2023 CVEs (page 121)
Page 121 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5928 | Medium | 5.5 | 2023-11-02 | A vulnerability was found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2023-5927 | Medium | 5.5 | 2023-11-02 | A vulnerability has been found in Campcodes Simple Student Information System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2023-5926 | Medium | 5.5 | 2023-11-02 | A vulnerability, which was classified as critical, was found in Campcodes Simple Student Information System 1.0. Affected is an unknown function of the file /a… |
CVE-2023-5925 | Medium | 5.5 | 2023-11-02 | A vulnerability, which was classified as critical, has been found in Campcodes Simple Student Information System 1.0. This issue affects some unknown processin… |
CVE-2023-5924 | Medium | 5.5 | 2023-11-02 | A vulnerability classified as critical was found in Campcodes Simple Student Information System 1.0. This vulnerability affects unknown code of the file /admin… |
CVE-2023-5923 | Medium | 5.5 | 2023-11-02 | A vulnerability classified as critical has been found in Campcodes Simple Student Information System 1.0. This affects an unknown part of the file /admin/index… |
CVE-2023-31027 | High | 8.2 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels of privilege to escalate privileges when an administra… |
CVE-2023-31026 | Medium | 6.0 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a NULL-pointer dereference may lead to deni… |
CVE-2023-31023 | Medium | 5.5 | 2023-11-02 | NVIDIA Display Driver for Windows contains a vulnerability where an attacker may cause a pointer dereference of an untrusted value, which may lead to denial of… |
CVE-2023-31022 | Medium | 5.5 | 2023-11-02 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of servi… |
CVE-2023-31021 | Medium | 5.5 | 2023-11-02 | NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause… |
CVE-2023-31020 | Medium | 6.1 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control… |
CVE-2023-31019 | High | 7.8 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restri… |
CVE-2023-31018 | Medium | 6.5 | 2023-11-02 | NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer derefere… |
CVE-2023-31017 | High | 7.8 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be able to write arbitrary data to privileged locations by using reparse p… |
CVE-2023-31016 | High | 7.3 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an uncontrolled search path element may allow an attacker to execute arbitrary code, which… |
CVE-2023-5846 | High | 8.3 | 2023-11-02 | Franklin Fueling System TS-550 versions prior to 1.9.23.8960 are vulnerable to attackers decoding admin credentials, resulting in unauthenticated access to th… |
CVE-2023-5035 | Low | 3.1 | 2023-11-02 | A vulnerability has been identified in PT-G503 Series firmware versions prior to v5.2, where the Secure attribute for sensitive cookies in HTTPS sessions is no… |
CVE-2023-4217 | Low | 3.1 | 2023-11-02 | A vulnerability has been identified in PT-G503 Series versions prior to v5.2, where the session cookies attribute is not set properly in the affected applicati… |
CVE-2023-46925 | Medium | 4.8 | 2023-11-02 | Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-38473 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_alternative_host_name() function. |
CVE-2023-46725 | High | 8.1 | 2023-11-02 | FoodCoopShop is open source software for food coops and local shops. Versions starting with 3.2.0 prior to 3.6.1 are vulnerable to server-side request forgery… |
CVE-2023-45347 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_verified' parameter of the routers/user-router… |
CVE-2023-45346 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_role' parameter of the routers/user-router.php… |
CVE-2023-45345 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_deleted' parameter of the routers/user-router… |
CVE-2023-45338 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/add-ticket.php reso… |
CVE-2023-38472 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_rdata_parse() function. |
CVE-2023-38471 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the dbus_set_host_name function. |
CVE-2023-38470 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi. A reachable assertion exists in the avahi_escape_label() function. |
CVE-2023-38469 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in Avahi, where a reachable assertion exists in avahi_dns_packet_append_record. |
CVE-2023-5919 | Medium | 4.7 | 2023-11-02 | A vulnerability was found in SourceCodester Company Website CMS 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2023-45344 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_balance' parameter of the routers/user-router… |
CVE-2023-45343 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'ticket_id' parameter of the routers/ticket-messa… |
CVE-2023-45342 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/register-router… |
CVE-2023-45341 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_price' parameter of the routers/menu-router.ph… |
CVE-2023-45340 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routers/details-router.p… |
CVE-2023-45336 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the routers/router.php re… |
CVE-2023-45334 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routers/edit-orders.php… |
CVE-2023-45325 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the routers/add-users.php… |
CVE-2023-45323 | Critical | 9.8 | 2023-11-02 | Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routers/add-item.php reso… |
CVE-2023-42802 | Critical | 10.0 | 2023-11-02 | GLPI is a free asset and IT management software package. Starting in version 10.0.7 and prior to version 10.0.10, an unverified object instantiation allows one… |
CVE-2023-29047 | Medium | 5.3 | 2023-11-02 | Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrary SQL statements. A… |
CVE-2023-29046 | Medium | 4.3 | 2023-11-02 | Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connections were logged. Som… |
CVE-2023-29045 | Medium | 5.4 | 2023-11-02 | Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an ope… |
CVE-2023-29044 | Medium | 5.4 | 2023-11-02 | Documents operations could be manipulated to contain invalid data types, possibly script code. Script code could be injected to an operation that would be exec… |
CVE-2023-29043 | Medium | 6.1 | 2023-11-02 | Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed when editing a docum… |
CVE-2023-26456 | Medium | 5.4 | 2023-11-02 | Users were able to set an arbitrary "product name" for OX Guard. The chosen value was not sufficiently sanitized before processing it at the user interface, al… |
CVE-2023-26455 | Medium | 5.6 | 2023-11-02 | RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. Attackers with local or adjacent network access could abuse the RMI serv… |
CVE-2023-26454 | High | 7.6 | 2023-11-02 | Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least acces… |
CVE-2023-26453 | High | 7.6 | 2023-11-02 | Requests to cache an image could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requires at least access to a… |
CVE-2023-26452 | High | 7.6 | 2023-11-02 | Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. Exploiting this vulnerability requi… |
CVE-2023-46475 | Medium | 5.4 | 2023-11-02 | A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the project, they can inj… |
CVE-2023-5918 | Medium | 6.3 | 2023-11-02 | A vulnerability, which was classified as critical, was found in SourceCodester Visitor Management System 1.0. Affected is an unknown function of the file manag… |
CVE-2023-5860 | High | 7.2 | 2023-11-02 | The Icons Font Loader plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the upload function in all versions u… |
CVE-2023-43336 | High | 8.8 | 2023-11-02 | Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value… |
CVE-2023-43193 | Medium | 6.1 | 2023-11-02 | Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). An attacker can create a malicious link in the forum that leads to XSS. |
CVE-2023-3164 | Medium | 5.5 | 2023-11-02 | A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attack… |
CVE-2023-5917 | Low | 2.4 | 2023-11-02 | A vulnerability, which was classified as problematic, has been found in phpBB up to 3.3.10. This issue affects the function main of the file phpBB/includes/acp… |
CVE-2023-5916 | Medium | 4.3 | 2023-11-02 | A vulnerability classified as critical has been found in Lissy93 Dashy 2.1.1. This affects an unknown part of the file /config-manager/save of the component Co… |
CVE-2023-43087 | Medium | 4.3 | 2023-11-02 | Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. A low privileged remote attacker could potentially exp… |
CVE-2023-43076 | Medium | 6.5 | 2023-11-02 | Dell PowerScale OneFS 8.2.x,9.0.0.x-9.5.0.x contains a denial-of-service vulnerability. A low privilege remote attacker could potentially exploit this vulnera… |
CVE-2023-5920 | Low | 2.9 | 2023-11-02 | Mattermost Desktop for MacOS fails to utilize the secure keyboard input functionality provided by macOS, allowing for other processes to read the keyboard inpu… |
CVE-2023-5876 | Low | 3.1 | 2023-11-02 | Mattermost fails to properly validate a RegExp built off the server URL path, allowing an attacker in control of an enrolled server to mount a Denial Of Servic… |
CVE-2023-5875 | Low | 3.7 | 2023-11-02 | Mattermost Desktop fails to correctly handle permissions or prompt the user for consent on certain sensitive ones allowing media exploitation from a malicious… |
CVE-2023-5606 | Medium | 4.4 | 2023-11-02 | The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficient input sanitizati… |
CVE-2023-46595 | Medium | 5.9 | 2023-11-02 | Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor allows an attacker to obtain victim’s domain credentials and Net-NTLM hash which can le… |
CVE-2023-47204 | Critical | 9.8 | 2023-11-02 | Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code. |
CVE-2023-46695 | High | 7.5 | 2023-11-02 | An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. The NFKC normalization is slow on Windows. As a consequence, djan… |
CVE-2023-5408 | High | 7.2 | 2023-11-02 | A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the no… |
CVE-2023-46327 | Medium | 5.9 | 2023-11-02 | Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. and Xerox Corporation provide a facility to export the contents of their… |
CVE-2023-45019 | Critical | 9.8 | 2023-11-02 | Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'category' parameter of the category.php resource d… |
CVE-2023-45018 | Critical | 9.8 | 2023-11-02 | Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'username' parameter of the includes/login.php reso… |
CVE-2023-45015 | Critical | 9.8 | 2023-11-02 | Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'date' parameter of the bus_info.php resource does… |
CVE-2023-45012 | Critical | 9.8 | 2023-11-02 | Online Bus Booking System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'user_email' parameter of the bus_info.php resource… |
CVE-2023-45111 | Critical | 9.8 | 2023-11-02 | Online Examination System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'email' parameter of the feed.php resource does not… |
CVE-2023-5910 | Low | 2.6 | 2023-11-02 | A vulnerability was found in PopojiCMS 2.0.1 and classified as problematic. This issue affects some unknown processing of the file install.php of the component… |
CVE-2023-45203 | Medium | 6.1 | 2023-11-01 | Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the login.php resource allows an attacker to redir… |
CVE-2023-45202 | Medium | 6.1 | 2023-11-01 | Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the feed.php resource allows an attacker to redire… |
CVE-2023-44954 | Medium | 5.4 | 2023-11-01 | Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Developer Settings fun… |
CVE-2023-46448 | Medium | 6.1 | 2023-11-01 | Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code via crafted string i… |
CVE-2023-45201 | Medium | 6.1 | 2023-11-01 | Online Examination System v1.0 is vulnerable to multiple Open Redirect vulnerabilities. The 'q' parameter of the admin.php resource allows an attacker to redir… |
CVE-2023-44025 | Critical | 9.8 | 2023-11-01 | SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the getrule… |
CVE-2023-39281 | Critical | 9.8 | 2023-11-01 | A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run arbitrary code exe… |
CVE-2023-46428 | High | 8.8 | 2023-11-01 | An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file. |
CVE-2023-46724 | High | 8.6 | 2023-11-01 | Squid is a caching proxy for the Web. Due to an Improper Validation of Specified Index bug, Squid versions 3.3.0.1 through 5.9 and 6.0 prior to 6.4 compiled us… |
CVE-2023-3397 | High | 7.0 | 2023-11-01 | A race condition occurred between the functions lmLogClose and txEnd in JFS, in the Linux Kernel, executed in different threads. This flaw allows a local attac… |
CVE-2023-1193 | Medium | 6.5 | 2023-11-01 | A use-after-free flaw was found in setup_async_work in the KSMBD implementation of the in-kernel samba server and CIFS in the Linux kernel. This issue could al… |
CVE-2023-1192 | Medium | 6.5 | 2023-11-01 | A use-after-free flaw was found in smb2_is_status_io_timeout() in CIFS in the Linux Kernel. After CIFS transfers response data to a system call, there are stil… |
CVE-2023-46482 | Critical | 9.8 | 2023-11-01 | SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in the coreframe/app/d… |
CVE-2023-5859 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted local H… |
CVE-2023-5858 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML… |
CVE-2023-5857 | High | 8.8 | 2023-11-01 | Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrary code via a malici… |
CVE-2023-5856 | High | 8.8 | 2023-11-01 | Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to poten… |
CVE-2023-5855 | High | 8.8 | 2023-11-01 | Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to pot… |
CVE-2023-5854 | High | 8.8 | 2023-11-01 | Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2023-5853 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page. (Chromi… |
CVE-2023-5852 | High | 8.8 | 2023-11-01 | Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2023-5851 | Medium | 4.3 | 2023-11-01 | Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted HTML page… |
CVE-2023-5850 | Medium | 4.3 | 2023-11-01 | Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a crafted domain name. (Ch… |
CVE-2023-5849 | High | 8.8 | 2023-11-01 | Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |