2023 CVEs (page 126)
Page 126 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-46468 | High | 7.8 | 2023-10-28 | An issue in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function. |
CVE-2023-46467 | Medium | 5.4 | 2023-10-28 | Cross Site Scripting vulnerability in juzawebCMS v.3.4 and before allows a remote attacker to execute arbitrary code via a crafted payload to the username para… |
CVE-2023-43322 | High | 8.8 | 2023-10-28 | ZPE Systems, Inc Nodegrid OS v5.0.0 to v5.0.17, v5.2.0 to v5.2.19, v5.4.0 to v5.4.16, v5.6.0 to v5.6.13, v5.8.0 to v5.8.10, and v5.10.0 to v5.10.3 was discover… |
CVE-2023-46587 | High | 7.8 | 2023-10-27 | Buffer Overflow vulnerability in XnView Classic v.2.51.5 allows a local attacker to execute arbitrary code via a crafted TIF file. |
CVE-2023-5834 | Low | 3.8 | 2023-10-27 | HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junctioned, introducing potential for unauthorized fil… |
CVE-2023-46490 | Medium | 6.5 | 2023-10-27 | SQL Injection vulnerability in Cacti v1.2.25 allows a remote attacker to obtain sensitive information via the form_actions() function in the managers.php funct… |
CVE-2023-5830 | High | 7.3 | 2023-10-27 | A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. This affects an unknown part of the file /api/authentication/login of t… |
CVE-2023-46510 | Critical | 9.8 | 2023-10-27 | An issue in ZIONCOM (Hong Kong) Technology Limited A7000R v.4.1cu.4154 allows an attacker to execute arbitrary code via the cig-bin/cstecgi.cgi to the settings… |
CVE-2023-46509 | Critical | 9.8 | 2023-10-27 | An issue in Contec SolarView Compact v.6.0 and before allows an attacker to execute arbitrary code via the texteditor.php component. |
CVE-2023-46211 | Medium | 6.5 | 2023-10-27 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder plugin <= 3.19.14 versions. |
CVE-2023-46209 | High | 7.1 | 2023-10-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in G5Theme Grid Plus – Unlimited grid plugin <= 1.3.2 versions. |
CVE-2023-46208 | High | 7.1 | 2023-10-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in StylemixThemes Motors – Car Dealer, Classifieds & Listing plugin <= 1.4.6 versions. |
CVE-2023-46200 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Stephen Darlington, Wandle Software Limited Smart App Banner plugin <= 1.1.3 versions. |
CVE-2023-44480 | High | 8.8 | 2023-10-27 | Leave Management System Project v1.0 is vulnerable to multiple Authenticated SQL Injection vulnerabilities. The 'setcasualleave' parameter of the admin/setleav… |
CVE-2023-40140 | High | 7.8 | 2023-10-27 | In android_view_InputDevice_create of android_view_InputDevice.cpp, there is a possible way to execute arbitrary code due to a use after free. This could lead… |
CVE-2023-40139 | Medium | 5.5 | 2023-10-27 | In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with… |
CVE-2023-40138 | Low | 3.3 | 2023-10-27 | In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure with… |
CVE-2023-40137 | Low | 3.3 | 2023-10-27 | In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local informatio… |
CVE-2023-40136 | Low | 3.3 | 2023-10-27 | In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclos… |
CVE-2023-40135 | Low | 3.3 | 2023-10-27 | In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information… |
CVE-2023-40134 | Low | 3.3 | 2023-10-27 | In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local information disclosure… |
CVE-2023-40133 | Medium | 5.5 | 2023-10-27 | In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy. This could lead to local informatio… |
CVE-2023-40131 | High | 7.0 | 2023-10-27 | In GpuService of GpuService.cpp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additiona… |
CVE-2023-40130 | High | 7.8 | 2023-10-27 | In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of pr… |
CVE-2023-40129 | High | 8.8 | 2023-10-27 | In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) cod… |
CVE-2023-40128 | High | 7.8 | 2023-10-27 | In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege wi… |
CVE-2023-40127 | Low | 3.3 | 2023-10-27 | In multiple locations, there is a possible way to access screenshots due to a confused deputy. This could lead to local information disclosure with no addition… |
CVE-2023-40125 | High | 7.8 | 2023-10-27 | In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of pr… |
CVE-2023-40123 | Medium | 5.5 | 2023-10-27 | In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local infor… |
CVE-2023-40121 | Medium | 5.5 | 2023-10-27 | In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local information disclosu… |
CVE-2023-40120 | High | 7.8 | 2023-10-27 | In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation. This could lead to local es… |
CVE-2023-40117 | High | 7.8 | 2023-10-27 | In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of priv… |
CVE-2023-40116 | High | 7.8 | 2023-10-27 | In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This co… |
CVE-2023-35794 | High | 8.8 | 2023-10-27 | An issue was discovered in Cassia Access Controller 2.1.1.2303271039. The Web SSH terminal endpoint (spawned console) can be accessed without authentication. S… |
CVE-2023-32738 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Alkaweb Eonet Manual User Approve plugin <= 2.1.3 versions. |
CVE-2023-5829 | Medium | 6.3 | 2023-10-27 | A vulnerability was found in code-projects Admission Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2023-5828 | High | 7.3 | 2023-10-27 | A vulnerability was found in Nanning Ontall Longxing Industrial Development Zone Project Construction and Installation Management System up to 20231026. It has… |
CVE-2023-46853 | Critical | 9.8 | 2023-10-27 | In Memcached before 1.6.22, an off-by-one error exists when processing proxy requests in proxy mode, if \n is used instead of \r\n. |
CVE-2023-46852 | High | 7.5 | 2023-10-27 | In Memcached before 1.6.22, a buffer overflow exists when processing multiget requests in proxy mode, if there are many spaces after the "get" substring. |
CVE-2023-46407 | Medium | 5.5 | 2023-10-27 | FFmpeg prior to commit bf814 was discovered to contain an out of bounds read via the dist->alphabet_size variable in the read_vlc_prefix() function. |
CVE-2023-29009 | Medium | 6.1 | 2023-10-27 | baserCMS is a website development framework with WebAPI that runs on PHP8 and CakePHP4. There is a XSS Vulnerability in Favorites Feature to baserCMS. This iss… |
CVE-2023-4967 | High | 8.2 | 2023-10-27 | Denial of Service in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA Virtual Server |
CVE-2023-46290 | High | 8.1 | 2023-10-27 | Due to inadequate code logic, a previously unauthenticated threat actor could potentially obtain a local Windows OS user token through the FactoryTalk® Servic… |
CVE-2023-46289 | High | 7.5 | 2023-10-27 | Rockwell Automation FactoryTalk View Site Edition insufficiently validates user input, which could potentially allow threat actors to send malicious data brin… |
CVE-2023-46246 | Medium | 4.0 | 2023-10-27 | Vim is an improved version of the good old UNIX editor Vi. Heap-use-after-free in memory allocated in the function `ga_grow_inner` in in the file `src/alloc.c`… |
CVE-2023-27858 | High | 7.8 | 2023-10-27 | Rockwell Automation Arena Simulation contains an arbitrary code execution vulnerability that could potentially allow a malicious user to commit unauthorized c… |
CVE-2023-27854 | High | 7.8 | 2023-10-27 | An arbitrary code execution vulnerability was reported to Rockwell Automation in Arena Simulation that could potentially allow a malicious user to commit unau… |
CVE-2023-5827 | Medium | 5.5 | 2023-10-27 | A vulnerability was found in Shanghai CTI Navigation CTI Monitoring and Early Warning System 2.2. It has been classified as critical. This affects an unknown p… |
CVE-2023-5826 | Medium | 5.5 | 2023-10-27 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2023-46604 | Critical | 10.0 | 2023-10-27 | The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. This vulnerability may allow a remote attacker with network access to either a… |
CVE-2023-5443 | High | 7.5 | 2023-10-27 | Improper Protection for Outbound Error Messages and Alert Signals vulnerability in EDM Informatics E-invoice allows Account Footprinting. This issue affects E… |
CVE-2023-46394 | Medium | 5.4 | 2023-10-27 | A stored cross-site scripting (XSS) vulnerability in /home/user/edit_submit of gougucms v4.08.18 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2023-46393 | High | 7.5 | 2023-10-27 | gougucms v4.08.18 was discovered to contain a password reset poisoning vulnerability which allows attackers to arbitrarily reset users' passwords via a crafted… |
CVE-2023-5807 | Critical | 9.8 | 2023-10-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection. Th… |
CVE-2023-5821 | Medium | 4.3 | 2023-10-27 | The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the d… |
CVE-2023-5820 | Critical | 9.6 | 2023-10-27 | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce v… |
CVE-2023-5705 | Medium | 6.4 | 2023-10-27 | The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all versions up to, and… |
CVE-2023-5570 | High | 7.5 | 2023-10-27 | Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects… |
CVE-2023-5817 | Medium | 6.4 | 2023-10-27 | The Neon text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's neontext_box shortcode in all versions up to, and including, 1… |
CVE-2023-5774 | Medium | 6.4 | 2023-10-27 | The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.7… |
CVE-2023-46199 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Triberr plugin <= 4.1.1 versions. |
CVE-2023-46194 | Medium | 5.8 | 2023-10-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.5 versions. |
CVE-2023-46192 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions. |
CVE-2023-46153 | High | 7.1 | 2023-10-27 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.9 versions. |
CVE-2023-46093 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LionScripts.Com Webmaster Tools plugin <= 2.0 versions. |
CVE-2023-46091 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin <= 2.5 versions. |
CVE-2023-44220 | High | 7.3 | 2023-10-27 | SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL comp… |
CVE-2023-44219 | High | 7.8 | 2023-10-27 | A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earlier versions allows a local low-privileg… |
CVE-2023-34059 | High | 7.4 | 2023-10-27 | open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack… |
CVE-2023-34058 | High | 7.1 | 2023-10-27 | VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/… |
CVE-2023-34057 | High | 7.8 | 2023-10-27 | VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges wi… |
CVE-2023-5051 | Medium | 6.4 | 2023-10-27 | The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in versions up to, and inc… |
CVE-2023-46818 | High | 7.2 | 2023-10-27 | An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is ena… |
CVE-2023-46816 | High | 8.8 | 2023-10-27 | An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the Gec… |
CVE-2023-46815 | High | 8.8 | 2023-10-27 | An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. B… |
CVE-2023-46504 | Medium | 5.4 | 2023-10-27 | Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a physically proximate attacker to execute arbitrary code via the library name func… |
CVE-2023-46503 | Medium | 6.1 | 2023-10-27 | Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book inpu… |
CVE-2023-45499 | Critical | 9.8 | 2023-10-27 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials. |
CVE-2023-45498 | Critical | 9.8 | 2023-10-27 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability. |
CVE-2023-46813 | High | 7.0 | 2023-10-27 | An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the… |
CVE-2023-5814 | Medium | 6.3 | 2023-10-27 | A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /classes/Mas… |
CVE-2023-5813 | Medium | 6.3 | 2023-10-27 | A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2023-5812 | Medium | 4.7 | 2023-10-27 | A vulnerability has been found in flusity CMS and classified as critical. Affected by this vulnerability is the function handleFileUpload of the file core/tool… |
CVE-2023-5811 | Low | 2.4 | 2023-10-27 | A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The… |
CVE-2023-5810 | Low | 2.4 | 2023-10-27 | A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/pos… |
CVE-2023-46505 | Medium | 6.1 | 2023-10-27 | Cross Site Scripting vulnerability in FanCMS v.1.0.0 allows an attacker to execute arbitrary code via the content1 parameter in the demo.php file. |
CVE-2023-46376 | High | 7.5 | 2023-10-27 | Zentao Biz version 8.7 and before is vulnerable to Information Disclosure. |
CVE-2023-46375 | High | 8.8 | 2023-10-27 | ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2023-46491 | Medium | 6.1 | 2023-10-27 | ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library. |
CVE-2023-46374 | Medium | 6.1 | 2023-10-27 | ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-42188 | Medium | 6.5 | 2023-10-27 | IceCMS v2.0.1 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2023-27170 | High | 7.5 | 2023-10-26 | Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter. |
CVE-2023-5805 | Medium | 6.3 | 2023-10-26 | A vulnerability was found in SourceCodester Simple Real Estate Portal System 1.0. It has been classified as critical. Affected is an unknown function of the fi… |
CVE-2023-43352 | High | 7.8 | 2023-10-26 | An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component. |
CVE-2023-42406 | Critical | 9.8 | 2023-10-26 | SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute… |
CVE-2023-38328 | Medium | 4.9 | 2023-10-26 | An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which… |
CVE-2023-46748 | High | 8.8 | 2023-10-26 | An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the… |
CVE-2023-46747 | Critical | 9.8 | 2023-10-26 | Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port… |
CVE-2023-46665 | Critical | 9.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain u… |
CVE-2023-46664 | High | 7.5 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-… |