2023 CVEs (page 115)
Page 115 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47119 | Medium | 5.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-46130 | Medium | 4.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-45816 | Low | 3.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-45806 | Medium | 4.3 | 2023-11-10 | Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-p… |
CVE-2023-23367 | Medium | 4.7 | 2023-11-10 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authentic… |
CVE-2023-31078 | Medium | 4.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in Marco Steinbrecher WP BrowserUpdate plugin <= 4.4.1 versions. |
CVE-2023-31077 | Medium | 4.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in ReCorp Export WP Page to Static HTML/CSS plugin <= 2.1.9 versions. |
CVE-2023-30478 | Medium | 5.4 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Newsletters plugin <= 4.8.8 versions. |
CVE-2023-29440 | Medium | 4.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions. |
CVE-2023-29428 | Medium | 5.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in SuPlugins Superb Social Media Share Buttons and Follow Buttons for WordPress plugin <= 1.1.3 versions. |
CVE-2023-29426 | Medium | 4.3 | 2023-11-10 | Cross-Site Request Forgery (CSRF) vulnerability in Robert Schulz (sprd.Net AG) Spreadshop plugin <= 1.6.5 versions. |
CVE-2023-47164 | Medium | 6.1 | 2023-11-10 | Cross-site scripting vulnerability in HOTELDRUID 3.0.5 and earlier allows a remote unauthenticated attacker to execute an arbitrary script on the web browser o… |
CVE-2023-6073 | Medium | 5.7 | 2023-11-10 | Attacker can perform a Denial of Service attack to crash the ICAS 3 IVI ECU in a Volkswagen ID.3 (and other vehicles of the VW Group with the same hardware) an… |
CVE-2023-47800 | Critical | 9.8 | 2023-11-10 | Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowing a threat actor to… |
CVE-2023-47246 | Critical | 9.8 | 2023-11-10 | In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat webroot, as exploited… |
CVE-2023-39796 | Critical | 9.8 | 2023-11-10 | SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via the DB_RECORD_TABLE… |
CVE-2023-45167 | Medium | 6.2 | 2023-11-10 | IBM AIX's 7.3 Python implementation could allow a non-privileged local user to exploit a vulnerability to cause a denial of service. IBM X-Force ID: 267965. |
CVE-2023-6069 | Critical | 9.9 | 2023-11-10 | Improper Link Resolution Before File Access in GitHub repository froxlor/froxlor prior to 2.1.0. |
CVE-2023-46729 | Critical | 9.3 | 2023-11-10 | sentry-javascript provides Sentry SDKs for JavaScript. An unsanitized input of Next.js SDK tunnel endpoint allows sending HTTP requests to arbitrary URLs and r… |
CVE-2023-36024 | High | 7.1 | 2023-11-10 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2023-36014 | High | 7.3 | 2023-11-10 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-32502 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Sybre Waaijer Pro Mime Types – Manage file media types plugin <= 1.0.7 versions. |
CVE-2023-32501 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in E4J s.R.L. VikBooking Hotel Booking Engine & PMS plugin <= 1.6.1 versions. |
CVE-2023-32500 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in xtemos WoodMart - Multipurpose WooCommerce Theme <= 7.1.1 versions. |
CVE-2023-32125 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.6 versions. |
CVE-2023-32093 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Criss Swaim TPG Redirect plugin <= 1.0.7 versions. |
CVE-2023-32092 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in PeepSo Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin <= 6.0.9.0 versi… |
CVE-2023-31235 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions. |
CVE-2023-31093 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Chronosly Chronosly Events Calendar plugin <= 2.6.2 versions. |
CVE-2023-31088 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Faraz Quazi Floating Action Button plugin <= 1.2.1 versions. |
CVE-2023-31086 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Igor Benic Simple Giveaways – Grow your business, email lists and traffic with contests plugin <= 2.46.0 ver… |
CVE-2023-5543 | Low | 3.3 | 2023-11-09 | When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unint… |
CVE-2023-32592 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Palasthotel by Edward Bock, Katharina Rompf Sunny Search plugin <= 1.0.2 versions. |
CVE-2023-32587 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WP Reactions, LLC WP Reactions Lite plugin <= 1.3.8 versions. |
CVE-2023-32579 | Medium | 5.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Designs & Code Forget About Shortcode Buttons plugin <= 2.1.2 versions. |
CVE-2023-32512 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions. |
CVE-2023-29975 | High | 7.2 | 2023-11-09 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification. |
CVE-2023-5954 | Medium | 5.9 | 2023-11-09 | HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these… |
CVE-2023-4379 | High | 8.1 | 2023-11-09 | An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner… |
CVE-2023-34031 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Pascal Casier bbPress Toolkit plugin <= 1.0.12 versions. |
CVE-2023-34025 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in LWS LWS Hide Login plugin <= 2.1.6 versions. |
CVE-2023-34024 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Guillemant David WP Full Auto Tags Manager plugin <= 2.2 versions. |
CVE-2023-32794 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Add-Ons plugin <= 6.1.3 versions. |
CVE-2023-32745 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce AutomateWoo plugin <= 5.7.1 versions. |
CVE-2023-32744 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WooCommerce Product Recommendations plugin <= 2.3.0 versions. |
CVE-2023-32739 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Web_Trendy WP Custom Cursors | WordPress Cursor Plugin plugin < 3.2 versions. |
CVE-2023-32602 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in LOKALYZE CALL ME NOW plugin <= 3.0 versions. |
CVE-2023-32594 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Benedict B., Maciej Gryniuk Hyphenator plugin <= 5.1.5 versions. |
CVE-2023-5551 | Low | 3.3 | 2023-11-09 | Separate Groups mode restrictions were not honoured in the forum summary report, which would display users from other groups. |
CVE-2023-5550 | Medium | 6.5 | 2023-11-09 | In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user who also has direct access to the web server… |
CVE-2023-5549 | Low | 3.3 | 2023-11-09 | Insufficient web service capability checks made it possible to move categories a user had permission to manage, to a parent category they did not have the capa… |
CVE-2023-5548 | Low | 3.3 | 2023-11-09 | Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection. |
CVE-2023-5547 | Low | 3.3 | 2023-11-09 | The course upload preview contained an XSS risk for users uploading unsafe data. |
CVE-2023-5546 | Medium | 4.3 | 2023-11-09 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. |
CVE-2023-5545 | Low | 3.3 | 2023-11-09 | H5P metadata automatically populated the author with the user's username, which could be sensitive information. |
CVE-2023-5544 | Medium | 6.5 | 2023-11-09 | Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk. |
CVE-2023-5542 | Low | 3.3 | 2023-11-09 | Students in "Only see own membership" groups could see other students in the group, which should be hidden. |
CVE-2023-5541 | Low | 3.3 | 2023-11-09 | The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content. |
CVE-2023-5540 | Medium | 4.7 | 2023-11-09 | A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers. |
CVE-2023-5539 | Medium | 4.7 | 2023-11-09 | A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers. |
CVE-2023-39198 | High | 7.5 | 2023-11-09 | A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_crea… |
CVE-2023-34177 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions. |
CVE-2023-34171 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions. |
CVE-2023-34169 | Medium | 6.5 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in SAKURA Internet Inc. TS Webfonts for さくらのレンタルサーバ plugin <= 3.1.2 versions. |
CVE-2023-34033 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <= 2.0.1 versions. |
CVE-2023-6054 | Medium | 5.5 | 2023-11-09 | A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/manage/lock… |
CVE-2023-6053 | Medium | 6.3 | 2023-11-09 | A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.9. Affected by this issue is some unknown functionality of the fil… |
CVE-2023-47238 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions. |
CVE-2023-47237 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson Auto Publish for Google My Business plugin <= 3.7 versions. |
CVE-2023-34371 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions. |
CVE-2023-34182 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Peter Shaw LH Password Changer plugin <= 1.55 versions. |
CVE-2023-34181 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WP-Cirrus plugin <= 0.6.11 versions. |
CVE-2023-34178 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11 versions. |
CVE-2023-46614 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions. |
CVE-2023-34386 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions. |
CVE-2023-34002 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin <= 2.1.0.13 versions. |
CVE-2023-31087 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions. |
CVE-2023-25975 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Frédéric Sheedy Etsy Shop plugin <= 3.0.3 versions. |
CVE-2023-47610 | High | 8.1 | 2023-11-09 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to ex… |
CVE-2023-45885 | Medium | 5.4 | 2023-11-09 | Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in t… |
CVE-2023-45884 | Medium | 6.5 | 2023-11-09 | Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLay… |
CVE-2023-45284 | Medium | 5.3 | 2023-11-09 | On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserve… |
CVE-2023-45283 | High | 7.5 | 2023-11-09 | The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a… |
CVE-2023-47110 | Critical | 9.1 | 2023-11-09 | blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in mod… |
CVE-2023-46894 | High | 7.5 | 2023-11-09 | An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm. |
CVE-2023-46743 | High | 7.3 | 2023-11-09 | application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a docu… |
CVE-2023-36688 | Medium | 4.3 | 2023-11-09 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Mann Simple Site Verify plugin <= 1.0.7 versions. |
CVE-2023-25994 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.4.2 versions. |
CVE-2023-6039 | Medium | 5.5 | 2023-11-09 | A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw… |
CVE-2023-47373 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47372 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47370 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47368 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-43791 | Critical | 9.8 | 2023-11-09 | Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Lea… |
CVE-2023-41138 | High | 7.5 | 2023-11-09 | The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process. |
CVE-2023-41137 | High | 8.0 | 2023-11-09 | Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonat… |
CVE-2023-40055 | High | 8.0 | 2023-11-09 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-40054 | High | 8.0 | 2023-11-09 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-4612 | Critical | 9.8 | 2023-11-09 | Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.T… |
CVE-2023-47369 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications. |