2023 CVEs (page 110)
Page 110 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47308 | Critical | 9.8 | 2023-11-15 | In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL i… |
CVE-2023-43979 | Critical | 9.8 | 2023-11-15 | ETS Soft ybc_blog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component Ybc_blogBlogModuleFrontController::getPosts(). |
CVE-2023-46121 | Medium | 5.0 | 2023-11-15 | yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a r… |
CVE-2023-43591 | High | 7.8 | 2023-11-15 | Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local ac… |
CVE-2023-43590 | High | 7.8 | 2023-11-15 | Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2023-43588 | Low | 3.5 | 2023-11-15 | Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access. |
CVE-2023-43582 | Medium | 5.5 | 2023-11-15 | Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. |
CVE-2023-41718 | High | 7.8 | 2023-11-15 | When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a… |
CVE-2023-39337 | Critical | 9.1 | 2023-11-15 | A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extrac… |
CVE-2023-39335 | Critical | 9.8 | 2023-11-15 | A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existi… |
CVE-2023-38544 | Medium | 5.5 | 2023-11-15 | A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited t… |
CVE-2023-38543 | High | 7.8 | 2023-11-15 | A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulne… |
CVE-2023-38043 | High | 7.8 | 2023-11-15 | A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulne… |
CVE-2023-35080 | High | 7.8 | 2023-11-15 | A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable conf… |
CVE-2023-31100 | High | 8.4 | 2023-11-15 | Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification. This issue affects SecureCore™ Technol… |
CVE-2023-5189 | Medium | 6.3 | 2023-11-14 | A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer o… |
CVE-2023-47518 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Matthew Muro Restrict Categories plugin <= 2.6.4 versions. |
CVE-2023-47517 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions. |
CVE-2023-45627 | Medium | 4.3 | 2023-11-14 | An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to inter… |
CVE-2023-45626 | Medium | 5.5 | 2023-11-14 | An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across b… |
CVE-2023-45625 | High | 7.2 | 2023-11-14 | Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ab… |
CVE-2023-45624 | High | 7.5 | 2023-11-14 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. Successful exploitation of this vulnerabi… |
CVE-2023-45623 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploitation of these vuln… |
CVE-2023-45622 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulner… |
CVE-2023-45621 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2023-45620 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2023-45619 | High | 8.2 | 2023-11-14 | There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of t… |
CVE-2023-45618 | High | 8.2 | 2023-11-14 | There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol). Successful exploit… |
CVE-2023-45617 | High | 8.2 | 2023-11-14 | There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of th… |
CVE-2023-45616 | Critical | 9.8 | 2023-11-14 | There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially… |
CVE-2023-45615 | Critical | 9.8 | 2023-11-14 | There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted p… |
CVE-2023-45614 | Critical | 9.8 | 2023-11-14 | There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted p… |
CVE-2023-41570 | Medium | 5.3 | 2023-11-14 | MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API. |
CVE-2023-39206 | Low | 3.7 | 2023-11-14 | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2023-39205 | Medium | 4.3 | 2023-11-14 | Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-39204 | Medium | 4.3 | 2023-11-14 | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2023-39203 | Medium | 4.3 | 2023-11-14 | Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disc… |
CVE-2023-39202 | Low | 3.1 | 2023-11-14 | Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access. |
CVE-2023-39199 | Medium | 4.9 | 2023-11-14 | Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access. |
CVE-2023-48217 | High | 8.8 | 2023-11-14 | Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like imag… |
CVE-2023-47532 | Medium | 5.8 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themeum WP Crowdfunding plugin <= 2.1.6 versions. |
CVE-2023-47528 | Medium | 5.9 | 2023-11-14 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sajjad Hossain Sagor WP Edit Username plugin <= 1.0.5 versions. |
CVE-2023-47524 | Medium | 5.8 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability (requires PHP 8.x) in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 vers… |
CVE-2023-47522 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Feed plugin <= 2.2.1 versions. |
CVE-2023-47520 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Uno (miunosoft) Responsive Column Widgets plugin <= 1.2.7 versions. |
CVE-2023-46582 | High | 7.8 | 2023-11-14 | SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.ph… |
CVE-2023-46581 | Medium | 5.5 | 2023-11-14 | SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the reg… |
CVE-2023-46580 | Medium | 5.4 | 2023-11-14 | Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php… |
CVE-2023-46026 | Medium | 4.8 | 2023-11-14 | Cross Site Scripting (XSS) vulnerability in profile.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary code v… |
CVE-2023-46025 | Medium | 4.9 | 2023-11-14 | SQL Injection vulnerability in teacher-info.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to obtain sensitive information… |
CVE-2023-46024 | High | 7.5 | 2023-11-14 | SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQL commands and obta… |
CVE-2023-46023 | Medium | 6.5 | 2023-11-14 | SQL injection vulnerability in addTask.php in Code-Projects Simple Task List 1.0 allows attackers to obtain sensitive information via the 'status' parameter. |
CVE-2023-46022 | High | 7.8 | 2023-11-14 | SQL Injection vulnerability in delete.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via the 'bid' parameter. |
CVE-2023-39537 | High | 7.5 | 2023-11-14 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerab… |
CVE-2023-39536 | High | 7.5 | 2023-11-14 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerab… |
CVE-2023-39535 | High | 7.5 | 2023-11-14 | AMI AptioV contains a vulnerability in BIOS where an Attacker may use an improper input validation via the local network. A successful exploit of this vulnerab… |
CVE-2023-36558 | Medium | 6.2 | 2023-11-14 | ASP.NET Core Security Feature Bypass Vulnerability |
CVE-2023-36038 | High | 8.2 | 2023-11-14 | ASP.NET Core Denial of Service Vulnerability |
CVE-2023-5528 | High | 7.2 | 2023-11-14 | A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privil… |
CVE-2023-47641 | Low | 3.4 | 2023-11-14 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. Affected versions of aiohttp have a security vulnerability regarding the incons… |
CVE-2023-47640 | Medium | 6.4 | 2023-11-14 | DataHub is an open-source metadata platform. The HMAC signature for DataHub Frontend sessions was being signed using a SHA-1 HMAC with the frontend secret key… |
CVE-2023-47631 | High | 7.2 | 2023-11-14 | vantage6 is a framework to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). In affected version… |
CVE-2023-47630 | High | 7.1 | 2023-11-14 | Kyverno is a policy engine designed for Kubernetes. An issue was found in Kyverno that allowed an attacker to control the digest of images used by Kyverno user… |
CVE-2023-47627 | Medium | 5.3 | 2023-11-14 | aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. The HTTP parser in AIOHTTP has numerous problems with header parsing, which cou… |
CVE-2023-47549 | Medium | 6.8 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability on 302 response page in spider-themes EazyDocs plugin <= 2.3.3 versions. |
CVE-2023-47547 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPFactory Products, Order & Customers Export for WooCommerce plugin <= 2.0.7 versions. |
CVE-2023-47546 | Medium | 5.9 | 2023-11-14 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Walter Pinem OneClick Chat to Order plugin <= 1.0.4.2 versions. |
CVE-2023-47545 | Medium | 5.9 | 2023-11-14 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Fatcat Apps Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin <= 2.5.4 vers… |
CVE-2023-47544 | High | 7.1 | 2023-11-14 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Atarim Visual Website Collaboration, Feedback & Project Management – Atarim plugin <= 3.12 versions. |
CVE-2023-47533 | Medium | 5.9 | 2023-11-14 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpdevart Countdown and CountUp, WooCommerce Sales Timer plugin <= 1.8.2 versions. |
CVE-2023-47130 | High | 8.1 | 2023-11-14 | Yii is an open source PHP web framework. yiisoft/yii before version 1.1.29 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize(… |
CVE-2023-46132 | High | 7.1 | 2023-11-14 | Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a mol… |
CVE-2023-36437 | High | 8.8 | 2023-11-14 | Azure DevOps Server Remote Code Execution Vulnerability |
CVE-2023-36049 | High | 7.6 | 2023-11-14 | .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability |
CVE-2023-36007 | High | 7.6 | 2023-11-14 | Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability |
CVE-2023-34060 | Critical | 9.8 | 2023-11-14 | VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 from an older vers… |
CVE-2023-47646 | Medium | 5.9 | 2023-11-14 | Auth. (Shop Manager+) Stored Cross-Site Scripting (XSS) vulnerability in CedCommerce Recently viewed and most viewed products plugin <= 1.1.1 versions. |
CVE-2023-47554 | Medium | 5.9 | 2023-11-14 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DenK BV Actueel Financieel Nieuws – Denk Internet Solutions plugin <= 5.1.0 versions. |
CVE-2023-47550 | High | 7.1 | 2023-11-14 | Cross-Site Request Forgery (CSRF) vulnerability in RedNao Donations Made Easy – Smart Donations allows Stored XSS.This issue affects Donations Made Easy – Smar… |
CVE-2023-47384 | Medium | 5.5 | 2023-11-14 | MP4Box GPAC v2.3-DEV-rev617-g671976fcc-master was discovered to contain a memory leak in the function gf_isom_add_chapter at /isomedia/isom_write.c. This vulne… |
CVE-2023-47127 | Medium | 4.2 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different site… |
CVE-2023-47126 | Low | 3.7 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install too… |
CVE-2023-47125 | Medium | 4.7 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled co… |
CVE-2023-26222 | High | 8.7 | 2023-11-14 | The Web Application component of TIBCO Software Inc.'s TIBCO EBX and TIBCO Product and Service Catalog powered by TIBCO EBX contains an easily exploitable vuln… |
CVE-2023-47658 | Medium | 5.9 | 2023-11-14 | Auth. (ShopManager+) Stored Cross-Site Scripting (XSS) vulnerability in actpro Extra Product Options for WooCommerce plugin <= 3.0.3 versions. |
CVE-2023-47656 | Medium | 5.9 | 2023-11-14 | Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Marco Milesi ANAC XML Bandi di Gara plugin <= 7.5 versions. |
CVE-2023-47654 | Medium | 6.5 | 2023-11-14 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in livescore.Bz BZScore – Live Score plugin <= 1.03 versions. |
CVE-2023-47653 | Medium | 5.9 | 2023-11-14 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Abu Bakar TWB Woocommerce Reviews plugin <= 1.7.5 versions. |
CVE-2023-40719 | Medium | 4.1 | 2023-11-14 | A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an attacker to access Fo… |
CVE-2023-40540 | Medium | 4.1 | 2023-11-14 | Non-Transparent Sharing of Microarchitectural Resources in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclo… |
CVE-2023-40220 | Medium | 5.3 | 2023-11-14 | Improper buffer restrictions in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via local access. |
CVE-2023-39412 | Medium | 5.4 | 2023-11-14 | Cross-site request forgery in some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. |
CVE-2023-39411 | Medium | 5.0 | 2023-11-14 | Improper input validationation for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. |
CVE-2023-39230 | Medium | 6.7 | 2023-11-14 | Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user to potentially enab… |
CVE-2023-39228 | Medium | 5.3 | 2023-11-14 | Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network access. |
CVE-2023-39221 | Medium | 5.4 | 2023-11-14 | Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. |
CVE-2023-38570 | Medium | 5.3 | 2023-11-14 | Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2023-38411 | Low | 3.9 | 2023-11-14 | Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2023-38131 | Medium | 6.5 | 2023-11-14 | Improper input validationation for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access. |
CVE-2023-36860 | High | 7.1 | 2023-11-14 | Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via network access. |