2023 CVEs (page 105)
Page 105 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47808 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christina Uechi Add Widgets to Page plugin <= 1.3.2 versi… |
CVE-2023-47786 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LayerSlider plugin <= 7.7.9 versions. |
CVE-2023-47773 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YAS Global Team Permalinks Customizer plugin <= 2.8.2 ver… |
CVE-2023-47768 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson Footer Putter plugin <= 1.17 versions. |
CVE-2023-47767 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fla-shop.Com Interactive World Map plugin <= 3.2.0 versio… |
CVE-2023-47766 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Timo Reith Post Status Notifier Lite plugin <= 1.11.0 ver… |
CVE-2023-6265 | Medium | 6.5 | 2023-11-22 | ** UNSUPPORTED WHEN ASSIGNED ** Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory traversal via the mainfunction.cgi dumpSyslog 'option' para… |
CVE-2023-47825 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra plugin <= 6.4 versions. |
CVE-2023-47824 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDPR, CCPA, and Cookie Notice Generator plugin <= 1… |
CVE-2023-47759 | Medium | 5.9 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty allows DOM-Based XSS.This issue affect… |
CVE-2023-30496 | High | 7.1 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MagePeople Team WpBusTicketly plugin <= 5.2.5 versions. |
CVE-2023-6264 | Medium | 5.3 | 2023-11-22 | Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gatew… |
CVE-2023-47819 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc Binh Easy Call Now by ThikShare plugin <= 1.1.0 versions. |
CVE-2023-47792 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Infinite Uploads Big File Uploads – Increase Maximum File Upload Size plugin <= 2.1.1 versions. |
CVE-2023-47791 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Leadster plugin <= 1.1.2 versions. |
CVE-2023-47785 | High | 7.1 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider plugin <= 7.7.9 versions. |
CVE-2023-47781 | High | 8.8 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Thrive Themes Thrive Theme Builder < 3.24.2 versions. |
CVE-2023-47775 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions. |
CVE-2023-39925 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Download Community by PeepSo plugin <= 6.1.6.0 versions. |
CVE-2023-25682 | Medium | 6.2 | 2023-11-22 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 and 6.1.0.0 through 6.1.2.1 stores potentially sensitive information in log files that cou… |
CVE-2023-6263 | High | 8.3 | 2023-11-22 | An issue was discovered by IPVM team in Network Optix NxCloud before 23.1.0.40440. It was possible to add a fake VMS server to NxCloud by using the exact ident… |
CVE-2023-48646 | High | 7.2 | 2023-11-22 | Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings. |
CVE-2023-48106 | High | 8.8 | 2023-11-22 | Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_resolve function in… |
CVE-2023-47765 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 versions. |
CVE-2023-47758 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form plugin <= 1.7.11 versions. |
CVE-2023-47755 | Medium | 6.5 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel Slider plugin <= 3… |
CVE-2023-47467 | Medium | 6.5 | 2023-11-22 | Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file directory structure. |
CVE-2023-47251 | Medium | 6.5 | 2023-11-22 | In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows authenticated attack… |
CVE-2023-47250 | High | 8.8 | 2023-11-22 | In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attackers (with access to… |
CVE-2023-47014 | Medium | 6.5 | 2023-11-22 | A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 allows a local attacker to obtain sensiti… |
CVE-2023-46357 | Critical | 9.8 | 2023-11-22 | In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. The method `motiva… |
CVE-2023-43887 | High | 8.1 | 2023-11-22 | Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pic_parameter_set::du… |
CVE-2023-25987 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Aleksandar Urošević My YouTube Channel plugin <= 3.23.3 versions. |
CVE-2023-25986 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in WattIsIt PayGreen – Ancienne version plugin <= 4.10.2 versions. |
CVE-2023-6157 | High | 7.6 | 2023-11-22 | Improper neutralization of livestatus command delimiters in ajax_search in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary livestatus command… |
CVE-2023-6156 | High | 7.6 | 2023-11-22 | Improper neutralization of livestatus command delimiters in the availability timeline in Checkmk <= 2.0.0p39, < 2.1.0p37, and < 2.2.0p15 allows arbitrary lives… |
CVE-2023-47316 | Medium | 5.4 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. The Web panel allows users to gain access to potentially sensitive API calls such as l… |
CVE-2023-47315 | High | 8.8 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. The secret is hardcoded into the source code available… |
CVE-2023-47314 | Medium | 5.4 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting (XSS). The file upload function allows APK and arbitrary files to be uploaded. By exploitin… |
CVE-2023-47313 | Medium | 5.4 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. The application uses an API call to move the uploaded temporary file to the file directory… |
CVE-2023-47312 | Medium | 6.5 | 2023-11-22 | Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries. |
CVE-2023-45377 | Critical | 9.8 | 2023-11-22 | In the module "Chronopost Official" (chronopost) for PrestaShop, a guest can perform SQL injection. The script PHP `cancelSkybill.php` own a sensitive SQL call… |
CVE-2023-43082 | High | 8.6 | 2023-11-22 | Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component. If a customer has a certificate signed by a third-party publi… |
CVE-2023-20241 | Medium | 5.5 | 2023-11-22 | Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a d… |
CVE-2023-20240 | Medium | 5.5 | 2023-11-22 | Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local attacker to cause a d… |
CVE-2023-20084 | Medium | 5.0 | 2023-11-22 | A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint protection within… |
CVE-2023-6164 | Low | 2.2 | 2023-11-22 | The MainWP Dashboard – WordPress Manager for Multiple Websites Maintenance plugin for WordPress is vulnerable to CSS Injection via the ‘newColor’ parameter in… |
CVE-2023-6160 | Low | 3.3 | 2023-11-22 | The LifterLMS – WordPress LMS Plugin for eLearning plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 7.4.2 via the ma… |
CVE-2023-6009 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.4 due to insufficient restriction on the 'userpro_… |
CVE-2023-6008 | Medium | 6.3 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce… |
CVE-2023-6007 | High | 7.3 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized access of data, modification of data, loss of data due to a missing capability check on multiple… |
CVE-2023-5822 | High | 8.1 | 2023-11-22 | The Drag and Drop Multiple File Upload - Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation i… |
CVE-2023-5815 | High | 8.1 | 2023-11-22 | The News & Blog Designer Pack – WordPress Blog Plugin — (Blog Post Grid, Blog Post Slider, Blog Post Carousel, Blog Post Ticker, Blog Post Masonry) plugin for… |
CVE-2023-5742 | Medium | 6.4 | 2023-11-22 | The EasyRotator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyrotator' shortcode in all versions up to… |
CVE-2023-5715 | Medium | 4.4 | 2023-11-22 | The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings in all versions up… |
CVE-2023-5708 | Medium | 6.4 | 2023-11-22 | The WP Post Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'column' shortcode in all versions up to, and including… |
CVE-2023-5706 | Medium | 6.4 | 2023-11-22 | The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, an… |
CVE-2023-5704 | Medium | 6.4 | 2023-11-22 | The CPO Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.0 du… |
CVE-2023-5667 | Medium | 6.4 | 2023-11-22 | The Tab Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3 due to… |
CVE-2023-5664 | Medium | 6.4 | 2023-11-22 | The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ggpkg' shortcode in all versions up to, and includ… |
CVE-2023-5662 | Medium | 6.4 | 2023-11-22 | The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, and including, 3.5… |
CVE-2023-5537 | Medium | 4.3 | 2023-11-22 | The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing nonce vali… |
CVE-2023-5469 | Medium | 6.4 | 2023-11-22 | The Drop Shadow Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dropshadowbox' shortcode in versions up to, and including, 1.7.13… |
CVE-2023-5466 | High | 8.8 | 2023-11-22 | The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient… |
CVE-2023-5465 | High | 8.8 | 2023-11-22 | The Popup with fancybox plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.5 due to insufficien… |
CVE-2023-5419 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail functi… |
CVE-2023-5417 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category func… |
CVE-2023-5416 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category func… |
CVE-2023-5415 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category functio… |
CVE-2023-5411 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post functi… |
CVE-2023-5387 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mod… |
CVE-2023-5386 | Medium | 6.5 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts functio… |
CVE-2023-5385 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function… |
CVE-2023-5383 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrec… |
CVE-2023-5382 | Medium | 6.5 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrec… |
CVE-2023-5338 | Medium | 6.4 | 2023-11-22 | The Theme Blvd Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.6.8 due to insuf… |
CVE-2023-5314 | Medium | 4.3 | 2023-11-22 | The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' sectio… |
CVE-2023-5234 | Medium | 6.4 | 2023-11-22 | The Related Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'woo-related' shortcode in versions up to, and inclu… |
CVE-2023-5163 | Medium | 6.4 | 2023-11-22 | The Weather Atlas Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortcode-weather-atlas' shortcode in versions up to, and inclu… |
CVE-2023-5128 | Medium | 6.4 | 2023-11-22 | The TCD Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'map' shortcode in versions up to, and including, 1.8 due to insuffic… |
CVE-2023-5096 | Medium | 6.4 | 2023-11-22 | The HTML filter and csv-file search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'csvsearch' shortcode in versions up to… |
CVE-2023-5048 | Medium | 6.4 | 2023-11-22 | The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versions up to, and incl… |
CVE-2023-4726 | Medium | 4.4 | 2023-11-22 | The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.7. due to ins… |
CVE-2023-4686 | Medium | 4.3 | 2023-11-22 | The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts… |
CVE-2023-48705 | High | 7.1 | 2023-11-22 | Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are… |
CVE-2023-47350 | High | 8.8 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the… |
CVE-2023-2841 | High | 7.2 | 2023-11-22 | The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including… |
CVE-2023-2497 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce… |
CVE-2023-2449 | Critical | 9.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native p… |
CVE-2023-2448 | Medium | 6.5 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in… |
CVE-2023-2440 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation i… |
CVE-2023-2438 | Medium | 6.1 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce… |
CVE-2023-2437 | Critical | 9.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on th… |
CVE-2023-47380 | Medium | 6.1 | 2023-11-22 | Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-26542 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Exeebit phpinfo() WP plugin <= 4.0 versions. |
CVE-2023-6252 | High | 7.5 | 2023-11-22 | Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could allow a remote user to read files locate… |
CVE-2023-2889 | Critical | 9.8 | 2023-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veon Computer Service Tracking Software allows SQL Inject… |
CVE-2023-28747 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in codeboxr CBX Currency Converter plugin <= 3.0.3 versions. |
CVE-2023-27633 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions. |
CVE-2023-27461 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Yoohoo Plugins When Last Login plugin <= 1.2.1 versions. |