2023 CVEs (page 110)
Page 110 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48199 | High | 7.8 | 2023-11-15 | HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without script execution. Thi… |
CVE-2023-48198 | Medium | 5.4 | 2023-11-15 | A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 allows attackers to ob… |
CVE-2023-48197 | Medium | 5.4 | 2023-11-15 | Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's cookies when the victi… |
CVE-2023-48365 | Critical | 9.6 | 2023-11-15 | Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP hea… |
CVE-2023-47444 | High | 8.8 | 2023-11-15 | An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data… |
CVE-2023-47347 | High | 7.5 | 2023-11-15 | Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages whose Sequence Number is mutated to over… |
CVE-2023-47345 | High | 7.5 | 2023-11-15 | Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP Heartbeat message who… |
CVE-2023-41442 | Critical | 9.8 | 2023-11-15 | An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via a crafted request t… |
CVE-2023-6105 | Medium | 5.5 | 2023-11-15 | An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user wit… |
CVE-2023-48224 | High | 8.2 | 2023-11-15 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of pri… |
CVE-2023-47637 | High | 8.8 | 2023-11-15 | Pimcore is an Open Source Data & Experience Management Platform. In affected versions the `/admin/object/grid-proxy` endpoint calls `getFilterCondition()` on f… |
CVE-2023-47636 | Medium | 5.3 | 2023-11-15 | The Pimcore Admin Classic Bundle provides a Backend UI for Pimcore. Full Path Disclosure (FPD) vulnerabilities enable the attacker to see the path to the webro… |
CVE-2023-41699 | Medium | 6.1 | 2023-11-15 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Payara Platform Payara Server, Micro and Embedded (Servlet Implementation modules) allows… |
CVE-2023-30954 | Low | 2.7 | 2023-11-15 | The Gotham video-application-server service contained a race condition which would cause it to not apply certain acls new videos if the source system had not y… |
CVE-2023-22818 | High | 7.3 | 2023-11-15 | Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to e… |
CVE-2023-48219 | Medium | 6.1 | 2023-11-15 | TinyMCE is an open source rich text editor. A mutation cross-site scripting (mXSS) vulnerability was discovered in TinyMCE’s core undo/redo functionality and o… |
CVE-2023-48014 | High | 7.8 | 2023-11-15 | GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/av_parsers.c. |
CVE-2023-48013 | High | 7.8 | 2023-11-15 | GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core/filter.c. |
CVE-2023-48011 | High | 7.8 | 2023-11-15 | GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isomedia/movie_fragments… |
CVE-2023-6112 | High | 8.8 | 2023-11-15 | Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2023-5997 | High | 8.8 | 2023-11-15 | Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2023-34982 | Medium | 5.5 | 2023-11-15 | This external control vulnerability, if exploited, could allow a local OS-authenticated user with standard privileges to delete files with System privilege on… |
CVE-2023-33873 | High | 7.8 | 2023-11-15 | This privilege escalation vulnerability, if exploited, cloud allow a local OS-authenticated user with standard privileges to escalate to System privilege on t… |
CVE-2023-48089 | High | 8.8 | 2023-11-15 | xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save. |
CVE-2023-48088 | Medium | 5.4 | 2023-11-15 | xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage. |
CVE-2023-48087 | Medium | 5.4 | 2023-11-15 | xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat. |
CVE-2023-5720 | High | 7.7 | 2023-11-15 | A flaw was found in Quarkus, where it does not properly sanitize artifacts created using the Gradle plugin, allowing certain build system information to remain… |
CVE-2023-5676 | Medium | 4.1 | 2023-11-15 | In Eclipse OpenJ9 before version 0.41.0, the JVM can be forced into an infinite busy hang on a spinlock or a segmentation fault if a shutdown signal (SIGTERM… |
CVE-2023-5245 | High | 7.5 | 2023-11-15 | FileUtil.extract() enumerates all zip file entries and extracts each file without validating whether file paths in the archive are outside the intended directo… |
CVE-2023-4602 | Medium | 6.1 | 2023-11-15 | The Namaste! LMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'course_id' parameter in versions up to, and including, 2.6.1.1… |
CVE-2023-23549 | Low | 2.7 | 2023-11-15 | Improper Input Validation in Checkmk <2.2.0p15, <2.1.0p37, <=2.0.0p39 allows priviledged attackers to cause partial denial of service of the UI via too long ho… |
CVE-2023-34062 | High | 7.5 | 2023-11-15 | In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a specially crafted… |
CVE-2023-46672 | High | 8.4 | 2023-11-15 | An issue was identified by Elastic whereby sensitive information is recorded in Logstash logs under specific circumstances. The prerequisites for the manifest… |
CVE-2023-6133 | Medium | 6.6 | 2023-11-15 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient blacklisting on the 'forminator_allowed_mime_types' function in… |
CVE-2023-4889 | Medium | 6.4 | 2023-11-15 | The Shareaholic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shareaholic' shortcode in versions up to, and including, 9.7.8 due to in… |
CVE-2023-47586 | High | 7.8 | 2023-11-15 | Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a speciall… |
CVE-2023-47585 | High | 7.8 | 2023-11-15 | Out-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR file… |
CVE-2023-47584 | High | 7.8 | 2023-11-15 | Out-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. If a user opens a specially crafted VPR fil… |
CVE-2023-47583 | High | 7.8 | 2023-11-15 | Multiple out-of-bounds read vulnerabilities exist in TELLUS Simulator V4.0.17.0 and earlier. If a user opens a specially crafted file (X1 or V9 file), informat… |
CVE-2023-47582 | High | 7.8 | 2023-11-15 | Access of uninitialized pointer vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted… |
CVE-2023-47581 | High | 7.8 | 2023-11-15 | Out-of-bounds read vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. If a user opens a specially crafted file (X1, V8… |
CVE-2023-47580 | High | 7.8 | 2023-11-15 | Multiple improper restriction of operations within the bounds of a memory buffer issues exist in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and ear… |
CVE-2023-47446 | Medium | 5.4 | 2023-11-15 | Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter. |
CVE-2023-47445 | Critical | 9.8 | 2023-11-15 | Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page. |
CVE-2023-41597 | Medium | 6.1 | 2023-11-15 | EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t. |
CVE-2023-40923 | High | 8.8 | 2023-11-15 | MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_setting parameters. |
CVE-2023-6032 | Medium | 5.3 | 2023-11-15 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file system enumeration and f… |
CVE-2023-5987 | Medium | 6.1 | 2023-11-15 | A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability leading to a cross… |
CVE-2023-5986 | High | 8.2 | 2023-11-15 | A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scripting attack. By p… |
CVE-2023-5985 | Medium | 4.8 | 2023-11-15 | A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability exists that could cause compromise of a user’s browser when an attacker w… |
CVE-2023-5984 | High | 7.2 | 2023-11-15 | A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins… |
CVE-2023-47678 | Critical | 9.1 | 2023-11-15 | An improper access control vulnerability exists in RT-AC87U all versions. An attacker may read or write files that are not intended to be accessed by connectin… |
CVE-2023-47309 | Medium | 5.4 | 2023-11-15 | Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhoneMobile. |
CVE-2023-47308 | Critical | 9.8 | 2023-11-15 | In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a guest can perform SQL i… |
CVE-2023-43979 | Critical | 9.8 | 2023-11-15 | ETS Soft ybc_blog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component Ybc_blogBlogModuleFrontController::getPosts(). |
CVE-2023-46121 | Medium | 5.0 | 2023-11-15 | yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a r… |
CVE-2023-43591 | High | 7.8 | 2023-11-15 | Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local ac… |
CVE-2023-43590 | High | 7.8 | 2023-11-15 | Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2023-43588 | Low | 3.5 | 2023-11-15 | Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network access. |
CVE-2023-43582 | Medium | 5.5 | 2023-11-15 | Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. |
CVE-2023-41718 | High | 7.8 | 2023-11-15 | When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when having control over a… |
CVE-2023-39337 | Critical | 9.1 | 2023-11-15 | A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier to access and extrac… |
CVE-2023-39335 | Critical | 9.8 | 2023-11-15 | A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to impersonate any existi… |
CVE-2023-38544 | Medium | 5.5 | 2023-11-15 | A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. This vulnerability could be exploited t… |
CVE-2023-38543 | High | 7.8 | 2023-11-15 | A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulne… |
CVE-2023-38043 | High | 7.8 | 2023-11-15 | A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker to exploit a vulne… |
CVE-2023-35080 | High | 7.8 | 2023-11-15 | A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable conf… |
CVE-2023-31100 | High | 8.4 | 2023-11-15 | Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification. This issue affects SecureCore™ Technol… |
CVE-2023-5189 | Medium | 6.3 | 2023-11-14 | A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer o… |
CVE-2023-47518 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Matthew Muro Restrict Categories plugin <= 2.6.4 versions. |
CVE-2023-47517 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in SendPress Newsletters plugin <= 1.23.11.6 versions. |
CVE-2023-45627 | Medium | 4.3 | 2023-11-14 | An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. Successful exploitation of this vulnerability results in the ability to inter… |
CVE-2023-45626 | Medium | 5.5 | 2023-11-14 | An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code execution across b… |
CVE-2023-45625 | High | 7.2 | 2023-11-14 | Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ab… |
CVE-2023-45624 | High | 7.5 | 2023-11-14 | An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. Successful exploitation of this vulnerabi… |
CVE-2023-45623 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. Successful exploitation of these vuln… |
CVE-2023-45622 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. Successful exploitation of these vulner… |
CVE-2023-45621 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2023-45620 | High | 7.5 | 2023-11-14 | Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. Successful exploitation of these vulnerabiliti… |
CVE-2023-45619 | High | 8.2 | 2023-11-14 | There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of t… |
CVE-2023-45618 | High | 8.2 | 2023-11-14 | There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol). Successful exploit… |
CVE-2023-45617 | High | 8.2 | 2023-11-14 | There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol). Successful exploitation of th… |
CVE-2023-45616 | Critical | 9.8 | 2023-11-14 | There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution by sending specially… |
CVE-2023-45615 | Critical | 9.8 | 2023-11-14 | There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted p… |
CVE-2023-45614 | Critical | 9.8 | 2023-11-14 | There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending specially crafted p… |
CVE-2023-41570 | Medium | 5.3 | 2023-11-14 | MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API. |
CVE-2023-39206 | Low | 3.7 | 2023-11-14 | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2023-39205 | Medium | 4.3 | 2023-11-14 | Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network access. |
CVE-2023-39204 | Medium | 4.3 | 2023-11-14 | Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. |
CVE-2023-39203 | Medium | 4.3 | 2023-11-14 | Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated user to conduct a disc… |
CVE-2023-39202 | Low | 3.1 | 2023-11-14 | Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access. |
CVE-2023-39199 | Medium | 4.9 | 2023-11-14 | Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network access. |
CVE-2023-48217 | High | 8.8 | 2023-11-14 | Statamic is a flat-first, Laravel + Git powered CMS designed for building websites. In affected versions certain additional PHP files crafted to look like imag… |
CVE-2023-47532 | Medium | 5.8 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Themeum WP Crowdfunding plugin <= 2.1.6 versions. |
CVE-2023-47528 | Medium | 5.9 | 2023-11-14 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Sajjad Hossain Sagor WP Edit Username plugin <= 1.0.5 versions. |
CVE-2023-47524 | Medium | 5.8 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability (requires PHP 8.x) in CodeBard CodeBard's Patron Button and Widgets for Patreon plugin <= 2.1.9 vers… |
CVE-2023-47522 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Photo Feed plugin <= 2.2.1 versions. |
CVE-2023-47520 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Michael Uno (miunosoft) Responsive Column Widgets plugin <= 1.2.7 versions. |
CVE-2023-46582 | High | 7.8 | 2023-11-14 | SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in the deleteProduct.ph… |
CVE-2023-46581 | Medium | 5.5 | 2023-11-14 | SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email parameters in the reg… |