2023 CVEs (page 108)
Page 108 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38320 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafte… |
CVE-2023-38316 | Critical | 9.8 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS comma… |
CVE-2023-38315 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a try_to_authenticate NULL pointer dereference that can be triggered with a cra… |
CVE-2023-38314 | Medium | 6.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated() that can be triggered with a c… |
CVE-2023-38313 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer dereference that can be triggered with a crafted GET HTTP req… |
CVE-2023-48659 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. |
CVE-2023-48658 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. |
CVE-2023-48657 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. |
CVE-2023-48656 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. |
CVE-2023-48655 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. |
CVE-2023-47675 | High | 7.2 | 2023-11-17 | CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. |
CVE-2023-47283 | Medium | 4.9 | 2023-11-17 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the sys… |
CVE-2023-42428 | Medium | 6.5 | 2023-11-17 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and… |
CVE-2023-38130 | High | 8.1 | 2023-11-17 | Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system. |
CVE-2023-48649 | Low | 3.5 | 2023-11-17 | Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name. |
CVE-2023-48648 | Critical | 9.8 | 2023-11-17 | Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation function… |
CVE-2023-48031 | Critical | 9.8 | 2023-11-17 | OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions an… |
CVE-2023-45387 | Critical | 9.8 | 2023-11-17 | In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform… |
CVE-2023-45382 | High | 7.5 | 2023-11-17 | In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restri… |
CVE-2023-48078 | Critical | 9.8 | 2023-11-17 | SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter. |
CVE-2023-48237 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possi… |
CVE-2023-48236 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user… |
CVE-2023-48235 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the ex… |
CVE-2023-48234 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user… |
CVE-2023-48233 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_to… |
CVE-2023-48232 | Low | 3.9 | 2023-11-16 | Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling i… |
CVE-2023-48231 | Low | 3.9 | 2023-11-16 | Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the a… |
CVE-2023-47687 | Medium | 4.3 | 2023-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in VJInfotech Woo Custom and Sequential Order Number plugin <= 2.6.0 versions. |
CVE-2023-47686 | Medium | 4.3 | 2023-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.2.2 versions. |
CVE-2023-47025 | Medium | 5.5 | 2023-11-16 | An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component. |
CVE-2023-48222 | High | 8.1 | 2023-11-16 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck… |
CVE-2023-47688 | Medium | 4.3 | 2023-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in Alexufo Youtube SpeedLoad plugin <= 0.6.3 versions. |
CVE-2023-47642 | Medium | 4.3 | 2023-11-16 | Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stre… |
CVE-2023-47112 | Medium | 4.3 | 2023-11-16 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck… |
CVE-2023-40314 | Medium | 5.8 | 2023-11-16 | Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. Th… |
CVE-2023-6020 | High | 7.5 | 2023-11-16 | LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. |
CVE-2023-6014 | Critical | 9.8 | 2023-11-16 | An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. |
CVE-2023-46214 | High | 8.0 | 2023-11-16 | In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that user… |
CVE-2023-46213 | Medium | 4.8 | 2023-11-16 | In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized… |
CVE-2023-39926 | High | 7.1 | 2023-11-16 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Acurax Under Construction / Maintenance Mode from Acurax plugin <= 2.6 versions. |
CVE-2023-36026 | Medium | 4.3 | 2023-11-16 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-36008 | Medium | 6.6 | 2023-11-16 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-34375 | High | 7.1 | 2023-11-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web SEO by 10Web plugin <= 1.2.9 versions. |
CVE-2023-32957 | Medium | 5.9 | 2023-11-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dazzlersoft Team Members Showcase plugin <= 1.3.4 versions. |
CVE-2023-32796 | High | 7.1 | 2023-11-16 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in MingoCommerce WooCommerce Product Enquiry plugin <= 2.3.4 versions. |
CVE-2023-28621 | High | 7.1 | 2023-11-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wishfulthemes Raise Mag, Wishfulthemes Wishful Blog theme… |
CVE-2023-48134 | High | 7.5 | 2023-11-16 | nagayama_copabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. |
CVE-2023-47512 | High | 7.1 | 2023-11-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions. |
CVE-2023-47511 | Medium | 5.9 | 2023-11-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in SO WP Pinyin Slugs plugin <= 2.3.0 versions. |
CVE-2023-47509 | High | 7.1 | 2023-11-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ioannup Edit WooCommerce Templates plugin <= 1.1.1 versions. |
CVE-2023-47508 | High | 7.1 | 2023-11-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Averta Master Slider Pro plugin <= 3.6.5 versions. |
CVE-2023-47245 | Medium | 5.9 | 2023-11-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Viewer plugin <= 1.7 versions. |
CVE-2023-47242 | Medium | 6.5 | 2023-11-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Bandi di Gara plugin <= 7.5 versions. |
CVE-2023-47240 | Medium | 6.5 | 2023-11-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Codeboxr CBX Map for Google Map & OpenStreetMap plugin <= 1.1.11 versions. |
CVE-2023-47239 | Medium | 6.5 | 2023-11-16 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Scott Paterson Easy PayPal Shopping Cart plugin <= 1.1.10 versions. |
CVE-2023-6176 | Medium | 4.7 | 2023-11-16 | A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user cons… |
CVE-2023-48056 | High | 7.5 | 2023-11-16 | PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of infor… |
CVE-2023-48055 | High | 7.5 | 2023-11-16 | SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations. This vulnerability can lead to the disclosure of information and communicatio… |
CVE-2023-48054 | High | 7.4 | 2023-11-16 | Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle att… |
CVE-2023-48053 | High | 7.5 | 2023-11-16 | Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of informa… |
CVE-2023-48052 | High | 7.4 | 2023-11-16 | Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack. |
CVE-2023-47514 | High | 7.1 | 2023-11-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in lawrenceowen, gcubero, acunnningham, fmahmood Star CloudPRNT for WooCommerce plugin <= 2.0.3 vers… |
CVE-2023-6038 | High | 7.5 | 2023-11-16 | A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with t… |
CVE-2023-6022 | High | 8.8 | 2023-11-16 | Cross-Site Request Forgery (CSRF) in GitHub repository prefecthq/prefect prior to 2.16.5. |
CVE-2023-6021 | High | 7.5 | 2023-11-16 | LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' re… |
CVE-2023-6019 | Critical | 9.8 | 2023-11-16 | A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely witho… |
CVE-2023-6017 | High | 7.1 | 2023-11-16 | H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL. |
CVE-2023-6013 | Medium | 5.4 | 2023-11-16 | H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack. |
CVE-2023-47060 | Low | 3.3 | 2023-11-16 | Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclo… |
CVE-2023-47059 | High | 7.8 | 2023-11-16 | Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which cou… |
CVE-2023-47058 | High | 7.8 | 2023-11-16 | Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which cou… |
CVE-2023-47057 | High | 7.8 | 2023-11-16 | Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code e… |
CVE-2023-47056 | High | 7.8 | 2023-11-16 | Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary… |
CVE-2023-47055 | High | 7.8 | 2023-11-16 | Adobe Premiere Pro version 24.0 (and earlier) and 23.6 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code executi… |
CVE-2023-6023 | High | 7.5 | 2023-11-16 | An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter. |
CVE-2023-6018 | Critical | 9.8 | 2023-11-16 | An attacker can overwrite any file on the server hosting MLflow without any authentication. |
CVE-2023-6016 | Critical | 9.8 | 2023-11-16 | An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature. |
CVE-2023-6015 | High | 7.5 | 2023-11-16 | MLflow allowed arbitrary files to be PUT onto the server. |
CVE-2023-47054 | Medium | 5.5 | 2023-11-16 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosu… |
CVE-2023-47053 | Medium | 5.5 | 2023-11-16 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to disclosu… |
CVE-2023-47052 | Medium | 5.5 | 2023-11-16 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensiti… |
CVE-2023-47051 | Medium | 5.5 | 2023-11-16 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary co… |
CVE-2023-47050 | Medium | 5.5 | 2023-11-16 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could… |
CVE-2023-47049 | Medium | 5.5 | 2023-11-16 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could… |
CVE-2023-47048 | Medium | 5.5 | 2023-11-16 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could… |
CVE-2023-47047 | Medium | 5.5 | 2023-11-16 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitr… |
CVE-2023-47046 | Medium | 5.5 | 2023-11-16 | Adobe Audition version 24.0 (and earlier) and 23.6.1 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code exe… |
CVE-2023-26368 | High | 7.8 | 2023-11-16 | Adobe InCopy versions 18.5 (and earlier) and 17.4.2 (and earlier) are affected by are affected by an out-of-bounds read vulnerability when parsing a crafted fi… |
CVE-2023-6121 | Medium | 4.3 | 2023-11-16 | An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP pa… |
CVE-2023-47044 | Medium | 5.5 | 2023-11-16 | Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to dis… |
CVE-2023-47043 | High | 7.8 | 2023-11-16 | Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-47042 | High | 7.8 | 2023-11-16 | Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitra… |
CVE-2023-47041 | High | 7.8 | 2023-11-16 | Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary cod… |
CVE-2023-47040 | High | 7.8 | 2023-11-16 | Adobe Media Encoder version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-44335 | Medium | 5.5 | 2023-11-16 | Adobe Photoshop versions 24.7.1 (and earlier) and 25.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensi… |
CVE-2023-44334 | Medium | 5.5 | 2023-11-16 | Adobe Photoshop versions 24.7.1 (and earlier) and 25.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensi… |
CVE-2023-44333 | Medium | 5.5 | 2023-11-16 | Adobe Photoshop versions 24.7.1 (and earlier) and 25.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensi… |
CVE-2023-44332 | Medium | 5.5 | 2023-11-16 | Adobe Photoshop versions 24.7.1 (and earlier) and 25.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensi… |
CVE-2023-44331 | Medium | 5.5 | 2023-11-16 | Adobe Photoshop versions 24.7.1 (and earlier) and 25.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensi… |
CVE-2023-44330 | High | 7.8 | 2023-11-16 | Adobe Photoshop versions 24.7.1 (and earlier) and 25.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code e… |