2023 CVEs (page 107)
Page 107 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46100 | Medium | 6.2 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource. |
CVE-2023-43612 | High | 8.4 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions. |
CVE-2023-42774 | Medium | 6.2 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions. |
CVE-2023-3116 | High | 7.3 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions. |
CVE-2023-46302 | Critical | 9.8 | 2023-11-20 | Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-… |
CVE-2023-3379 | Medium | 5.3 | 2023-11-20 | Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin use… |
CVE-2023-47175 | Medium | 6.1 | 2023-11-20 | Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a rem… |
CVE-2023-46700 | Critical | 9.8 | 2023-11-20 | SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote una… |
CVE-2023-5341 | Medium | 6.2 | 2023-11-19 | A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. |
CVE-2023-41129 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6. |
CVE-2023-32514 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Himanshu Parashar Google Site Verification plugin using Meta Tag.This issue affects Google Site Verification… |
CVE-2023-32504 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.This issue affects Wise Chat: from n/a through 3.1.3. |
CVE-2023-32245 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Essential Addons for Elementor Pro.This issue affects Essential Addons for Elementor Pro: from n… |
CVE-2023-31089 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Tradebooster Video XML Sitemap Generator.This issue affects Video XML Sitemap Generator: from n/a through 1… |
CVE-2023-31075 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Arshid Easy Hide Login.This issue affects Easy Hide Login: from n/a through 1.0.8. |
CVE-2023-28780 | Medium | 6.5 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: from n/a through 14.8. |
CVE-2023-25985 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Tomas | Docs | FAQ | Premium Support WordPress Tooltips.This issue affects WordPress Tooltips: from n/a thro… |
CVE-2023-47655 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi ANAC XML Bandi di Gara.This issue affects ANAC XML Bandi di Gara: from n/a through 7.5. |
CVE-2023-47651 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Robert Macchi WP Links Page.This issue affects WP Links Page: from n/a through 4.9.4. |
CVE-2023-47650 | Medium | 6.5 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar: from n/a through 12.1. |
CVE-2023-47649 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in PriceListo Best Restaurant Menu by PriceListo.This issue affects Best Restaurant Menu by PriceListo: from n/… |
CVE-2023-47644 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid… |
CVE-2023-47556 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in James Mehorter Device Theme Switcher.This issue affects Device Theme Switcher: from n/a through 3.0.2. |
CVE-2023-47553 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in User Local Inc UserHeat Plugin.This issue affects UserHeat Plugin: from n/a through 1.1.6. |
CVE-2023-47552 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Image Hover Effects – WordPress Plugin.This issue affects Image Hover Effects – WordPress Plugin… |
CVE-2023-47551 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations.This issue affects Donations Made Easy – Smart Donations: from… |
CVE-2023-47531 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Dark Mode.This issue affects Droit Dark Mode: from n/a through 1.1.2. |
CVE-2023-47519 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in WC Product Table WooCommerce Product Table Lite.This issue affects WooCommerce Product Table Lite: from n/a… |
CVE-2023-47243 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in CodeMShop 코드엠샵 마이사이트 – MSHOP MY SITE.This issue affects 코드엠샵 마이사이트 – MSHOP MY SITE: from n/a through 1.1.6. |
CVE-2023-47685 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Lukman Nakib Preloader Matrix.This issue affects Preloader Matrix: from n/a through 2.0.1. |
CVE-2023-47672 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Swashata WP Category Post List Widget.This issue affects WP Category Post List Widget: from n/a through 2.0… |
CVE-2023-47671 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy Vertical scroll recent.This issue affects Vertical scroll recent post: from n/a through 14.0. |
CVE-2023-47670 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Jongmyoung Kim Korea SNS.This issue affects Korea SNS: from n/a through 1.6.3. |
CVE-2023-47667 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Mammothology WP Full Stripe Free.This issue affects WP Full Stripe Free: from n/a through 7.0.16. |
CVE-2023-47666 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Code Snippets Pro Code Snippets.This issue affects Code Snippets: from n/a through 3.5.0. |
CVE-2023-47664 | Medium | 6.5 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview Plainview Protect Passwords.This issue affects Plainview Protect Passwords: from n/a throug… |
CVE-2023-48736 | Medium | 6.5 | 2023-11-18 | In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read. |
CVE-2023-40363 | High | 8.1 | 2023-11-18 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings. IBM X-Force I… |
CVE-2023-38361 | Medium | 5.9 | 2023-11-18 | IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2023-40817 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field. |
CVE-2023-40816 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field. |
CVE-2023-40815 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field. |
CVE-2023-40814 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field. |
CVE-2023-40813 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation. |
CVE-2023-40812 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field. |
CVE-2023-40810 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field. |
CVE-2023-40809 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number. |
CVE-2023-6187 | High | 7.5 | 2023-11-18 | The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_sess… |
CVE-2023-4214 | High | 8.1 | 2023-11-18 | The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating… |
CVE-2023-48017 | High | 8.8 | 2023-11-18 | Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management. |
CVE-2023-48028 | Critical | 9.8 | 2023-11-18 | kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based o… |
CVE-2023-46402 | High | 7.5 | 2023-11-18 | git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go. |
CVE-2023-44796 | Medium | 5.4 | 2023-11-18 | Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the… |
CVE-2023-43177 | Critical | 9.8 | 2023-11-18 | CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. |
CVE-2023-48294 | Medium | 4.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2023-48238 | High | 7.5 | 2023-11-17 | joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to b… |
CVE-2023-46745 | Medium | 5.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2023-48295 | Medium | 6.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affe… |
CVE-2023-6188 | Medium | 4.7 | 2023-11-17 | A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edi… |
CVE-2023-48185 | High | 7.5 | 2023-11-17 | Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request. |
CVE-2023-6179 | High | 7.8 | 2023-11-17 | Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potenti… |
CVE-2023-48025 | High | 8.1 | 2023-11-17 | Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get_length(lisp_cell_t * x) at eval.c |
CVE-2023-48024 | Medium | 6.5 | 2023-11-17 | Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hash_destroy(hash_table_t *h) at hash.c |
CVE-2023-44355 | Medium | 4.3 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Secu… |
CVE-2023-44353 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-44352 | Medium | 6.1 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenti… |
CVE-2023-44351 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-44350 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-26364 | Medium | 5.3 | 2023-11-17 | @adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while atte… |
CVE-2023-26347 | High | 7.5 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Securi… |
CVE-2023-48029 | High | 8.0 | 2023-11-17 | Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploi… |
CVE-2023-44324 | Critical | 9.8 | 2023-11-17 | Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature b… |
CVE-2023-22275 | High | 7.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2023-22274 | High | 7.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead… |
CVE-2023-22273 | High | 7.2 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2023-22272 | High | 7.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Input Validation vulnerability that could lead to information disclosure by an unau… |
CVE-2023-22268 | Medium | 6.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2023-47073 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary cod… |
CVE-2023-47072 | Low | 3.3 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to dis… |
CVE-2023-47071 | Medium | 5.5 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of se… |
CVE-2023-47070 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary cod… |
CVE-2023-47069 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-47068 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-47067 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-47066 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-5445 | Medium | 5.4 | 2023-11-17 | An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the p… |
CVE-2023-5444 | High | 8.0 | 2023-11-17 | A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new u… |
CVE-2023-47757 | Medium | 4.3 | 2023-11-17 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation… |
CVE-2023-44326 | Medium | 5.5 | 2023-11-17 | Adobe Dimension versions 3.4.9 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-44325 | Medium | 5.5 | 2023-11-17 | Adobe Animate versions 23.0.2 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker c… |
CVE-2023-47797 | Critical | 9.6 | 2023-11-17 | Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject… |
CVE-2023-41102 | High | 7.5 | 2023-11-17 | An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may l… |
CVE-2023-41101 | Critical | 9.8 | 2023-11-17 | An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length of the query string… |
CVE-2023-39548 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-39547 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-39546 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-39545 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-39544 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-38324 | Medium | 5.3 | 2023-11-17 | An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS… |
CVE-2023-38322 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a do_binauth NULL pointer dereference that be triggered with a crafted GET HTTP… |