2023 CVEs (page 119)
Page 119 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-44398 | High | 8.8 | 2023-11-06 | Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. An out-of-bounds write was found in… |
CVE-2023-4535 | Medium | 4.5 | 2023-11-06 | An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires… |
CVE-2023-40661 | Medium | 5.4 | 2023-11-06 | Several memory vulnerabilities were identified within the OpenSC packages, particularly in the card enrollment process using pkcs15-init when a user or adminis… |
CVE-2023-40660 | Medium | 6.6 | 2023-11-06 | A flaw was found in OpenSC packages that allow a potential PIN bypass. When a token/card is authenticated by one process, it can perform cryptographic operatio… |
CVE-2023-5969 | Medium | 5.3 | 2023-11-06 | Mattermost fails to properly sanitize the request to /api/v4/redirect_location allowing an attacker, sending a specially crafted request to /api/v4/redirect_lo… |
CVE-2023-5968 | Medium | 4.9 | 2023-11-06 | Mattermost fails to properly sanitize the user object when updating the username, resulting in the password hash being included in the response body. |
CVE-2023-5967 | Medium | 4.3 | 2023-11-06 | Mattermost fails to properly validate requests to the Calls plugin, allowing an attacker sending a request without a User Agent header to cause a panic and cra… |
CVE-2023-5678 | Medium | 5.3 | 2023-11-06 | Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applicatio… |
CVE-2023-41378 | High | 7.5 | 2023-11-06 | In certain conditions for Calico Typha (v3.26.2, v3.25.1 and below), and Calico Enterprise Typha (v3.17.1, v3.16.3, v3.15.3 and below), a client TLS handshake… |
CVE-2023-5950 | High | 8.6 | 2023-11-06 | Rapid7 Velociraptor versions prior to 0.7.0-4 suffer from a reflected cross site scripting vulnerability. This vulnerability allows attackers to inject JS into… |
CVE-2023-5964 | Critical | 9.9 | 2023-11-06 | The 1E-Exchange-DisplayMessageinstruction that is part of the End-User Interaction product pack available on the 1E Exchange does not properly validate the Cap… |
CVE-2023-5963 | Low | 3.1 | 2023-11-06 | An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that c… |
CVE-2023-4910 | Medium | 5.5 | 2023-11-06 | A flaw was found In 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is r… |
CVE-2023-45163 | Critical | 9.9 | 2023-11-06 | The 1E-Exchange-CommandLinePing instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the input paramete… |
CVE-2023-45161 | Critical | 9.9 | 2023-11-06 | The 1E-Exchange-URLResponseTime instruction that is part of the Network product pack available on the 1E Exchange does not properly validate the URL parameter… |
CVE-2023-3909 | Medium | 4.3 | 2023-11-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versio… |
CVE-2023-3399 | High | 8.5 | 2023-11-06 | An issue has been discovered in GitLab EE affecting all versions starting from 11.6 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions… |
CVE-2023-3246 | Medium | 4.3 | 2023-11-06 | An issue has been discovered in GitLab EE/CE affecting all versions starting before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions startin… |
CVE-2023-5823 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in ThemeKraft TK Google Fonts GDPR Compliant plugin <= 2.2.11 versions. |
CVE-2023-47186 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Kadence WP Kadence WooCommerce Email Designer plugin <= 1.5.11 versions. |
CVE-2023-46781 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Murg Current Menu Item for Custom Post Types plugin <= 1.5 versions. |
CVE-2023-46780 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Alter plugin <= 1.0 versions. |
CVE-2023-46779 | Medium | 5.4 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in EasyRecipe plugin <= 3.5.3251 versions. |
CVE-2023-46778 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in TheFreeWindows Auto Limit Posts Reloaded plugin <= 2.5 versions. |
CVE-2023-46777 | Medium | 5.4 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Custom Login Page | Temporary Users | Rebrand Login | Login Captcha plugin <= 1.1.3 versions. |
CVE-2023-46776 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Serena Villa Auto Excerpt everywhere plugin <= 1.5 versions. |
CVE-2023-5831 | Low | 3.7 | 2023-11-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all ve… |
CVE-2023-5825 | Medium | 6.5 | 2023-11-06 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versio… |
CVE-2023-5090 | Medium | 6.0 | 2023-11-06 | A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, pot… |
CVE-2023-4996 | Medium | 6.6 | 2023-11-06 | Netskope was made aware of a security vulnerability in its NSClient product for version 100 & prior where a malicious non-admin user can disable the Netskope c… |
CVE-2023-47185 | High | 7.1 | 2023-11-06 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in gVectors Team Comments — wpDiscuz plugin <= 7.6.11 versions. |
CVE-2023-46775 | Medium | 4.3 | 2023-11-06 | Cross-Site Request Forgery (CSRF) vulnerability in Djo Original texts Yandex WebMaster plugin <= 1.18 versions. |
CVE-2023-47184 | Medium | 5.9 | 2023-11-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Proper Fraction LLC. Admin Bar & Dashboard Access Control plugin <= 1.2.8 versions. |
CVE-2023-47182 | High | 7.1 | 2023-11-06 | Cross-Site Request Forgery (CSRF) leading to a Stored Cross-Site Scripting (XSS) vulnerability in Nazmul Hossain Nihal Login Screen Manager plugin <= 3.5.2 ver… |
CVE-2023-47177 | Medium | 6.5 | 2023-11-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Yakir Sitbon, Ariel Klikstein Linker plugin <= 1.2.1 versions. |
CVE-2023-46824 | Medium | 5.9 | 2023-11-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Om Ak Solutions Slick Popup: Contact Form 7 Popup Plugin plugin <= 1.7.14 versions. |
CVE-2023-46823 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Avirtum ImageLinks Interactive Image Builder for WordPres… |
CVE-2023-46822 | High | 7.1 | 2023-11-06 | Unauth. Reflected Cross-Site Scripting') vulnerability in Visser Labs Store Exporter for WooCommerce – Export Products, Export Orders, Export Subscriptions, an… |
CVE-2023-46821 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers allows auth. (admin+)… |
CVE-2023-46783 | Medium | 6.5 | 2023-11-06 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Bright Plugins Pre-Orders for WooCommerce plugin <= 1.2.13 versions. |
CVE-2023-46782 | Medium | 6.5 | 2023-11-06 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Yee MomentoPress for Momento360 plugin <= 1.0.1 versions. |
CVE-2023-46084 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bPlugins LLC Icons Font Loader allows SQL Injection.This… |
CVE-2023-23702 | Medium | 5.9 | 2023-11-06 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pixelgrade Comments Ratings plugin <= 1.1.7 versions. |
CVE-2023-45830 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL I… |
CVE-2023-45657 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in POSIMYTH Nexter allows SQL Injection.This issue affects N… |
CVE-2023-45074 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Page Visit Counter Advanced Page Visit Counter – Most Wan… |
CVE-2023-45069 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Video Gallery by Total-Soft Video Gallery – Best WordPres… |
CVE-2023-45055 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in InspireUI MStore API allows SQL Injection.This issue affe… |
CVE-2023-45046 | Medium | 5.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pressference Pressference Exporter allows SQL Injection.T… |
CVE-2023-45001 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Castos Seriously Simple Stats allows SQL Injection.This i… |
CVE-2023-41685 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ilGhera Woocommerce Support System allows SQL Injection.T… |
CVE-2023-40609 | High | 8.2 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aiyaz, maheshpatel Contact form 7 Custom validation allow… |
CVE-2023-40207 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedNao Donations Made Easy – Smart Donations allows SQL I… |
CVE-2023-38382 | Critical | 9.8 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Cat… |
CVE-2023-35911 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creative Solutions Contact Form Generator : Creative form… |
CVE-2023-33924 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Felix Welberg SIS Handball allows SQL Injection.This issu… |
CVE-2023-28748 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in biztechc Copy or Move Comments allows SQL Injection.This… |
CVE-2023-27605 | Medium | 5.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sajjad Hossain WP Reroute Email allows SQL Injection.This… |
CVE-2023-28794 | Medium | 4.3 | 2023-11-06 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: befor… |
CVE-2023-42669 | Medium | 6.5 | 2023-11-06 | A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability ste… |
CVE-2023-4699 | Critical | 10.0 | 2023-11-06 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R seri… |
CVE-2023-47253 | Critical | 9.8 | 2023-11-06 | Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHid… |
CVE-2023-38407 | High | 7.5 | 2023-11-06 | bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. |
CVE-2023-38406 | Critical | 9.8 | 2023-11-06 | bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow." |
CVE-2023-4625 | Medium | 5.3 | 2023-11-06 | Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server funct… |
CVE-2023-32840 | Medium | 6.5 | 2023-11-06 | In modem CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2023-32839 | Medium | 6.7 | 2023-11-06 | In dpe, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution p… |
CVE-2023-32838 | Medium | 6.7 | 2023-11-06 | In dpe, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution p… |
CVE-2023-32837 | High | 7.8 | 2023-11-06 | In video, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution… |
CVE-2023-32836 | Medium | 6.7 | 2023-11-06 | In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileg… |
CVE-2023-32835 | Medium | 6.7 | 2023-11-06 | In keyinstall, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2023-32834 | Medium | 6.7 | 2023-11-06 | In secmem, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges neede… |
CVE-2023-32832 | High | 7.0 | 2023-11-06 | In video, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileg… |
CVE-2023-32825 | Medium | 5.5 | 2023-11-06 | In bluethooth service, there is a possible out of bounds reads due to improper input validation. This could lead to local information disclosure with no additi… |
CVE-2023-32818 | Medium | 6.7 | 2023-11-06 | In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges neede… |
CVE-2023-20702 | High | 7.5 | 2023-11-06 | In 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial of service, if UE received invalid 1-byte… |
CVE-2023-46802 | Medium | 5.5 | 2023-11-06 | e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By proc… |
CVE-2023-47272 | Medium | 6.1 | 2023-11-06 | Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download). |
CVE-2023-47271 | Medium | 5.3 | 2023-11-06 | PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file n… |
CVE-2023-47260 | Medium | 6.1 | 2023-11-05 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails. |
CVE-2023-47259 | Medium | 6.1 | 2023-11-05 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter. |
CVE-2023-47258 | Medium | 6.1 | 2023-11-05 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter. |
CVE-2023-47249 | Medium | 6.5 | 2023-11-05 | In International Color Consortium DemoIccMAX 79ecb74, a CIccXmlArrayType:::ParseText function (for unsigned short) in IccUtilXml.cpp in libIccXML.a has an out-… |
CVE-2023-46981 | Critical | 9.8 | 2023-11-05 | SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/… |
CVE-2023-46964 | Medium | 6.1 | 2023-11-05 | Cross Site Scripting (XSS) vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the u… |
CVE-2023-46963 | Medium | 5.3 | 2023-11-04 | An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via… |
CVE-2023-46382 | High | 7.5 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login. |
CVE-2023-46381 | High | 8.2 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled v… |
CVE-2023-46380 | High | 7.5 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartex… |
CVE-2023-40922 | Critical | 9.8 | 2023-11-04 | kerawen before v2.5.1 was discovered to contain a SQL injection vulnerability via the ocs_id_cart parameter at KerawenDeliveryModuleFrontController::initConten… |
CVE-2023-40215 | High | 7.6 | 2023-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Demonisblack demon image annotation allows SQL Injection… |
CVE-2023-38391 | Medium | 6.7 | 2023-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themesgrove Onepage Builder allows SQL Injection.This iss… |
CVE-2023-35910 | High | 8.5 | 2023-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Contact Form Builder fo… |
CVE-2023-32741 | High | 7.6 | 2023-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows… |
CVE-2023-45189 | Medium | 6.5 | 2023-11-03 | A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result… |
CVE-2023-36677 | High | 8.3 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Inje… |
CVE-2023-47235 | High | 7.5 | 2023-11-03 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of… |
CVE-2023-47234 | High | 7.5 | 2023-11-03 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and add… |
CVE-2023-47233 | Medium | 4.3 | 2023-11-03 | The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug)… |
CVE-2023-41726 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability |