2023 CVEs (page 105)
Page 105 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5742 | Medium | 6.4 | 2023-11-22 | The EasyRotator for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'easyrotator' shortcode in all versions up to… |
CVE-2023-5715 | Medium | 4.4 | 2023-11-22 | The Website Optimization – Plerdy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tracking code settings in all versions up… |
CVE-2023-5708 | Medium | 6.4 | 2023-11-22 | The WP Post Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'column' shortcode in all versions up to, and including… |
CVE-2023-5706 | Medium | 6.4 | 2023-11-22 | The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk-blocks/ancestor-page-list' block in all versions up to, an… |
CVE-2023-5704 | Medium | 6.4 | 2023-11-22 | The CPO Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.5.0 du… |
CVE-2023-5667 | Medium | 6.4 | 2023-11-22 | The Tab Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 1.3 due to… |
CVE-2023-5664 | Medium | 6.4 | 2023-11-22 | The Garden Gnome Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ggpkg' shortcode in all versions up to, and includ… |
CVE-2023-5662 | Medium | 6.4 | 2023-11-22 | The Sponsors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sponsors' shortcode in all versions up to, and including, 3.5… |
CVE-2023-5537 | Medium | 4.3 | 2023-11-22 | The Delete Usermeta plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.2. This is due to missing nonce vali… |
CVE-2023-5469 | Medium | 6.4 | 2023-11-22 | The Drop Shadow Boxes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dropshadowbox' shortcode in versions up to, and including, 1.7.13… |
CVE-2023-5466 | High | 8.8 | 2023-11-22 | The Wp anything slider plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.1 due to insufficient… |
CVE-2023-5465 | High | 8.8 | 2023-11-22 | The Popup with fancybox plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.5 due to insufficien… |
CVE-2023-5419 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_test_mail functi… |
CVE-2023-5417 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_update_category func… |
CVE-2023-5416 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_category func… |
CVE-2023-5415 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_add_category functio… |
CVE-2023-5411 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_save_post functi… |
CVE-2023-5387 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_af2_trigger_dark_mod… |
CVE-2023-5386 | Medium | 6.5 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_delete_posts functio… |
CVE-2023-5385 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsf_copy_posts function… |
CVE-2023-5383 | Medium | 4.3 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrec… |
CVE-2023-5382 | Medium | 6.5 | 2023-11-22 | The Funnelforms Free plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.4. This is due to missing or incorrec… |
CVE-2023-5338 | Medium | 6.4 | 2023-11-22 | The Theme Blvd Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 1.6.8 due to insuf… |
CVE-2023-5314 | Medium | 4.3 | 2023-11-22 | The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' sectio… |
CVE-2023-5234 | Medium | 6.4 | 2023-11-22 | The Related Products for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'woo-related' shortcode in versions up to, and inclu… |
CVE-2023-5163 | Medium | 6.4 | 2023-11-22 | The Weather Atlas Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortcode-weather-atlas' shortcode in versions up to, and inclu… |
CVE-2023-5128 | Medium | 6.4 | 2023-11-22 | The TCD Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'map' shortcode in versions up to, and including, 1.8 due to insuffic… |
CVE-2023-5096 | Medium | 6.4 | 2023-11-22 | The HTML filter and csv-file search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'csvsearch' shortcode in versions up to… |
CVE-2023-5048 | Medium | 6.4 | 2023-11-22 | The WDContactFormBuilder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Contact_Form_Builder' shortcode in versions up to, and incl… |
CVE-2023-4726 | Medium | 4.4 | 2023-11-22 | The Ultimate Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 3.7.7. due to ins… |
CVE-2023-4686 | Medium | 4.3 | 2023-11-22 | The WP Customer Reviews plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.6.6 via the ajax_enabled_posts… |
CVE-2023-48705 | High | 7.1 | 2023-11-22 | Nautobot is a Network Source of Truth and Network Automation Platform built as a web application All users of Nautobot versions earlier than 1.6.6 or 2.0.5 are… |
CVE-2023-47350 | High | 8.8 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate privileges via the… |
CVE-2023-2841 | High | 7.2 | 2023-11-22 | The Advanced Local Pickup for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in versions up to, and including… |
CVE-2023-2497 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce… |
CVE-2023-2449 | Critical | 9.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 5.1.1. This is due to the plugin using native p… |
CVE-2023-2448 | Medium | 6.5 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'userpro_shortcode_template' function in… |
CVE-2023-2440 | High | 8.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing nonce validation i… |
CVE-2023-2438 | Medium | 6.1 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.0. This is due to missing or incorrect nonce… |
CVE-2023-2437 | Critical | 9.8 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on th… |
CVE-2023-47380 | Medium | 6.1 | 2023-11-22 | Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-26542 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Exeebit phpinfo() WP plugin <= 4.0 versions. |
CVE-2023-6252 | High | 7.5 | 2023-11-22 | Path traversal vulnerability in Chalemelon Power framework, affecting the getImage parameter. This vulnerability could allow a remote user to read files locate… |
CVE-2023-2889 | Critical | 9.8 | 2023-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Veon Computer Service Tracking Software allows SQL Inject… |
CVE-2023-28747 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in codeboxr CBX Currency Converter plugin <= 3.0.3 versions. |
CVE-2023-27633 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Pixelgrade Customify – Intuitive Website Styling plugin <= 2.10.4 versions. |
CVE-2023-27461 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Yoohoo Plugins When Last Login plugin <= 1.2.1 versions. |
CVE-2023-27458 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in wpstream WpStream plugin <= 4.4.10 versions. |
CVE-2023-27457 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Passionate Brains Add Expires Headers & Optimized Minify plugin <= 2.7 versions. |
CVE-2023-27453 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Tools plugin <= 2.3.1 versions. |
CVE-2023-27451 | High | 7.2 | 2023-11-22 | Server-Side Request Forgery (SSRF) vulnerability in Darren Cooney Instant Images plugin <= 5.1.0.2 versions. |
CVE-2023-27446 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Fluenx DeepL API translation plugin <= 2.1.4 versions. |
CVE-2023-27444 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Pierre Lannoy / PerfOps One DecaLog plugin <= 3.7.0 versions. |
CVE-2023-27442 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in Teplitsa of social technologies Leyka plugin <= 3.29.2 versions. |
CVE-2023-26535 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in WPPOOL Sheets To WP Table Live Sync plugin <= 2.12.15 versions. |
CVE-2023-26532 | Medium | 5.4 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in AccessPress Themes Social Auto Poster plugin <= 2.1.4 versions. |
CVE-2023-43081 | Medium | 4.0 | 2023-11-22 | PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in ddfscon component. A low Privileged loc… |
CVE-2023-28749 | Medium | 4.3 | 2023-11-22 | Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace plugin <= 1.3.0 versions. |
CVE-2023-6253 | Medium | 6.0 | 2023-11-22 | A saved encryption key in the Uninstaller in Digital Guardian's Agent before version 7.9.4 allows a local attacker to retrieve the uninstall key and remove the… |
CVE-2023-5983 | High | 7.5 | 2023-11-22 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Botanik Software Pharmacy Automation allows Retrieve Embedded Sensitive Data… |
CVE-2023-5047 | Critical | 9.8 | 2023-11-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DRD Fleet Leasing DRDrive allows SQL Injection. This iss… |
CVE-2023-3104 | Medium | 5.7 | 2023-11-22 | Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of auth… |
CVE-2023-3103 | High | 8.0 | 2023-11-22 | Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera… |
CVE-2023-6189 | Medium | 4.3 | 2023-11-22 | Missing access permissions checks in the M-Files server before 23.11.13156.0 allow attackers to perform data write and export jobs using the M-Files API met… |
CVE-2023-6117 | Medium | 5.7 | 2023-11-22 | A possibility of unwanted server memory consumption was detected through the obsolete functionalities in the Rest API methods of the M-Files server before 23… |
CVE-2023-46673 | Medium | 6.5 | 2023-11-22 | It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when calling the Simulat… |
CVE-2023-37924 | Critical | 9.8 | 2023-11-22 | Apache Software Foundation Apache Submarine has an SQL injection vulnerability when a user logs in. This issue can result in unauthorized login. Now we have fi… |
CVE-2023-6011 | Medium | 5.4 | 2023-11-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DECE Software Geodi allows Stored XSS. This issue affect… |
CVE-2023-5921 | High | 7.1 | 2023-11-22 | Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass. This issue affects Geodi: before 8.0.0.27396. |
CVE-2023-2447 | Medium | 6.1 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.1.1. This is due to missing or incorrect nonce… |
CVE-2023-2446 | Medium | 6.5 | 2023-11-22 | The UserPro plugin for WordPress is vulnerable to sensitive information disclosure via the 'userpro' shortcode in versions up to, and including 5.1.1. This is… |
CVE-2023-47393 | Medium | 5.3 | 2023-11-22 | An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access sensitive user infor… |
CVE-2023-47392 | Medium | 5.3 | 2023-11-22 | An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add order request. |
CVE-2023-47016 | High | 7.5 | 2023-11-22 | radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endian.h. |
CVE-2023-41146 | Medium | 4.3 | 2023-11-22 | Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account. |
CVE-2023-41145 | Medium | 5.3 | 2023-11-22 | Autodesk users who no longer have an active license for an account can still access cases for that account. |
CVE-2023-29069 | High | 7.8 | 2023-11-22 | A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with malicious DLLs. These… |
CVE-2023-48161 | High | 7.1 | 2023-11-22 | Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RGB function in gif2r… |
CVE-2023-46814 | High | 7.8 | 2023-11-22 | A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute code with elevated p… |
CVE-2023-5299 | High | 7.3 | 2023-11-22 | A user with a standard account in Fuji Electric Tellus Lite may overwrite files in the system. |
CVE-2023-40152 | High | 7.8 | 2023-11-22 | When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file an out of bounds write may occur. |
CVE-2023-35127 | High | 7.8 | 2023-11-22 | Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V-Simulator parses a specially-crafted input file. |
CVE-2023-48701 | High | 7.5 | 2023-11-21 | Statamic CMS is a Laravel and Git powered content management system (CMS). Prior to versions 3.4.15 an 4.36.0, HTML files crafted to look like images may be up… |
CVE-2023-48700 | Medium | 5.7 | 2023-11-21 | The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libraries to simplify the onboarding process of a new device into Nautobot down to, in many c… |
CVE-2023-48699 | High | 8.4 | 2023-11-21 | fastbots is a library for fast bot and scraper development using selenium and the Page Object Model (POM) design. Prior to version 0.1.5, an attacker could mod… |
CVE-2023-48307 | Low | 3.5 | 2023-11-21 | Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivity platform. Starting in version 1.13.0 and prior to version 2.2.8 and 3.3.0, an attacker… |
CVE-2023-48306 | Medium | 5.0 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1… |
CVE-2023-48305 | Medium | 4.2 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1… |
CVE-2023-6248 | Critical | 10.0 | 2023-11-21 | The Syrus4 IoT gateway utilizes an unsecured MQTT server to download and execute arbitrary commands, allowing a remote unauthenticated attacker to execute code… |
CVE-2023-49105 | Critical | 9.8 | 2023-11-21 | An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of… |
CVE-2023-49104 | High | 8.7 | 2023-11-21 | An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled. An attacker is able to pass in a crafted redirect-url that… |
CVE-2023-49103 | Critical | 10.0 | 2023-11-21 | An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relies on a third-party GetPhpInfo.php librar… |
CVE-2023-48304 | Medium | 4.3 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1… |
CVE-2023-48303 | Low | 2.4 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.11, 26.0.6, and 27.1… |
CVE-2023-48302 | Low | 3.5 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1… |
CVE-2023-48301 | Low | 3.5 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1… |
CVE-2023-6238 | Medium | 6.7 | 2023-11-21 | A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let… |
CVE-2023-48299 | Medium | 5.3 | 2023-11-21 | TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow manag… |
CVE-2023-48239 | High | 8.5 | 2023-11-21 | Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. Starting in version 25.0.0 and prior to versions 25.0.13, 26.0.8, and 27.1… |
CVE-2023-48230 | Medium | 5.9 | 2023-11-21 | Cap'n Proto is a data interchange format and capability-based RPC system. In versions 1.0 and 1.0.1, when using the KJ HTTP library with WebSocket compression… |