2023 CVEs (page 120)
Page 120 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-41725 | High | 7.8 | 2023-11-03 | Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation Vulnerability |
CVE-2023-3893 | High | 8.8 | 2023-11-03 | A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admi… |
CVE-2023-39301 | Medium | 4.3 | 2023-11-03 | A server-side request forgery (SSRF) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could al… |
CVE-2023-39299 | High | 7.5 | 2023-11-03 | A path traversal vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to read the contents of unexpected… |
CVE-2023-36529 | Critical | 9.9 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Favethemes Houzez - Real Estate WordPress Theme allows SQ… |
CVE-2023-34179 | High | 7.6 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Inc. Groundhogg allows SQL Injection.This issu… |
CVE-2023-32508 | High | 7.6 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolf van Gelder Order Your Posts Manually allows SQL Inje… |
CVE-2023-32121 | High | 7.6 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Highfivery LLC Zero Spam for WordPress allows SQL Injecti… |
CVE-2023-25990 | High | 7.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-25800 | High | 8.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-25700 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum Tutor LMS allows SQL Injection.This issue affects… |
CVE-2023-23369 | Critical | 9.0 | 2023-11-03 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-23368 | Critical | 9.8 | 2023-11-03 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to… |
CVE-2023-46980 | Critical | 9.8 | 2023-11-03 | An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID… |
CVE-2023-46404 | Critical | 9.9 | 2023-11-03 | PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing. |
CVE-2023-5946 | Medium | 6.1 | 2023-11-03 | The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 due to insufficient i… |
CVE-2023-5088 | Medium | 6.4 | 2023-11-03 | A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the… |
CVE-2023-5945 | Medium | 4.3 | 2023-11-03 | The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect no… |
CVE-2023-5707 | Medium | 6.4 | 2023-11-03 | The SEO Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'slider' shortcode and post meta in all versions up to, and i… |
CVE-2023-46947 | High | 8.8 | 2023-11-03 | Subrion 4.2.1 has a remote command execution vulnerability in the backend. |
CVE-2023-3961 | Critical | 9.1 | 2023-11-03 | A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba ty… |
CVE-2023-26015 | High | 7.1 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Chris Richardson MapPress Maps for WordPress mappress-goo… |
CVE-2023-25960 | Critical | 10.0 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Zendrop Zendrop – Global Dropshipping zendrop-dropshippin… |
CVE-2023-4592 | Medium | 6.1 | 2023-11-03 | A Cross-Site Scripting vulnerability has been detected in WPN-XM Serverstack affecting version 0.8.6. This vulnerability could allow a remote attacker to send… |
CVE-2023-4591 | High | 7.5 | 2023-11-03 | A local file inclusion vulnerability has been found in WPN-XM Serverstack affecting version 0.8.6, which would allow an unauthenticated user to perform a local… |
CVE-2023-41652 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.Th… |
CVE-2023-3277 | Critical | 9.8 | 2023-11-03 | The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due to impro… |
CVE-2023-34383 | High | 8.5 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP Project Manager wedevs-project-manager allows S… |
CVE-2023-4769 | Medium | 6.6 | 2023-11-03 | A SSRF vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0, specifically the /smtpConfig.do component. This vulnerability coul… |
CVE-2023-4768 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-4767 | Medium | 6.1 | 2023-11-03 | A CRLF injection vulnerability has been found in ManageEngine Desktop Central affecting version 9.1.0. This vulnerability could allow a remote attacker to inje… |
CVE-2023-4043 | Medium | 5.9 | 2023-11-03 | In Eclipse Parsson before versions 1.1.4 and 1.0.5, Parsing JSON from untrusted sources can lead malicious actors to exploit the fact that the built-in support… |
CVE-2023-1476 | High | 7.0 | 2023-11-03 | A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between… |
CVE-2023-5824 | High | 7.5 | 2023-11-03 | A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP respons… |
CVE-2023-4091 | Medium | 6.5 | 2023-11-03 | A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xa… |
CVE-2023-46848 | High | 8.6 | 2023-11-03 | Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs… |
CVE-2023-46847 | High | 8.6 | 2023-11-03 | Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory… |
CVE-2023-46846 | Critical | 9.3 | 2023-11-03 | SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past firewall… |
CVE-2023-42670 | Medium | 6.5 | 2023-11-03 | A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC se… |
CVE-2023-1194 | High | 7.1 | 2023-11-03 | An out-of-bounds (OOB) memory read flaw was found in parse_lease_state in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel… |
CVE-2023-5948 | Medium | 5.5 | 2023-11-03 | Improper Authorization in GitHub repository teamamaze/amazefileutilities prior to 1.91. |
CVE-2023-5763 | Medium | 6.8 | 2023-11-03 | In Eclipse Glassfish 5 or 6, running with old versions of JDK (lower than 6u211, or < 7u201, or < 8u191), allows remote attackers to load malicious code on the… |
CVE-2023-41357 | High | 8.8 | 2023-11-03 | Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload… |
CVE-2023-41356 | Medium | 6.5 | 2023-11-03 | NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this v… |
CVE-2023-41344 | High | 7.5 | 2023-11-03 | NCSIST ManageEngine Mobile Device Manager(MDM) APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this v… |
CVE-2023-41355 | Critical | 9.8 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can ex… |
CVE-2023-41354 | Medium | 4.0 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q Firewall function does not block ICMP TIMESTAMP requests by default, an unauthenticated remote attacker can exploit this vulner… |
CVE-2023-41353 | High | 8.8 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administr… |
CVE-2023-41352 | High | 7.2 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege can exploit this v… |
CVE-2023-41351 | Critical | 9.8 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mech… |
CVE-2023-46817 | Critical | 9.8 | 2023-11-03 | An issue was discovered in phpFox before 4.8.14. The url request parameter passed to the /core/redirect route is not properly sanitized before being used in a… |
CVE-2023-45362 | Medium | 4.3 | 2023-11-03 | An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser… |
CVE-2023-45360 | Medium | 5.4 | 2023-11-03 | An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenewmessagesmanyusers… |
CVE-2023-45024 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. |
CVE-2023-44271 | High | 7.5 | 2023-11-03 | An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a… |
CVE-2023-43982 | Critical | 9.8 | 2023-11-03 | Bon Presta boninstagramcarousel between v5.2.1 to v7.0.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at insta_parser.p… |
CVE-2023-43665 | High | 7.5 | 2023-11-03 | In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) ar… |
CVE-2023-41914 | High | 7.0 | 2023-11-03 | SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or dele… |
CVE-2023-41350 | High | 7.5 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote atta… |
CVE-2023-41348 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An au… |
CVE-2023-41347 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authentica… |
CVE-2023-41346 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenti… |
CVE-2023-41345 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authen… |
CVE-2023-41343 | Medium | 5.4 | 2023-11-03 | Rogic No-Code Database Builder's file uploading function has insufficient filtering for special characters. A remote attacker with regular user privilege can i… |
CVE-2023-41260 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. |
CVE-2023-41259 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or… |
CVE-2023-41164 | High | 7.5 | 2023-11-03 | In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) atta… |
CVE-2023-38965 | Critical | 9.8 | 2023-11-03 | Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI. |
CVE-2023-36621 | Critical | 9.1 | 2023-11-03 | An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions tempora… |
CVE-2023-36620 | Medium | 4.6 | 2023-11-03 | An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in… |
CVE-2023-34261 | Medium | 5.3 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they lead to a "nicht ei… |
CVE-2023-34260 | High | 7.5 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed by a directory refe… |
CVE-2023-34259 | Medium | 4.9 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the filesystem, even f… |
CVE-2023-31102 | High | 7.8 | 2023-11-03 | Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive. |
CVE-2023-46954 | Critical | 9.8 | 2023-11-03 | SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrary code via the nam… |
CVE-2023-35896 | Medium | 5.4 | 2023-11-03 | IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from t… |
CVE-2023-46176 | Medium | 6.7 | 2023-11-03 | IBM MQ Appliance 9.3 CD could allow a local attacker to gain elevated privileges on the system, caused by improper validation of security keys. IBM X-Force ID… |
CVE-2023-36034 | High | 7.3 | 2023-11-03 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-36029 | Medium | 4.3 | 2023-11-03 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-36022 | Medium | 6.6 | 2023-11-03 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-43018 | Medium | 5.9 | 2023-11-03 | IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new… |
CVE-2023-42029 | Medium | 4.8 | 2023-11-03 | IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows… |
CVE-2023-42027 | Medium | 4.3 | 2023-11-03 | IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an… |
CVE-2023-46958 | Critical | 9.8 | 2023-11-02 | An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file. |
CVE-2023-46352 | High | 7.5 | 2023-11-02 | In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for Prest… |
CVE-2023-43194 | Medium | 5.3 | 2023-11-02 | Submitty before v22.06.00 is vulnerable to Incorrect Access Control. An attacker can delete any post in the forum by modifying request parameter. |
CVE-2023-42299 | Critical | 9.8 | 2023-11-02 | Buffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_subi… |
CVE-2023-39283 | High | 7.8 | 2023-11-02 | An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to s… |
CVE-2023-39057 | High | 7.5 | 2023-11-02 | An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39054 | High | 7.5 | 2023-11-02 | An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39053 | High | 7.5 | 2023-11-02 | An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39051 | High | 7.5 | 2023-11-02 | An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39050 | High | 7.5 | 2023-11-02 | An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39048 | High | 7.5 | 2023-11-02 | An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39047 | High | 7.5 | 2023-11-02 | An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39042 | High | 7.5 | 2023-11-02 | An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-31579 | Critical | 9.8 | 2023-11-02 | Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows at… |
CVE-2023-5930 | Low | 3.5 | 2023-11-02 | A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been declared as problematic. This vulnerability affects unknown code of t… |
CVE-2023-5929 | Medium | 5.5 | 2023-11-02 | A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been classified as critical. This affects an unknown part of the file /adm… |
CVE-2023-39284 | Medium | 5.5 | 2023-11-02 | An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized argument… |