2023 CVEs (page 116)
Page 116 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-43567 | Medium | 6.7 | 2023-11-08 | A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to… |
CVE-2023-36667 | High | 7.5 | 2023-11-08 | Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. |
CVE-2023-46363 | Medium | 5.5 | 2023-11-08 | jbig2enc v0.28 was discovered to contain a SEGV via jbig2_add_page in src/jbig2enc.cc:512. |
CVE-2023-46362 | Medium | 5.5 | 2023-11-08 | jbig2enc v0.28 was discovered to contain a heap-use-after-free via jbig2enc_auto_threshold_using_hash in src/jbig2enc.cc. |
CVE-2023-45875 | High | 7.5 | 2023-11-08 | An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster. |
CVE-2023-45857 | Medium | 6.5 | 2023-11-08 | An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for ever… |
CVE-2023-29974 | Critical | 9.8 | 2023-11-08 | An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements. |
CVE-2023-0392 | Medium | 6.7 | 2023-11-08 | The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. |
CVE-2023-5996 | High | 8.8 | 2023-11-08 | Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2023-26221 | Medium | 5.0 | 2023-11-08 | The Spotfire Connectors component of TIBCO Software Inc.'s Spotfire Analyst, Spotfire Server, and Spotfire for AWS Marketplace contains an easily exploitable v… |
CVE-2023-47231 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bainternet ShortCodes UI plugin <= 1.9.8 versions. |
CVE-2023-47229 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vyas Dipen Top 25 Social Icons plugin <= 3.1 versions. |
CVE-2023-47228 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Muneeb Layer Slider plugin <= 1.1.9.7 versions. |
CVE-2023-47227 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Web-Settler Social Feed | All social media in one place plugin <= 1.5.4.6 versions. |
CVE-2023-47226 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Post Sliders & Post Grids plugin <= 1.0.20 versions. |
CVE-2023-47223 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Map Plugins Basic Interactive World Map plugin <= 2.0 versions. |
CVE-2023-47190 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Apollo13Themes Apollo13 Framework Extensions plugin <= 1.9.0 versions. |
CVE-2023-47181 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Martin Gibson IdeaPush plugin <= 8.52 versions. |
CVE-2023-3282 | Medium | 6.4 | 2023-11-08 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system enables a local atta… |
CVE-2023-5913 | High | 8.2 | 2023-11-08 | Incorrect Privilege Assignment vulnerability in opentext Fortify ScanCentral DAST. The vulnerability could be exploited to gain elevated privileges.This issue… |
CVE-2023-5760 | High | 8.2 | 2023-11-08 | A time-of-check to time-of-use (TOCTOU) bug in handling of IOCTL (input/output control) requests. This TOCTOU bug leads to an out-of-bounds write vulnerability… |
CVE-2023-47379 | Medium | 5.4 | 2023-11-08 | Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality. |
CVE-2023-46643 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in GARY JEZORSKI CloudNet360 plugin <= 3.2.0 versions. |
CVE-2023-46642 | Medium | 5.9 | 2023-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in sahumedia SAHU TikTok Pixel for E-Commerce plugin <= 1.2.2 versions. |
CVE-2023-5759 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the buffer was identified. Reported by Jason Geffner. |
CVE-2023-5136 | Medium | 5.5 | 2023-11-08 | An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure. An attacker could exploit this vulnerability b… |
CVE-2023-47397 | Critical | 9.8 | 2023-11-08 | WeBid <=1.2.2 is vulnerable to code injection via admin/categoriestrans.php. |
CVE-2023-47107 | High | 8.8 | 2023-11-08 | PILOS is an open source front-end for BigBlueButton servers with a built-in load balancer. The password reset component deployed within PILOS uses the hostname… |
CVE-2023-46640 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in D. Relton Medialist plugin <= 1.3.9 versions. |
CVE-2023-46627 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin <= 2.1 versions. |
CVE-2023-46626 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FLOWFACT WP Connector plugin <= 2.1.7 versions. |
CVE-2023-46621 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin <= 1.4.11 versions. |
CVE-2023-46613 | Medium | 6.5 | 2023-11-08 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Jens Kuerschner Add to Calendar Button plugin <= 1.5.1 versions. |
CVE-2023-45849 | Critical | 9.0 | 2023-11-08 | An arbitrary code execution which results in privilege escalation was discovered in Helix Core versions prior to 2023.2. Reported by Jason Geffner. |
CVE-2023-45319 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the commit function was identified. Reported by Jason Geffner. |
CVE-2023-45140 | Medium | 4.8 | 2023-11-08 | The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Estab… |
CVE-2023-35767 | High | 7.5 | 2023-11-08 | In Helix Core versions prior to 2023.2, an unauthenticated remote Denial of Service (DoS) via the shutdown function was identified. Reported by Jason Geffner… |
CVE-2023-32298 | High | 7.1 | 2023-11-08 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Kathy Darling Simple User Listing plugin <= 1.9.2 versions. |
CVE-2023-6012 | High | 8.3 | 2023-11-08 | An improper input validation vulnerability has been found in Lanaccess ONSAFE MonitorHM affecting version 3.7.0. This vulnerability could lead a remote attacke… |
CVE-2023-46759 | High | 7.5 | 2023-11-08 | Permission control vulnerability in the call module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-46758 | High | 7.5 | 2023-11-08 | Permission management vulnerability in the multi-screen interaction module. Successful exploitation of this vulnerability may cause service exceptions of the d… |
CVE-2023-46757 | High | 7.5 | 2023-11-08 | The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability may affect confiden… |
CVE-2023-46756 | Medium | 5.3 | 2023-11-08 | Permission control vulnerability in the window management module. Successful exploitation of this vulnerability may cause malicious pop-up windows. |
CVE-2023-46774 | High | 7.5 | 2023-11-08 | Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability. |
CVE-2023-46772 | High | 7.5 | 2023-11-08 | Vulnerability of parameters being out of the value range in the QMI service module. Successful exploitation of this vulnerability may cause errors in reading f… |
CVE-2023-46767 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |
CVE-2023-46766 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |
CVE-2023-46765 | High | 7.5 | 2023-11-08 | Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability. |
CVE-2023-46764 | Medium | 5.3 | 2023-11-08 | Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously. |
CVE-2023-46763 | Medium | 5.3 | 2023-11-08 | Vulnerability of background app permission management in the framework module. Successful exploitation of this vulnerability may cause background apps to start… |
CVE-2023-46762 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |
CVE-2023-46761 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |
CVE-2023-46760 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |
CVE-2023-46755 | Medium | 5.3 | 2023-11-08 | Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerability may cause the launcher to restart. |
CVE-2023-5978 | High | 7.5 | 2023-11-08 | In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constra… |
CVE-2023-5941 | Critical | 9.8 | 2023-11-08 | In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not c… |
CVE-2023-46771 | High | 7.5 | 2023-11-08 | Security vulnerability in the face unlock module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44098 | High | 7.5 | 2023-11-08 | Vulnerability of missing encryption in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-46483 | Medium | 5.4 | 2023-11-08 | Cross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the remark parameter of t… |
CVE-2023-41112 | High | 7.1 | 2023-11-08 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200… |
CVE-2023-41111 | High | 7.1 | 2023-11-08 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200… |
CVE-2023-39913 | High | 8.8 | 2023-11-08 | Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Jav… |
CVE-2023-41270 | Low | 3.5 | 2023-11-08 | Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before allows attackers to c… |
CVE-2023-44115 | High | 7.5 | 2023-11-08 | Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-5801 | Critical | 9.1 | 2023-11-08 | Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confid… |
CVE-2023-46770 | High | 7.5 | 2023-11-08 | Out-of-bounds vulnerability in the sensor module. Successful exploitation of this vulnerability may cause mistouch prevention errors on users' mobile phones. |
CVE-2023-46769 | High | 7.5 | 2023-11-08 | Use-After-Free (UAF) vulnerability in the dubai module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-46768 | High | 7.5 | 2023-11-08 | Multi-thread vulnerability in the idmap module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-4061 | Medium | 6.5 | 2023-11-08 | A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildf… |
CVE-2023-6002 | Medium | 6.5 | 2023-11-08 | YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to for… |
CVE-2023-6001 | Medium | 5.3 | 2023-11-08 | Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment. |
CVE-2023-45380 | High | 8.8 | 2023-11-07 | In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download… |
CVE-2023-43984 | High | 7.5 | 2023-11-07 | Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer t… |
CVE-2023-46800 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the view_profile.php resource do… |
CVE-2023-46793 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register()' function of th… |
CVE-2023-46001 | Medium | 5.5 | 2023-11-07 | Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/… |
CVE-2023-42361 | High | 7.8 | 2023-11-07 | Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arb… |
CVE-2023-5982 | Medium | 5.4 | 2023-11-07 | The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2… |
CVE-2023-46789 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic1' multipart param… |
CVE-2023-46788 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter in the 'uploadphoto()' function of… |
CVE-2023-46787 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the auth/auth.php resource… |
CVE-2023-46785 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partner_preference.php resou… |
CVE-2023-46679 | Critical | 9.8 | 2023-11-07 | Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index.php resource does… |
CVE-2023-46677 | Critical | 9.8 | 2023-11-07 | Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname' parameter of the sign-up.php resource does not… |
CVE-2023-5819 | Medium | 4.4 | 2023-11-07 | The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8.1 due to insuffici… |
CVE-2023-5818 | Medium | 4.3 | 2023-11-07 | The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect… |
CVE-2023-4956 | Medium | 6.5 | 2023-11-07 | A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on anot… |
CVE-2023-4154 | High | 7.5 | 2023-11-07 | A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Do… |
CVE-2023-46243 | Critical | 9.9 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execu… |
CVE-2023-5998 | High | 7.5 | 2023-11-07 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-5309 | Medium | 6.8 | 2023-11-07 | Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations. |
CVE-2023-46253 | Critical | 9.1 | 2023-11-07 | Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore… |
CVE-2023-46252 | Medium | 6.8 | 2023-11-07 | Squidex is an open source headless CMS and content management hub. Affected versions are missing origin verification in a postMessage handler which introduces… |
CVE-2023-46244 | Critical | 9.1 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to write… |
CVE-2023-46242 | Critical | 9.6 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to execute a conten… |
CVE-2023-46744 | Medium | 5.4 | 2023-11-07 | Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting (XSS) vulnerability enables privilege esc… |
CVE-2023-46737 | Low | 3.1 | 2023-11-07 | Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls… |
CVE-2023-46730 | High | 7.4 | 2023-11-07 | Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.ph… |
CVE-2023-46501 | Critical | 9.1 | 2023-11-07 | An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function. |
CVE-2023-41798 | Medium | 5.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing… |