2023 CVEs (page 126)
Page 126 of 307 — CVEs published in 2023, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-5807 | Critical | 9.8 | 2023-10-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TRtek Software Education Portal allows SQL Injection. Th… |
CVE-2023-5821 | Medium | 4.3 | 2023-10-27 | The Thumbnail carousel slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing nonce validation on the d… |
CVE-2023-5820 | Critical | 9.6 | 2023-10-27 | The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce v… |
CVE-2023-5705 | Medium | 6.4 | 2023-10-27 | The VK Filter Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'vk_filter_search' shortcode in all versions up to, and… |
CVE-2023-5570 | High | 7.5 | 2023-10-27 | Improper Protection for Outbound Error Messages and Alert Signals vulnerability in Inohom Home Manager Gateway allows Account Footprinting. This issue affects… |
CVE-2023-5817 | Medium | 6.4 | 2023-10-27 | The Neon text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's neontext_box shortcode in all versions up to, and including, 1… |
CVE-2023-5774 | Medium | 6.4 | 2023-10-27 | The Animated Counters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 1.7… |
CVE-2023-46199 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Triberr plugin <= 4.1.1 versions. |
CVE-2023-46194 | Medium | 5.8 | 2023-10-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin <= 1.7.5 versions. |
CVE-2023-46192 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Internet Marketing Ninjas Internal Link Building plugin <= 1.2.3 versions. |
CVE-2023-46153 | High | 7.1 | 2023-10-27 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in UserFeedback Team User Feedback plugin <= 1.0.9 versions. |
CVE-2023-46093 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in LionScripts.Com Webmaster Tools plugin <= 2.0 versions. |
CVE-2023-46091 | Medium | 5.9 | 2023-10-27 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Bala Krishna, Sergey Yakovlev Category SEO Meta Tags plugin <= 2.5 versions. |
CVE-2023-44220 | High | 7.3 | 2023-10-27 | SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL comp… |
CVE-2023-44219 | High | 7.8 | 2023-10-27 | A local privilege escalation vulnerability in SonicWall Directory Services Connector Windows MSI client 4.1.21 and earlier versions allows a local low-privileg… |
CVE-2023-34059 | High | 7.4 | 2023-10-27 | open-vm-tools contains a file descriptor hijack vulnerability in the vmware-user-suid-wrapper. A malicious actor with non-root privileges may be able to hijack… |
CVE-2023-34058 | High | 7.1 | 2023-10-27 | VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/… |
CVE-2023-34057 | High | 7.8 | 2023-10-27 | VMware Tools contains a local privilege escalation vulnerability. A malicious actor with local user access to a guest virtual machine may elevate privileges wi… |
CVE-2023-5051 | Medium | 6.4 | 2023-10-27 | The CallRail Phone Call Tracking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callrail_form' shortcode in versions up to, and inc… |
CVE-2023-46818 | High | 7.2 | 2023-10-27 | An issue was discovered in ISPConfig before 3.2.11p1. PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is ena… |
CVE-2023-46816 | High | 8.8 | 2023-10-27 | An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection (SSTI) vulnerability has been identified in the Gec… |
CVE-2023-46815 | High | 8.8 | 2023-10-27 | An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. B… |
CVE-2023-46504 | Medium | 5.4 | 2023-10-27 | Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a physically proximate attacker to execute arbitrary code via the library name func… |
CVE-2023-46503 | Medium | 6.1 | 2023-10-27 | Cross Site Scripting (XSS) vulnerability in PwnCYN YXBOOKCMS v.1.0.2 allows a remote attacker to execute arbitrary code via the reader management and book inpu… |
CVE-2023-45499 | Critical | 9.8 | 2023-10-27 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials. |
CVE-2023-45498 | Critical | 9.8 | 2023-10-27 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability. |
CVE-2023-46813 | High | 7.0 | 2023-10-27 | An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers. Incorrect access checking in the… |
CVE-2023-5814 | Medium | 6.3 | 2023-10-27 | A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been classified as critical. This affects an unknown part of the file /classes/Mas… |
CVE-2023-5813 | Medium | 6.3 | 2023-10-27 | A vulnerability was found in SourceCodester Task Reminder System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2023-5812 | Medium | 4.7 | 2023-10-27 | A vulnerability has been found in flusity CMS and classified as critical. Affected by this vulnerability is the function handleFileUpload of the file core/tool… |
CVE-2023-5811 | Low | 2.4 | 2023-10-27 | A vulnerability, which was classified as problematic, was found in flusity CMS. Affected is the function loadPostAddForm of the file core/tools/posts.php. The… |
CVE-2023-5810 | Low | 2.4 | 2023-10-27 | A vulnerability, which was classified as problematic, has been found in flusity CMS. This issue affects the function loadPostAddForm of the file core/tools/pos… |
CVE-2023-46505 | Medium | 6.1 | 2023-10-27 | Cross Site Scripting vulnerability in FanCMS v.1.0.0 allows an attacker to execute arbitrary code via the content1 parameter in the demo.php file. |
CVE-2023-46376 | High | 7.5 | 2023-10-27 | Zentao Biz version 8.7 and before is vulnerable to Information Disclosure. |
CVE-2023-46375 | High | 8.8 | 2023-10-27 | ZenTao Biz version 4.1.3 and before is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2023-46491 | Medium | 6.1 | 2023-10-27 | ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library. |
CVE-2023-46374 | Medium | 6.1 | 2023-10-27 | ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS). |
CVE-2023-42188 | Medium | 6.5 | 2023-10-27 | IceCMS v2.0.1 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2023-27170 | High | 7.5 | 2023-10-26 | Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter. |
CVE-2023-5805 | Medium | 6.3 | 2023-10-26 | A vulnerability was found in SourceCodester Simple Real Estate Portal System 1.0. It has been classified as critical. Affected is an unknown function of the fi… |
CVE-2023-43352 | High | 7.8 | 2023-10-26 | An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu component. |
CVE-2023-42406 | Critical | 9.8 | 2023-10-26 | SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive information and execute… |
CVE-2023-38328 | Medium | 4.9 | 2023-10-26 | An issue was discovered in eGroupWare 17.1.20190111. An Improper Password Storage vulnerability affects the setup panel of under setup/manageheader.php, which… |
CVE-2023-46748 | High | 8.8 | 2023-10-26 | An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the… |
CVE-2023-46747 | Critical | 9.8 | 2023-10-26 | Undisclosed requests may bypass configuration utility authentication, allowing an attacker with network access to the BIG-IP system through the management port… |
CVE-2023-46665 | Critical | 9.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an authentication bypass vulnerability due to an attacker modifying passwords in a POST request and gain u… |
CVE-2023-46664 | High | 7.5 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an improper access control vulnerability when the application provides direct access to objects based on user-… |
CVE-2023-46663 | High | 7.5 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an attacker bypassing authorization and accessing resources behind protected pages. The application interface allo… |
CVE-2023-39726 | Critical | 9.8 | 2023-10-26 | An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal. |
CVE-2023-33559 | High | 8.8 | 2023-10-26 | A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying a crafted PHP file. |
CVE-2023-33558 | High | 7.5 | 2023-10-26 | An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive information such as e… |
CVE-2023-5804 | High | 7.3 | 2023-10-26 | A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0 and classified as critical. This issue affects some unknown processing of the… |
CVE-2023-5754 | Critical | 9.1 | 2023-10-26 | Sielco PolyEco1000 uses a weak set of default administrative credentials that can be easily guessed in remote password attacks and gain full control of th… |
CVE-2023-46662 | High | 7.5 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an information disclosure vulnerability due to improper access control enforcement. An unauthenticated remote attacker… |
CVE-2023-46661 | Critical | 9.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to an attacker escalating their privileges by modifying passwords in POST requests. |
CVE-2023-44267 | Critical | 9.8 | 2023-10-26 | Online Art Gallery v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'lnm' parameter of the header.php resource does not valida… |
CVE-2023-39936 | High | 7.8 | 2023-10-26 | In Ashlar-Vellum Graphite v13.0.48, the affected application lacks proper validation of user-supplied data when parsing VC6 files. This could lead to an out… |
CVE-2023-39427 | High | 7.8 | 2023-10-26 | In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share v12 SP0 Build (1204.77), the affected applications lack proper validation of user-supplied da… |
CVE-2023-0897 | High | 8.8 | 2023-10-26 | Sielco PolyEco1000 is vulnerable to a session hijack vulnerability due to the cookie being vulnerable to a brute force attack, lack of SSL, and the session be… |
CVE-2023-31416 | Medium | 5.3 | 2023-10-26 | Secret token configuration is never applied when using ECK <2.8 with APM Server >=8.0. This could lead to anonymous requests to an APM Server being accepted an… |
CVE-2023-5796 | Medium | 6.3 | 2023-10-26 | A vulnerability was found in CodeAstro POS System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /setting… |
CVE-2023-5795 | Medium | 6.3 | 2023-10-26 | A vulnerability was found in CodeAstro POS System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-5794 | High | 7.3 | 2023-10-26 | A vulnerability was found in PHPGurukul Online Railway Catering System 1.0. It has been classified as critical. Affected is an unknown function of the file ind… |
CVE-2023-5793 | Low | 3.5 | 2023-10-26 | A vulnerability was found in flusity CMS and classified as problematic. This issue affects the function loadCustomBlocCreateForm of the file /core/tools/custom… |
CVE-2023-46435 | Critical | 9.8 | 2023-10-26 | Sourcecodester Packers and Movers Management System v1.0 is vulnerable to SQL Injection via mpms/?p=services/view_service&id. |
CVE-2023-31419 | Medium | 6.5 | 2023-10-26 | A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Deni… |
CVE-2023-31418 | High | 7.5 | 2023-10-26 | An issue has been identified with how Elasticsearch handled incoming requests on the HTTP layer. An unauthenticated user could force an Elasticsearch node to e… |
CVE-2023-31417 | Medium | 4.1 | 2023-10-26 | Elasticsearch generally filters out sensitive information and credentials before logging to the audit log. It was found that this filtering was not applied whe… |
CVE-2023-5792 | Medium | 6.3 | 2023-10-26 | A vulnerability has been found in SourceCodester Sticky Notes App 1.0 and classified as critical. This vulnerability affects unknown code of the file endpoint/… |
CVE-2023-5791 | Low | 3.5 | 2023-10-26 | A vulnerability, which was classified as problematic, was found in SourceCodester Sticky Notes App 1.0. This affects an unknown part of the file endpoint/add-n… |
CVE-2023-5790 | Medium | 6.3 | 2023-10-26 | A vulnerability classified as critical was found in SourceCodester File Manager App 1.0. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-5789 | Low | 2.4 | 2023-10-26 | A vulnerability classified as problematic has been found in Dragon Path 707GR1 up to 20231022. Affected is an unknown function of the component Ping Diagnostic… |
CVE-2023-5624 | High | 7.2 | 2023-10-26 | Under certain conditions, Nessus Network Monitor was found to not properly enforce input validation. This could allow an admin user to alter parameters that c… |
CVE-2023-5623 | High | 7.0 | 2023-10-26 | NNM failed to properly set ACLs on its installation directory, which could allow a low privileged user to run arbitrary code with SYSTEM privileges where NNM… |
CVE-2023-5622 | High | 7.1 | 2023-10-26 | Under certain conditions, Nessus Network Monitor could allow a low privileged user to escalate privileges to NT AUTHORITY\SYSTEM on Windows hosts by replacing… |
CVE-2023-46666 | Medium | 5.3 | 2023-10-26 | An issue was discovered when using Document Level Security and the SPO "Limited Access" functionality in Elastic Sharepoint Online Python Connector. If a user… |
CVE-2023-45317 | High | 8.8 | 2023-10-26 | The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can… |
CVE-2023-45228 | Medium | 6.5 | 2023-10-26 | The application suffers from improper access control when editing users. A user with read permissions can manipulate users, passwords, and permissions by s… |
CVE-2023-43208 | Critical | 9.8 | 2023-10-26 | NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution. Note that this vulnerability is caused by the inc… |
CVE-2023-42769 | Critical | 9.8 | 2023-10-26 | The cookie session ID is of insufficient length and can be exploited by brute force, which may allow a remote attacker to obtain a valid session, bypass auth… |
CVE-2023-41966 | Medium | 6.5 | 2023-10-26 | The application suffers from a privilege escalation vulnerability. A user with read permissions can elevate privileges by sending a HTTP POST to set a par… |
CVE-2023-5787 | High | 7.3 | 2023-10-26 | A vulnerability was found in Shaanxi Chanming Education Technology Score Query System 5.0. It has been rated as critical. This issue affects some unknown proce… |
CVE-2023-5786 | Medium | 5.3 | 2023-10-26 | A vulnerability was found in GeoServer GeoWebCache up to 1.15.1. It has been declared as problematic. This vulnerability affects unknown code of the file /geos… |
CVE-2023-5785 | Medium | 5.5 | 2023-10-26 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3. It has been classified as critical. This affects an unknown part of the file /p… |
CVE-2023-5784 | Medium | 5.5 | 2023-10-26 | A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2023-46450 | Medium | 5.4 | 2023-10-26 | Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier function. |
CVE-2023-46449 | High | 8.8 | 2023-10-26 | Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control. An arbitrary user can change the password of an… |
CVE-2023-46238 | High | 8.7 | 2023-10-26 | ZITADEL is an identity infrastructure management system. ZITADEL users can upload their own avatar image using various image types including SVG. SVG can inclu… |
CVE-2023-46234 | Medium | 6.5 | 2023-10-26 | browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls… |
CVE-2023-45869 | Critical | 9.0 | 2023-10-26 | ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS… |
CVE-2023-45868 | High | 8.1 | 2023-10-26 | The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Traversal attack on c… |
CVE-2023-45867 | Medium | 6.5 | 2023-10-26 | ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module. An attacker with a pri… |
CVE-2023-5783 | Medium | 6.3 | 2023-10-26 | A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2023-5782 | Medium | 5.5 | 2023-10-26 | A vulnerability, which was classified as critical, was found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /manage/delete_query.ph… |
CVE-2023-46090 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in WebDorado WDSocialWidgets plugin <= 1.0.15 versions. |
CVE-2023-41096 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs Ember ZNet SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ex… |
CVE-2023-41095 | Medium | 6.8 | 2023-10-26 | Missing Encryption of Security Keys vulnerability in Silicon Labs OpenThread SDK on 32 bit, ARM (SecureVault High modules) allows potential modification or ext… |
CVE-2023-5781 | Medium | 6.3 | 2023-10-26 | A vulnerability, which was classified as critical, has been found in Tongda OA 2017 11.10. This issue affects the function DELETE_STR of the file general/syste… |
CVE-2023-5780 | High | 7.3 | 2023-10-26 | A vulnerability classified as critical was found in Tongda OA 2017 11.10. This vulnerability affects unknown code of the file general/system/approve_center/flo… |
CVE-2023-46094 | High | 7.1 | 2023-10-26 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Conversios Track Google Analytics 4, Facebook Pixel & Conversions API via Google Tag Manager for… |