2023 CVEs (page 113)
Page 113 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-48094 | Medium | 6.1 | 2023-11-14 | A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's browser via sending a c… |
CVE-2023-47660 | Medium | 5.9 | 2023-11-14 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Wham Product Visibility by Country for WooCommerce plugin <= 1.4.9 versions. |
CVE-2023-47659 | Medium | 6.5 | 2023-11-14 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions. |
CVE-2023-6128 | Medium | 5.4 | 2023-11-14 | Cross-site Scripting (XSS) - Reflected in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6127 | Medium | 5.4 | 2023-11-14 | Unrestricted Upload of File with Dangerous Type in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6126 | Critical | 9.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-6125 | High | 8.8 | 2023-11-14 | Code Injection in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-47262 | Medium | 5.2 | 2023-11-14 | The startup process and device configurations of the Abbott ID NOW device, before v7.1, can be interrupted and/or modified via physical access to an internal s… |
CVE-2023-6124 | Medium | 4.3 | 2023-11-14 | Server-Side Request Forgery (SSRF) in GitHub repository salesagility/suitecrm prior to 7.14.2, 8.4.2, 7.12.14. |
CVE-2023-48021 | High | 8.8 | 2023-11-14 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update. |
CVE-2023-48020 | High | 8.8 | 2023-11-14 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus. |
CVE-2023-45684 | High | 7.5 | 2023-11-14 | Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. The fixed versions are 3.18.6 and 3.21.3. The earliest affected version is 3.6.0. The iss… |
CVE-2023-6111 | High | 7.8 | 2023-11-14 | A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The function nft_t… |
CVE-2023-46601 | Critical | 9.6 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in making the SQLServer connection. This cou… |
CVE-2023-46590 | High | 7.5 | 2023-11-14 | A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions < V2.8). Affected products suffer from a XML external entity (XXE)… |
CVE-2023-46099 | Medium | 5.4 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). There is a stored cross-site scripting vulnerability in the Administration Consol… |
CVE-2023-46098 | High | 8.0 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). When accessing the Information Server from affected products, the products use an… |
CVE-2023-46097 | Medium | 6.3 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly neutralize user provided i… |
CVE-2023-46096 | Medium | 6.5 | 2023-11-14 | A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly authenticate users in the… |
CVE-2023-45794 | Medium | 6.8 | 2023-11-14 | A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions < V10.4.0), Mendix Applications using Mendix 7 (All versions < V7.23.3… |
CVE-2023-44374 | Medium | 6.5 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2023-44373 | Critical | 9.1 | 2023-11-14 | Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or s… |
CVE-2023-44322 | Low | 3.7 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2023-44321 | Low | 2.7 | 2023-11-14 | Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated att… |
CVE-2023-44320 | Medium | 4.3 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2023-44319 | Medium | 4.9 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2… |
CVE-2023-44318 | Medium | 4.9 | 2023-11-14 | Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated… |
CVE-2023-44317 | High | 7.2 | 2023-11-14 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2023-43505 | Critical | 9.6 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions). The affected application lacks proper access controls in SMB shares. This could allow an attacker… |
CVE-2023-43504 | Critical | 9.6 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions < V10.4.4). Ptmcast executable used for testing cache validation service in affected application is… |
CVE-2023-43503 | Low | 3.5 | 2023-11-14 | A vulnerability has been identified in COMOS (All versions < V10.4.4). Caching system in the affected application leaks sensitive information such as user and… |
CVE-2023-31247 | Critical | 9.0 | 2023-11-14 | A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network… |
CVE-2023-28391 | Critical | 9.0 | 2023-11-14 | A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. Specially crafted network packets… |
CVE-2023-28379 | Critical | 9.0 | 2023-11-14 | A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet… |
CVE-2023-27882 | Critical | 9.0 | 2023-11-14 | A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted netwo… |
CVE-2023-25181 | Critical | 9.0 | 2023-11-14 | A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted set of network pack… |
CVE-2023-24585 | High | 7.7 | 2023-11-14 | An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. A specially crafted network packet can lead t… |
CVE-2023-6109 | Medium | 5.3 | 2023-11-14 | The YOP Poll plugin for WordPress is vulnerable to a race condition in all versions up to, and including, 6.5.26. This is due to improper restrictions on the a… |
CVE-2023-47609 | High | 8.8 | 2023-11-14 | SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or obtain and/or alter t… |
CVE-2023-45881 | Medium | 6.1 | 2023-11-14 | GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources_addQuick_ajaxProcess.php file upload with resultant XSS. The imageAsLinks parameter m… |
CVE-2023-45880 | High | 7.2 | 2023-11-14 | GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. An attacker can create a new Asset Component. The templateF… |
CVE-2023-45879 | Medium | 5.4 | 2023-11-14 | GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component. |
CVE-2023-45878 | Critical | 9.8 | 2023-11-14 | GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authentication. The endpoint ac… |
CVE-2023-43902 | Critical | 9.8 | 2023-11-14 | Incorrect access control in the Forgot Your Password function of eMudhra emSigner v2.8.7 allows unauthenticated attackers to access accounts of all registered… |
CVE-2023-43901 | High | 7.5 | 2023-11-14 | Incorrect access control in the AdHoc User creation form of eMudhra emSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify usernames and privil… |
CVE-2023-43900 | Medium | 6.5 | 2023-11-14 | Insecure Direct Object References (IDOR) in eMudhra emSigner v2.8.7 allow authenticated attackers to gain unauthorized access to application content and view s… |
CVE-2023-42326 | High | 8.8 | 2023-11-14 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_… |
CVE-2023-6006 | High | 7.8 | 2023-11-14 | This vulnerability potentially allows local attackers to escalate privileges on affected installations of PaperCut NG. An attacker must have local write access… |
CVE-2023-42327 | Medium | 5.4 | 2023-11-14 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.ph… |
CVE-2023-42325 | Medium | 5.4 | 2023-11-14 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dyn… |
CVE-2023-31754 | Medium | 4.8 | 2023-11-14 | Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel. |
CVE-2023-46446 | Medium | 6.8 | 2023-11-14 | An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a… |
CVE-2023-46445 | Medium | 5.9 | 2023-11-14 | An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "Rogue Extension Neg… |
CVE-2023-45560 | High | 7.5 | 2023-11-14 | An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-45558 | High | 7.5 | 2023-11-14 | An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. |
CVE-2023-47629 | High | 7.1 | 2023-11-14 | DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged… |
CVE-2023-47628 | Medium | 4.2 | 2023-11-14 | DataHub is an open-source metadata platform. DataHub Frontend's sessions are configured using Play Framework's default settings for stateless session which do… |
CVE-2023-42480 | Medium | 5.3 | 2023-11-14 | The unauthenticated attacker in NetWeaver AS Java Logon application - version 7.50, can brute force the login functionality to identify the legitimate user ids… |
CVE-2023-41366 | Medium | 5.3 | 2023-11-14 | Under certain condition SAP NetWeaver Application Server ABAP - versions KERNEL 722, KERNEL 7.53, KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7… |
CVE-2023-31403 | Critical | 9.6 | 2023-11-14 | SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious… |
CVE-2023-47684 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ThemePunch OHG Essential Grid plugin <= 3.1.0 versions. |
CVE-2023-47680 | Medium | 6.5 | 2023-11-14 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Qode Interactive Qi Addons For Elementor plugin <= 1.6.3 versions. |
CVE-2023-47673 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Stefano Ottolenghi Post Pay Counter plugin <= 2.784 versions. |
CVE-2023-47665 | High | 7.1 | 2023-11-14 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in edward_plainview Plainview Protect Passwords plugin <= 1.4 versions. |
CVE-2023-47662 | Medium | 5.9 | 2023-11-14 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in GoldBroker.Com Live Gold Price & Silver Price Charts Widgets plugin <= 2.4 versions. |
CVE-2023-47657 | Medium | 5.9 | 2023-11-14 | Auth. (ShopManager+) Stored Cross-Site Scripting (XSS) vulnerability in GrandPlugins Direct Checkout – Quick View – Buy Now For WooCommerce plugin <= 1.5.8 ver… |
CVE-2023-4603 | Medium | 6.1 | 2023-11-13 | The Star CloudPRNT for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'printersettings' parameter in versions up to… |
CVE-2023-47697 | High | 7.1 | 2023-11-13 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce… |
CVE-2023-47696 | High | 7.1 | 2023-11-13 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Gravity Master Product Enquiry for WooCommerce plugin <= 3.0 versions. |
CVE-2023-47695 | High | 7.1 | 2023-11-13 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Scribit Shortcodes Finder plugin <= 1.5.3 versions. |
CVE-2023-47690 | High | 7.1 | 2023-11-13 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Anton Bond Additional Order Filters for WooCommerce plugin <= 1.10 versions. |
CVE-2023-46021 | Medium | 5.5 | 2023-11-13 | SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands via the 'reqid' parameter. |
CVE-2023-46020 | Medium | 6.1 | 2023-11-13 | Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 'remail', 'rphone' and… |
CVE-2023-46019 | Medium | 6.1 | 2023-11-13 | Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' parameter. |
CVE-2023-47346 | High | 7.5 | 2023-11-13 | Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP messages. |
CVE-2023-46018 | Medium | 5.5 | 2023-11-13 | SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \allows attackers to run arbitrary SQL commands via 'remail' parameter. |
CVE-2023-46017 | Medium | 5.5 | 2023-11-13 | SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'remail' and 'rpassword' pa… |
CVE-2023-46016 | Medium | 6.1 | 2023-11-13 | Cross Site Scripting (XSS) in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'search' parameter in the application URL. |
CVE-2023-46015 | Medium | 6.1 | 2023-11-13 | Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via 'msg' parameter in application… |
CVE-2023-46014 | Medium | 5.5 | 2023-11-13 | SQL Injection vulnerability in hospitalLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'hemail' and 'hpassword' pa… |
CVE-2023-47625 | Low | 2.9 | 2023-11-13 | PX4 autopilot is a flight control solution for drones. In affected versions a global buffer overflow vulnerability exists in the CrsfParser_TryParseCrsfPacket… |
CVE-2023-47117 | High | 7.5 | 2023-11-13 | Label Studio is an open source data labeling tool. In all current versions of Label Studio prior to 1.9.2post0, the application allows users to insecurely set… |
CVE-2023-42816 | Medium | 6.1 | 2023-11-13 | Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. T… |
CVE-2023-42815 | Low | 3.1 | 2023-11-13 | Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. T… |
CVE-2023-42814 | Low | 3.1 | 2023-11-13 | Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. T… |
CVE-2023-42813 | Medium | 6.1 | 2023-11-13 | Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. T… |
CVE-2023-47621 | High | 8.8 | 2023-11-13 | Guest Entries is a php library which allows users to create, update & delete entries from the front-end of a site. In affected versions the file uploads featur… |
CVE-2023-6103 | Low | 2.4 | 2023-11-13 | A vulnerability has been found in Intelbras RX 1500 1.1.9 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-6102 | Medium | 5.3 | 2023-11-13 | A vulnerability, which was classified as problematic, was found in Maiwei Safety Production Control Platform 4.1. Affected is an unknown function of the file /… |
CVE-2023-32123 | Medium | 6.1 | 2023-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in Dream-Theme The7 allows Stored XSS.This issue affects The7: from n/a through 11.7.3. |
CVE-2023-31230 | High | 7.1 | 2023-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in Haoqisir Baidu Tongji generator allows Stored XSS.This issue affects Baidu Tongji generator: from n/a throug… |
CVE-2023-39166 | High | 7.1 | 2023-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in tagDiv tagDiv Composer allows Cross-Site Scripting (XSS).This issue affects tagDiv Composer: from n/a before… |
CVE-2023-35877 | Medium | 4.3 | 2023-11-13 | Cross-Site Request Forgery (CSRF) vulnerability in Vadym K. Extra User Details allows Stored XSS.This issue affects Extra User Details: from n/a through 0.5. |
CVE-2023-6101 | Medium | 5.3 | 2023-11-13 | A vulnerability, which was classified as problematic, has been found in Maiwei Safety Production Control Platform 4.1. This issue affects some unknown processi… |
CVE-2023-6100 | Medium | 5.3 | 2023-11-13 | A vulnerability classified as problematic was found in Maiwei Safety Production Control Platform 4.1. This vulnerability affects unknown code of the file /api/… |
CVE-2023-6099 | High | 7.3 | 2023-11-13 | A vulnerability classified as critical has been found in Shenzhen Youkate Industrial Facial Love Cloud Payment System up to 1.0.55.0.0.1. This affects an unkno… |
CVE-2023-48068 | Medium | 5.4 | 2023-11-13 | DedeCMS v6.2 was discovered to contain a Cross-site Scripting (XSS) vulnerability via spec_add.php. |
CVE-2023-48063 | Medium | 4.3 | 2023-11-13 | An issue was discovered in dreamer_cms 4.1.3. There is a CSRF vulnerability that can delete a theme project via /admin/category/delete. |
CVE-2023-48060 | High | 8.8 | 2023-11-13 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add |
CVE-2023-48058 | High | 8.8 | 2023-11-13 | Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run |