | Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in Poporon Pz-LinkCard plugin <= 2.4.8 versions. |
CVE-2023-47668 | Medium | 5.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in StellarWP Membership Plugin – Restrict Content plugin <= 3.2.7 versions. |
CVE-2023-40002 | Medium | 6.5 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pluggabl LLC Booster for WooCommerce plugin <= 7.1.1 versions. |
CVE-2023-30581 | High | 7.5 | 2023-11-23 | The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This… |
CVE-2023-23978 | Medium | 4.3 | 2023-11-23 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SwitchWP WP Client Reports plugin <= 1.0.16 versions. |
CVE-2023-48107 | High | 8.8 | 2023-11-22 | Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_has_slash function i… |
CVE-2023-48105 | High | 7.5 | 2023-11-22 | An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of service via the was… |
CVE-2023-47831 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in assorted[chips] DrawIt (draw.Io) plugin <= 1.1.3 versions. |
CVE-2023-47829 | Medium | 5.9 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codez Quick Call Button plugin <= 1.2.9 versions. |
CVE-2023-47821 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jannis Thuemmig Email Encoder plugin <= 2.1.8 versions. |
CVE-2023-47817 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.10.13 versions. |
CVE-2023-47816 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Charitable Donations & Fundraising Team Donation Forms by… |
CVE-2023-47815 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra plugin <= 2.5.2 vers… |
CVE-2023-47814 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Waterloo Plugins BMI Calculator Plugin plugin <= 1.0.3 ve… |
CVE-2023-47813 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grandslambert Better RSS Widget plugin <= 2.8.1 versions. |
CVE-2023-47812 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bamboo Mcr Bamboo Columns plugin <= 1.6.1 versions. |
CVE-2023-47811 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh KUMAR Mukhiya Anywhere Flash Embed plugin <= 1.0.5… |
CVE-2023-47810 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asdqwe Dev Ajax Domain Checker plugin <= 1.3.0 versions. |
CVE-2023-47809 | Medium | 5.9 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Accordion plugin <= 2.6 versions. |
CVE-2023-49146 | Medium | 6.1 | 2023-11-22 | DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressions. |
CVE-2023-49102 | High | 8.8 | 2023-11-22 | NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. An attacker with th… |
CVE-2023-48706 | Low | 3.6 | 2023-11-22 | Vim is a UNIX editor that, prior to version 9.0.2121, has a heap-use-after-free vulnerability. When executing a `:s` command for the very first time and using… |
CVE-2023-47808 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versi… |
CVE-2023-47786 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions. |
CVE-2023-47773 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 ver… |
CVE-2023-47768 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter plugin <= 1.17 versions. |
CVE-2023-47767 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versio… |
CVE-2023-47766 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 ver… |
CVE-2023-6265 | Medium | 6.5 | 2023-11-22 | ** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' para… |
CVE-2023-47825 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra plugin <= 6.4 versions. |
CVE-2023-47824 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1… |
CVE-2023-47759 | Medium | 5.9 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty allows DOM-Based XSS.This issue affect… |
CVE-2023-30496 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions. |
CVE-2023-6264 | Medium | 5.3 | 2023-11-22 | Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gatew… |
CVE-2023-47819 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions. |
CVE-2023-47792 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions. |
CVE-2023-47791 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions. |
CVE-2023-47785 | High | 7.1 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <= 7.7.9 versions. |
CVE-2023-47781 | High | 8.8 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Theme Builder < 3.24.2 versions. |
CVE-2023-47775 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions. |
CVE-2023-39925 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions. |
CVE-2023-25682 | Medium | 6.2 | 2023-11-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 stores potentially sensitive information in log files that cou… |
CVE-2023-6263 | High | 8.3 | 2023-11-22 | An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact ident… |
CVE-2023-48646 | High | 7.2 | 2023-11-22 | Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings. |
CVE-2023-48106 | High | 8.8 | 2023-11-22 | Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_resolve function in… |
CVE-2023-47765 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions. |
CVE-2023-47758 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form plugin <= 1.7.11 versions. |
CVE-2023-47755 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <= 3… |
CVE-2023-47467 | Medium | 6.5 | 2023-11-22 | Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure. |
CVE-2023-47251 | Medium | 6.5 | 2023-11-22 | In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attack… |
CVE-2023-47250 | High | 8.8 | 2023-11-22 | In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to… |
CVE-2023-47014 | Medium | 6.5 | 2023-11-22 | A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 allows a local attacker to obtain sensiti… |
CVE-2023-46357 | Critical | 9.8 | 2023-11-22 | In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `motiva… |
CVE-2023-43887 | High | 8.1 | 2023-11-22 | Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::du… |
CVE-2023-25987 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Aleksandar Urošević My YouTube Channel plugin <= 3.23.3 versions. |
CVE-2023-25986 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in WattIsIt PayGreen – Ancienne version plugin <= 4.10.2 versions. |
CVE-2023-6157 | High | 7.6 | 2023-11-22 | Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command… |
CVE-2023-6156 | High | 7.6 | 2023-11-22 | Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary lives… |
CVE-2023-47316 | Medium | 5.4 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as l… |
CVE-2023-47315 | High | 8.8 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available… |
CVE-2023-47314 | Medium | 5.4 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting (XSS). The file upload function allows APK and arbitrary files to be uploaded. By exploitin… |
CVE-2023-47313 | Medium | 5.4 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory… |
CVE-2023-47312 | Medium | 6.5 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries. |
CVE-2023-45377 | Critical | 9.8 | 2023-11-22 | In the module "Chronopost Official" (chronopost) for PrestaShop, a guest can perform SQL injection. The script PHP `cancelSkybill.php` own a sensitive SQL call… |
CVE-2023-43082 | High | 8.6 | 2023-11-22 | Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component. If a customer has a certificate signed by a third-party publi… |
CVE-2023-20241 | Medium | 5.5 | 2023-11-22 | Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a d… |
CVE-2023-20240 | Medium | 5.5 | 2023-11-22 | Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a d… |
CVE-2023-20084 | Medium | 5.0 | 2023-11-22 | A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within… |
CVE-2023-6164 | Low | 2.2 | 2023-11-22 | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in… |
CVE-2023-6160 | Low | 3.3 | 2023-11-22 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the ma… |
CVE-2023-6009 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_… |
CVE-2023-6008 | Medium | 6.3 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce… |
CVE-2023-6007 | High | 7.3 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple… |
CVE-2023-5822 | High | 8.1 | 2023-11-22 | The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation i… |
CVE-2023-5815 | High | 8.1 | 2023-11-22 | The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for… |