2023 CVEs (page 108)
Page 108 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-6187 | High | 7.5 | 2023-11-18 | The Paid Memberships Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'pmpro_paypalexpress_sess… |
CVE-2023-4214 | High | 8.1 | 2023-11-18 | The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 4.2.5. This is due to the plugin generating… |
CVE-2023-48017 | High | 8.8 | 2023-11-18 | Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) via Add permissions to CSRF in Permission Management. |
CVE-2023-48028 | Critical | 9.8 | 2023-11-18 | kodbox 1.46.01 has a security flaw that enables user enumeration. This problem is present on the login page, where an attacker can identify valid users based o… |
CVE-2023-46402 | High | 7.5 | 2023-11-18 | git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go. |
CVE-2023-44796 | Medium | 5.4 | 2023-11-18 | Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a crafted script to the… |
CVE-2023-43177 | Critical | 9.8 | 2023-11-18 | CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. |
CVE-2023-48294 | Medium | 4.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2023-48238 | High | 7.5 | 2023-11-17 | joaquimserafim/json-web-token is a javascript library use to interact with JSON Web Tokens (JWT) which are a compact URL-safe means of representing claims to b… |
CVE-2023-46745 | Medium | 5.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. In a… |
CVE-2023-48295 | Medium | 6.3 | 2023-11-17 | LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring which includes support for a wide range of network hardware and operating systems. Affe… |
CVE-2023-6188 | Medium | 4.7 | 2023-11-17 | A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It has been rated as critical. This issue affects some unknown processing of the file /admin/theme-edi… |
CVE-2023-48185 | High | 7.5 | 2023-11-17 | Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a crafted GET request. |
CVE-2023-6179 | High | 7.8 | 2023-11-17 | Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folder(s). A(n) attacker could potenti… |
CVE-2023-48025 | High | 8.1 | 2023-11-17 | Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get_length(lisp_cell_t * x) at eval.c |
CVE-2023-48024 | Medium | 6.5 | 2023-11-17 | Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hash_destroy(hash_table_t *h) at hash.c |
CVE-2023-44355 | Medium | 4.3 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Input Validation vulnerability that could result in a Secu… |
CVE-2023-44353 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-44352 | Medium | 6.1 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an unauthenti… |
CVE-2023-44351 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-44350 | Critical | 9.8 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Deserialization of Untrusted Data vulnerability that could result i… |
CVE-2023-26364 | Medium | 5.3 | 2023-11-17 | @adobe/css-tools version 4.3.0 and earlier are affected by an Improper Input Validation vulnerability that could result in a minor denial of service while atte… |
CVE-2023-26347 | High | 7.5 | 2023-11-17 | Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Securi… |
CVE-2023-48029 | High | 8.0 | 2023-11-17 | Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploi… |
CVE-2023-44324 | Critical | 9.8 | 2023-11-17 | Adobe FrameMaker Publishing Server versions 2022 and earlier are affected by an Improper Authentication vulnerability that could result in a Security feature b… |
CVE-2023-22275 | High | 7.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2023-22274 | High | 7.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead… |
CVE-2023-22273 | High | 7.2 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability… |
CVE-2023-22272 | High | 7.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Input Validation vulnerability that could lead to information disclosure by an unau… |
CVE-2023-22268 | Medium | 6.5 | 2023-11-17 | Adobe RoboHelp Server versions 11.4 and earlier are affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnera… |
CVE-2023-47073 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary cod… |
CVE-2023-47072 | Low | 3.3 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an Access of Uninitialized Pointer vulnerability that could lead to dis… |
CVE-2023-47071 | Medium | 5.5 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of se… |
CVE-2023-47070 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary cod… |
CVE-2023-47069 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-47068 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-47067 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-47066 | High | 7.8 | 2023-11-17 | Adobe After Effects version 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which… |
CVE-2023-5445 | Medium | 5.4 | 2023-11-17 | An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL parameter for the p… |
CVE-2023-5444 | High | 8.0 | 2023-11-17 | A Cross Site Request Forgery vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2 allows a remote low privilege user to successfully add a new u… |
CVE-2023-47757 | Medium | 4.3 | 2023-11-17 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation… |
CVE-2023-44326 | Medium | 5.5 | 2023-11-17 | Adobe Dimension versions 3.4.9 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2023-44325 | Medium | 5.5 | 2023-11-17 | Adobe Animate versions 23.0.2 (and earlier) is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker c… |
CVE-2023-47797 | Critical | 9.6 | 2023-11-17 | Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject… |
CVE-2023-41102 | High | 7.5 | 2023-11-17 | An issue was discovered in the captive portal in OpenNDS before version 10.1.3. It has multiple memory leaks due to not freeing up allocated memory. This may l… |
CVE-2023-41101 | Critical | 9.8 | 2023-11-17 | An issue was discovered in the captive portal in OpenNDS before version 10.1.3. get_query in http_microhttpd.c does not validate the length of the query string… |
CVE-2023-39548 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-39547 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-39546 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-39545 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-39544 | High | 8.8 | 2023-11-17 | CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and… |
CVE-2023-38324 | Medium | 5.3 | 2023-11-17 | An issue was discovered in OpenNDS before 10.1.2. It allows users to skip the splash page sequence (and directly authenticate) when it is using the default FAS… |
CVE-2023-38322 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a do_binauth NULL pointer dereference that be triggered with a crafted GET HTTP… |
CVE-2023-38320 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a show_preauthpage NULL pointer dereference that can be triggered with a crafte… |
CVE-2023-38316 | Critical | 9.8 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. When the custom unescape callback is enabled, attackers can execute arbitrary OS comma… |
CVE-2023-38315 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a try_to_authenticate NULL pointer dereference that can be triggered with a cra… |
CVE-2023-38314 | Medium | 6.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before version 10.1.2. It has a NULL pointer dereference in preauthenticated() that can be triggered with a c… |
CVE-2023-38313 | High | 7.5 | 2023-11-17 | An issue was discovered in OpenNDS Captive Portal before 10.1.2. it has a do_binauth NULL pointer dereference that can be triggered with a crafted GET HTTP req… |
CVE-2023-48659 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Controller/AppController.php mishandles parameter parsing. |
CVE-2023-48658 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php lacks a checkParam function for alphanumerics, underscore, dash, period, and space. |
CVE-2023-48657 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles filters. |
CVE-2023-48656 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Model/AppModel.php mishandles order clauses. |
CVE-2023-48655 | Critical | 9.8 | 2023-11-17 | An issue was discovered in MISP before 2.4.176. app/Controller/Component/IndexFilterComponent.php does not properly filter out query parameters. |
CVE-2023-47675 | High | 7.2 | 2023-11-17 | CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. |
CVE-2023-47283 | Medium | 4.9 | 2023-11-17 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtain files in the sys… |
CVE-2023-42428 | Medium | 6.5 | 2023-11-17 | Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to delete directories and… |
CVE-2023-38130 | High | 8.1 | 2023-11-17 | Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the system. |
CVE-2023-48649 | Low | 3.5 | 2023-11-17 | Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name. |
CVE-2023-48648 | Critical | 9.8 | 2023-11-17 | Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. File creation function… |
CVE-2023-48031 | Critical | 9.8 | 2023-11-17 | OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the comment function, an attacker can bypass security restrictions an… |
CVE-2023-45387 | Critical | 9.8 | 2023-11-17 | In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a guest can perform… |
CVE-2023-45382 | High | 7.5 | 2023-11-17 | In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal information without restri… |
CVE-2023-48078 | Critical | 9.8 | 2023-11-17 | SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' parameter. |
CVE-2023-48237 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. In affected versions when shifting lines in operator pending mode and using a very large value, it may be possi… |
CVE-2023-48236 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. When using the z= command, the user may overflow the count with values larger than MAX_INT. Impact is low, user… |
CVE-2023-48235 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. When parsing relative ex addresses one may unintentionally cause an overflow. Ironically this happens in the ex… |
CVE-2023-48234 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. When getting the count for a normal mode z command, it may overflow for large counts given. Impact is low, user… |
CVE-2023-48233 | Low | 2.8 | 2023-11-16 | Vim is an open source command line text editor. If the count after the :s command is larger than what fits into a (signed) long variable, abort with e_value_to… |
CVE-2023-48232 | Low | 3.9 | 2023-11-16 | Vim is an open source command line text editor. A floating point exception may occur when calculating the line offset for overlong lines and smooth scrolling i… |
CVE-2023-48231 | Low | 3.9 | 2023-11-16 | Vim is an open source command line text editor. When closing a window, vim may try to access already freed window structure. Exploitation beyond crashing the a… |
CVE-2023-47687 | Medium | 4.3 | 2023-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in VJInfotech Woo Custom and Sequential Order Number plugin <= 2.6.0 versions. |
CVE-2023-47686 | Medium | 4.3 | 2023-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in Kiboko Labs Arigato Autoresponder and Newsletter plugin <= 2.7.2.2 versions. |
CVE-2023-47025 | Medium | 5.5 | 2023-11-16 | An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component. |
CVE-2023-48222 | High | 8.1 | 2023-11-16 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck… |
CVE-2023-47688 | Medium | 4.3 | 2023-11-16 | Cross-Site Request Forgery (CSRF) vulnerability in Alexufo Youtube SpeedLoad plugin <= 0.6.3 versions. |
CVE-2023-47642 | Medium | 4.3 | 2023-11-16 | Zulip is an open-source team collaboration tool. It was discovered by the Zulip development team that active users who had previously been subscribed to a stre… |
CVE-2023-47112 | Medium | 4.3 | 2023-11-16 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck… |
CVE-2023-40314 | Medium | 5.8 | 2023-11-16 | Cross-site scripting in bootstrap.jsp in multiple versions of OpenNMS Meridian and Horizon allows an attacker access to confidential session information. Th… |
CVE-2023-6020 | High | 7.5 | 2023-11-16 | LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. |
CVE-2023-6014 | Critical | 9.8 | 2023-11-16 | An attacker is able to arbitrarily create an account in MLflow bypassing any authentication requirment. |
CVE-2023-46214 | High | 8.0 | 2023-11-16 | In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that user… |
CVE-2023-46213 | Medium | 4.8 | 2023-11-16 | In Splunk Enterprise versions below 9.0.7 and 9.1.2, ineffective escaping in the “Show syntax Highlighted” feature can result in the execution of unauthorized… |
CVE-2023-39926 | High | 7.1 | 2023-11-16 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Acurax Under Construction / Maintenance Mode from Acurax plugin <= 2.6 versions. |
CVE-2023-36026 | Medium | 4.3 | 2023-11-16 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-36008 | Medium | 6.6 | 2023-11-16 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-34375 | High | 7.1 | 2023-11-16 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 10Web SEO by 10Web plugin <= 1.2.9 versions. |
CVE-2023-32957 | Medium | 5.9 | 2023-11-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Dazzlersoft Team Members Showcase plugin <= 1.3.4 versions. |
CVE-2023-32796 | High | 7.1 | 2023-11-16 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in MingoCommerce WooCommerce Product Enquiry plugin <= 2.3.4 versions. |
CVE-2023-28621 | High | 7.1 | 2023-11-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wishfulthemes Raise Mag, Wishfulthemes Wishful Blog theme… |
CVE-2023-48134 | High | 7.5 | 2023-11-16 | nagayama_copabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor. |