2023 CVEs (page 118)
Page 118 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28554 | Medium | 6.1 | 2023-11-07 | Information Disclosure in Qualcomm IPC while reading values from shared memory in VM. |
CVE-2023-28553 | Medium | 6.1 | 2023-11-07 | Information Disclosure in WLAN Host when processing WMI event command. |
CVE-2023-28545 | High | 8.2 | 2023-11-07 | Memory corruption in TZ Secure OS while loading an app ELF. |
CVE-2023-24852 | High | 8.4 | 2023-11-07 | Memory Corruption in Core due to secure memory access by user while loading modem image. |
CVE-2023-22388 | Critical | 9.8 | 2023-11-07 | Memory Corruption in Multi-mode Call Processor while processing bit mask API. |
CVE-2023-21671 | Critical | 9.3 | 2023-11-07 | Memory Corruption in Core during syscall for Sectools Fuse comparison feature. |
CVE-2023-46998 | Medium | 6.1 | 2023-11-07 | Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted payload to alert()… |
CVE-2023-35140 | Medium | 5.5 | 2023-11-07 | The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated local user with rea… |
CVE-2023-5976 | Medium | 4.3 | 2023-11-07 | Improper Access Control in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-5904 | Medium | 5.4 | 2023-11-07 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5903 | Medium | 5.4 | 2023-11-07 | Cross-site Scripting (XSS) - Stored in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5902 | Medium | 4.3 | 2023-11-07 | Cross-Site Request Forgery (CSRF) in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5901 | Low | 3.5 | 2023-11-07 | Cross-site Scripting in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5900 | Low | 3.5 | 2023-11-07 | Cross-Site Request Forgery in GitHub repository pkp/pkp-lib prior to 3.3.0-16. |
CVE-2023-5748 | Low | 3.3 | 2023-11-07 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL VPN Client before 1.4.7-0687 allows local… |
CVE-2023-41036 | High | 7.8 | 2023-11-07 | Macvim is a text editor for MacOS. Prior to version 178, Macvim makes use of an insecure interprocess communication (IPC) mechanism which could lead to a privi… |
CVE-2023-40453 | Medium | 6.5 | 2023-11-07 | Docker Machine through 0.16.2 allows an attacker, who has control of a worker node, to provide crafted version data, which might potentially trick an administr… |
CVE-2023-38509 | Medium | 4.3 | 2023-11-07 | XWiki Platform is a generic wiki platform. In org.xwiki.platform:xwiki-platform-livetable-ui starting with version 3.5-milestone-1 and prior to versions 14.10… |
CVE-2023-2675 | Critical | 9.8 | 2023-11-07 | Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 2023.Q1.1223. |
CVE-2023-36409 | Medium | 6.5 | 2023-11-07 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability |
CVE-2023-36769 | Medium | 4.6 | 2023-11-06 | Microsoft OneNote Spoofing Vulnerability |
CVE-2023-47004 | High | 8.8 | 2023-11-06 | Buffer Overflow vulnerability in Redis RedisGraph v.2.x through v.2.12.8 and fixed in v.2.12.9 allows an attacker to execute arbitrary code via the code logic… |
CVE-2023-45556 | Medium | 5.4 | 2023-11-06 | Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name parameter in the theme man… |
CVE-2023-5771 | Medium | 6.1 | 2023-11-06 | Proofpoint Enterprise Protection contains a stored XSS vulnerability in the AdminUI. An unauthenticated attacker can send a specially crafted email with HTML i… |
CVE-2023-5605 | Medium | 4.8 | 2023-11-06 | The URL Shortify WordPress plugin before 1.7.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2023-5601 | Critical | 9.8 | 2023-11-06 | The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to uplo… |
CVE-2023-5530 | Medium | 4.8 | 2023-11-06 | The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin… |
CVE-2023-5454 | High | 7.5 | 2023-11-06 | The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete a… |
CVE-2023-5355 | High | 8.1 | 2023-11-06 | The Awesome Support WordPress plugin before 6.1.5 does not sanitize file paths when deleting temporary attachment files, allowing a ticket submitter to delete… |
CVE-2023-5354 | Medium | 6.1 | 2023-11-06 | The Awesome Support WordPress plugin before 6.1.5 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2023-5352 | Medium | 4.3 | 2023-11-06 | The Awesome Support WordPress plugin before 6.1.5 does not correctly authorize the wpas_edit_reply function, allowing users to edit posts for which they do not… |
CVE-2023-5228 | Medium | 4.8 | 2023-11-06 | The User Registration WordPress plugin before 3.0.4.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin t… |
CVE-2023-5181 | Medium | 4.8 | 2023-11-06 | The WP Discord Invite WordPress plugin before 2.5.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2023-5082 | High | 7.2 | 2023-11-06 | The History Log by click5 WordPress plugin before 1.0.13 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL… |
CVE-2023-4930 | Medium | 6.5 | 2023-11-06 | The Front End PM WordPress plugin before 11.4.3 does not block listing the contents of the directories where it stores attachments to private messages, allowin… |
CVE-2023-4858 | Medium | 4.8 | 2023-11-06 | The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2023-4810 | Medium | 4.8 | 2023-11-06 | The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2023-5777 | Critical | 9.8 | 2023-11-06 | Weintek EasyBuilder Pro contains a vulnerability that, even when the private key is immediately deleted after the crash report transmission is finished, the… |
CVE-2023-5719 | High | 8.8 | 2023-11-06 | The Crimson 3.2 Windows-based configuration tool allows users with administrative access to define new passwords for users and to download the resulting secur… |
CVE-2023-46732 | Critical | 9.6 | 2023-11-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting… |
CVE-2023-46731 | Critical | 10.0 | 2023-11-06 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki doesn't properly escape the section URL paramete… |
CVE-2023-46254 | Medium | 4.3 | 2023-11-06 | capsule-proxy is a reverse proxy for Capsule kubernetes multi-tenancy framework. A bug in the RoleBinding reflector used by `capsule-proxy` gives ServiceAccoun… |
CVE-2023-39345 | High | 7.6 | 2023-11-06 | strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the user registration en… |
CVE-2023-4700 | Low | 3.5 | 2023-11-06 | An authorization issue affecting GitLab EE affecting all versions from 14.7 prior to 16.3.6, 16.4 prior to 16.4.2, and 16.5 prior to 16.5.1, allowed a user to… |
CVE-2023-46728 | High | 7.5 | 2023-11-06 | Squid is a caching proxy for the Web supporting HTTP, HTTPS, FTP, and more. Due to a NULL pointer dereference bug Squid is vulnerable to a Denial of Service at… |
CVE-2023-46251 | High | 7.5 | 2023-11-06 | MyBB is a free and open source forum software. Custom MyCode (BBCode) for the visual editor (_SCEditor_) doesn't escape input properly when rendering HTML, re… |
CVE-2023-45827 | High | 7.3 | 2023-11-06 | Dot diver is a lightweight, powerful, and dependency-free TypeScript utility library that provides types and functions to work with object paths in dot notatio… |
CVE-2023-44398 | High | 8.8 | 2023-11-06 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in… |
CVE-2023-4535 | Medium | 4.5 | 2023-11-06 | An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires… |
CVE-2023-40661 | Medium | 5.4 | 2023-11-06 | Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or adminis… |
CVE-2023-40660 | Medium | 6.6 | 2023-11-06 | A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operatio… |
CVE-2023-5969 | Medium | 5.3 | 2023-11-06 | Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_lo… |
CVE-2023-5968 | Medium | 4.9 | 2023-11-06 | Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. |
CVE-2023-5967 | Medium | 4.3 | 2023-11-06 | Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and cra… |
CVE-2023-5678 | Medium | 5.3 | 2023-11-06 | Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applicatio… |
CVE-2023-41378 | High | 7.5 | 2023-11-06 | In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake… |
CVE-2023-5950 | High | 8.6 | 2023-11-06 | Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into… |
CVE-2023-5964 | Critical | 9.9 | 2023-11-06 | The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Cap… |
CVE-2023-5963 | Low | 3.1 | 2023-11-06 | An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that c… |
CVE-2023-4910 | Medium | 5.5 | 2023-11-06 | A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is r… |
CVE-2023-45163 | Critical | 9.9 | 2023-11-06 | The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input paramete… |
CVE-2023-45161 | Critical | 9.9 | 2023-11-06 | The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter… |
CVE-2023-3909 | Medium | 4.3 | 2023-11-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versio… |
CVE-2023-3399 | High | 8.5 | 2023-11-06 | An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions… |
CVE-2023-3246 | Medium | 4.3 | 2023-11-06 | An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions startin… |
CVE-2023-5823 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions. |
CVE-2023-47186 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions. |
CVE-2023-46781 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Murg Current Menu Item for Custom Post Types plugin <= 1.5 versions. |
CVE-2023-46780 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Alter plugin <= 1.0 versions. |
CVE-2023-46779 | Medium | 5.4 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in EasyRecipe plugin <= 3.5.3251 versions. |
CVE-2023-46778 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in TheFreeWindows Auto Limit Posts Reloaded plugin <= 2.5 versions. |
CVE-2023-46777 | Medium | 5.4 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions. |
CVE-2023-46776 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Serena Villa Auto Excerpt everywhere plugin <= 1.5 versions. |
CVE-2023-5831 | Low | 3.7 | 2023-11-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all ve… |
CVE-2023-5825 | Medium | 6.5 | 2023-11-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versio… |
CVE-2023-5090 | Medium | 6.0 | 2023-11-06 | A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, pot… |
CVE-2023-4996 | Medium | 6.6 | 2023-11-06 | Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope c… |
CVE-2023-47185 | High | 7.1 | 2023-11-06 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions. |
CVE-2023-46775 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Djo Original texts Yandex WebMaster plugin <= 1.18 versions. |
CVE-2023-47184 | Medium | 5.9 | 2023-11-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Proper Fraction LLC. Admin Bar & Dashboard Access Control plugin <= 1.2.8 versions. |
CVE-2023-47182 | High | 7.1 | 2023-11-06 | Cross-Site Request Forgery (CSRF) leading to a Stored Cross-Site Scripting (XSS) vulnerability in Nazmul Hossain Nihal Login Screen Manager plugin <= 3.5.2 ver… |
CVE-2023-47177 | Medium | 6.5 | 2023-11-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yakir Sitbon, Ariel Klikstein Linker plugin <= 1.2.1 versions. |
CVE-2023-46824 | Medium | 5.9 | 2023-11-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Om Ak Solutions Slick Popup: Contact Form 7 Popup Plugin plugin <= 1.7.14 versions. |
CVE-2023-46823 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum ImageLinks Interactive Image Builder for WordPres… |
CVE-2023-46822 | High | 7.1 | 2023-11-06 | Unauth. Reflected Cross-Site Scripting') vulnerability in Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, an… |
CVE-2023-46821 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers allows auth. (admin+)… |
CVE-2023-46783 | Medium | 6.5 | 2023-11-06 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bright Plugins Pre-Orders for WooCommerce plugin <= 1.2.13 versions. |
CVE-2023-46782 | Medium | 6.5 | 2023-11-06 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Yee MomentoPress for Momento360 plugin <= 1.0.1 versions. |
CVE-2023-46084 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This… |
CVE-2023-23702 | Medium | 5.9 | 2023-11-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions. |
CVE-2023-45830 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL I… |
CVE-2023-45657 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects N… |
CVE-2023-45074 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wan… |
CVE-2023-45069 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Video Gallery by Total-Soft Video Gallery – Best WordPres… |
CVE-2023-45055 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InspireUI MStore API allows SQL Injection.This issue affe… |
CVE-2023-45046 | Medium | 5.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressference Pressference Exporter allows SQL Injection.T… |
CVE-2023-45001 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Castos Seriously Simple Stats allows SQL Injection.This i… |
CVE-2023-41685 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ilGhera Woocommerce Support System allows SQL Injection.T… |
CVE-2023-40609 | High | 8.2 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aiyaz, maheshpatel Contact form 7 Custom validation allow… |
CVE-2023-40207 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedNao Donations Made Easy – Smart Donations allows SQL I… |