2023 CVEs (page 107)
Page 107 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47311 | Medium | 6.1 | 2023-11-20 | An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking. |
CVE-2023-47172 | High | 7.8 | 2023-11-20 | Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and S… |
CVE-2023-46471 | Medium | 5.4 | 2023-11-20 | Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the text variable script… |
CVE-2023-46470 | Medium | 5.4 | 2023-11-20 | Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via crafted telecommand in t… |
CVE-2023-48111 | High | 7.5 | 2023-11-20 | Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the function saveParentControlInfo . This vulnerability allows attac… |
CVE-2023-48110 | High | 7.5 | 2023-11-20 | Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the function saveParentControlInfo . This vulnerability allows attack… |
CVE-2023-48109 | High | 7.5 | 2023-11-20 | Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the deviceId parameter in the function saveParentControlInfo . This vulnerability allows at… |
CVE-2023-47417 | Medium | 6.1 | 2023-11-20 | Cross Site Scripting (XSS) vulnerability in the component /shells/embedder.html of DZSlides after v2011.07.25 allows attackers to execute arbitrary code via a… |
CVE-2023-46990 | Critical | 9.8 | 2023-11-20 | Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the writeReplace funct… |
CVE-2023-38823 | Critical | 9.8 | 2023-11-20 | Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to execute arbitrary code via the formSetCfm f… |
CVE-2023-5799 | Medium | 5.4 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have proper authorisation when deleting a package, allowing Contributor and above roles to delete p… |
CVE-2023-5652 | Critical | 9.8 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not escape user input before using it in a SQL… |
CVE-2023-5651 | Medium | 5.4 | 2023-11-20 | The WP Hotel Booking WordPress plugin before 2.0.8 does not have authorisation and CSRF checks, as well as does not ensure that the package to be deleted is a… |
CVE-2023-5640 | Critical | 9.8 | 2023-11-20 | The Article Analytics WordPress plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to una… |
CVE-2023-5610 | Medium | 5.4 | 2023-11-20 | The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user to, leading to an arbitrary redirect |
CVE-2023-5609 | Medium | 6.1 | 2023-11-20 | The Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflect… |
CVE-2023-5509 | Medium | 5.4 | 2023-11-20 | The myStickymenu WordPress plugin before 2.6.5 does not adequately authorize some ajax calls, allowing any logged-in user to perform the actions. |
CVE-2023-5343 | Medium | 4.8 | 2023-11-20 | The Popup box WordPress plugin before 3.7.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2023-5340 | Critical | 9.8 | 2023-11-20 | The Five Star Restaurant Menu and Food Ordering WordPress plugin before 2.4.11 unserializes user input via an AJAX action available to unauthenticated users, a… |
CVE-2023-5140 | Medium | 6.1 | 2023-11-20 | The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-S… |
CVE-2023-5119 | Medium | 4.8 | 2023-11-20 | The Forminator WordPress plugin before 1.27.0 does not properly sanitize the redirect-url field in the form submission settings, which could allow high-privile… |
CVE-2023-4970 | Medium | 4.8 | 2023-11-20 | The PubyDoc WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform C… |
CVE-2023-4824 | High | 8.8 | 2023-11-20 | The WooHoo Newspaper Magazine theme does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change… |
CVE-2023-4808 | Medium | 4.8 | 2023-11-20 | The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perfo… |
CVE-2023-4799 | Medium | 5.4 | 2023-11-20 | The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where t… |
CVE-2023-48309 | Medium | 5.3 | 2023-11-20 | NextAuth.js provides authentication for Next.js. `next-auth` applications prior to version 4.24.5 that rely on the default Middleware authorization are affecte… |
CVE-2023-48300 | Medium | 6.3 | 2023-11-20 | The `Embed Privacy` plugin for WordPress that prevents the loading of embedded external content is vulnerable to Stored Cross-Site Scripting via `embed_privacy… |
CVE-2023-48293 | High | 8.8 | 2023-11-20 | The XWiki Admin Tools Application provides tools to help the administration of XWiki. Prior to version 4.5.1, a cross-site request forgery vulnerability in the… |
CVE-2023-38885 | High | 8.8 | 2023-11-20 | OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app. This may allow an attacker to trick… |
CVE-2023-38884 | High | 7.5 | 2023-11-20 | An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated remote attacker to a… |
CVE-2023-38883 | Medium | 6.1 | 2023-11-20 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitra… |
CVE-2023-38882 | Medium | 6.1 | 2023-11-20 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitra… |
CVE-2023-38881 | Medium | 6.1 | 2023-11-20 | A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to execute arbitra… |
CVE-2023-38880 | Critical | 9.8 | 2023-11-20 | The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality. Whenever an admin… |
CVE-2023-38879 | High | 7.5 | 2023-11-20 | The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulnerability in the 'fi… |
CVE-2023-48292 | Critical | 9.6 | 2023-11-20 | The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request… |
CVE-2023-48241 | High | 7.5 | 2023-11-20 | XWiki Platform is a generic wiki platform. Starting in version 6.3-milestone-2 and prior to versions 14.10.15, 15.5.1, and 15.6RC1, the Solr-based search sugge… |
CVE-2023-48240 | Critical | 9.0 | 2023-11-20 | XWiki Platform is a generic wiki platform. The rendered diff in XWiki embeds images to be able to compare the contents and not display a difference for an actu… |
CVE-2023-48223 | Medium | 5.9 | 2023-11-20 | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to version 3.3.2, the fast-jwt library does not properly prevent JWT algorithm confusion for… |
CVE-2023-48221 | High | 7.3 | 2023-11-20 | wire-avs provides Audio, Visual, and Signaling (AVS) functionality sure the secure messaging software Wire. Prior to versions 9.2.22 and 9.3.5, a remote format… |
CVE-2023-48218 | Medium | 5.3 | 2023-11-20 | The Strapi Protected Populate Plugin protects `get` endpoints from revealing too much information. Prior to version 1.3.4, users were able to bypass the field… |
CVE-2023-35762 | Critical | 9.9 | 2023-11-20 | Versions of INEA ME RTU firmware 3.36b and prior are vulnerable to operating system (OS) command injection, which could allow remote code execution. |
CVE-2023-29155 | Critical | 9.8 | 2023-11-20 | Versions of INEA ME RTU firmware 3.36b and prior do not require authentication to the "root" account on the host system of the device. This could allow an atta… |
CVE-2023-36013 | Medium | 6.5 | 2023-11-20 | PowerShell Information Disclosure Vulnerability |
CVE-2023-6197 | Medium | 5.4 | 2023-11-20 | The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or inco… |
CVE-2023-6196 | High | 8.8 | 2023-11-20 | The Audio Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.0.4. This is due to missing or inco… |
CVE-2023-48090 | High | 7.1 | 2023-11-20 | GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329. |
CVE-2023-48039 | Medium | 5.5 | 2023-11-20 | GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75. |
CVE-2023-47772 | Medium | 6.5 | 2023-11-20 | Contributor+ Stored Cross-Site Scripting (XSS) vulnerability in Slider Revolution <= 6.6.14. |
CVE-2023-6045 | Medium | 5.9 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through type confusion. |
CVE-2023-5593 | High | 7.8 | 2023-11-20 | The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software version 4.0.4.0 could allow an authenticated local user to gain… |
CVE-2023-47217 | Medium | 4.0 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker cause DOS through buffer overflow. |
CVE-2023-46705 | Medium | 6.2 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker causes system information leak through type confusion. |
CVE-2023-46100 | Medium | 6.2 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get sensitive buffer information through use of uninitialized resource. |
CVE-2023-43612 | High | 8.4 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker arbitrary file read and write through improper preservation of permissions. |
CVE-2023-42774 | Medium | 6.2 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information through incorrect default permissions. |
CVE-2023-3116 | High | 7.3 | 2023-11-20 | in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions. |
CVE-2023-46302 | Critical | 9.8 | 2023-11-20 | Apache Software Foundation Apache Submarine has a bug when serializing against yaml. The bug is caused by snakeyaml https://nvd.nist.gov/vuln/detail/CVE-2022-… |
CVE-2023-3379 | Medium | 5.3 | 2023-11-20 | Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin use… |
CVE-2023-47175 | Medium | 6.1 | 2023-11-20 | Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a rem… |
CVE-2023-46700 | Critical | 9.8 | 2023-11-20 | SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) allows a remote una… |
CVE-2023-5341 | Medium | 6.2 | 2023-11-19 | A heap use-after-free flaw was found in coders/bmp.c in ImageMagick. |
CVE-2023-41129 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress.This issue affects Patreon WordPress: from n/a through 1.8.6. |
CVE-2023-32514 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Himanshu Parashar Google Site Verification plugin using Meta Tag.This issue affects Google Site Verification… |
CVE-2023-32504 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Kainex Wise Chat.This issue affects Wise Chat: from n/a through 3.1.3. |
CVE-2023-32245 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in WPDeveloper Essential Addons for Elementor Pro.This issue affects Essential Addons for Elementor Pro: from n… |
CVE-2023-31089 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Tradebooster Video XML Sitemap Generator.This issue affects Video XML Sitemap Generator: from n/a through 1… |
CVE-2023-31075 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Arshid Easy Hide Login.This issue affects Easy Hide Login: from n/a through 1.0.8. |
CVE-2023-28780 | Medium | 6.5 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Yoast Yoast Local Premium.This issue affects Yoast Local Premium: from n/a through 14.8. |
CVE-2023-25985 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Tomas | Docs | FAQ | Premium Support WordPress Tooltips.This issue affects WordPress Tooltips: from n/a thro… |
CVE-2023-47655 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Milesi ANAC XML Bandi di Gara.This issue affects ANAC XML Bandi di Gara: from n/a through 7.5. |
CVE-2023-47651 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Robert Macchi WP Links Page.This issue affects WP Links Page: from n/a through 4.9.4. |
CVE-2023-47650 | Medium | 6.5 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar: from n/a through 12.1. |
CVE-2023-47649 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in PriceListo Best Restaurant Menu by PriceListo.This issue affects Best Restaurant Menu by PriceListo: from n/… |
CVE-2023-47644 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid… |
CVE-2023-47556 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in James Mehorter Device Theme Switcher.This issue affects Device Theme Switcher: from n/a through 3.0.2. |
CVE-2023-47553 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in User Local Inc UserHeat Plugin.This issue affects UserHeat Plugin: from n/a through 1.1.6. |
CVE-2023-47552 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Labib Ahmed Image Hover Effects – WordPress Plugin.This issue affects Image Hover Effects – WordPress Plugin… |
CVE-2023-47551 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations.This issue affects Donations Made Easy – Smart Donations: from… |
CVE-2023-47531 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in DroitThemes Droit Dark Mode.This issue affects Droit Dark Mode: from n/a through 1.1.2. |
CVE-2023-47519 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in WC Product Table WooCommerce Product Table Lite.This issue affects WooCommerce Product Table Lite: from n/a… |
CVE-2023-47243 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in CodeMShop 코드엠샵 마이사이트 – MSHOP MY SITE.This issue affects 코드엠샵 마이사이트 – MSHOP MY SITE: from n/a through 1.1.6. |
CVE-2023-47685 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Lukman Nakib Preloader Matrix.This issue affects Preloader Matrix: from n/a through 2.0.1. |
CVE-2023-47672 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Swashata WP Category Post List Widget.This issue affects WP Category Post List Widget: from n/a through 2.0… |
CVE-2023-47671 | Medium | 5.4 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Gopi Ramasamy Vertical scroll recent.This issue affects Vertical scroll recent post: from n/a through 14.0. |
CVE-2023-47670 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Jongmyoung Kim Korea SNS.This issue affects Korea SNS: from n/a through 1.6.3. |
CVE-2023-47667 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Mammothology WP Full Stripe Free.This issue affects WP Full Stripe Free: from n/a through 7.0.16. |
CVE-2023-47666 | Medium | 4.3 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Code Snippets Pro Code Snippets.This issue affects Code Snippets: from n/a through 3.5.0. |
CVE-2023-47664 | Medium | 6.5 | 2023-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in edward_plainview Plainview Protect Passwords.This issue affects Plainview Protect Passwords: from n/a throug… |
CVE-2023-48736 | Medium | 6.5 | 2023-11-18 | In International Color Consortium DemoIccMAX 3e7948b, CIccCLUT::Interp2d in IccTagLut.cpp in libSampleICC.a has an out-of-bounds read. |
CVE-2023-40363 | High | 8.1 | 2023-11-18 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to change installation files due to incorrect file permission settings. IBM X-Force I… |
CVE-2023-38361 | Medium | 5.9 | 2023-11-18 | IBM CICS TX Advanced 10.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2023-40817 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Product Configuration Name Field. |
CVE-2023-40816 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Milestone Name Field. |
CVE-2023-40815 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Category Creation Name Field. |
CVE-2023-40814 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Name Field. |
CVE-2023-40813 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Activity Saved Search Creation. |
CVE-2023-40812 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Accounts Group Name Field. |
CVE-2023-40810 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via Product Name Field. |
CVE-2023-40809 | Medium | 6.1 | 2023-11-18 | OpenCRX version 5.2.0 is vulnerable to HTML injection via the Activity Search Criteria-Activity Number. |