2023 CVEs (page 115)
Page 115 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5546 | Medium | 4.3 | 2023-11-09 | ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk. |
CVE-2023-5545 | Low | 3.3 | 2023-11-09 | H5P metadata automatically populated the author with the user's username, which could be sensitive information. |
CVE-2023-5544 | Medium | 6.5 | 2023-11-09 | Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk. |
CVE-2023-5542 | Low | 3.3 | 2023-11-09 | Students in "Only see own membership" groups could see other students in the group, which should be hidden. |
CVE-2023-5541 | Low | 3.3 | 2023-11-09 | The CSV grade import method contained an XSS risk for users importing the spreadsheet, if it contained unsafe content. |
CVE-2023-5540 | Medium | 4.7 | 2023-11-09 | A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers. |
CVE-2023-5539 | Medium | 4.7 | 2023-11-09 | A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers. |
CVE-2023-39198 | High | 7.5 | 2023-11-09 | A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_crea… |
CVE-2023-34177 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Kenth Hagström WP-Cache.Com plugin <= 1.1.1 versions. |
CVE-2023-34171 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Alex Raven WP Report Post plugin <= 2.1.2 versions. |
CVE-2023-34169 | Medium | 6.5 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in SAKURA Internet Inc. TS Webfonts for さくらのレンタルサーバ plugin <= 3.1.2 versions. |
CVE-2023-34033 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Malinky Ajax Pagination and Infinite Scroll plugin <= 2.0.1 versions. |
CVE-2023-6054 | Medium | 5.5 | 2023-11-09 | A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.9. This affects an unknown part of the file general/wiki/cp/manage/lock… |
CVE-2023-6053 | Medium | 6.3 | 2023-11-09 | A vulnerability, which was classified as critical, has been found in Tongda OA 2017 up to 11.9. Affected by this issue is some unknown functionality of the fil… |
CVE-2023-47238 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WebberZone Top 10 – WordPress Popular posts by WebberZone plugin <= 3.3.2 versions. |
CVE-2023-47237 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Martin Gibson Auto Publish for Google My Business plugin <= 3.7 versions. |
CVE-2023-34371 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Didier Sampaolo SpamReferrerBlock plugin <= 2.22 versions. |
CVE-2023-34182 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Peter Shaw LH Password Changer plugin <= 1.55 versions. |
CVE-2023-34181 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WP-Cirrus plugin <= 0.6.11 versions. |
CVE-2023-34178 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11 versions. |
CVE-2023-46614 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Mat Bao Corp WP Helper Premium plugin <= 4.5.1 versions. |
CVE-2023-34386 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WPClever WPC Smart Wishlist for WooCommerce plugin <= 4.7.1 versions. |
CVE-2023-34002 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory Manager plugin <= 2.1.0.13 versions. |
CVE-2023-31087 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in JoomSky JS Job Manager plugin <= 2.0.0 versions. |
CVE-2023-25975 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Frédéric Sheedy Etsy Shop plugin <= 3.0.3 versions. |
CVE-2023-47610 | High | 8.1 | 2023-11-09 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticated attacker to ex… |
CVE-2023-45885 | Medium | 5.4 | 2023-11-09 | Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new component feature in t… |
CVE-2023-45884 | Medium | 6.5 | 2023-11-09 | Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information via the flexibleLay… |
CVE-2023-45284 | Medium | 5.3 | 2023-11-09 | On Windows, The IsLocal function does not correctly detect reserved device names in some cases. Reserved names followed by spaces, such as "COM1 ", and reserve… |
CVE-2023-45283 | High | 7.5 | 2023-11-09 | The filepath package does not recognize paths with a \??\ prefix as special. On Windows, a path beginning with \??\ is a Root Local Device path equivalent to a… |
CVE-2023-47110 | Critical | 9.1 | 2023-11-09 | blockreassurance adds an information block aimed at offering helpful information to reassure customers that their store is trustworthy. An ajax function in mod… |
CVE-2023-46894 | High | 7.5 | 2023-11-09 | An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm. |
CVE-2023-46743 | High | 7.3 | 2023-11-09 | application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a docu… |
CVE-2023-36688 | Medium | 4.3 | 2023-11-09 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Michael Mann Simple Site Verify plugin <= 1.0.7 versions. |
CVE-2023-25994 | Medium | 5.4 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Alex Benfica Publish to Schedule plugin <= 4.4.2 versions. |
CVE-2023-6039 | Medium | 5.5 | 2023-11-09 | A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw… |
CVE-2023-47373 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47372 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47370 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47368 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-43791 | Critical | 9.8 | 2023-11-09 | Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chained within the ORM Lea… |
CVE-2023-41138 | High | 7.5 | 2023-11-09 | The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user process. |
CVE-2023-41137 | High | 8.0 | 2023-11-09 | Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and used to impersonat… |
CVE-2023-40055 | High | 8.0 | 2023-11-09 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-40054 | High | 8.0 | 2023-11-09 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-4612 | Critical | 9.8 | 2023-11-09 | Improper Authentication vulnerability in Apereo CAS in jakarta.servlet.http.HttpServletRequest.getRemoteAddr method allows Multi-Factor Authentication bypass.T… |
CVE-2023-47369 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications. |
CVE-2023-47367 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47366 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47365 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-47364 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims |
CVE-2023-47363 | Medium | 6.5 | 2023-11-09 | The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims. |
CVE-2023-6052 | Medium | 6.3 | 2023-11-09 | A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.9. Affected is an unknown function of the file general/system/censor_words/mod… |
CVE-2023-47616 | Low | 2.4 | 2023-11-09 | A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion P… |
CVE-2023-47615 | Low | 3.3 | 2023-11-09 | A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cint… |
CVE-2023-47612 | Medium | 6.8 | 2023-11-09 | A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8… |
CVE-2023-4218 | Medium | 5.0 | 2023-11-09 | In Eclipse IDE versions < 2023-09 (4.29) some files with xml content are parsed vulnerable against all sorts of XXE attacks. The user just needs to open any ev… |
CVE-2023-47248 | Critical | 9.8 | 2023-11-09 | Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable… |
CVE-2023-47613 | Medium | 4.4 | 2023-11-09 | A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Cinterion ELS61/81, T… |
CVE-2023-47489 | High | 7.8 | 2023-11-09 | CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the export-v2.php and… |
CVE-2023-47488 | Medium | 6.1 | 2023-11-09 | Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted script to the attrib_m… |
CVE-2023-46492 | Medium | 6.1 | 2023-11-09 | Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the public_html/doc/in… |
CVE-2023-26156 | Medium | 5.6 | 2023-11-09 | Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary system binary. This… |
CVE-2023-20902 | Medium | 5.9 | 2023-11-09 | A timing condition in Harbor 2.6.x and below, Harbor 2.7.2 and below, Harbor 2.8.2 and below, and Harbor 1.10.17 and below allows an attacker with network acc… |
CVE-2023-37790 | Medium | 5.4 | 2023-11-09 | Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload function. |
CVE-2023-37533 | Medium | 5.4 | 2023-11-09 | HCL Connections is vulnerable to reflected cross-site scripting (XSS) where an attacker may leverage these issues to execute arbitrary script code in the brows… |
CVE-2023-4249 | High | 8.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 has a command in… |
CVE-2023-45225 | Critical | 9.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to… |
CVE-2023-45079 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-45078 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM var… |
CVE-2023-45077 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-45076 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-45075 | Medium | 6.7 | 2023-11-08 | A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. |
CVE-2023-43755 | Critical | 9.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable t… |
CVE-2023-43581 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arb… |
CVE-2023-43580 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute a… |
CVE-2023-43579 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbi… |
CVE-2023-43578 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbit… |
CVE-2023-43577 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitr… |
CVE-2023-43576 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbit… |
CVE-2023-43575 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to exe… |
CVE-2023-43574 | Medium | 4.4 | 2023-11-08 | A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated pri… |
CVE-2023-43573 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated priv… |
CVE-2023-43572 | Medium | 4.4 | 2023-11-08 | A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to d… |
CVE-2023-43571 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to ex… |
CVE-2023-3959 | Critical | 9.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to… |
CVE-2023-39435 | High | 8.8 | 2023-11-08 | Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220, CB6231, B8520, B8220, and CD321 IP Cameras with firmware version M2.1.6.05 are vulnerable to… |
CVE-2023-5079 | High | 7.5 | 2023-11-08 | Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information di… |
CVE-2023-5078 | Medium | 6.7 | 2023-11-08 | A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware. |
CVE-2023-5075 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated privileges to exec… |
CVE-2023-4891 | Medium | 5.5 | 2023-11-08 | A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service. |
CVE-2023-4706 | High | 7.3 | 2023-11-08 | A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrec… |
CVE-2023-4632 | High | 7.8 | 2023-11-08 | An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated pri… |
CVE-2023-47114 | Medium | 4.3 | 2023-11-08 | Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of… |
CVE-2023-47113 | High | 7.3 | 2023-11-08 | BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By… |
CVE-2023-47111 | High | 7.3 | 2023-11-08 | ZITADEL provides identity infrastructure. ZITADEL provides administrators the possibility to define a `Lockout Policy` with a maximum amount of failed password… |
CVE-2023-47109 | Medium | 5.5 | 2023-11-08 | PrestaShop blockreassurance adds an information block aimed at offering helpful information to reassure customers that the store is trustworthy. When adding a… |
CVE-2023-43570 | Medium | 6.7 | 2023-11-08 | A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permissions to execute… |
CVE-2023-43569 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitra… |
CVE-2023-43568 | Medium | 4.4 | 2023-11-08 | A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to… |