2023 CVEs (page 121)
Page 121 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5860 | High | 7.2 | 2023-11-02 | The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions u… |
CVE-2023-43336 | High | 8.8 | 2023-11-02 | Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value… |
CVE-2023-43193 | Medium | 6.1 | 2023-11-02 | Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS. |
CVE-2023-3164 | Medium | 5.5 | 2023-11-02 | A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attack… |
CVE-2023-5917 | Low | 2.4 | 2023-11-02 | A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp… |
CVE-2023-5916 | Medium | 4.3 | 2023-11-02 | A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Co… |
CVE-2023-43087 | Medium | 4.3 | 2023-11-02 | Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exp… |
CVE-2023-43076 | Medium | 6.5 | 2023-11-02 | Dell PowerScale OneFS 8.2.x,9.0.0.x-9.5.0.x contains a denial-of-service vulnerability. A low privilege remote attacker could potentially exploit this vulnera… |
CVE-2023-5920 | Low | 2.9 | 2023-11-02 | Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard inpu… |
CVE-2023-5876 | Low | 3.1 | 2023-11-02 | Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Servic… |
CVE-2023-5875 | Low | 3.7 | 2023-11-02 | Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious… |
CVE-2023-5606 | Medium | 4.4 | 2023-11-02 | The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitizati… |
CVE-2023-46595 | Medium | 5.9 | 2023-11-02 | Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can le… |
CVE-2023-47204 | Critical | 9.8 | 2023-11-02 | Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code. |
CVE-2023-46695 | High | 7.5 | 2023-11-02 | An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, djan… |
CVE-2023-5408 | High | 7.2 | 2023-11-02 | A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the no… |
CVE-2023-46327 | Medium | 5.9 | 2023-11-02 | Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their… |
CVE-2023-45019 | Critical | 9.8 | 2023-11-02 | Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource d… |
CVE-2023-45018 | Critical | 9.8 | 2023-11-02 | Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the includes/login.php reso… |
CVE-2023-45015 | Critical | 9.8 | 2023-11-02 | Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'date' parameter of the bus_info.php resource does… |
CVE-2023-45012 | Critical | 9.8 | 2023-11-02 | Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'user_email' parameter of the bus_info.php resource… |
CVE-2023-45111 | Critical | 9.8 | 2023-11-02 | Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the feed.php resource does not… |
CVE-2023-5910 | Low | 2.6 | 2023-11-02 | A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component… |
CVE-2023-45203 | Medium | 6.1 | 2023-11-01 | Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redir… |
CVE-2023-45202 | Medium | 6.1 | 2023-11-01 | Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redire… |
CVE-2023-44954 | Medium | 5.4 | 2023-11-01 | Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings fun… |
CVE-2023-46448 | Medium | 6.1 | 2023-11-01 | Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string i… |
CVE-2023-45201 | Medium | 6.1 | 2023-11-01 | Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the admin.php resource allows an attacker to redir… |
CVE-2023-44025 | Critical | 9.8 | 2023-11-01 | SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrule… |
CVE-2023-39281 | Critical | 9.8 | 2023-11-01 | A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code exe… |
CVE-2023-46428 | High | 8.8 | 2023-11-01 | An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file. |
CVE-2023-46724 | High | 8.6 | 2023-11-01 | Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled us… |
CVE-2023-3397 | High | 7.0 | 2023-11-01 | A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attac… |
CVE-2023-1193 | Medium | 6.5 | 2023-11-01 | A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could al… |
CVE-2023-1192 | Medium | 6.5 | 2023-11-01 | A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are stil… |
CVE-2023-46482 | Critical | 9.8 | 2023-11-01 | SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/d… |
CVE-2023-5859 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted local H… |
CVE-2023-5858 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML… |
CVE-2023-5857 | High | 8.8 | 2023-11-01 | Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malici… |
CVE-2023-5856 | High | 8.8 | 2023-11-01 | Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to poten… |
CVE-2023-5855 | High | 8.8 | 2023-11-01 | Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to pot… |
CVE-2023-5854 | High | 8.8 | 2023-11-01 | Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2023-5853 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromi… |
CVE-2023-5852 | High | 8.8 | 2023-11-01 | Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2023-5851 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page… |
CVE-2023-5850 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Ch… |
CVE-2023-5849 | High | 8.8 | 2023-11-01 | Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2023-5766 | Critical | 9.8 | 2023-11-01 | A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another win… |
CVE-2023-5765 | Critical | 9.8 | 2023-11-01 | Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to bypass pe… |
CVE-2023-5482 | High | 8.8 | 2023-11-01 | Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory access via a crafted HTM… |
CVE-2023-5480 | Medium | 6.1 | 2023-11-01 | Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a malicious file. (Ch… |
CVE-2023-5358 | Medium | 5.3 | 2023-11-01 | Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries th… |
CVE-2023-20267 | Medium | 4.0 | 2023-11-01 | A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restrictions. This vuln… |
CVE-2023-20264 | Medium | 6.1 | 2023-11-01 | A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco Adaptive Security Ap… |
CVE-2023-20255 | Medium | 5.3 | 2023-11-01 | A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS)… |
CVE-2023-20247 | Medium | 5.0 | 2023-11-01 | A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software coul… |
CVE-2023-20246 | Medium | 5.8 | 2023-11-01 | Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacker to bypass the con… |
CVE-2023-20220 | High | 7.2 | 2023-11-01 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2023-20219 | High | 7.2 | 2023-11-01 | Multiple vulnerabilities in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to e… |
CVE-2023-20196 | Medium | 4.7 | 2023-11-01 | Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilitie… |
CVE-2023-20175 | High | 8.8 | 2023-11-01 | A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operati… |
CVE-2023-20170 | Medium | 6.0 | 2023-11-01 | A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the underlying operati… |
CVE-2023-20095 | High | 8.6 | 2023-11-01 | A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could al… |
CVE-2023-20083 | High | 8.6 | 2023-11-01 | A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2023-20071 | Medium | 5.8 | 2023-11-01 | Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker to bypass the config… |
CVE-2023-20070 | Medium | 4.0 | 2023-11-01 | A vulnerability in the TLS 1.3 implementation of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause the… |
CVE-2023-20063 | High | 8.2 | 2023-11-01 | A vulnerability in the inter-device communication mechanisms between devices that are running Cisco Firepower Threat Defense (FTD) Software and devices that ar… |
CVE-2023-20048 | Critical | 9.9 | 2023-11-01 | A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execute cert… |
CVE-2023-20042 | Medium | 6.8 | 2023-11-01 | A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could a… |
CVE-2023-20031 | Medium | 4.0 | 2023-11-01 | A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense (FTD) Software could allow an u… |
CVE-2023-5178 | High | 8.8 | 2023-11-01 | A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux k… |
CVE-2023-46911 | Medium | 6.1 | 2023-11-01 | There is a Cross Site Scripting (XSS) vulnerability in the choose_style_tree.do interface of Jspxcms v10.2.0 backend. |
CVE-2023-20270 | Medium | 5.8 | 2023-11-01 | A vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco Firepower Threat Def… |
CVE-2023-20256 | Medium | 5.0 | 2023-11-01 | Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… |
CVE-2023-20245 | Medium | 5.8 | 2023-11-01 | Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… |
CVE-2023-20244 | High | 8.6 | 2023-11-01 | A vulnerability in the internal packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Firewalls could allow an una… |
CVE-2023-20213 | Medium | 4.3 | 2023-11-01 | A vulnerability in the CDP processing feature of Cisco ISE could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition of th… |
CVE-2023-20206 | Medium | 6.1 | 2023-11-01 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attac… |
CVE-2023-20195 | Medium | 4.7 | 2023-11-01 | Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit these vulnerabilitie… |
CVE-2023-20177 | Medium | 4.0 | 2023-11-01 | A vulnerability in the SSL file policy implementation of Cisco Firepower Threat Defense (FTD) Software that occurs when the SSL/TLS connection is configured wi… |
CVE-2023-20155 | High | 7.5 | 2023-11-01 | A vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to cause the device to bec… |
CVE-2023-20114 | Medium | 6.5 | 2023-11-01 | A vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to download arbi… |
CVE-2023-20086 | High | 8.6 | 2023-11-01 | A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unaut… |
CVE-2023-20074 | Medium | 4.8 | 2023-11-01 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attac… |
CVE-2023-20041 | Medium | 4.8 | 2023-11-01 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attac… |
CVE-2023-20005 | Medium | 4.8 | 2023-11-01 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attac… |
CVE-2023-5847 | Medium | 6.7 | 2023-11-01 | Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileges on Windows and L… |
CVE-2023-5627 | High | 7.5 | 2023-11-01 | A vulnerability has been identified in NPort 6000 Series, making the authentication mechanism vulnerable. This vulnerability arises from the incorrect implemen… |
CVE-2023-40062 | High | 8.0 | 2023-11-01 | SolarWinds Platform Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability. If executed, this vulnerability would allow a low-privileged user… |
CVE-2023-40061 | High | 8.8 | 2023-11-01 | Insecure job execution mechanism vulnerability. This vulnerability can lead to other attacks as a result. |
CVE-2023-3972 | High | 7.8 | 2023-11-01 | A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and director… |
CVE-2023-33228 | Medium | 4.5 | 2023-11-01 | The SolarWinds Network Configuration Manager was susceptible to the Exposure of Sensitive Information Vulnerability. This vulnerability allows users with admin… |
CVE-2023-33227 | High | 8.0 | 2023-11-01 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability This vulnerability allows a low level user to pe… |
CVE-2023-33226 | High | 8.0 | 2023-11-01 | The Network Configuration Manager was susceptible to a Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows a low-level user to… |
CVE-2023-4452 | Medium | 6.5 | 2023-11-01 | A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerability. This vulnera… |
CVE-2023-46928 | Medium | 5.5 | 2023-11-01 | GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:42. |
CVE-2023-46927 | Medium | 5.5 | 2023-11-01 | GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in gpac/MP4Box. |
CVE-2023-5625 | Medium | 5.3 | 2023-11-01 | A regression was introduced in the Red Hat build of python-eventlet due to a change in the patch application strategy, resulting in a patch for CVE-2021-21419… |
CVE-2023-46931 | Medium | 5.5 | 2023-11-01 | GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in gpac/MP4Box. |
CVE-2023-46930 | Medium | 5.5 | 2023-11-01 | GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:522:14. |