2023 CVEs (page 117)
Page 117 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46765 | High | 7.5 | 2023-11-08 | Vulnerability of uncaught exceptions in the NFC module. Successful exploitation of this vulnerability can affect NFC availability. |
CVE-2023-46764 | Medium | 5.3 | 2023-11-08 | Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously. |
CVE-2023-46763 | Medium | 5.3 | 2023-11-08 | Vulnerability of background app permission management in the framework module. Successful exploitation of this vulnerability may cause background apps to start… |
CVE-2023-46762 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |
CVE-2023-46761 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |
CVE-2023-46760 | High | 7.5 | 2023-11-08 | Out-of-bounds write vulnerability in the kernel driver module. Successful exploitation of this vulnerability may cause process exceptions. |
CVE-2023-46755 | Medium | 5.3 | 2023-11-08 | Vulnerability of input parameters being not strictly verified in the input. Successful exploitation of this vulnerability may cause the launcher to restart. |
CVE-2023-5978 | High | 7.5 | 2023-11-08 | In versions of FreeBSD 13-RELEASE before 13-RELEASE-p5, under certain circumstances the cap_net libcasper(3) service incorrectly validates that updated constra… |
CVE-2023-5941 | Critical | 9.8 | 2023-11-08 | In versions of FreeBSD 12.4-RELEASE prior to 12.4-RELEASE-p7 and FreeBSD 13.2-RELEASE prior to 13.2-RELEASE-p5 the __sflush() stdio function in libc does not c… |
CVE-2023-46771 | High | 7.5 | 2023-11-08 | Security vulnerability in the face unlock module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-44098 | High | 7.5 | 2023-11-08 | Vulnerability of missing encryption in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-46483 | Medium | 5.4 | 2023-11-08 | Cross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the remark parameter of t… |
CVE-2023-41112 | High | 7.1 | 2023-11-08 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200… |
CVE-2023-41111 | High | 7.1 | 2023-11-08 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850, 1080, 2100, 2200… |
CVE-2023-39913 | High | 8.8 | 2023-11-08 | Deserialization of Untrusted Data, Improper Input Validation vulnerability in Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Java SDK, Apache UIMA Jav… |
CVE-2023-41270 | Low | 3.5 | 2023-11-08 | Improper Restriction of Excessive Authentication Attempts vulnerability in Samsung Smart TV UE40D7000 version T-GAPDEUC-1033.2 and before allows attackers to c… |
CVE-2023-44115 | High | 7.5 | 2023-11-08 | Vulnerability of improper permission control in the Booster module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2023-5801 | Critical | 9.1 | 2023-11-08 | Vulnerability of identity verification being bypassed in the face unlock module. Successful exploitation of this vulnerability will affect integrity and confid… |
CVE-2023-46770 | High | 7.5 | 2023-11-08 | Out-of-bounds vulnerability in the sensor module. Successful exploitation of this vulnerability may cause mistouch prevention errors on users' mobile phones. |
CVE-2023-46769 | High | 7.5 | 2023-11-08 | Use-After-Free (UAF) vulnerability in the dubai module. Successful exploitation of this vulnerability will affect availability. |
CVE-2023-46768 | High | 7.5 | 2023-11-08 | Multi-thread vulnerability in the idmap module. Successful exploitation of this vulnerability may cause features to perform abnormally. |
CVE-2023-4061 | Medium | 6.5 | 2023-11-08 | A flaw was found in wildfly-core. A management user could use the resolve-expression in the HAL Interface to read possible sensitive information from the Wildf… |
CVE-2023-6002 | Medium | 6.5 | 2023-11-08 | YugabyteDB is vulnerable to cross site scripting (XSS) via log injection. Writing invalidated user input to log files can allow an unprivileged attacker to for… |
CVE-2023-6001 | Medium | 5.3 | 2023-11-08 | Prometheus metrics are available without authentication. These expose detailed and sensitive information about the YugabyteDB Anywhere environment. |
CVE-2023-45380 | High | 8.8 | 2023-11-07 | In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a guest can download… |
CVE-2023-43984 | High | 7.5 | 2023-11-07 | Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information from the ps_customer t… |
CVE-2023-46800 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the view_profile.php resource do… |
CVE-2023-46793 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'day' parameter in the 'register()' function of th… |
CVE-2023-46001 | Medium | 5.5 | 2023-11-07 | Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the gpac/src/isomedia/… |
CVE-2023-42361 | High | 7.8 | 2023-11-07 | Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an attacker to view arb… |
CVE-2023-5982 | Medium | 5.4 | 2023-11-07 | The UpdraftPlus: WordPress Backup & Migration Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2… |
CVE-2023-46789 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'filename' attribute of the 'pic1' multipart param… |
CVE-2023-46788 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter in the 'uploadphoto()' function of… |
CVE-2023-46787 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the auth/auth.php resource… |
CVE-2023-46785 | Critical | 9.8 | 2023-11-07 | Online Matrimonial Project v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the partner_preference.php resou… |
CVE-2023-46679 | Critical | 9.8 | 2023-11-07 | Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname_email' parameter of the index.php resource does… |
CVE-2023-46677 | Critical | 9.8 | 2023-11-07 | Online Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'txt_uname' parameter of the sign-up.php resource does not… |
CVE-2023-5819 | Medium | 4.4 | 2023-11-07 | The Amazonify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.8.1 due to insuffici… |
CVE-2023-5818 | Medium | 4.3 | 2023-11-07 | The Amazonify plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.8.1. This is due to missing or incorrect… |
CVE-2023-4956 | Medium | 6.5 | 2023-11-07 | A flaw was found in Quay. Clickjacking is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link on anot… |
CVE-2023-4154 | High | 7.5 | 2023-11-07 | A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Do… |
CVE-2023-46243 | Critical | 9.9 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to execu… |
CVE-2023-5998 | High | 7.5 | 2023-11-07 | Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.3.0-DEV. |
CVE-2023-5309 | Medium | 6.8 | 2023-11-07 | Versions of Puppet Enterprise prior to 2021.7.6 and 2023.5 contain a flaw which results in broken session management for SAML implementations. |
CVE-2023-46253 | Critical | 9.1 | 2023-11-07 | Squidex is an open source headless CMS and content management hub. Affected versions are subject to an arbitrary file write vulnerability in the backup restore… |
CVE-2023-46252 | Medium | 6.8 | 2023-11-07 | Squidex is an open source headless CMS and content management hub. Affected versions are missing origin verification in a postMessage handler which introduces… |
CVE-2023-46244 | Critical | 9.1 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for a user to write… |
CVE-2023-46242 | Critical | 9.6 | 2023-11-07 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible to execute a conten… |
CVE-2023-46744 | Medium | 5.4 | 2023-11-07 | Squidex is an open source headless CMS and content management hub. In affected versions a stored Cross-Site Scripting (XSS) vulnerability enables privilege esc… |
CVE-2023-46737 | Low | 3.1 | 2023-11-07 | Cosign is a sigstore signing tool for OCI containers. Cosign is susceptible to a denial of service by an attacker controlled registry. An attacker who controls… |
CVE-2023-46730 | High | 7.4 | 2023-11-07 | Group-Office is an enterprise CRM and groupware tool. In affected versions there is full Server-Side Request Forgery (SSRF) vulnerability in the /api/upload.ph… |
CVE-2023-46501 | Critical | 9.1 | 2023-11-07 | An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin password function. |
CVE-2023-41798 | Medium | 5.1 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in wpWax Directorist – WordPress Business Directory Plugin with Classified Ads Listing… |
CVE-2023-32966 | Medium | 5.4 | 2023-11-07 | Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through 1.8.7. |
CVE-2023-28499 | Medium | 5.4 | 2023-11-07 | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in simonpedge Slide Anything – Responsive Content / HTML Slider and Carousel plugin <= 2.4.9 ve… |
CVE-2023-0898 | Medium | 5.3 | 2023-11-07 | General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application. |
CVE-2023-5179 | High | 7.8 | 2023-11-07 | An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to a… |
CVE-2023-4295 | High | 7.8 | 2023-11-07 | A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. |
CVE-2023-4272 | Medium | 5.5 | 2023-11-07 | A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory. |
CVE-2023-47360 | High | 7.5 | 2023-11-07 | Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. |
CVE-2023-47359 | Critical | 9.8 | 2023-11-07 | Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memo… |
CVE-2023-42659 | Critical | 9.1 | 2023-11-07 | In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the abili… |
CVE-2023-41425 | Medium | 6.1 | 2023-11-07 | Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the i… |
CVE-2023-3889 | High | 7.8 | 2023-11-07 | A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain acces… |
CVE-2023-36527 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft… |
CVE-2023-25983 | High | 8.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84. |
CVE-2023-23796 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builde… |
CVE-2023-23678 | Medium | 4.0 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cook… |
CVE-2023-22719 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1. |
CVE-2023-47456 | Critical | 9.1 | 2023-11-07 | Tenda AX1806 V1.0.0.1 contains a stack overflow vulnerability in function sub_455D4, called by function fromSetWirelessRepeat. |
CVE-2023-47455 | Critical | 9.1 | 2023-11-07 | Tenda AX1806 V1.0.0.1 contains a heap overflow vulnerability in setSchedWifi function, in which the src and v12 are directly obtained from http request paramet… |
CVE-2023-33481 | Critical | 9.8 | 2023-11-07 | RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php. |
CVE-2023-33480 | High | 8.8 | 2023-11-07 | RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users… |
CVE-2023-33479 | Critical | 9.8 | 2023-11-07 | RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file. |
CVE-2023-33478 | Critical | 9.8 | 2023-11-07 | RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php. |
CVE-2023-5709 | High | 8.8 | 2023-11-07 | The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 due to insufficient… |
CVE-2023-5703 | Medium | 6.4 | 2023-11-07 | The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in a… |
CVE-2023-5669 | Medium | 6.4 | 2023-11-07 | The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, an… |
CVE-2023-5661 | Medium | 6.4 | 2023-11-07 | The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including… |
CVE-2023-5660 | Medium | 6.4 | 2023-11-07 | The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including… |
CVE-2023-5659 | Medium | 6.4 | 2023-11-07 | The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all ver… |
CVE-2023-5577 | Medium | 6.4 | 2023-11-07 | The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, and including, 2.7.1… |
CVE-2023-5567 | Medium | 6.4 | 2023-11-07 | The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and including, 1.0 due to insuff… |
CVE-2023-4888 | Medium | 6.4 | 2023-11-07 | The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including… |
CVE-2023-4842 | Medium | 6.4 | 2023-11-07 | The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to… |
CVE-2023-0436 | Medium | 4.5 | 2023-11-07 | The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBU… |
CVE-2023-5975 | Medium | 4.3 | 2023-11-07 | The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect n… |
CVE-2023-5743 | Medium | 6.4 | 2023-11-07 | The Telephone Number Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'telnumlink' shortcode in all versions up to, an… |
CVE-2023-5658 | Medium | 6.4 | 2023-11-07 | The WP MapIt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_mapit' shortcode in all versions up to, and including, 2.7… |
CVE-2023-5532 | Medium | 6.1 | 2023-11-07 | The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect n… |
CVE-2023-5507 | Medium | 6.4 | 2023-11-07 | The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insuf… |
CVE-2023-5506 | Medium | 5.4 | 2023-11-07 | The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area_ajax' function in… |
CVE-2023-46819 | Medium | 5.3 | 2023-11-07 | Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are rec… |
CVE-2023-47510 | High | 7.1 | 2023-11-07 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPSolutions-HQ WPDBSpringClean plugin <= 1.6 versions. |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2023-5076 | Medium | 6.4 | 2023-11-07 | The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and includin… |
CVE-2023-46845 | High | 7.2 | 2023-11-07 | EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability… |
CVE-2023-43886 | High | 7.1 | 2023-11-07 | A buffer overflow in the HTTP server component of Tenda RX9 Pro v22.03.02.20 might allow an authenticated attacker to overwrite memory. |
CVE-2023-43885 | High | 8.1 | 2023-11-07 | Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily lock the device. |
CVE-2023-42555 | Medium | 6.3 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in EasySetup prior to version 11.1.13 allows attackers to get the bluetooth address of user de… |