2023 CVEs (page 119)
Page 119 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-38382 | Critical | 9.8 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Cat… |
CVE-2023-35911 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creative Solutions Contact Form Generator : Creative form… |
CVE-2023-33924 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Felix Welberg SIS Handball allows SQL Injection.This issu… |
CVE-2023-28748 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in biztechc Copy or Move Comments allows SQL Injection.This… |
CVE-2023-27605 | Medium | 5.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sajjad Hossain WP Reroute Email allows SQL Injection.This… |
CVE-2023-28794 | Medium | 4.3 | 2023-11-06 | Origin Validation Error vulnerability in Zscaler Client Connector on Linux allows Privilege Abuse. This issue affects Zscaler Client Connector for Linux: befor… |
CVE-2023-42669 | Medium | 6.5 | 2023-11-06 | A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements. This vulnerability ste… |
CVE-2023-4699 | Critical | 10.0 | 2023-11-06 | Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R seri… |
CVE-2023-47253 | Critical | 9.8 | 2023-11-06 | Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.php gridValoresPopHid… |
CVE-2023-38407 | High | 7.5 | 2023-11-06 | bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing. |
CVE-2023-38406 | Critical | 9.8 | 2023-11-06 | bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow." |
CVE-2023-4625 | Medium | 5.3 | 2023-11-06 | Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server funct… |
CVE-2023-32840 | Medium | 6.5 | 2023-11-06 | In modem CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2023-32839 | Medium | 6.7 | 2023-11-06 | In dpe, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution p… |
CVE-2023-32838 | Medium | 6.7 | 2023-11-06 | In dpe, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution p… |
CVE-2023-32837 | High | 7.8 | 2023-11-06 | In video, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution… |
CVE-2023-32836 | Medium | 6.7 | 2023-11-06 | In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileg… |
CVE-2023-32835 | Medium | 6.7 | 2023-11-06 | In keyinstall, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2023-32834 | Medium | 6.7 | 2023-11-06 | In secmem, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with System execution privileges neede… |
CVE-2023-32832 | High | 7.0 | 2023-11-06 | In video, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileg… |
CVE-2023-32825 | Medium | 5.5 | 2023-11-06 | In bluethooth service, there is a possible out of bounds reads due to improper input validation. This could lead to local information disclosure with no additi… |
CVE-2023-32818 | Medium | 6.7 | 2023-11-06 | In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges neede… |
CVE-2023-20702 | High | 7.5 | 2023-11-06 | In 5G NRLC, there is a possible invalid memory access due to lack of error handling. This could lead to remote denial of service, if UE received invalid 1-byte… |
CVE-2023-46802 | Medium | 5.5 | 2023-11-06 | e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded XML parser. By proc… |
CVE-2023-47272 | Medium | 6.1 | 2023-11-06 | Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download). |
CVE-2023-47271 | Medium | 5.3 | 2023-11-06 | PKP-WAL (aka PKP Web Application Library or pkp-lib) before 3.3.0-16, as used in Open Journal Systems (OJS) and other products, does not verify that the file n… |
CVE-2023-47260 | Medium | 6.1 | 2023-11-05 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS via thumbnails. |
CVE-2023-47259 | Medium | 6.1 | 2023-11-05 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in the Textile formatter. |
CVE-2023-47258 | Medium | 6.1 | 2023-11-05 | Redmine before 4.2.11 and 5.0.x before 5.0.6 allows XSS in a Markdown formatter. |
CVE-2023-47249 | Medium | 6.5 | 2023-11-05 | In International Color Consortium DemoIccMAX 79ecb74, a CIccXmlArrayType:::ParseText function (for unsigned short) in IccUtilXml.cpp in libIccXML.a has an out-… |
CVE-2023-46981 | Critical | 9.8 | 2023-11-05 | SQL injection vulnerability in Novel-Plus v.4.2.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parameter in /common/log/… |
CVE-2023-46964 | Medium | 6.1 | 2023-11-05 | Cross Site Scripting (XSS) vulnerability in Hillstone Next Generation FireWall SG-6000-e3960 v.5.5 allows a remote attacker to execute arbitrary code via the u… |
CVE-2023-46963 | Medium | 5.3 | 2023-11-04 | An issue in Beijing Yunfan Internet Technology Co., Ltd, Yunfan Learning Examination System v.6.5 allows a remote attacker to obtain sensitive information via… |
CVE-2023-46382 | High | 7.5 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) use cleartext HTTP for login. |
CVE-2023-46381 | High | 8.2 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) lack authentication for the preinstalled v… |
CVE-2023-46380 | High | 7.5 | 2023-11-04 | LOYTEC LINX-151, LINX-212, LVIS-3ME12-A1, LIOB-586, LIOB-580 V2, LIOB-588, L-INX Configurator devices (all versions) send password-change requests via cleartex… |
CVE-2023-40922 | Critical | 9.8 | 2023-11-04 | kerawen before v2.5.1 was discovered to contain a SQL injection vulnerability via the ocs_id_cart parameter at KerawenDeliveryModuleFrontController::initConten… |
CVE-2023-40215 | High | 7.6 | 2023-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Demonisblack demon image annotation allows SQL Injection… |
CVE-2023-38391 | Medium | 6.7 | 2023-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themesgrove Onepage Builder allows SQL Injection.This iss… |
CVE-2023-35910 | High | 8.5 | 2023-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Contact Form Builder fo… |
CVE-2023-32741 | High | 7.6 | 2023-11-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IT Path Solutions PVT LTD Contact Form to Any API allows… |
CVE-2023-45189 | Medium | 6.5 | 2023-11-03 | A vulnerability in IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.10, 23.0.0 through 23.0.10 may result… |
CVE-2023-36677 | High | 8.3 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smartypants SP Project & Document Manager allows SQL Inje… |
CVE-2023-47235 | High | 7.5 | 2023-11-03 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when a malformed BGP UPDATE message with an EOR is processed, because the presence of… |
CVE-2023-47234 | High | 7.5 | 2023-11-03 | An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur when processing a crafted BGP UPDATE message with a MP_UNREACH_NLRI attribute and add… |
CVE-2023-47233 | Medium | 4.3 | 2023-11-03 | The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect the USB by hotplug)… |
CVE-2023-41726 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation Vulnerability |
CVE-2023-41725 | High | 7.8 | 2023-11-03 | Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability |
CVE-2023-3893 | High | 8.8 | 2023-11-03 | A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admi… |
CVE-2023-39301 | Medium | 4.3 | 2023-11-03 | A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2023-39299 | High | 7.5 | 2023-11-03 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected… |
CVE-2023-36529 | Critical | 9.9 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQ… |
CVE-2023-34179 | High | 7.6 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Inc. Groundhogg allows SQL Injection.This issu… |
CVE-2023-32508 | High | 7.6 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolf van Gelder Order Your Posts Manually allows SQL Inje… |
CVE-2023-32121 | High | 7.6 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injecti… |
CVE-2023-25990 | High | 7.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-25800 | High | 8.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-25700 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-23369 | Critical | 9.0 | 2023-11-03 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-23368 | Critical | 9.8 | 2023-11-03 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-46980 | Critical | 9.8 | 2023-11-03 | An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID… |
CVE-2023-46404 | Critical | 9.9 | 2023-11-03 | PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing. |
CVE-2023-5946 | Medium | 6.1 | 2023-11-03 | The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 due to insufficient i… |
CVE-2023-5088 | Medium | 6.4 | 2023-11-03 | A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the… |
CVE-2023-5945 | Medium | 4.3 | 2023-11-03 | The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect no… |
CVE-2023-5707 | Medium | 6.4 | 2023-11-03 | The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta in all versions up to, and i… |
CVE-2023-46947 | High | 8.8 | 2023-11-03 | Subrion 4.2.1 has a remote command execution vulnerability in the backend. |
CVE-2023-3961 | Critical | 9.1 | 2023-11-03 | A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba ty… |
CVE-2023-26015 | High | 7.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for WordPress mappress-goo… |
CVE-2023-25960 | Critical | 10.0 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zendrop Zendrop – Global Dropshipping zendrop-dropshippin… |
CVE-2023-4592 | Medium | 6.1 | 2023-11-03 | A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send… |
CVE-2023-4591 | High | 7.5 | 2023-11-03 | A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local… |
CVE-2023-41652 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.Th… |
CVE-2023-3277 | Critical | 9.8 | 2023-11-03 | The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to impro… |
CVE-2023-34383 | High | 8.5 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows S… |
CVE-2023-4769 | Medium | 6.6 | 2023-11-03 | A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability coul… |
CVE-2023-4768 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-4767 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-4043 | Medium | 5.9 | 2023-11-03 | In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support… |
CVE-2023-1476 | High | 7.0 | 2023-11-03 | A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between… |
CVE-2023-5824 | High | 7.5 | 2023-11-03 | A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP respons… |
CVE-2023-4091 | Medium | 6.5 | 2023-11-03 | A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xa… |
CVE-2023-46848 | High | 8.6 | 2023-11-03 | Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs… |
CVE-2023-46847 | High | 8.6 | 2023-11-03 | Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory… |
CVE-2023-46846 | Critical | 9.3 | 2023-11-03 | SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall… |
CVE-2023-42670 | Medium | 6.5 | 2023-11-03 | A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC se… |
CVE-2023-1194 | High | 7.1 | 2023-11-03 | An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel… |
CVE-2023-5948 | Medium | 5.5 | 2023-11-03 | Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91. |
CVE-2023-5763 | Medium | 6.8 | 2023-11-03 | In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the… |
CVE-2023-41357 | High | 8.8 | 2023-11-03 | Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload… |
CVE-2023-41356 | Medium | 6.5 | 2023-11-03 | NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this v… |
CVE-2023-41344 | High | 7.5 | 2023-11-03 | NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this v… |
CVE-2023-41355 | Critical | 9.8 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can ex… |
CVE-2023-41354 | Medium | 4.0 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulner… |
CVE-2023-41353 | High | 8.8 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administr… |
CVE-2023-41352 | High | 7.2 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege can exploit this v… |
CVE-2023-41351 | Critical | 9.8 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mech… |
CVE-2023-46817 | Critical | 9.8 | 2023-11-03 | An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a… |
CVE-2023-45362 | Medium | 4.3 | 2023-11-03 | An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser… |
CVE-2023-45360 | Medium | 5.4 | 2023-11-03 | An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenewmessagesmanyusers… |