2023 CVEs (page 114)
Page 114 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28172 | Medium | 5.4 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in flippercode WordPress Plugin for Google Maps – WP MAPS (formerly WP Google Map Plugin) plugin <= 4.4.2 versi… |
CVE-2023-28167 | Medium | 5.4 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin <= 1.3.3 versions. |
CVE-2023-28134 | High | 7.8 | 2023-11-12 | Local attacker can escalate privileges on affected installations of Check Point Harmony Endpoint/ZoneAlarm Extreme Security. An attacker must first obtain the… |
CVE-2023-27632 | Medium | 5.4 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Daily Prayer Time plugin <= 2023.03.08 versions. |
CVE-2023-27623 | Medium | 5.4 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Jens Törnell WP Page Numbers plugin <= 0.5 versions. |
CVE-2023-27611 | Medium | 5.4 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in audrasjb Reusable Blocks Extended plugin <= 0.9 versions. |
CVE-2023-27431 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeHunk Big Store theme <= 1.9.3 versions. |
CVE-2023-27418 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Side Menu Lite – add sticky fixed buttons plugin <= 4.0 versions. |
CVE-2023-27417 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Timo Reith Affiliate Super Assistent plugin <= 1.5.1 versions. |
CVE-2023-29425 | Medium | 5.4 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in plainware.Com ShiftController Employee Shift Scheduling plugin <= 4.9.23 versions. |
CVE-2023-29238 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Whydonate Whydonate – FREE Donate button – Crowdfunding – Fundraising plugin <= 3.12.15 versions. |
CVE-2023-28987 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Ultimate Review plugin <= 2.0.3 versions. |
CVE-2023-28930 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Robin Phillips Mobile Banner plugin <= 1.5 versions. |
CVE-2023-28696 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Harish Chouhan, Themeist I Recommend This allows Cross Site Request Forgery.This issue affects I Recommend T… |
CVE-2023-28694 | Medium | 5.4 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Wbcom Designs Wbcom Designs – BuddyPress Activity Social Share plugin <= 3.5.0 versions. |
CVE-2023-28618 | Medium | 5.4 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Enhanced Plugin Admin plugin <= 1.16 versions. |
CVE-2023-28498 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions. |
CVE-2023-28497 | Medium | 5.4 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Slideshow Gallery LITE plugin <= 1.7.6 versions. |
CVE-2023-28495 | Medium | 4.3 | 2023-11-12 | Cross-Site Request Forgery (CSRF) vulnerability in MyThemeShop WP Shortcode by MyThemeShop plugin <= 1.4.16 versions. |
CVE-2023-47037 | Medium | 4.3 | 2023-11-12 | We failed to apply CVE-2023-40611 in 2.7.1 and this vulnerability was marked as fixed then. Apache Airflow, versions before 2.7.3, is affected by a vulnerabi… |
CVE-2023-42781 | Medium | 6.5 | 2023-11-12 | Apache Airflow, versions before 2.7.3, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about… |
CVE-2023-6084 | Medium | 6.3 | 2023-11-12 | A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this issue is some unknown functionality of the file general/veh… |
CVE-2023-47390 | High | 7.5 | 2023-11-11 | Headscale through 0.22.3 writes bearer tokens to info-level logs. |
CVE-2023-43057 | Medium | 4.6 | 2023-11-11 | IBM QRadar SIEM 7.5.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the… |
CVE-2023-5959 | Medium | 4.3 | 2023-11-11 | A vulnerability, which was classified as problematic, was found in Byzoro Smart S85F Management Platform V31R02B10-01. Affected is an unknown function of the f… |
CVE-2023-46850 | Critical | 9.8 | 2023-11-11 | Use after free in OpenVPN version 2.6.0 to 2.6.6 may lead to undefined behavoir, leaking memory buffers or remote execution when sending network buffers to a r… |
CVE-2023-46849 | High | 7.5 | 2023-11-11 | Using the --fragment option in certain configuration setups OpenVPN version 2.6.0 to 2.6.6 allows an attacker to trigger a divide by zero behaviour which could… |
CVE-2023-4804 | Critical | 10.0 | 2023-11-10 | An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed. |
CVE-2023-47122 | Medium | 4.2 | 2023-11-10 | Gitsign is software for keyless Git signing using Sigstore. In versions of gitsign starting with 0.6.0 and prior to 0.8.0, Rekor public keys were fetched via t… |
CVE-2023-36027 | High | 7.1 | 2023-11-10 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-47129 | High | 8.3 | 2023-11-10 | Statmic is a core Laravel content management system Composer package. Prior to versions 3.4.13 and 4.33.0, on front-end forms with an asset upload field, PHP f… |
CVE-2023-47108 | High | 7.5 | 2023-11-10 | OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary S… |
CVE-2023-47128 | Critical | 9.1 | 2023-11-10 | Piccolo is an object-relational mapping and query builder which supports asyncio. Prior to version 1.1.1, the handling of named transaction `savepoints` in all… |
CVE-2023-46735 | Medium | 6.1 | 2023-11-10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in version 6.0.0 and prior to version 6.3.8, the err… |
CVE-2023-46734 | Medium | 6.1 | 2023-11-10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 2.0.0, 5.0.0, and 6.0.0 and prior to ver… |
CVE-2023-46733 | Medium | 6.5 | 2023-11-10 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Starting in versions 5.4.21 and 6.2.7 and prior to versions 5… |
CVE-2023-4949 | High | 8.1 | 2023-11-10 | An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploi… |
CVE-2023-47611 | High | 7.8 | 2023-11-10 | A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS6… |
CVE-2023-6076 | Medium | 5.3 | 2023-11-10 | A vulnerability classified as problematic was found in PHPGurukul Restaurant Table Booking System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2023-47614 | Low | 3.3 | 2023-11-10 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion P… |
CVE-2023-47121 | Low | 3.4 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-47120 | High | 7.5 | 2023-11-10 | Discourse is an open source platform for community discussion. In versions 3.1.0 through 3.1.2 of the `stable` branch and versions 3.1.0,beta6 through 3.2.0.be… |
CVE-2023-41285 | High | 7.4 | 2023-11-10 | A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via… |
CVE-2023-41284 | High | 7.4 | 2023-11-10 | A SQL injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to inject malicious code via… |
CVE-2023-39295 | High | 8.8 | 2023-11-10 | An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands… |
CVE-2023-6075 | Low | 3.5 | 2023-11-10 | A vulnerability classified as problematic has been found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file index.p… |
CVE-2023-6074 | Medium | 6.3 | 2023-11-10 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2023-47119 | Medium | 5.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-46130 | Medium | 4.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-45816 | Low | 3.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-45806 | Medium | 4.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-23367 | Medium | 4.7 | 2023-11-10 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-31078 | Medium | 4.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.4.1 versions. |
CVE-2023-31077 | Medium | 4.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions. |
CVE-2023-30478 | Medium | 5.4 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions. |
CVE-2023-29440 | Medium | 4.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions. |
CVE-2023-29428 | Medium | 5.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions. |
CVE-2023-29426 | Medium | 4.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in Robert Schulz (sprd.Net AG) Spreadshop plugin <= 1.6.5 versions. |
CVE-2023-47164 | Medium | 6.1 | 2023-11-10 | Cross-site scripting vulnerability in HOTELDRUID 3.0.5 and earlier allows a remote unauthenticated attacker to execute an arbitrary script on the web browser o… |
CVE-2023-6073 | Medium | 5.7 | 2023-11-10 | Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) an… |
CVE-2023-47800 | Critical | 9.8 | 2023-11-10 | Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to… |
CVE-2023-47246 | Critical | 9.8 | 2023-11-10 | In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited… |
CVE-2023-39796 | Critical | 9.8 | 2023-11-10 | SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE… |
CVE-2023-45167 | Medium | 6.2 | 2023-11-10 | IBM AIX's 7.3 Python implementation could allow a non-privileged local user to exploit a vulnerability to cause a denial of service. IBM X-Force ID: 267965. |
CVE-2023-6069 | Critical | 9.9 | 2023-11-10 | Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. |
CVE-2023-46729 | Critical | 9.3 | 2023-11-10 | sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and r… |
CVE-2023-36024 | High | 7.1 | 2023-11-10 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-36014 | High | 7.3 | 2023-11-10 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-32502 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Sybre Waaijer Pro Mime Types – Manage file media types plugin <= 1.0.7 versions. |
CVE-2023-32501 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.6.1 versions. |
CVE-2023-32500 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme <= 7.1.1 versions. |
CVE-2023-32125 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions. |
CVE-2023-32093 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <= 1.0.7 versions. |
CVE-2023-32092 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.9.0 versi… |
CVE-2023-31235 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions. |
CVE-2023-31093 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Chronosly Chronosly Events Calendar plugin <= 2.6.2 versions. |
CVE-2023-31088 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Faraz Quazi Floating Action Button plugin <= 1.2.1 versions. |
CVE-2023-31086 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 ver… |
CVE-2023-5543 | Low | 3.3 | 2023-11-09 | When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unint… |
CVE-2023-32592 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions. |
CVE-2023-32587 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WP Reactions, LLC WP Reactions Lite plugin <= 1.3.8 versions. |
CVE-2023-32579 | Medium | 5.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Designs & Code Forget About Shortcode Buttons plugin <= 2.1.2 versions. |
CVE-2023-32512 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions. |
CVE-2023-29975 | High | 7.2 | 2023-11-09 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification. |
CVE-2023-5954 | Medium | 5.9 | 2023-11-09 | HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these… |
CVE-2023-4379 | High | 8.1 | 2023-11-09 | An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner… |
CVE-2023-34031 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions. |
CVE-2023-34025 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions. |
CVE-2023-34024 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Guillemant David WP Full Auto Tags Manager plugin <= 2.2 versions. |
CVE-2023-32794 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Add-Ons plugin <= 6.1.3 versions. |
CVE-2023-32745 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions. |
CVE-2023-32744 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions. |
CVE-2023-32739 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions. |
CVE-2023-32602 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in LOKALYZE CALL ME NOW plugin <= 3.0 versions. |
CVE-2023-32594 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Benedict B., Maciej Gryniuk Hyphenator plugin <= 5.1.5 versions. |
CVE-2023-5551 | Low | 3.3 | 2023-11-09 | Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. |
CVE-2023-5550 | Medium | 6.5 | 2023-11-09 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server… |
CVE-2023-5549 | Low | 3.3 | 2023-11-09 | Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capa… |
CVE-2023-5548 | Low | 3.3 | 2023-11-09 | Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection. |
CVE-2023-5547 | Low | 3.3 | 2023-11-09 | The course upload preview contained an XSS risk for users uploading unsafe data. |