2023 CVEs (page 123)
Page 123 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-22518 | Critical | 9.8 | 2023-10-31 | All versions of Confluence Data Center and Server are affected by this unexploited vulnerability. This Improper Authorization vulnerability allows an unauthent… |
CVE-2023-5519 | Medium | 4.3 | 2023-10-31 | The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwan… |
CVE-2023-5458 | Medium | 5.4 | 2023-10-31 | The CITS Support svg, webp Media and TTF,OTF File Upload WordPress plugin before 3.0 does not sanitise uploaded SVG files, which could allow users with a role… |
CVE-2023-5360 | Critical | 9.8 | 2023-10-31 | The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated users to u… |
CVE-2023-5307 | Medium | 6.1 | 2023-10-31 | The Photos and Files Contest Gallery WordPress plugin before 21.2.8.1 does not sanitise and escape some parameters, which could allow unauthenticated users to… |
CVE-2023-5243 | Medium | 4.8 | 2023-10-31 | The Login Screen Manager WordPress plugin through 3.5.2 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin… |
CVE-2023-5238 | Medium | 6.1 | 2023-10-31 | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape a parameter before outputting it back in the page, leading to an HTML Injection on th… |
CVE-2023-5237 | Medium | 5.4 | 2023-10-31 | The Memberlite Shortcodes WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2023-5229 | Medium | 4.8 | 2023-10-31 | The E2Pdf WordPress plugin before 1.20.20 does not sanitize and escape some of its settings, which could allow high privilege users to perform Cross-Site Scrip… |
CVE-2023-5211 | Medium | 6.1 | 2023-10-31 | The Fattura24 WordPress plugin before 6.2.8 does not sanitize or escape the 'id' parameter before outputting it back in the page, leading to a reflected Cross-… |
CVE-2023-5098 | High | 8.1 | 2023-10-31 | The Campaign Monitor Forms by Optin Cat WordPress plugin before 2.5.6 does not prevent users with low privileges (like subscribers) from overwriting any option… |
CVE-2023-4836 | Medium | 4.3 | 2023-10-31 | The WordPress File Sharing Plugin WordPress plugin before 2.0.5 does not check authorization before displaying files and folders, allowing users to gain access… |
CVE-2023-4823 | Medium | 5.4 | 2023-10-31 | The WP Meta and Date Remover WordPress plugin before 2.2.0 provides an AJAX endpoint for configuring the plugin settings. This endpoint has no capability check… |
CVE-2023-4390 | Medium | 4.8 | 2023-10-31 | The Popup box WordPress plugin before 3.7.2 does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to… |
CVE-2023-4251 | Medium | 4.3 | 2023-10-31 | The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged in users create unwan… |
CVE-2023-4250 | Medium | 6.1 | 2023-10-31 | The EventPrime WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected Cross… |
CVE-2023-46979 | Critical | 9.8 | 2023-10-31 | TOTOLINK X6000R V9.4.0cu.852_B20230719 was discovered to contain a command injection vulnerability via the enable parameter in the setLedCfg function. |
CVE-2023-46978 | High | 7.5 | 2023-10-31 | TOTOLINK X6000R V9.4.0cu.852_B20230719 is vulnerable to Incorrect Access Control.Attackers can reset login password & WIFI passwords without authentication. |
CVE-2023-46977 | Critical | 9.8 | 2023-10-31 | TOTOLINK LR1200GB V9.1.0u.6619_B20230130 was discovered to contain a stack overflow via the password parameter in the function loginAuth. |
CVE-2023-46976 | Critical | 9.8 | 2023-10-31 | TOTOLINK A3300R 17.0.0cu.557_B20221024 contains a command injection via the file_name parameter in the UploadFirmwareFile function. |
CVE-2023-28777 | High | 8.5 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LearnDash LearnDash LMS allows SQL Injection.This issue a… |
CVE-2023-25047 | Medium | 5.5 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker rsvpmaker allows SQL Injection.Th… |
CVE-2023-25045 | Medium | 6.7 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David F. Carr RSVPMaker allows SQL Injection.This issue a… |
CVE-2023-24000 | High | 8.2 | 2023-10-31 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GamiPress gamipress allows SQL Injection.This issue affec… |
CVE-2023-5116 | Medium | 6.4 | 2023-10-31 | The Live updates from Excel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ipushpull_page' shortcode in versions up to, an… |
CVE-2023-5114 | Medium | 5.4 | 2023-10-31 | The idbbee plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'idbbee' shortcode in versions up to, and including, 1.0 due to i… |
CVE-2023-5099 | High | 8.8 | 2023-10-31 | The HTML filter and csv-file search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.7 via the 'src' attribute of… |
CVE-2023-5073 | Medium | 6.4 | 2023-10-31 | The iframe forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iframe' shortcode in versions up to, and including, 1.0 due to insu… |
CVE-2023-38994 | High | 7.9 | 2023-10-31 | The 'check_univention_joinstatus' prometheus monitoring script (and other scripts) in UCS 5.0-5 revealed the LDAP plaintext password of the machine account in… |
CVE-2023-46622 | High | 7.1 | 2023-10-31 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ollybach WPPizza – A Restaurant Plugin plugin <= 3.18.2 versions. |
CVE-2023-46313 | High | 7.1 | 2023-10-31 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Katie Seaborn Zotpress plugin <= 7.3.4 versions. |
CVE-2023-46312 | High | 7.1 | 2023-10-31 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Zaytech Smart Online Order for Clover plugin <= 1.5.4 versions. |
CVE-2023-40681 | Medium | 5.9 | 2023-10-31 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Groundhogg Inc. Groundhogg plugin <= 2.7.11.10 versions. |
CVE-2023-5873 | Medium | 5.4 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 11.1.0. |
CVE-2023-5464 | High | 8.8 | 2023-10-31 | The Jquery accordion slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.1 due to insu… |
CVE-2023-5439 | High | 8.8 | 2023-10-31 | The Wp photo text slider 50 plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 8.0 due to insuffi… |
CVE-2023-5438 | High | 8.8 | 2023-10-31 | The wp image slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insufficien… |
CVE-2023-5437 | High | 8.8 | 2023-10-31 | The WP fade in text news plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due to insuffici… |
CVE-2023-5436 | High | 8.8 | 2023-10-31 | The Vertical marquee plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 7.1 due to insufficient e… |
CVE-2023-5435 | High | 8.8 | 2023-10-31 | The Up down image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 due t… |
CVE-2023-5434 | High | 8.8 | 2023-10-31 | The Superb slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13.1 due to insuf… |
CVE-2023-5433 | High | 8.8 | 2023-10-31 | The Message ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.2 due to insufficient esc… |
CVE-2023-5431 | High | 8.8 | 2023-10-31 | The Left right image slideshow gallery plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 12.0 du… |
CVE-2023-5430 | High | 8.8 | 2023-10-31 | The Jquery news ticker plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 3.0 due to insufficient… |
CVE-2023-5429 | High | 8.8 | 2023-10-31 | The Information Reel plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 10.0 due to insufficient… |
CVE-2023-5428 | High | 8.8 | 2023-10-31 | The Image vertical reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 9.0 d… |
CVE-2023-5412 | High | 8.8 | 2023-10-31 | The Image horizontal reel scroll slideshow plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode in versions up to, and including, 13… |
CVE-2023-46210 | Medium | 5.9 | 2023-10-31 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WebCource WC Captcha plugin <= 1.4 versions. |
CVE-2023-46451 | Medium | 5.4 | 2023-10-31 | Best Courier Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in the change username field. |
CVE-2023-46361 | Medium | 6.5 | 2023-10-31 | Artifex Software jbig2dec v0.20 was discovered to contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c. |
CVE-2023-45996 | High | 8.8 | 2023-10-31 | SQL injection vulnerability in Senayan Library Management Systems Slims v.9 and Bulian v.9.6.1 allows a remote attacker to obtain sensitive information and exe… |
CVE-2023-43139 | Critical | 9.8 | 2023-10-31 | An issue in franfinance before v.2.0.27 allows a remote attacker to execute arbitrary code via the validation.php, and controllers/front/validation.php compone… |
CVE-2023-36263 | Critical | 9.8 | 2023-10-31 | Prestashop opartlimitquantity 1.4.5 and before is vulnerable to SQL Injection. OpartlimitquantityAlertlimitModuleFrontController::displayAjaxPushAlertMessage()… |
CVE-2023-47174 | Critical | 9.8 | 2023-10-31 | Thorn SFTP gateway 3.4.x before 3.4.4 uses Pivotal Spring Framework for Java deserialization of untrusted data, which is not supported by Pivotal, a related is… |
CVE-2023-46356 | Critical | 9.8 | 2023-10-31 | In the module "CSV Feeds PRO" (csvfeeds) before 2.6.1 from Bl Modules for PrestaShop, a guest can perform SQL injection. The method `SearchApiCsv::getProducts(… |
CVE-2023-45378 | Critical | 9.8 | 2023-10-31 | In the module "PrestaBlog" (prestablog) version 4.4.7 and before from HDclic for PrestaShop, a guest can perform SQL injection. The script ajax slider_position… |
CVE-2023-27846 | Critical | 9.8 | 2023-10-31 | SQL injection vulnerability found in PrestaShop themevolty v.4.0.8 and before allow a remote attacker to gain privileges via the tvcmsblog, tvcmsvideotab, tvcm… |
CVE-2023-46040 | Medium | 5.4 | 2023-10-31 | Cross Site Scripting vulnerability in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via the a crafted payload to the components.php… |
CVE-2023-45899 | High | 7.5 | 2023-10-31 | An issue in the component SuperUserSetuserModuleFrontController:init() of idnovate superuser before v2.4.2 allows attackers to bypass authentication via a craf… |
CVE-2023-5867 | Medium | 5.4 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5866 | Medium | 5.7 | 2023-10-31 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5865 | Critical | 9.8 | 2023-10-31 | Insufficient Session Expiration in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5864 | Medium | 4.8 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.1. |
CVE-2023-5863 | Medium | 6.1 | 2023-10-31 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.2.2. |
CVE-2023-5862 | Low | 3.3 | 2023-10-31 | Missing Authorization in GitHub repository hamza417/inure prior to Build95. |
CVE-2023-5861 | Medium | 4.8 | 2023-10-31 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 2.0. |
CVE-2023-31794 | Medium | 5.5 | 2023-10-31 | MuPDF v1.21.1 was discovered to contain an infinite recursion in the component pdf_mark_list_push. This vulnerability allows attackers to cause a Denial of Ser… |
CVE-2023-46139 | Medium | 5.0 | 2023-10-31 | KernelSU is a Kernel based root solution for Android. Starting in version 0.6.1 and prior to version 0.7.0, if a KernelSU installed device is infected with a m… |
CVE-2023-46138 | Low | 3.7 | 2023-10-31 | JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email… |
CVE-2023-46129 | High | 7.5 | 2023-10-31 | NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptogra… |
CVE-2023-46502 | Critical | 9.8 | 2023-10-30 | An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure DocumentBuilderFactory. |
CVE-2023-46478 | High | 8.8 | 2023-10-30 | An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter. |
CVE-2023-45672 | High | 7.5 | 2023-10-30 | Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, an unsafe deserialization vulnerability was identified in the endpoints used… |
CVE-2023-45671 | Medium | 4.7 | 2023-10-30 | Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints… |
CVE-2023-45670 | High | 7.5 | 2023-10-30 | Frigate is an open source network video recorder. Prior to version 0.13.0 Beta 3, the `config/save` and `config/set` endpoints of Frigate do not implement any… |
CVE-2023-44397 | High | 7.5 | 2023-10-30 | CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller… |
CVE-2023-43798 | Medium | 5.6 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side Request Forgery (SSRF). T… |
CVE-2023-43797 | Medium | 6.3 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripting when users wai… |
CVE-2023-45956 | High | 7.5 | 2023-10-30 | An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands. |
CVE-2023-42323 | High | 8.8 | 2023-10-30 | Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.class.php file. |
CVE-2023-5349 | Medium | 5.3 | 2023-10-30 | A memory leak flaw was found in ruby-magick, an interface between Ruby and ImageMagick. This issue can lead to a denial of service (DOS) by memory exhaustion. |
CVE-2023-43792 | Critical | 9.8 | 2023-10-30 | baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baserCMS. As of time… |
CVE-2023-47104 | Critical | 9.8 | 2023-10-30 | tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input d… |
CVE-2023-43649 | Medium | 4.7 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content preview feature of base… |
CVE-2023-43648 | Medium | 4.9 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management featur… |
CVE-2023-43647 | Medium | 6.1 | 2023-10-30 | baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload feature of baserCMS. Vers… |
CVE-2023-42804 | Low | 3.1 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.1 has a path traversal vulnerability that allows an attacker with… |
CVE-2023-42803 | Medium | 5.3 | 2023-10-30 | BigBlueButton is an open-source virtual classroom. BigBlueButton prior to version 2.6.0-beta.2 is vulnerable to unrestricted file upload, where the insertDocum… |
CVE-2023-41891 | Low | 3.5 | 2023-10-30 | FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. Prior to version 1.1.124, list endpoints on… |
CVE-2023-47101 | High | 7.8 | 2023-10-30 | The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installation or repair. |
CVE-2023-45780 | High | 7.3 | 2023-10-30 | In Print Service, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no add… |
CVE-2023-40101 | Medium | 5.5 | 2023-10-30 | In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no… |
CVE-2023-21398 | High | 7.8 | 2023-10-30 | In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code. This could lead to local escalation of privilege with no a… |
CVE-2023-21397 | High | 7.8 | 2023-10-30 | In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value. This could lead to local escalation of privilege with no addi… |
CVE-2023-21396 | High | 7.8 | 2023-10-30 | In Activity Manager, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with Use… |
CVE-2023-21395 | Medium | 6.5 | 2023-10-30 | In Bluetooth, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth with no additiona… |
CVE-2023-21394 | Medium | 5.5 | 2023-10-30 | In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a missing permission check. This could le… |
CVE-2023-21393 | High | 7.8 | 2023-10-30 | In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to local escalation of privilege with no add… |
CVE-2023-21392 | High | 8.8 | 2023-10-30 | In Bluetooth, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege when connecting to a Bluetoot… |
CVE-2023-21391 | High | 7.5 | 2023-10-30 | In Messaging, there is a possible way to disable the messaging application due to improper input validation. This could lead to remote denial of service with n… |