2023 CVEs (page 120)
Page 120 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45024 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder. |
CVE-2023-44271 | High | 7.5 | 2023-11-03 | An issue was discovered in Pillow before 10.0.0. It is a Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a… |
CVE-2023-43982 | Critical | 9.8 | 2023-11-03 | Bon Presta boninstagramcarousel between v5.2.1 to v7.0.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the url parameter at insta_parser.p… |
CVE-2023-43665 | High | 7.5 | 2023-11-03 | In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) ar… |
CVE-2023-41914 | High | 7.0 | 2023-11-03 | SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwriting a file, or dele… |
CVE-2023-41350 | High | 7.5 | 2023-11-03 | Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient measures to prevent multiple failed authentication attempts. An unauthenticated remote atta… |
CVE-2023-41348 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An au… |
CVE-2023-41347 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authentica… |
CVE-2023-41346 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenti… |
CVE-2023-41345 | High | 8.8 | 2023-11-03 | ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authen… |
CVE-2023-41343 | Medium | 5.4 | 2023-11-03 | Rogic No-Code Database Builder's file uploading function has insufficient filtering for special characters. A remote attacker with regular user privilege can i… |
CVE-2023-41260 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API calls. |
CVE-2023-41259 | High | 7.5 | 2023-11-03 | Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in an email message or… |
CVE-2023-41164 | High | 7.5 | 2023-11-03 | In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) atta… |
CVE-2023-38965 | Critical | 9.8 | 2023-11-03 | Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI. |
CVE-2023-36621 | Critical | 9.1 | 2023-11-03 | An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions tempora… |
CVE-2023-36620 | Medium | 4.6 | 2023-11-03 | An issue was discovered in the Boomerang Parental Control application before 13.83 for Android. The app is missing the android:allowBackup="false" attribute in… |
CVE-2023-34261 | Medium | 5.3 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they lead to a "nicht ei… |
CVE-2023-34260 | High | 7.5 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed by a directory refe… |
CVE-2023-34259 | Medium | 4.9 | 2023-11-03 | Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the filesystem, even f… |
CVE-2023-31102 | High | 7.8 | 2023-11-03 | Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive. |
CVE-2023-46954 | Critical | 9.8 | 2023-11-03 | SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitrary code via the nam… |
CVE-2023-35896 | Medium | 5.4 | 2023-11-03 | IBM Content Navigator 3.0.13 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from t… |
CVE-2023-46176 | Medium | 6.7 | 2023-11-03 | IBM MQ Appliance 9.3 CD could allow a local attacker to gain elevated privileges on the system, caused by improper validation of security keys. IBM X-Force ID… |
CVE-2023-36034 | High | 7.3 | 2023-11-03 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-36029 | Medium | 4.3 | 2023-11-03 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2023-36022 | Medium | 6.6 | 2023-11-03 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
CVE-2023-43018 | Medium | 5.9 | 2023-11-03 | IBM CICS TX Standard 11.1 and Advanced 10.1, 11.1 performs an operation at a privilege level that is higher than the minimum level required, which creates new… |
CVE-2023-42029 | Medium | 4.8 | 2023-11-03 | IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site scripting. This vulnerability allows… |
CVE-2023-42027 | Medium | 4.3 | 2023-11-03 | IBM CICS TX Standard 11.1, Advanced 10.1, 11.1, and TXSeries for Multiplatforms 8.1, 8.2, 9.1 are vulnerable to cross-site request forgery which could allow an… |
CVE-2023-46958 | Critical | 9.8 | 2023-11-02 | An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file. |
CVE-2023-46352 | High | 7.5 | 2023-11-02 | In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for Prest… |
CVE-2023-43194 | Medium | 5.3 | 2023-11-02 | Submitty before v22.06.00 is vulnerable to Incorrect Access Control. An attacker can delete any post in the forum by modifying request parameter. |
CVE-2023-42299 | Critical | 9.8 | 2023-11-02 | Buffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_subi… |
CVE-2023-39283 | High | 7.8 | 2023-11-02 | An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to s… |
CVE-2023-39057 | High | 7.5 | 2023-11-02 | An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39054 | High | 7.5 | 2023-11-02 | An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39053 | High | 7.5 | 2023-11-02 | An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39051 | High | 7.5 | 2023-11-02 | An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39050 | High | 7.5 | 2023-11-02 | An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39048 | High | 7.5 | 2023-11-02 | An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39047 | High | 7.5 | 2023-11-02 | An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-39042 | High | 7.5 | 2023-11-02 | An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages. |
CVE-2023-31579 | Critical | 9.8 | 2023-11-02 | Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. This vulnerability allows at… |
CVE-2023-5930 | Low | 3.5 | 2023-11-02 | A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been declared as problematic. This vulnerability affects unknown code of t… |
CVE-2023-5929 | Medium | 5.5 | 2023-11-02 | A vulnerability was found in Campcodes Simple Student Information System 1.0. It has been classified as critical. This affects an unknown part of the file /adm… |
CVE-2023-39284 | Medium | 5.5 | 2023-11-02 | An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. There are arbitrary calls to SetVariable with unsanitized argument… |
CVE-2023-5928 | Medium | 5.5 | 2023-11-02 | A vulnerability was found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2023-5927 | Medium | 5.5 | 2023-11-02 | A vulnerability has been found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2023-5926 | Medium | 5.5 | 2023-11-02 | A vulnerability, which was classified as critical, was found in Campcodes Simple Student Information System 1.0. Affected is an unknown function of the file /a… |
CVE-2023-5925 | Medium | 5.5 | 2023-11-02 | A vulnerability, which was classified as critical, has been found in Campcodes Simple Student Information System 1.0. This issue affects some unknown processin… |
CVE-2023-5924 | Medium | 5.5 | 2023-11-02 | A vulnerability classified as critical was found in Campcodes Simple Student Information System 1.0. This vulnerability affects unknown code of the file /admin… |
CVE-2023-5923 | Medium | 5.5 | 2023-11-02 | A vulnerability classified as critical has been found in Campcodes Simple Student Information System 1.0. This affects an unknown part of the file /admin/index… |
CVE-2023-31027 | High | 8.2 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels of privilege to escalate privileges when an administra… |
CVE-2023-31026 | Medium | 6.0 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a NULL-pointer dereference may lead to deni… |
CVE-2023-31023 | Medium | 5.5 | 2023-11-02 | NVIDIA Display Driver for Windows contains a vulnerability where an attacker may cause a pointer dereference of an untrusted value, which may lead to denial of… |
CVE-2023-31022 | Medium | 5.5 | 2023-11-02 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of servi… |
CVE-2023-31021 | Medium | 5.5 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause… |
CVE-2023-31020 | Medium | 6.1 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control… |
CVE-2023-31019 | High | 7.8 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restri… |
CVE-2023-31018 | Medium | 6.5 | 2023-11-02 | NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer derefere… |
CVE-2023-31017 | High | 7.8 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be able to write arbitrary data to privileged locations by using reparse p… |
CVE-2023-31016 | High | 7.3 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an uncontrolled search path element may allow an attacker to execute arbitrary code, which… |
CVE-2023-5846 | High | 8.3 | 2023-11-02 | Franklin Fueling System TS-550 versions prior to 1.9.23.8960 are vulnerable to attackers decoding admin credentials, resulting in unauthenticated access to th… |
CVE-2023-5035 | Low | 3.1 | 2023-11-02 | A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is no… |
CVE-2023-4217 | Low | 3.1 | 2023-11-02 | A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected applicati… |
CVE-2023-46925 | Medium | 4.8 | 2023-11-02 | Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-38473 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. |
CVE-2023-46725 | High | 8.1 | 2023-11-02 | FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery… |
CVE-2023-45347 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_verified' parameter of the routers/user-router… |
CVE-2023-45346 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php… |
CVE-2023-45345 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router… |
CVE-2023-45338 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/add-ticket.php reso… |
CVE-2023-38472 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. |
CVE-2023-38471 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. |
CVE-2023-38470 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. |
CVE-2023-38469 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. |
CVE-2023-5919 | Medium | 4.7 | 2023-11-02 | A vulnerability was found in SourceCodester Company Website CMS 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2023-45344 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_balance' parameter of the routers/user-router… |
CVE-2023-45343 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'ticket_id' parameter of the routers/ticket-messa… |
CVE-2023-45342 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/register-router… |
CVE-2023-45341 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_price' parameter of the routers/menu-router.ph… |
CVE-2023-45340 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/details-router.p… |
CVE-2023-45336 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php re… |
CVE-2023-45334 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php… |
CVE-2023-45325 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the routers/add-users.php… |
CVE-2023-45323 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-item.php reso… |
CVE-2023-42802 | Critical | 10.0 | 2023-11-02 | GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one… |
CVE-2023-29047 | Medium | 5.3 | 2023-11-02 | Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. A… |
CVE-2023-29046 | Medium | 4.3 | 2023-11-02 | Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Som… |
CVE-2023-29045 | Medium | 5.4 | 2023-11-02 | Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an ope… |
CVE-2023-29044 | Medium | 5.4 | 2023-11-02 | Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be exec… |
CVE-2023-29043 | Medium | 6.1 | 2023-11-02 | Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a docum… |
CVE-2023-26456 | Medium | 5.4 | 2023-11-02 | Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, al… |
CVE-2023-26455 | Medium | 5.6 | 2023-11-02 | RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI serv… |
CVE-2023-26454 | High | 7.6 | 2023-11-02 | Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least acces… |
CVE-2023-26453 | High | 7.6 | 2023-11-02 | Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to a… |
CVE-2023-26452 | High | 7.6 | 2023-11-02 | Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requi… |
CVE-2023-46475 | Medium | 5.4 | 2023-11-02 | A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inj… |
CVE-2023-5918 | Medium | 6.3 | 2023-11-02 | A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manag… |