2023 CVEs (page 117)
Page 117 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-32966 | Medium | 5.4 | 2023-11-07 | Cross-Site Request Forgery (CSRF) vulnerability in CRUDLab Jazz Popups leads to Stored XSS.This issue affects Jazz Popups: from n/a through 1.8.7. |
CVE-2023-28499 | Medium | 5.4 | 2023-11-07 | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in simonpedge Slide Anything – Responsive Content / HTML Slider and Carousel plugin <= 2.4.9 ve… |
CVE-2023-0898 | Medium | 5.3 | 2023-11-07 | General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application. |
CVE-2023-5179 | High | 7.8 | 2023-11-07 | An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. A corrupted value for the start of MiniFat sector in a crafted DGN file leads to a… |
CVE-2023-4295 | High | 7.8 | 2023-11-07 | A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory. |
CVE-2023-4272 | Medium | 5.5 | 2023-11-07 | A local non-privileged user can make GPU processing operations that expose sensitive data from previously freed memory. |
CVE-2023-47360 | High | 7.5 | 2023-11-07 | Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. |
CVE-2023-47359 | Critical | 9.8 | 2023-11-07 | Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() and results in a memo… |
CVE-2023-42659 | Critical | 9.1 | 2023-11-07 | In WS_FTP Server versions prior to 8.7.6 and 8.8.4, an unrestricted file upload flaw has been identified. An authenticated Ad Hoc Transfer user has the abili… |
CVE-2023-41425 | Medium | 6.1 | 2023-11-07 | Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the i… |
CVE-2023-3889 | High | 7.8 | 2023-11-07 | A local non-privileged user can make improper GPU memory processing operations. If the operations are carefully prepared, then they could be used to gain acces… |
CVE-2023-36527 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in BestWebSoft Post to CSV by BestWebSoft.This issue affects Post to CSV by BestWebSoft… |
CVE-2023-25983 | High | 8.8 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WPOmnia KB Support.This issue affects KB Support: from n/a through 1.5.84. |
CVE-2023-23796 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Muneeb Form Builder | Create Responsive Contact Forms.This issue affects Form Builde… |
CVE-2023-23678 | Medium | 4.0 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in WPEkaClub WP Cookie Consent ( for GDPR, CCPA & ePrivacy ).This issue affects WP Cook… |
CVE-2023-22719 | Medium | 4.7 | 2023-11-07 | Improper Neutralization of Formula Elements in a CSV File vulnerability in GiveWP.This issue affects GiveWP: from n/a through 2.25.1. |
CVE-2023-47456 | Critical | 9.1 | 2023-11-07 | Tenda AX1806 V1.0.0.1 contains a stack overflow vulnerability in function sub_455D4, called by function fromSetWirelessRepeat. |
CVE-2023-47455 | Critical | 9.1 | 2023-11-07 | Tenda AX1806 V1.0.0.1 contains a heap overflow vulnerability in setSchedWifi function, in which the src and v12 are directly obtained from http request paramet… |
CVE-2023-33481 | Critical | 9.8 | 2023-11-07 | RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php. |
CVE-2023-33480 | High | 8.8 | 2023-11-07 | RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to create admin users… |
CVE-2023-33479 | Critical | 9.8 | 2023-11-07 | RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file. |
CVE-2023-33478 | Critical | 9.8 | 2023-11-07 | RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php. |
CVE-2023-5709 | High | 8.8 | 2023-11-07 | The WD WidgetTwitter plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 1.0.9 due to insufficient… |
CVE-2023-5703 | Medium | 6.4 | 2023-11-07 | The Gift Up Gift Cards for WordPress and WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'giftup' shortcode in a… |
CVE-2023-5669 | Medium | 6.4 | 2023-11-07 | The Featured Image Caption plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and post meta in all versions up to, an… |
CVE-2023-5661 | Medium | 6.4 | 2023-11-07 | The Social Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialfeed' shortcode in all versions up to, and including… |
CVE-2023-5660 | Medium | 6.4 | 2023-11-07 | The SendPress Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including… |
CVE-2023-5659 | Medium | 6.4 | 2023-11-07 | The Interact: Embed A Quiz On Your Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'interact-quiz' shortcode in all ver… |
CVE-2023-5577 | Medium | 6.4 | 2023-11-07 | The Bitly's plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpbitly' shortcode in all versions up to, and including, 2.7.1… |
CVE-2023-5567 | Medium | 6.4 | 2023-11-07 | The QR Code Tag plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'qrcodetag' shortcode in versions up to, and including, 1.0 due to insuff… |
CVE-2023-4888 | Medium | 6.4 | 2023-11-07 | The Simple Like Page Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'sfp-page-plugin' shortcode in versions up to, and including… |
CVE-2023-4842 | Medium | 6.4 | 2023-11-07 | The Social Sharing Plugin - Social Warfare plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'social_warfare' shortcode in versions up to… |
CVE-2023-0436 | Medium | 4.5 | 2023-11-07 | The affected versions of MongoDB Atlas Kubernetes Operator may print sensitive information like GCP service account keys and API integration secrets while DEBU… |
CVE-2023-5975 | Medium | 4.3 | 2023-11-07 | The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect n… |
CVE-2023-5743 | Medium | 6.4 | 2023-11-07 | The Telephone Number Linker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'telnumlink' shortcode in all versions up to, an… |
CVE-2023-5658 | Medium | 6.4 | 2023-11-07 | The WP MapIt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_mapit' shortcode in all versions up to, and including, 2.7… |
CVE-2023-5532 | Medium | 6.1 | 2023-11-07 | The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to missing or incorrect n… |
CVE-2023-5507 | Medium | 6.4 | 2023-11-07 | The ImageMapper plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'imagemap' shortcode in versions up to, and including, 1.2.6 due to insuf… |
CVE-2023-5506 | Medium | 5.4 | 2023-11-07 | The ImageMapper plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'imgmap_delete_area_ajax' function in… |
CVE-2023-46819 | Medium | 5.3 | 2023-11-07 | Missing Authentication in Apache Software Foundation Apache OFBiz when using the Solr plugin. This issue affects Apache OFBiz: before 18.12.09. Users are rec… |
CVE-2023-47510 | High | 7.1 | 2023-11-07 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WPSolutions-HQ WPDBSpringClean plugin <= 1.6 versions. |
CVE-2023-46851 | Medium | 4.9 | 2023-11-07 | Allura Discussion and Allura Forum importing does not restrict URL values specified in attachments. Project administrators can run these imports, which could c… |
CVE-2023-5076 | Medium | 6.4 | 2023-11-07 | The Ziteboard Online Whiteboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ziteboard' shortcode in versions up to, and includin… |
CVE-2023-46845 | High | 7.2 | 2023-11-07 | EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execution vulnerability… |
CVE-2023-43886 | High | 7.1 | 2023-11-07 | A buffer overflow in the HTTP server component of Tenda RX9 Pro v22.03.02.20 might allow an authenticated attacker to overwrite memory. |
CVE-2023-43885 | High | 8.1 | 2023-11-07 | Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily lock the device. |
CVE-2023-42555 | Medium | 6.3 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in EasySetup prior to version 11.1.13 allows attackers to get the bluetooth address of user de… |
CVE-2023-42554 | Medium | 5.4 | 2023-11-07 | Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication. |
CVE-2023-42553 | Medium | 4.0 | 2023-11-07 | Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email. |
CVE-2023-42552 | Medium | 4.4 | 2023-11-07 | Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 in Android 12 and 14.1.00.7 in Android 1… |
CVE-2023-42551 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows attackers to access a… |
CVE-2023-42550 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5.00.7 allows attackers to access arbitr… |
CVE-2023-42549 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers… |
CVE-2023-42548 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior to version 14.5.00.7 allows attackers… |
CVE-2023-42547 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00.7 allows attackers… |
CVE-2023-42546 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account prior to version 14.5.00.7 allows attacke… |
CVE-2023-42545 | Medium | 5.5 | 2023-11-07 | Use of implicit intent for sensitive communication vulnerability in Phone prior to versions 12.7.20.12 in Android 11, 13.1.48, 13.5.28 in Android 12, and 14.7… |
CVE-2023-42544 | Medium | 5.5 | 2023-11-07 | Improper access control vulnerability in Quick Share prior to 13.5.52.0 allows local attacker to access local files. |
CVE-2023-42543 | Medium | 6.2 | 2023-11-07 | Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows attackers to access arbitrary data with Bi… |
CVE-2023-42542 | Low | 3.3 | 2023-11-07 | Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID to identify the device. |
CVE-2023-42541 | Medium | 4.0 | 2023-11-07 | Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id. |
CVE-2023-42540 | Medium | 4.0 | 2023-11-07 | Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via implicit intent. |
CVE-2023-42539 | Medium | 4.7 | 2023-11-07 | PendingIntent hijacking vulnerability in ChallengeNotificationManager in Samsung Health prior to version 6.25 allows local attackers to access data. |
CVE-2023-42538 | Medium | 5.9 | 2023-11-07 | An improper input validation in saped_rec_silence in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write. |
CVE-2023-42537 | High | 8.4 | 2023-11-07 | An improper input validation in get_head_crc in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write. |
CVE-2023-42536 | High | 8.4 | 2023-11-07 | An improper input validation in saped_dec in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and write. |
CVE-2023-42535 | High | 8.4 | 2023-11-07 | Out-of-bounds Write in read_block of vold prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-42534 | Medium | 6.3 | 2023-11-07 | Improper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows local attackers to read arbitrary files with system privilege. |
CVE-2023-42533 | Medium | 6.6 | 2023-11-07 | Improper Input Validation with USB Gadget Interface prior to SMR Nov-2023 Release 1 allows a physical attacker to execute arbitrary code in Kernel. |
CVE-2023-42532 | Medium | 5.9 | 2023-11-07 | Improper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote attacker to intercept the network traffic including Firmware informat… |
CVE-2023-42531 | Medium | 6.2 | 2023-11-07 | Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on starting activities from… |
CVE-2023-42530 | Medium | 6.7 | 2023-11-07 | Improper access control vulnerability in SecSettings prior to SMR Nov-2023 Release 1 allows attackers to enable Wi-Fi and Wi-Fi Direct without User Interaction. |
CVE-2023-42529 | Medium | 6.7 | 2023-11-07 | Out-of-bound write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to execute arbitrary code. |
CVE-2023-42528 | Medium | 6.7 | 2023-11-07 | Improper Input Validation vulnerability in ProcessNvBuffering of libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-42527 | Medium | 5.6 | 2023-11-07 | Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose sensitive informatio… |
CVE-2023-42284 | Critical | 9.8 | 2023-11-07 | Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query. |
CVE-2023-42283 | Critical | 9.8 | 2023-11-07 | Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query. |
CVE-2023-30739 | Medium | 6.7 | 2023-11-07 | Arbitrary File Descriptor Write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code. |
CVE-2023-41723 | Medium | 4.3 | 2023-11-07 | A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. Note: The criticality of this vulnerability i… |
CVE-2023-38549 | Medium | 5.4 | 2023-11-07 | A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by… |
CVE-2023-38548 | Medium | 4.3 | 2023-11-07 | A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of the account used by… |
CVE-2023-38547 | Critical | 9.8 | 2023-11-07 | A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its configuration data… |
CVE-2023-47102 | Medium | 5.3 | 2023-11-07 | UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid. |
CVE-2023-33074 | High | 8.4 | 2023-11-07 | Memory corruption in Audio when SSR event is triggered after music playback is stopped. |
CVE-2023-33061 | High | 7.5 | 2023-11-07 | Transient DOS in WLAN Firmware while parsing WLAN beacon or probe-response frame. |
CVE-2023-33059 | High | 7.8 | 2023-11-07 | Memory corruption in Audio while processing the VOC packet data from ADSP. |
CVE-2023-33056 | High | 7.5 | 2023-11-07 | Transient DOS in WLAN Firmware when firmware receives beacon including T2LM IE. |
CVE-2023-33055 | High | 7.8 | 2023-11-07 | Memory Corruption in Audio while invoking callback function in driver from ADSP. |
CVE-2023-33048 | High | 7.5 | 2023-11-07 | Transient DOS in WLAN Firmware while parsing t2lm buffers. |
CVE-2023-33047 | High | 7.5 | 2023-11-07 | Transient DOS in WLAN Firmware while parsing no-inherit IES. |
CVE-2023-33045 | Critical | 9.8 | 2023-11-07 | Memory corruption in WLAN Firmware while parsing a NAN management frame carrying a S3 attribute. |
CVE-2023-33031 | High | 7.8 | 2023-11-07 | Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer. |
CVE-2023-28574 | Critical | 9.0 | 2023-11-07 | Memory corruption in core services when Diag handler receives a command to configure event listeners. |
CVE-2023-28572 | Medium | 6.6 | 2023-11-07 | Memory corruption in WLAN HOST while processing the WLAN scan descriptor list. |
CVE-2023-28570 | Medium | 6.7 | 2023-11-07 | Memory corruption while processing audio effects. |
CVE-2023-28569 | Medium | 6.1 | 2023-11-07 | Information disclosure in WLAN HAL while handling command through WMI interfaces. |
CVE-2023-28568 | Medium | 6.1 | 2023-11-07 | Information disclosure in WLAN HAL when reception status handler is called. |
CVE-2023-28566 | Medium | 6.1 | 2023-11-07 | Information disclosure in WLAN HAL while handling the WMI state info command. |
CVE-2023-28563 | Medium | 6.1 | 2023-11-07 | Information disclosure in IOE Firmware while handling WMI command. |
CVE-2023-28556 | High | 7.1 | 2023-11-07 | Cryptographic issue in HLOS during key management. |